DRM Protection and macOS Screen Recording

This document provides a technical overview of Digital Rights Management (DRM) as it relates to screen recording on macOS. It covers FairPlay Streaming, Widevine, HDCP, and the macOS capture pipeline at a level suitable for developers and technically-inclined users.

1. DRM Systems on macOS

Three major DRM systems are relevant to the macOS platform:

System	Owner	Primary Platforms	macOS Security Tier
FairPlay Streaming	Apple	Safari, iOS, tvOS, native macOS	Hardware-level
Widevine	Google	Chrome, Firefox, Android, Smart TV	L3 software-level
PlayReady	Microsoft	Edge, Windows, Xbox	No native macOS support

Widevine L3 operates at the software level: decryption occurs in user-space processes, and decrypted frame data resides in system memory. In principle, this makes frames accessible. However, as detailed in Section 2, macOS provides a unified interception layer that applies regardless of the DRM system in use.

2. The macOS DRM Interception Architecture

macOS implements a multi-tier defense against the capture of DRM-protected content:

                    ┌─────────────────────────────┐
                    │     Screen Recording App     │
                    │  (ScreenCaptureKit /         │
                    │   CGDisplayStream)           │
                    └─────────────┬───────────────┘
                                  │ Capture attempt
                    ┌─────────────▼───────────────┐
                    │      WindowServer            │
                    │      Compositor              │
                    │  ┌────────────────────────┐  │
                    │  │ Regular window frames   │──→ Capturable
                    │  │ DRM-tagged frames       │──→ Replaced with black
                    │  └────────────────────────┘  │
                    └─────────────┬───────────────┘
                                  │
                    ┌─────────────▼───────────────┐
                    │       GPU Display Engine     │
                    │  ┌────────────────────────┐  │
                    │  │ Protected Memory Pool   │──→ Physical display only
                    │  │ (DRM frames)            │     (HDCP-encrypted path)
                    │  └────────────────────────┘  │
                    │  ┌────────────────────────┐  │
                    │  │ General Memory Pool     │──→ Accessible via IOSurface
                    │  │ (regular frames)        │     capture APIs
                    │  └────────────────────────┘  │
                    └─────────────────────────────┘

Three layers of interception:

Layer	Mechanism	Effect
CDM Frame Tagging	FairPlay CDM marks each frame as `protected`	WindowServer compositor skips capture path for tagged frames
Protected Memory Pool	Decoded frames placed in GPU-protected memory	Standard IOSurface read APIs return all-zero / all-black
HDCP Link Encryption	Display output signal encrypted	Intermediate capture hardware receives only encrypted data

Experimental data shows this interception is DRM-system-agnostic: both FairPlay and Widevine L3 content produce consistently blocked frames across all capture APIs tested (CGDisplayStream, ScreenCaptureKit, and QuickTime Player).

3. FairPlay Streaming Key Exchange

Apple’s FairPlay uses HLS with AES-128 CBCS encryption. The key exchange proceeds through a four-step handshake:

┌────────────┐          ┌────────────┐          ┌──────────────────┐
│  Player    │          │  Apple CDM  │          │  License Server  │
│ (AVFound-  │          │ (Kernel /   │          │     (KSM)        │
│  ation /   │          │  Secure     │          │                  │
│  Safari)   │          │  Enclave)   │          │                  │
└─────┬──────┘          └──────┬─────┘          └────────┬─────────┘
      │                        │                         │
      │ ① Request key          │                         │
      │ ──────────────────────►│                         │
      │                        │ ② SPC (Server Playback  │
      │                        │    Context)              │
      │                        │    Device-generated      │
      │                        │    Contains session key  │
      │                        │    + anti-replay data    │
      │                        │ ────────────────────────►│
      │                        │                         │
      │                        │ ③ CKC (Content Key      │
      │                        │    Context)              │
      │                        │    Server validates SPC, │
      │                        │    returns wrapped key   │
      │                        │ ◄────────────────────────│
      │                        │                         │
      │ ④ Decrypted frames     │                         │
      │ Kernel-level decrypt,  │                         │
      │ frames → display HW    │                         │
      │ ◄──────────────────────│                         │
      │                        │                         │
      ▼                        ▼                         ▼
 ┌──────────────────────────────────────────────────────────┐
 │ Application process              │ Kernel / Secure Enclave │
 │ Never sees plaintext key or frame│ Protected decrypt pipe  │
 └──────────────────────────────────────────────────────────┘

Key security properties:

SPC (Server Playback Context): The device encrypts the request with the server’s RSA public key, producing a package containing a unique device identifier and an anti-replay token. No intermediary can read it.
CKC (Content Key Context): The server decrypts the SPC and wraps the content key into a CKC that only the target device can unwrap.
Decryption location: On iOS/tvOS, within the XNU kernel. On macOS Safari, within Apple’s CDM (Content Decryption Module), running atop the hardware root of trust.
Application visibility of plaintext keys: None. From SPC generation to frame rendering, the plaintext key and application process are separated by hardware isolation.

4. FairPlay Implementation Architecture

┌──────────────────────────────────────────────────────────────┐
│                   Application Process                         │
│  ┌──────────────┐   ┌──────────────────┐                     │
│  │ AVPlayer /   │   │ AVContentKey     │                     │
│  │ Safari video │   │ Session (delegate)│                    │
│  └──────┬───────┘   └────────┬─────────┘                     │
│         │ Play request       │ SPC/CKC proxy                 │
│         │                    │ (does not hold keys)          │
├─────────┼────────────────────┼───────────────────────────────┤
│  XPC    │                    │                               │
│  ───────┼────────────────────┼───────────────── Process ────│
│         │                    │                               │
│  ┌──────▼────────────────────▼─────────┐                     │
│  │       mediaserverd (system daemon)  │                     │
│  │  ┌──────────────────────────────────┐                     │
│  │  │  CoreMedia FairPlay CDM          │                     │
│  │  │  · SPC generation (device-bound) │                     │
│  │  │  · CKC unwrapping               │                     │
│  │  │  · AES-CBCS decrypt scheduling   │                     │
│  │  │  · Decrypt key → Trusted Exec    │                     │
│  │  └──────────────────────────────────┘                     │
│  └──────────────┬───────────────────────┘                    │
│                 │                                            │
│  ┌──────────────▼───────────────────────┐                    │
│  │   Apple Silicon Secure Enclave       │                    │
│  │   · Hardware key derivation          │                    │
│  │   · Tamper-resistant key storage     │                    │
│  │   · Device-unique identifier binding │                    │
│  └──────────────┬───────────────────────┘                    │
│                 │                                            │
│  ┌──────────────▼───────────────────────┐                    │
│  │      GPU (Protected Pipeline)        │                    │
│  │  ┌──────────────────────────────────┐                     │
│  │  │ VideoToolbox Decoder             │                     │
│  │  │  · Protected Memory Pool alloc   │                     │
│  │  │  · Colorspace conversion inline  │                     │
│  │  │  · Frame → Display controller    │                     │
│  │  └──────────────────────────────────┘                     │
│  └──────────────┬───────────────────────┘                    │
│                 │ DisplayPort / HDMI / Built-in              │
│                 ▼                                            │
│  ┌──────────────────────────────────────┐                    │
│  │        Physical Display              │                    │
│  │  HDCP-encrypted link (if applicable) │                    │
│  └──────────────────────────────────────┘                    │
└──────────────────────────────────────────────────────────────┘

5. HDCP (High-bandwidth Digital Content Protection)

HDCP is a hardware-layer link encryption protocol operating between the GPU and external display, independent of content-level DRM systems:

HDCP 1.x: DVI/HDMI-based, 40-bit keys (cracked as of 2010)
HDCP 2.2: HDMI 2.0 / DisplayPort-based, RSA 2048 + AES-128, requires display to provide valid KSV (Key Selection Vector)
FairPlay enforces HDCP 2.2 for 4K and high-quality content

EDID and HDCP negotiation: The display reports its capabilities to the GPU via EDID (Extended Display Identification Data). Within the Vendor-Specific Data Block (VSDB, Tag 0x03):

Byte 25, Bit 5 = 1: HDCP supported
Byte 25, Bit 5 = 0: HDCP not supported

When the system detects that the connected display does not support the required HDCP version, behavior varies by content:

High-quality content: Playback is refused
Certain content: Downgraded to SD resolution
Virtual displays embedded in screen recording tools: DRM content is never routed to them, as they do not declare HDCP support

6. ScreenCaptureKit and DRM

macOS 12.3 introduced ScreenCaptureKit (SCK) as the replacement for the deprecated CGDisplayStream. Key changes as of macOS 15 Sequoia:

API	Status	DRM Behavior
`CGDisplayStream`	Deprecated	Triggers system permission warning on each restart; capturable but DRM-restricted
`CGWindowListCreateImage`	Deprecated	Same as above
`ScreenCaptureKit`	Current	DRM frames automatically replaced with black pixels
`SCContentSharingPicker`	Recommended	Content picker with improved permission management

macOS 15 Sequoia changes:

WindowServer compositor merges DRM-tagged and regular frames into a unified framebuffer
SCK captures from this framebuffer; DRM frame regions are replaced with pure black pixels
NSWindow.sharingType = .none (usable as a protective measure in macOS 14) no longer blocks SCK capture in macOS 15

The CMSampleBuffer metadata key kCMSampleAttachmentKey_ProtectedContent provides a programmatic signal indicating frames that were intentionally blacked out by the system. This key can be used to implement user-facing notices when protected content is detected during a recording session.

7. Hardware Root of Trust

Apple Silicon (M1/M2/M3/M4) DRM security rests on a hardware root of trust:

Secure Enclave Processor (SEP)
  ├── Device Unique ID (UID, fused in hardware)
  ├── FairPlay key derivation (based on UID + application identifier)
  └── Anti-replay counter

Apple T2 Security Chip (Intel Mac)
  ├── Secure storage (FairPlay keys)
  └── Hardware AES engine

8. Industry Practices

The screen recording industry has reached a consensus on DRM handling:

Tool	DRM Handling
QuickTime Player	System-level black frames
OBS Studio	Black frames + community documentation
CleanShot X	DRM detection + automatic recording pause
Snagit	Black frames + user-facing notice
Loom	Black frames
screenpipe	DRM application detection + SCK handle release

No mainstream screen recording tool offers DRM content capture. This position reflects a technical reality rather than a product choice.

Mac Screen Recording Shows Black Screen? Here’s How to Fix It → — Practical troubleshooting guide. Step-by-step fixes for black screen issues.

What We Learned Building a Screen Recorder — DRM, Black Screens, and the Hard Decisions → — Developer’s perspective. Real experiment data, failed solutions, and the product decisions behind DRM handling.

DRM Protection and macOS Screen Recording — A Technical Reference