Reverse-Engineering a Free Streaming Platform

Key Takeaways & TL;DR

Free streaming websites disguise fragmented MP4 segments inside fake .woff2 font files to deter scraping. By inspecting DevTools network payloads for moof/mdat boxes and fetching the initial init fragment, you can automate sequential segment downloads and remux them into a standard MP4 via FFmpeg.

A friend recently asked me to download a movie that was still in theaters. It wasn’t available on torrents or on any paid streaming service like Netflix or Prime, it was only accessible on a free streaming platform, such as FMovies.

I wanted to download it mainly because free streaming platforms are notorious for:

  1. Enormous and intrusive ads
  2. Annoying popups
  3. Poor user experience (UX)

So I thought: why not try to get the video directly?

That’s when things got interesting. At first glance, the video segments weren’t standard video files—they were being served as .woff / .woff2 files (which are web fonts, not video format).

What I Discovered Under the Hood

  1. Running file on a segment: It showed just data, nothing obvious.
  2. Hex-dumping the segment (using xxd or similar): It revealed MP4 boxes (moof / mdat) inside, which are classic markers for fragmented MP4 video.
  3. Finding the init fragment: The initialization fragment (init) was also disguised as a .woff file.
  4. Segment numbering: The segments were sequentially numbered: seg-001, seg-002, seg-003...
DevTools Network panel showing woff2 segments and hex dump response with MP4 boxes
Inspecting network requests in DevTools: .woff2 stream segments revealing fragmented MP4 headers (moof/mdat)

Essentially, the platform was obfuscating and disguising the audio/video stream inside a binary container with font extensions to trick casual inspection. Clever from a delivery standpoint, but entirely reversible.

How I Solved It

Once I understood the structure, I:

  1. Wrote a script to download all segments sequentially.
  2. Added retry logic for intermittent network errors.
  3. Concatenated all segments together starting with the init fragment.
  4. Used FFmpeg to remux everything into a single, clean, playable MP4 file.
Bash script downloading stream segments in parallel with retry logic
Automated parallel downloading script fetching video segments sequentially

The result? A clean, playable video without ads or interruptions, and a fascinating look behind the scenes of streaming tech.

Final remuxed output.mp4 file playing inside VS Code media player
The final remuxed output.mp4 file playing seamlessly

💡 Insights

  • Curiosity and low-level inspection (file, xxd) can reveal hidden structures.
  • Free streaming platforms sometimes disguise data to prevent easy scraping or access.
  • Automation and scripting can solve repetitive, technical challenges efficiently.

Sometimes, understanding how things actually work under the hood is more rewarding than the end product itself.

Ali Abbas

Software engineer who likes building close to the metal, reverse engineering APIs, and exploring client-side security.