My war on ads

I usually get curious about an idea, and dig through it till I find a viable conclusion, this time I decided to document it. This started with exploring how ad-blockers works and what companies whose business model is ads do to deal with this. As I went further down the rabbit hole realizing they are trying to build a layered-fortress to make us watch ads, I ended up with the plan to load a copy locally to watch later without ads (which is technically piracy but hey, nothing wrong with theorizing)

Level 1: The Application Layer (The Extension War)

The Idea: Intercept network calls via a browser extension. If an ad request is received, drop the packet or trigger a time-controlled relay to “fast-forward” the playback to bypass ssaf methods (amazon-prime uses this btw)

The Wall: **Manifest V3**. Google’s shift from the webRequest API to declarativeNetRequest means extensions can no longer dynamically proxy or modify requests in real-time. The browser now "vets" your rules against a static list.

Status: Compromised. The browser is now a gatekeeper for the advertiser.

Level 2: The Trust Layer (Web DRM)

The Idea: If the browser limits extensions, sit in the RAM and read/modify the data before the browser renders it.

The Wall: **Web Environment Integrity (WEI). Often called “Web DRM,” this proposed standard allows a website to ask the browser for an attestation**. It checks if you are running on a modified OS or using an unauthorized blocker. If the “WBS” (Web Binary Security) check fails, the site refuses to serve the high-value payload.

The Realization: At this point, our own browser has switched teams.

Level 3: The Kernel Layer (The Privileged Binary)

The Idea: Build a higher-priority binary that can’t be traced by DRM. Use the **Windows Filtering Platform (WFP)** to snatch packets at the network stack before they reach the browser process.

The Wall: TLS 1.3 & Certificate Pinning. **Certificate Pinning** ensures the app only trusts a hard-coded certificate. If we try to Man-in-the-Middle (MitM) the traffic at the kernel level to strip ads, the handshake fails. The packets are encrypted “End-to-End,” and we are the “Wrong End.”

Status: The data is a black box until it hits the hardware.

Level 4: The Hardware Enclave (The “Brutus” Moment)

The Idea: Wait for the hardware to decrypt the data. Scrape the decrypted video frames from the GPU memory or “sit” in the VRAM.

The Wall: **Intel PAVP (Protected Audio Video Path). The CPU decrypts the data and sends it over an encrypted bus directly to the GPU**. The cleartext never touches the standard RAM. Even with kernel permissions, the hardware creates an enclave we cannot peek into.

Quote: “Et tu, Brute?” Even our CPU is working for THEM?!

Level 5: The Physical Layer (The End Game)

The Idea: Once the data leaves the silicon, all internal encryption is finished. Intercept the movie at the HDMI cable.

The Wall: HDCP (High-bandwidth Digital Content Protection). The HDMI cable itself is encrypted. The PC and the Monitor perform a handshake; if the device in the middle isn’t “Authorized,” the screen goes black.

The Final Exploit: 1. The 2010 Master Key Leak: In 2010, the **Master Key for HDCP 1.x was leaked, allowing for the creation of hardware that can strip encryption. 2. The Modern Bypass: For HDCP 2.2/2.3, we use devices like [HDFury](https://www.avsforum.com/threads/what-does-the-hdfury-do-exactly-do-i-need-one.3052832/)**, which acts as a “Legal Man-in-the-Middle” to downgrade the signal or bypass the handshake protocols entirely.

Conclusion

As software becomes a cage, sovereignty moves to the hardware. When the browser, the OS, and the CPU all turn against us, the only “unpatchable” exit is the physical wire. In the war on ads, the final victory isn’t found in a line of code — it’s found in the silicon. This is a temporary ceasefire; a victory for users, for now. We enjoy it while it lasts. They will fortify these defenses, update the handshakes, and try to close the enclave. Let them. We will find another way.