Welp, here's a 1:1 copy made using Typora: # [Extracting content from an LCP "protected" ePub](https://shkspr.mobi/blog/2025/03/towards-extracting-content-from-an-lcp-protected-epub/) [debugging](https://shkspr.mobi/blog/tag/debugging/) [drm](https://shkspr.mobi/blog/tag/drm/) [ebooks](https://shkspr.mobi/blog/tag/ebooks/) [epub](https://shkspr.mobi/blog/tag/epub/) · [10 comments](https://shkspr.mobi/blog/2025/03/towards-extracting-content-from-an-lcp-protected-epub/#comments) · 1,800 words · read ~9,641 times. ------ As Cory Doctorow once said "[Any time that someone puts a lock on something that belongs to you but won't give you the key, that lock's not there for you.](https://www.bbc.co.uk/news/business-12701664)" But here's the thing with the LCP DRM scheme; they *do* give you the key! As [I've written about previously](https://shkspr.mobi/blog/2025/03/some-thoughts-on-lcp-ebook-drm/), LCP mostly relies on the user entering their password (the key) when they want to read the book. Oh, there's some deep cryptographic magic in the background but, ultimately, the key is sat on your computer waiting to be found. Of course, cryptography is Very Hard™ which make retrieving the key almost impossible - so perhaps we can use a different technique to extract the unencrypted content? One popular LCP app is [Thorium](https://thorium.edrlab.org/en/). It is an [Electron Web App](https://www.electronjs.org/). That means it is a bundled browser running JavaScript. That also means it can trivially be debugged. The code is running on your own computer, it doesn't touch anyone else's machine. There's no reverse engineering. No cracking of cryptographic secrets. No circumvention of any technical control. It doesn't reveal any [illegal numbers](https://en.wikipedia.org/wiki/Illegal_number). It doesn't jailbreak anything. We simply ask the reader to give us the content we've paid for - and it agrees. ## [Here Be Dragons](https://shkspr.mobi/blog/2025/03/towards-extracting-content-from-an-lcp-protected-epub/#here-be-dragons) This is a manual, error-prone, and tiresome process. This cannot be used to automatically remove DRM. I've only tested this on Linux. It must only be used on books that you have legally acquired. I am using it for research and private study. This uses [Thorium 3.1.0 AppImage](https://github.com/edrlab/thorium-reader/releases/tag/v3.1.0). First, extract the application: ``` BASH./Thorium-3.1.0.AppImage --appimage-extract ``` That creates a directory called `squashfs-root` which contains all the app's code. The Thorium app can be run with remote debugging enabled by using: ``` BASH./squashfs-root/thorium --remote-debugging-port=9223 --remote-allow-origins=* ``` Within the Thorium app, open up the book you want to read. Open up Chrome and go to `http://localhost:9223/` - you will see a list of Thorium windows. Click on the link which relates to your book. In the Thorium book window, navigate through your book. In the debug window, you should see the text and images pop up. ![Chrome debug screen.](https://lemmy.ml/api/v3/image_proxy?url=https%3A%2F%2Fshkspr.mobi%2Fblog%2Fwp-content%2Fuploads%2F2025%2F03%2Fdebug-fs8.png) In the debug window's "Content" tab, you'll be able to see the images and HTML that the eBook contains. ## [Images](https://shkspr.mobi/blog/2025/03/towards-extracting-content-from-an-lcp-protected-epub/#images) The images are the full resolution files decrypted from your ePub. They can be right-clicked and saved from the developer tools. ## [Files](https://shkspr.mobi/blog/2025/03/towards-extracting-content-from-an-lcp-protected-epub/#files) An ePub file is just a zipped collection of files. Get a copy of your ePub and rename it to `whatever.zip` then extract it. You will now be able to see the names of all the files - images, css, fonts, text, etc - but their contents will be encrypted, so you can't open them. You can, however, give their filenames to the Electron app and it will read them for you. ## [Images](https://shkspr.mobi/blog/2025/03/towards-extracting-content-from-an-lcp-protected-epub/#images) To get a Base64 encoded version of an image, run this command in the debug console: ``` JavaScriptfetch("httpsr2://...--/xthoriumhttps/ip0.0.0.0/p/OEBPS/image/whatever.jpg") .then(response => response.arrayBuffer()) .then(buffer => { let base64 = btoa( new Uint8Array(buffer).reduce((data, byte) => data + String.fromCharCode(byte), '') ); console.log(`data:image/jpeg;base64,${base64}`); }); ``` [Thorium uses the `httpsr2` URl scheme](https://github.com/w3c/epub-specs/issues/1888#issuecomment-958439051) - you can find the exact URl by looking at the content tab. ## [CSS](https://shkspr.mobi/blog/2025/03/towards-extracting-content-from-an-lcp-protected-epub/#css) The CSS can be read directly and printed to the console: ``` JavaScriptfetch("httpsr2://....--/xthoriumhttps/ip0.0.0.0/p/OEBPS/css/styles.css").then(response => response.text()) .then(cssText => console.log(cssText)); ``` However, it is *much* larger than the original CSS - presumably because Thorium has injected its own directives in there. ## [Metadata](https://shkspr.mobi/blog/2025/03/towards-extracting-content-from-an-lcp-protected-epub/#metadata) Metadata like the [NCX](https://wiki.mobileread.com/wiki/NCX) and the [OPF](https://opensource.com/article/22/8/epub-file) can also be decrypted without problem: ``` JavaScriptfetch("httpsr2://....--/xthoriumhttps/ip0.0.0.0/p/OEBPS/content.opf").then(response => response.text()) .then(metadata => console.log(metadata)); ``` They have roughly the same filesize as their encrypted counterparts - so I don't think anything is missing from them. ## [Fonts](https://shkspr.mobi/blog/2025/03/towards-extracting-content-from-an-lcp-protected-epub/#fonts) If a font has been used in the document, it should be available. It can be grabbed as Base64 encoded text to the console using: ``` JavaScriptfetch("httpsr2://....--/xthoriumhttps/ip0.0.0.0/p/OEBPS/font/Whatever.ttf") .then(response => response.arrayBuffer()) .then(buffer => { let base64 = btoa( new Uint8Array(buffer).reduce((data, byte) => data + String.fromCharCode(byte), '') ); console.log(`${base64}`); }); ``` From there it can be copied into a new file and then decoded. ## [Text](https://shkspr.mobi/blog/2025/03/towards-extracting-content-from-an-lcp-protected-epub/#text) The HTML of the book is also visible on the Content tab. It is *not* the original content from the ePub. It has a bunch of CSS and JS added to it. But, once you get to the body, you'll see something like: ``` HTML

Book Title

SUMMARY

Lorem ipsum etc.

``` Which looks like plain old ePub to me. You can use the `fetch` command as above, but you'll still get the verbose version of the xHTML. Edit: split apart, too big.