I reverse-engineered NAVER VIBE to recover two lost songs

Someone posted on r/LostMedia looking for two songs. "Embrace" and "Frontier", from an album called Her by Jasper Mitchell, released September 20, 2019. The album went out across Spotify, SoundCloud, Deezer, all the usual platforms, and then a couple years later the entire discography vanished when the artist lost access to the account keeping it up. Other people had reuploaded most of the tracklist to YouTube, but those two songs existed nowhere except the Korean music app FLO, as 60-second previews. Her is one of those albums a small group of people care about a lot, the OP included, and it was sitting two tracks short of being archivable.

FLO is region-locked. You need Korean phone service to register, and the poster didn't know anyone in Korea. I went down the rabbit hole anyway.

FLO was a dead end

I spent a couple of days trying to reverse-engineer FLO's API, looking for some gimmick that would either pull the full songs or get me past authentication without a Korean number. No dice. It's locked down tight. Whatever FLO is doing on the backend, they're doing it carefully.

But the album had clearly been pushed to Korean DSPs, and FLO isn't the only one. If it was on FLO, it was probably on a few others. So I started checking the rest of the Korean platforms, and the only one that returned a result was NAVER's VIBE.

VIBE also wants an account, but unlike FLO it accepts non-Korean numbers. I signed up, fully expecting it to at least let me stream the whole thing in low quality. It didn't. Same one-minute preview as everywhere else.

Reverse-engineering VIBE

So I bit the bullet and spent the next couple of days inside VIBE's API. As far as I can tell there's no public bypass for it anywhere. People have written downloaders for Spotify, Tidal, Netease, Kugou, half the streaming services on earth, but VIBE has stayed untouched. This is the first one.

The thing that cracked it is how VIBE serves previews. When you ask for a track's stream, it hands you an HLS manifest, the playlist of encrypted .ts segments that ffmpeg stitches into the song. For a non-subscriber, that manifest only lists the first 60 seconds. Six segments, give or take, and then #EXT-X-ENDLIST. As far as the player is concerned, that's the whole track.

Except the CDN token stapled to those segment URLs doesn't only authorize the preview. It authorizes every segment of the full track. The segment filenames are just a numbered sequence, ...-0-enc.ts, ...-1-enc.ts, and so on. The preview stops listing them at the 60-second mark, but the files keep existing on the CDN, and your token is allowed to fetch them.

So you don't need to break anything. You walk past the preview. Pull the preview manifest, grab the decryption key line and the segment URL pattern, then keep incrementing the segment number until the CDN stops returning 200:

count = 0
while count < 2000:
    if status(f"{prefix}{count}{suffix}") != 200:
        break
    count += 1

That count is where the real track ends. Rebuild a complete manifest listing every segment from 0 to the end, hand it to ffmpeg with the original #EXT-X-KEY line, and ffmpeg decrypts and muxes the whole song. Up to 320kbps AAC, the same file a paying subscriber would get. The preview was never a different file. It was the same file with most of the playlist withheld.

vibe-dl

I wrapped the whole thing into a CLI: vibe-dl. It searches VIBE, and it'll download a single track, a full album, or an artist's entire discography from a URL or a bare album id. No account, no subscription, no Korean number. Output is tagged .m4a files with embedded cover art and synced lyrics where VIBE has them.

python vibe_cli.py search "jasper mitchell"
python vibe_cli.py "https://vibe.naver.com/album/6766828"
python vibe_cli.py "https://vibe.naver.com/artist/4958319" --output discography

I ran it against Her and pulled the complete album, both missing songs included, in 320kbps. Sent it to the OP and uploaded it. I'm also seeding it on Soulseek under the alias BonusArticle, so it doesn't depend on me again.

One last thing for anyone who finds this looking for more of the same: I'm fairly sure Jasper Mitchell rebranded as albatraussmusic, if you want to follow where the music went.

---

The usual disclaimer applies. The tooling exists; what you do with it is on you, and what you download is subject to wherever you live and whatever rights are attached to it. I built this to recover an album that was about to be genuinely lost, and that's what I'd point it at.