DRM-X 5.0 Encryption SDK User Guide

1SDK Package Contents

After extracting the DRM-X5.0_Encryption_SDK archive, the directory contains the following files:

The command-line arguments are identical across all three platforms — only the program file name differs.

2Encryption Workflow Overview

Why call the DRM-X 5.0 Web Service first?The encryption program's -profile argument is not the numeric ID of the license profile — it is an encrypted string bound to your account (ProfileEncryptedParam). This string cannot be generated locally; it can only be obtained through the Web Service. It maps one-to-one to a ProfileID, and once obtained it can be cached and reused — you do not need to call the Web Service for every file. The Base64 values of the input / output paths, on the other hand, should be encoded locally in your program (see Section 6) — no Web Service call needed for them.

3Prerequisites

3.1 DRM-X 5.0 Account Information (obtained from the DRM-X admin console)

3.2 Server Environment Requirements

Security reminder: WebServiceAuthStr is equivalent to an account key. It must be stored server-side only — never place it in front-end web pages, client software, or public repositories.

4Step One: Call the DRM-X 5.0 Web Service to Obtain Encryption Parameters

4.1 Web Service Information

The endpoint must match your account's edition: International accounts use 5.drm-x.com (command line: -server_domain com); China accounts use 5.drm-x.cn (command line: -server_domain cn). Using the wrong edition will cause authentication to fail, or the encrypted files to be unplayable.

4.2 Request Parameters

4.3 Mapping Between Response Fields and Command-Line Arguments (Core)

4.4 Invocation Example (PHP / SoapClient)

This Web Service is a standard SOAP 1.1 service that can be called from any language, in the same uniform way: POST a SOAP envelope to the endpoint listed in 4.1 (or have a SOAP client generate it automatically from ?WSDL), pass the parameters from 4.2, then read the three fields from 4.3 in the response. Common SOAP client libraries by language:

The following example uses PHP's SoapClient to demonstrate the full call. Save the code as get_params.php on your server and run it (PHP 7.4+ with the soap extension enabled) — it prints the three command-line argument values:

<?php
// ========== Configuration (edit to match your account) ==========
$wsdl              = 'https://5.drm-x.com/haihaisoftlicenseservice.asmx?WSDL';  // China edition: https://5.drm-x.cn/...
$adminEmail        = 'admin@example.com';
$webServiceAuthStr = 'YOUR_AUTH_STRING';
$profileID         = '1001';
$input             = '/home/video/course01.mp4';
$output            = '/home/video/encrypted/course01_P.mp4';

// ========== Create a SoapClient (WSDL mode; the SOAP envelope is generated automatically) ==========
$client = new SoapClient($wsdl, [
    'soap_version'       => SOAP_1_1,
    'connection_timeout' => 20,
    'trace'              => true,          // enables __getLastRequest() for inspecting the raw request
]);

// ========== Call the method: the method name is the WSDL operation; arguments are an associative array ==========
$resp = $client->GetPackagerEncryptedParams([
    'AdminEmail'            => $adminEmail,
    'WebServiceAuthStr'     => $webServiceAuthStr,
    'ProfileID'             => $profileID,
    'Input'                 => $input,
    'Output'                => $output,
    'ProfileEncryptedParam' => '',
    'enc_Input'             => '',
    'enc_Output'            => '',
]);

// ========== The response is mapped to a stdClass object; read the fields directly ==========
$result  = $resp->GetPackagerEncryptedParamsResult;
$profile = $resp->ProfileEncryptedParam;   // this is the -profile argument value

if ($profile === '') {
    die("Call failed: $result\n");   // e.g. authentication errors appear here
}

// -profile: one call per ProfileID is enough. Cache it and reuse it —
//           do not call the Web Service again for every file you encrypt.
echo "-profile = $profile\n";

// Input / output paths: Base64-encode them locally (UTF-8). No Web Service call needed.
// If your PHP source file is saved as UTF-8, the strings are already UTF-8.
// Other languages work the same way: convert to UTF-8 bytes first, then Base64.
// (The service also returns enc_Input / enc_Output with the same values — either source is fine.)
$encIn  = base64_encode($input);
$encOut = base64_encode($output);
echo "-input_file_utf8_base64_encoded = $encIn\n";
echo "-output_file_utf8_base64_encoded = $encOut\n";

5Step Two: Run the Encryption Command

5.1 First Use (Linux / macOS)

In a terminal, change into the program's directory and grant execute permission first:

# Linux
chmod +x drm-x5-encrypt-sdk-linux-x86_64

# macOS (pick the one matching your architecture)
chmod +x drm-x5-encrypt-sdk-macos-x86_64
chmod +x drm-x5-encrypt-sdk-macos-arm64

5.2 Single-File Encryption Command Templates

Windows (cmd / PowerShell):

drm-x5-encrypt-sdk.exe -server_domain com -profile <ProfileEncryptedParam value> -input_file_utf8_base64_encoded <Base64 of the input path> -output_file_utf8_base64_encoded <Base64 of the output path>

Linux:

./drm-x5-encrypt-sdk-linux-x86_64 -server_domain com -profile <ProfileEncryptedParam value> -input_file_utf8_base64_encoded <Base64 of the input path> -output_file_utf8_base64_encoded <Base64 of the output path>

macOS:

./drm-x5-encrypt-sdk-macos-arm64 -server_domain com -profile <ProfileEncryptedParam value> -input_file_utf8_base64_encoded <Base64 of the input path> -output_file_utf8_base64_encoded <Base64 of the output path>

5.3 Argument Reference

5.4 Complete Examples

Windows:

drm-x5-encrypt-sdk.exe -server_domain com -profile UMuAZfLDToYGfmigBsRbklanDHRBoRrLrsTkI_W52KVnPcC-ZL-KU4UssGDA8Uja-4URQqsxw7WPsZL-CPWYQQj1jdwQsSbLri9_Q3YvPysCfMNtXKBHZvhrWlcsmNMg8FVqm7KFgr4ODrSQxAXgFV -input_file_utf8_base64_encoded RDpcSmFzb25caW5wdXRcMDEtdGVzdFZpZGVvLm1wNA== -output_file_utf8_base64_encoded RDpcSmFzb25cb3V0cHV0XDAxLXRlc3RWaWRlb19QLm1wNA==

Here RDpcSmFzb25c... decodes to D:\Jason\input\01-testVideo.mp4.

Linux:

./drm-x5-encrypt-sdk-linux-x86_64 -server_domain com -profile s5Gls5QDAz4LyC_USkG9rY0fyDU4cN90HhgvOe6-67OUn92UFWRFdv4N_7Qx-Ipxa_M5d123ZQEesB1BPnGkUs-HkFTwI1pZEwaj133IRLhaxuUfOpBBROkKZpPk_QxBKvoxiX4NVL-Rs6g457jWsV -input_file_utf8_base64_encoded Li9pbnB1dC8wMS1saW51eC1lbmNyeXB0LXZpZGVvLm1wNA== -output_file_utf8_base64_encoded Li9vdXRwdXQvMDEtbGludXgtZW5jcnlwdC12aWRlbzJfUC5tcDQ=

This encrypts ./input/01-linux-encrypt-video.mp4 → ./output/01-linux-encrypt-video2_P.mp4.

5.5 Verifying the Result

• When the program finishes, check that an encrypted file was created in the output directory (a _P suffix is recommended to distinguish it, e.g. course01_P.mp4);
• Encryption requires network access to the DRM-X server. Make sure your firewall / security group allows outbound access to 5.drm-x.com or 5.drm-x.cn;
• It is recommended to verify the full workflow with a small test video before batch-encrypting production content.

6Base64-Encoding the Input / Output Paths (Local Encoding Recommended)

Recommended practice: generate the values of -input_file_utf8_base64_encoded / -output_file_utf8_base64_encoded by encoding them in your own program — there is no need to call the Web Service once per file. The encoding rule: first convert the path string to UTF-8 bytes, then apply standard Base64 encoding. Note: your source files must be saved as UTF-8 (this matters especially for non-ASCII paths; on Windows, do not use ANSI / GBK encoding). Examples by language:

To re-emphasize: there is no way to generate the -profile argument locally. It is an encrypted string bound to your account and can only be obtained through the GetPackagerEncryptedParams Web Service.

7Server-Side Automation Examples

Chaining "obtain parameters + invoke the encryption program" enables one-click encryption from your website's back office, or scheduled batch encryption. The following PHP example invokes the Linux encryption program (continuing from the code in Section 4.4; at runtime, $profile should be read from cache first, and the Web Service in 4.4 called only when no cached value exists):

<?php
// ...continuing from Section 4.4, with $profile / $encIn / $encOut already obtained:

$packager = '/opt/drmx5/drm-x5-encrypt-sdk-linux-x86_64';   // absolute path to the encryption program
$domain   = 'com';                                        // com = International, cn = China

// Make sure the output directory exists (the program does not create it)
$outDir = dirname(base64_decode($encOut));
if (!is_dir($outDir)) { mkdir($outDir, 0755, true); }

// Assemble and execute the command (escapeshellarg prevents injection; the argument
// values are Base64 and contain no spaces, so this is double protection)
$cmd = $packager
     . ' -server_domain '   . escapeshellarg($domain)
     . ' -profile '         . escapeshellarg($profile)
     . ' -input_file_utf8_base64_encoded '  . escapeshellarg($encIn)
     . ' -output_file_utf8_base64_encoded ' . escapeshellarg($encOut);

exec($cmd, $outLines, $exitCode);
echo 'Exit code: ' . $exitCode . PHP_EOL . implode(PHP_EOL, $outLines);

Shell batch-encryption script example (Linux — encodes paths locally, then encrypts each file):

#!/bin/bash
# batch_encrypt.sh — batch-encrypt all mp4 files under ./input into ./output
ADMIN_EMAIL="admin@example.com"
AUTH_STR="YOUR_AUTH_STRING"
PROFILE_ID="1001"
PACKAGER="./drm-x5-encrypt-sdk-linux-x86_64"
DOMAIN="com"   # China edition: change to cn

mkdir -p ./output
for f in ./input/*.mp4; do
  name=$(basename "$f" .mp4)
  out="./output/${name}_P.mp4"
  # Base64-encode the paths locally (UTF-8)
  in_b64=$(printf '%s' "$f"  | base64 -w0)
  out_b64=$(printf '%s' "$out" | base64 -w0)
  # The -profile string should be obtained once by your server via the Web Service
  # and cached — the same ProfileID's value can be reused for every file.
  "$PACKAGER" -server_domain "$DOMAIN" -profile "$PROFILE_ENC" \
      -input_file_utf8_base64_encoded "$in_b64" \
      -output_file_utf8_base64_encoded "$out_b64"
  echo "[done] $out"
done

Recommended practice: fetch the ProfileEncryptedParam for a given ProfileID once via the Web Service and cache it for reuse — do not call the Web Service once per encrypted file. Generate enc_Input / enc_Output equivalents directly by Base64-encoding (UTF-8) the paths on your server (in PHP: base64_encode($path), see Section 6) — no Web Service call needed. When batch-encrypting, limit concurrency (e.g. 2-4 encryption processes per server) to avoid saturating bandwidth and CPU.

8Frequently Asked Questions (FAQ)

Q1: The Web Service returns "Your XML web service login info is not correct..."

AdminEmail or WebServiceAuthStr is incorrect. Double-check both in the DRM-X admin console; make sure the values have no leading or trailing spaces. Also note that even for this error the HTTP status code is still 200 — your program must determine success by inspecting the response fields, not the HTTP status code.

Q2: Passing the numeric ID (e.g. 1001) directly to -profile causes an error

-profile must be the complete ProfileEncryptedParam encrypted string returned by the Web Service — not the numeric Profile ID. The numeric ID is only used when calling the Web Service.

Q3: The path contains non-ASCII characters or spaces and encryption fails?

Paths are transported as Base64, and non-ASCII characters and spaces are fully supported. The key is that encoding must use UTF-8: on Windows, Notepad / cmd may default to ANSI (GBK) encoding, which corrupts the path after Base64 decoding. Encode paths as UTF-8 in your program as described in Section 6 (with a PHP source file saved as UTF-8, plain base64_encode() works directly; legacy GBK-encoded strings can be converted first with iconv('GBK', 'UTF-8', $path) or mb_convert_encoding() before encoding).

Q4: The program reports an output failure / cannot find the output directory

The output file's parent directory must be created in advance (e.g. mkdir -p ./output). Also verify that the user running the program has write permission for that directory.

Q5: macOS says the program "cannot be opened because the developer cannot be verified"

The program is not Apple-notarized, so Gatekeeper blocks the first launch. Pick either remedy: ① Run xattr -d com.apple.quarantine ./drm-x5-encrypt-sdk-macos-arm64 in a terminal to remove the quarantine flag; ② Or click "Open Anyway" in System Settings → Privacy & Security.

Q6: On Linux the program cannot execute (Permission denied or format error)

Run chmod +x drm-x5-encrypt-sdk-linux-x86_64 first. If you get "cannot execute binary file", confirm the server is x86_64 (uname -m). The current package ships x86_64 builds only; for ARM servers please contact Haihaisoft.

Q7: Should I use com or cn? What happens if I pick the wrong one?

It must match your DRM-X account's platform: International accounts use com (and call 5.drm-x.com), China accounts use cn (and call 5.drm-x.cn). A mismatch causes authentication failure, or encryption parameters that don't match the platform.

Q8: How do I verify the encrypted files?

Open the output files in the DRM-X 5.0 demo player / your integrated player and confirm: playback is blocked without a license, and plays normally after authorizing a test user in the admin console. Verify on a small scale before bulk production encryption.

9Notes and Best Practices

• Keep the original files: write output to a new location or new file name (e.g. with a _P suffix) so the original videos are never overwritten.
• Small before large: when using a new profile or a new server for the first time, run one short test video through the whole "fetch parameters → encrypt → licensed playback" flow before batch processing.
• Never hand-edit the arguments: -profile is a Base64 encrypted string — copy it in full (no extra leading/trailing spaces, no line-wrap truncation).
• Keep the auth string secret: WebServiceAuthStr belongs in server-side configuration only; do not deploy demo web tools like GetPackagerEncryptedParams.php to the public internet.
• Network requirement: during encryption the server must reach the DRM-X servers (International 5.drm-x.com / China 5.drm-x.cn); allow outbound port 443 if a firewall is present.