The YouTube Flash Video (FLV) secret

I’m sorry for the hyperbole in the title, but it really is something YouTube is very hush-hush about. In spite of that, direct access to the Flash Video file of YouTube movies gives you a very powerful tool. You have total control over: when, how and where you play the video.

A recap of the ActionScript 3.0 YouTube player series:

• Getting a list of videos (and some project setup)
• A bit about how the Flash stage works and fullscreen
• Install a php script to get the randomly generated key [this post]
• Getting the key for a video [later post]
• playing the video using Flash’s FLV player classes [later post]

Before we get started, I would like to make clear that, strictly speaking you may be violating the YouTube terms of use. I suggest that you make sure that you have a linkback somewhere to the original YouTube page of any video you play this way. As long as it’s not intended for commercial use, I don’t think YouTube will mind. This also means that evrything in this post could break at any moment. YouTube has no obligation to keep things working the way they are. Use at your own risk and make sure you have a backup plan.

How does YouTube work:

1. Lets take for instance the video at this url : http://www.youtube.com/watch?v=tlkd45W4TWU
2. In the URL above, you can see the YouTube video ID, visibly tlkd45W4TWU.
3. If you load that page and analyze it, the definition of the embedded Flash player is particularly interesting. You can get to it using, for instance, Firebug
4. The flashvars and more specifically the “t=” part are especially interesting (lets call it the T-parameter)

   1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27

   <object classid="clsid:d27cdb6e-ae6d-11cf-96b8-444553540000" width="480" height="385" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,40,0"><param name="id" value="movie_player" /><param name="name" value="movie_player" /><param name="bgcolor" value="#FFFFFF" /><param name="flashvars" value="usef=0 &amp;vq=null &amp;hl=en &amp;ad_module=http://s.ytimg.com/yt/swf/ad-vfl58133.swf &amp;video_id=tlkd45W4TWU &amp;l=92 &amp;fmt_map= &amp;sk=osboESkd68ugFfCt9elkF0CfokK9gi5XU &amp;invideo=true &amp;t=OEgsToPDskJVR3U-M0h8Jfmjm804cAEx &amp;plid=AARYvSJ5Us91bCLMAAAA4AD8YAE &amp;tk=pQy2JnLKck1IpHCbiI3lCF-f9AFsWqq9eEmlyPeWzlkTvqzkYD_OEg== &amp;ad_tag=http://n4061ad.doubleclick.net/pfadx/com.ytpwatch.entertainment/main_617;sz=480x70;kl=H;kl=T;kl=V;kl=Y;!c=617;k21=1;kvid=tlkd45W4TWU;kgg=1;kr=A;custl=ymqgO5MtLdC5YSSsVCtmxA;kgender=m;ko=p;kpid=617;kga=1002;kar=4;klg=en;kage=30;ku=N;kt=U;u=tlkd45W4TWU|617;kcr=us;afc=1;custp=zjCUH-MqVQUQryi1fVJ1tA;kpu=aniBOOM; &amp;playnext=0&amp;enablejsapi=1" /><param name="src" value="http://s.ytimg.com/yt/swf/watch-vfl58347.swf" /><embed id="movie_player" type="application/x-shockwave-flash" width="480" height="385" src="http://s.ytimg.com/yt/swf/watch-vfl58347.swf" flashvars="usef=0 &amp;vq=null &amp;hl=en &amp;ad_module=http://s.ytimg.com/yt/swf/ad-vfl58133.swf &amp;video_id=tlkd45W4TWU &amp;l=92 &amp;fmt_map= &amp;sk=osboESkd68ugFfCt9elkF0CfokK9gi5XU &amp;invideo=true &amp;t=OEgsToPDskJVR3U-M0h8Jfmjm804cAEx &amp;plid=AARYvSJ5Us91bCLMAAAA4AD8YAE &amp;tk=pQy2JnLKck1IpHCbiI3lCF-f9AFsWqq9eEmlyPeWzlkTvqzkYD_OEg== &amp;ad_tag=http://n4061ad.doubleclick.net/pfadx/com.ytpwatch.entertainment/main_617;sz=480x70;kl=H;kl=T;kl=V;kl=Y;!c=617;k21=1;kvid=tlkd45W4TWU;kgg=1;kr=A;custl=ymqgO5MtLdC5YSSsVCtmxA;kgender=m;ko=p;kpid=617;kga=1002;kar=4;klg=en;kage=30;ku=N;kt=U;u=tlkd45W4TWU|617;kcr=us;afc=1;custp=zjCUH-MqVQUQryi1fVJ1tA;kpu=aniBOOM; &amp;playnext=0&amp;enablejsapi=1" bgcolor="#FFFFFF" name="movie_player"></embed></object>

5. If you take a look at the network traffic (again Firebug is brilliant for this) you will notice a new request: http://www.youtube.com/get_video?video_id=tlkd45W4TWU&t=OEgsToPDskJVR3U-M0h8Jfmjm804cAEx
6. This URI uses both the video id and T-parameter and is the one that returns the actual FLV file.

So what we need to do, is obtain the video_id, use that to request the page, extract the T-parameter and, finally, request the FLV. Because of Flash’s security policies, we cannot execute this request to the YouTube page from within the Flash applet. The easiest solution is to deploy a small server side script. Again the work has already been done for you:

I’ve deployed this PHP script on my random YouTube player. And for the example above, this is the result.

Conclusion

This part was a pretty technical overview of how YouTube deals with its video id’s and how the Flash Video file is requested from the server. A simple script can be deployed to perform the task of extracting this FLV. With the FLV URI, we now have complete control over the YouTube stream. This will be shown in the next installments of the series.

Image source

If you liked this, why not share it with your friends?

•