VGrabDRM-protected video: no
Widevine, FairPlay and PlayReady are protection the rights holders put on a video. When VGrab recognises one it says so plainly — "this video is DRM-protected and can't be downloaded" — and stops.
That isn't a gap in what we've built. Breaking that protection is circumventing a protection measure, not solving a technical puzzle, so there is no code for it in the extension and there won't be.
YouTube: no
We actually looked rather than guessing: we captured the media requests a real playback page sends and read them. Three obstacles, and they are not the same kind of thing:
- A different delivery format. Picture and sound travel separately, and there's no m3u8 on the page at all. That part is engineering effort, nothing more.
- Access control. Video addresses expire, are tied to the address that asked for them, and carry two signatures. Mostly anti-hotlinking and abuse control, with harder downloading as a side effect.
- Protection aimed at downloading specifically. One parameter in the address throttles you if it's computed wrong, and the code that computes it lives inside player scripts that keep changing. Getting a usable address means reverse-engineering that.
The third one is where we stop. This project started with two hard rules: when a human verification check appears, stop and report it rather than impersonate a person; and don't touch copy protection. Reverse-engineering something built specifically to prevent downloading belongs in the same category.
There's a practical reason on top of the principle: store developer policies don't permit extensions to download YouTube content. Comparable extensions say the same on their own store pages.
Human verification: we stop there too
Some sites throw up a "checking your browser" page. VGrab won't fake a browser fingerprint, won't call a captcha-solving service, and won't use any library built to get past those checks.
There's exactly one thing that's fine: you open the page in your own browser and pass the check yourself, and the extension reads the page you actually browsed. That's inherently how an extension works — it never visits a site on your behalf, it only makes sense of the page you already have open.
So what's left
Nearly everything: split streams on ordinary sites (m3u8 and DASH), whole files in MP4, WEBM and FLV, AES-128 encrypted streams, sites that ship picture and sound as two tracks, and — through recording — players that never reveal an address, plus live broadcasts.
Put another way: VGrab saves what you can already watch. It doesn't get at what you can't. That line isn't moving.