Skip to content

Instantly share code, notes, and snippets.

@danielchc

danielchc/docker-emby-bypass.md

Last active November 15, 2024 16:42
Show Gist options
  • Save danielchc/c159626485a08c76856b2d30ae457e04 to your computer and use it in GitHub Desktop.
Save danielchc/c159626485a08c76856b2d30ae457e04 to your computer and use it in GitHub Desktop.
Download ZIP
Emby Premiere: ByPass Docker container
Raw
docker-emby-bypass.md

Emby Premiere ByPass Docker container

❗ All the information provided on this tutorial are for educational purposes only. I'm not responsible for any misuse of this information. If you like the app buy it

Table of Contents

Compatibility

Tested on version 4.9.0.28. Last update: September 13, 2024

This tutorial allows you to run Emby Premiere on:

Emby Premiere Local device Remote device
Web ✔️* ✔️
Mobile ✔️ ❌
Emby Theater ✔️ ? ❌
Other devices ❓ ❌

* The use of DoH may cause cosmetic issues

Getting Started

Create the working folder

mkdir -p emby/{mb3admin,server}
cd emby

1. Local client bypass

Folder structure

.
└── mb3admin
    ├── certs
    │   ├── emby.crt
    │   ├── emby.key
    │   └── ssl-dhparams.pem
    ├── Dockerfile
    └── nginx.conf

Steps

  1. Change working directory
mkdir certs
  1. Create certs folder
mkdir certs
  1. Generate a self-signed certificate for the fake mb3admin.com server to use:
openssl req -x509 -newkey rsa:2048 -days 36525 -nodes -subj '/CN=mb3admin.com' -addext "subjectAltName = DNS:www.mb3admin.com, DNS:mb3admin.com"  -out certs/emby.crt -keyout certs/emby.key
  1. Download ssl-dhparams.pem
curl https://ssl-config.mozilla.org/ffdhe2048.txt > certs/ssl-dhparams.pem
  1. Create nginx.conf file
events {
  worker_connections  4096;  ## Default: 1024
}

http{

	server {
	    listen 80;
	    listen [::]:80;
	    server_name mb3admin.com;
	    return 301 https://mb3admin.com$request_uri;
	}

	server {
	    listen 443 ssl http2;
	    listen [::]:443 ssl http2;
	    server_name mb3admin.com;

	    ssl_certificate /certs/emby.crt;
	    ssl_certificate_key /certs/emby.key;
	    ssl_session_timeout 1d;
	    ssl_session_cache shared:SSL:10m;  # about 40000 sessions
	    ssl_session_tickets off;

	    # curl https://ssl-config.mozilla.org/ffdhe2048.txt > /path/to/dhparam.pem
	    ssl_dhparam /certs/ssl-dhparams.pem;

	    # intermediate configuration
	    ssl_protocols TLSv1.2 TLSv1.3;
	    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
	    ssl_prefer_server_ciphers off;

	    location / {
		resolver 8.8.8.8 ipv6=off;
		set $target https://mb3admin.com;
		proxy_pass $target;
		proxy_set_header Host $host;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto $scheme;
	    }

	    location /admin/service/registration/validateDevice{
		default_type application/json;
		return 200 '{"cacheExpirationDays":3650,"message":"Device Valid (limit not checked)","resultCode":"GOOD"}';
	    }

	    location /admin/service/registration/validate {
		default_type application/json;
		return 200 '{"featId":"","registered":true,"expDate":"2099-01-01","key":""}';
	    }

	    location /admin/service/registration/getStatus {
		default_type application/json;
		return 200 '{"planType":"Lifetime","deviceStatus":0,"subscriptions":[]}';
	    }

	    location /admin/service/appstore/register {
		default_type application/json;
		return 200 '{"featId":"","registered":true,"expDate":"2099-01-01","key":""}';
	    }

	    location /emby/Plugins/SecurityInfo {
		default_type application/json;
		return 200 '{SupporterKey:"", IsMBSupporter:true}';
	    }

	    add_header Access-Control-Allow-Origin * always;
	    add_header Access-Control-Allow-Headers * always;
	    add_header Access-Control-Allow-Method * always;
	    add_header Access-Control-Allow-Credentials true always;
	}
}
  1. Create Dockerfile file
FROM nginx
COPY nginx.conf /etc/nginx/nginx.conf
ADD certs /certs

2. Web client bypass

Folder structure

.
└── server
    ├── Dockerfile
    └── patch
        ├── emby.crt
        ├── ilasm
        └── ildasm

Steps

  1. Change working directory
cd server
  1. Create patch folder
mkdir patch
  1. Copy emby.crt from ../mb3admin/certs to patch folder
cp ../mb3admin/certs/emby.crt patch
  1. Download ilasm and ildasm for your architecture and copy in patch folder.

You can get it here for x86_64 architecture : ilasm ildasm

You can get it here for arm64(Raspberry Pi 4) architecture. Just double click the binary file inside runtimes/linux-arm64/native and it will automatically download : ilasm ildasm

You can get it here for arm(Raspberry Pi <3) architecture. Just double click the binary file inside runtimes/linux-arm/native and it will automatically download : ilasm ildasm

Or you can download the deb package. You should unpack the .deb and find the executables in ./usr/bin/

  1. Create Dockerfile file
FROM linuxserver/emby:beta

ADD patch /patch

RUN chmod +x /patch/ilasm
RUN chmod +x /patch/ildasm
RUN mkdir /patch/tmp

WORKDIR /patch/tmp

RUN /patch/ildasm /app/emby/system/Emby.Web.dll -out=Emby.Web.dll

RUN sed -i 's#ajax({url:"https://mb3admin.com/admin/service/registration/validateDevice?"+new URLSearchParams(params).toString(),type:"POST",dataType:"json"})#Promise.resolve(new Response('"'"'{"cacheExpirationDays":365,"message":"Device Valid","resultCode":"GOOD"}'"'"').json())#g' Emby.Web.dashboard_ui.modules.emby_apiclient.connectionmanager.js

RUN /patch/ilasm -dll Emby.Web.dll -out=/app/emby/system/Emby.Web.dll
RUN cat /patch/emby.crt >> /app/emby/etc/ssl/certs/ca-certificates.crt

3. Docker Compose setup

Folder structure

.
├── compose.yml
├── mb3admin
│   ├── certs
│   │   ├── emby.crt
│   │   ├── emby.key
│   │   └── ssl-dhparams.pem
│   ├── Dockerfile
│   └── nginx.conf
└── server
    ├── Dockerfile
    └── patch
        ├── emby.crt
        ├── ilasm
        └── ildasm

Steps

⚠️ It is mandatory that the server where the Emby server is running has a DNS configured that resolves mb3admin.com to the local IP of the nginx server.

  1. Now, you have to options:

    a. Recommended: Edit your local DNS (Pihole, Adguard, router, bind...) and rewrite mb3admin.com with local IP.

    image

    b. Edit the hosts file of each device you're going to use Emby.

    • Windows: C:\Windows\System32\drivers\etc\hosts
    • Linux: /etc/hosts
    <your_local_ip_adress_here> mb3admin.com

    ⚠️ Replace <your_local_ip_adress_here> with the IP of machine where the containers run.

  2. Create compose.yml

services:
  emby:
      build: ./server
      container_name: emby
      environment:
        - PUID=1000
        - PGID=1000
        - TZ=Europe/London
      volumes:
        - ./config:/config
        - /media/tv:/data/tvshows
        - /media/movies:/data/movies
      ports:
        - 8096:8096
        - 8920:8920 #optional
      restart: unless-stopped
  mb3admin:
      build: ./mb3admin
      container_name: mb3admin
      ports:
        - 443:443
      restart: unless-stopped
      networks:
        default:
          aliases:
            - mb3admin.com
  1. Start containers
docker compose up -d
  1. Check if everything is OK

Execute

docker exec emby bash -c "curl -w '\n' -s  --cacert /app/emby/etc/ssl/certs/ca-certificates.crt  https://mb3admin.com/admin/service/registration/validateDevice"

If the output is as follows everything is fine

{"cacheExpirationDays":3650,"message":"Device Valid (limit not checked)","resultCode":"GOOD"}

First Run

  1. Open https://mb3admin.com in your browser and accept the self-signed certificate

image

  1. Open the Emby Premiere Section in Settings, and write whatever you want in the "Emby Premiere key (paste from e-mail)" and click "Save"

image

Apps

⚠️ You MUST do the above steps for this to work

Emby Theater

  1. Go to
  • Windows: %appdata%\Emby-Theater\system\electronapp
  • Linux: /opt/emby-theater/electron/resources/app/
  1. Open main.js with text editor
  2. After this
app.on('window-all-closed', function () {
    // On OS X it is common for applications and their menu bar
    // to stay active until the user quits explicitly with Cmd + Q
    if (process.platform != 'darwin') {
        app.quit();
    }
});

Add this:

app.on('certificate-error', (event, webContents, url, error, certificate, callback) => {
        event.preventDefault()
        callback(true)
})

Android

You DON'T NEED TO DO any extra steps to make it work on Android on local network. First time you open the app it will prompt a dialog to accept self-signed certificate. If this dialog does not appear you have done something wrong.

Dialog

If you want it to work outside the local network, you need to get a modded apk

Android TV

You must go to the settings and enable "Allow Untrusted SSL Playback"

image

Thanks @OrpheeGT for the information

Miscellaneous

Update Emby version

  1. Change to the folder where the compose.yml file is
  2. Build a new emby image
docker compose build emby --pull --no-cache
  1. Restart container
docker compose up -d

Credits

Special thanks for helping me improve this information to:

  • @potatoru
  • @orangejuice
  • @OrpheeGT
  • @senhan07
@StefanoGiu
Copy link

This is now weird... I made another restart of the Emby server (after a lot of them) without touching the config, and now I can see the channels...

@amitkhare
Copy link

amitkhare commented Sep 17, 2024 •
edited
Loading

Spinner thinggy keeps spinning, But It Worked!
I and went back to home page Refreshed the page after a few seconds of submitting the random key.

@OrpheeGT
Copy link

Spinner thinggy keeps spinning, But It Worked! I and went back to home page Refreshed the page after a few seconds of submitting the random key.

Got a Badge also!

image

Try this and you won't have the infinite spinning anymore :
https://gist.github.com/danielchc/c159626485a08c76856b2d30ae457e04?permalink_comment_id=5191918#gistcomment-5191918

@StefanoGiu
Copy link

How is it possible to remove the premiere warning when playing a movie/TV series on Emby Samsung Smart TV app?

@OrpheeGT
Copy link

How is it possible to remove the premiere warning when playing a movie/TV series on Emby Samsung Smart TV app?

The device must "trust" the self signed certificate.
On android apps, you have an option to do it.

Maybe you can't do it on Samsung TV. If so, this is not fixable.

@OrpheeGT
Copy link

Here how it is shown under Android TV app :

image

@danielchc you may want to add this screen too in the tutorial for Android TV :)
I don't remember if it is enabled by default when you install the app.

@danielchc
Copy link
Author

Here how it is shown under Android TV app :

image

@danielchc you may want to add this screen too in the tutorial for Android TV :) I don't remember if it is enabled by default when you install the app.

Sure! I just update the gist. Thank you again :)

@abdullahal39
Copy link

i don't can see this option

Emby Theater
Go to
Windows: %appdata%\Emby-Theater\system\electronapp
Linux: /opt/emby-theater/electron/resources/app/
Open main.js with text editor
After this

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment