# Scraper Engine Extractor Catalog

Catalog of 82 Kotlin video hoster extractors from the Streamflix scraper-engine decompile (`/home/rurouni/apk-analysis/scraper-engine/extractors/`). All handle direct embed-to-m3u8 resolution — **zero overlap** with nexstream-scraper (which uses torrent-indexing APIs).

## HIGH-Value Extractors Worth Porting

| Rank | Extractor | Why Unique | Technique |
|------|-----------|------------|-----------|
| **#1** | **Filemoon** | ECDSA secp256r1 attestation (generate EC keypair, sign nonce, submit JWK) → AES/GCM decrypt. Full 4-step challenge handshake. **Most sophisticated, no public equivalent.** | Crypto handshake |
| **#2** | **Closeload** | "Smart brute-force" engine: 5 string transforms × 5 byte transforms × double-base64 × modular arithmetic decryption loop. Novel `unmixLoop()` with magic number. | Brute-force transform |
| **#3** | **VidsrcNet** | **10 different decryption functions** in one file (switch-case by player ID): ROT13, Caesar shift, hex-to-char XOR, Base64+char-shift, substring extraction, etc. Most variety. | Multi-algorithm |
| **#4** | **AesHelper** (util) | Portable OpenSSL-compatible AES with MD5 KDF (salt + password → key+IV). Needed by Rabbitstream, Vidsrc.to, Vidplay. | AES + MD5 KDF |

## MEDIUM-Value Items

- **Rabbitstream/Megacloud**: JS obfuscation key extraction from player script switch-case analysis
- **Vidsrc.to**: RC4 two-stage token encoding + key rotation (fetched from GitHub JSON)
- **VidGuard**: Multi-stage sig decode: hex-xor → base64 → drop-last-5 → reverse → char-pair-swap → drop-last-5
- **StreamWish**: URL registry of **75+ rotating domains** (pack valuable as a JSON list for any hoster resolver)
- **MixDrop**: Rotating domain regex `^md[3bfyz][a-z0-9]*`
- **JsUnpacker** (util): P.A.C.K.E.R. eval deobfuscator (needed by 12+ extractors)

## LOW-Value / Common Patterns

- Simple regex scrapers (Goodstream, LuluVdo, Supervideo, Uqload, etc.)
- GoogleDrive/Pcloud/AmazonDrive/Dailymotion — cloud storage, not video hosters
- Moflix — proprietary API, not a standard embed pattern

## Technique Categories Found Across All 82 Extractors

1. **Regex**: Extract URL from raw HTML/JS — simplest, most common
2. **JS Unpacking**: Deobfuscate P.A.C.K.E.R.-style eval() — needed by 12 extractors
3. **AES Decryption**: AES-128/256 CBC/GCM with key extracted from page script
4. **AES + MD5 KDF**: Salt + password → key+IV via MD5 iteration (Rabbitstream, Vidplay)
5. **ECDSA Attestation**: Generate EC keypair, sign challenge, submit JWK (Filemoon only)
6. **RC4**: Symmetric stream cipher with extracted key
7. **Multi-Variant Switch**: Same hoster serves different player IDs, each with different decryption approach (VidsrcNet: 10 variants)
8. **Smart Brute-Force**: Apply N transform combinations against ciphertext until one produces valid URL (Closeload)
9. **Rate-Limited Retry**: Delay + retry loop for hosters that throttle (common)
10. **Rotating Domains**: Same hoster serves from different domains (StreamWish: 75+, MixDrop: regex pattern)