I've spent some time trying to crack this today, learning some new things I didn't already know.
The sky signature is a hmac signed api, I can locate some of the code used when I decompile the apk but dex2jar doesn't do a very good job of it.
More generic information for a signed request for context:
https://blog.andrewhoang.me/how-api-requ...n-nodejs-2
You may also perform a google search for hmac signed request to get a lot more diverse and specific information (for hmac signing in general).
Within the decompiled java code I located this:
java:
private final com.nowtv.player.sps.a a;
...
str1 = String.format(Locale.ROOT, "SkyOTT client=\"%s\",signature=\"%s\",timestamp=\"%d\",version=\"%s\"", Arrays.copyOf(new Object[] { configurations.j0(), this.a.a(str1), Long.valueOf(l), configurations.i0() }, 4));
s.h(str1, "format(locale, format, *args)");
Which obviously formats the signature for the header:
x-sky-signature: SkyOTT client="NBCU-WEB-v8",signature="",timestamp="1672683152",version="1.0"
I did not locate the path nowtv.player to see what was happening inside it.
As noted previously in this thread, the package is using libhmac.so
Seeing as it appears to be using a Now TV backend I attempted to follow that path with no results, attempts to decompile the 148MB NowTV apk just made my little laptop freeze up and I doubt it would be of use anyhow.
So in short, the signature is not arbitrary nor is it specific to Peacock, it's used widely but will likely be just as difficult as getting a widevine license is since you need private and public signing keys or api to sign.
If you want to peruse the decompiled code in question I made a paste for the 2 pertinent files here:
https://paste.kodi.tv/badasawupi
If you want to decompile yourself I used dex2jar and jd-gui.
Hope this information helps even though it's not a big revelation on generating signatures.
