How to Inspect DRM Plugins and Widevine Security Levels on Android Using ADB dumpsys media.drm

On modern mobile devices, streaming high-definition (HD), 4K, and High Dynamic Range (HDR) video from commercial media platforms (such as Netflix, Prime Video, Disney+, and YouTube) relies heavily on hardware-backed Digital Rights Management (DRM). Android implements a modular DRM framework managed by the mediadrmserver system daemon and the media.drm service. This architecture separates generic media playback engines from proprietary encryption schemes, most notably Google Widevine Modular DRM and ClearKey.

When media streaming applications fail to stream in full resolution, throw obscure playback errors (such as DRM error -107), or fall back to standard definition (SD), the root cause almost always traces back to DRM security level downgrades or cryptographic session limits. By connecting your device via Android Debug Bridge (ADB) and executing dumpsys media.drm, developers and QA engineers can inspect installed DRM plugins, determine the hardware Widevine security level (L1 versus L3), and analyze active cryptographic sessions.

Understanding Android DRM Architecture and Widevine Security Levels

The Android DRM framework consists of a high-level Java API (MediaDrm), a native C++ framework layer, and vendor-specific Hardware Abstraction Layer (HAL) plugins. Google Widevine is classified into two distinct hardware security levels on consumer Android devices:

• Widevine Level 1 (L1): Cryptographic keys, video decryption, and video frame rendering occur entirely within a hardware-isolated Trusted Execution Environment (TEE) or secure hardware enclave. The main application processor and Android kernel never have access to decrypted video frames. Widevine L1 is strictly required by streaming platforms for 1080p, 4K, and HDR streaming.
• Widevine Level 3 (L3): Cryptographic operations occur in software within the standard user space or kernel memory. Because decrypted buffers could theoretically be captured by root malware or screen-recording software, content providers restrict Widevine L3 devices to standard definition (480p/540p) streams.
• Security Downgrades: Unlocking a device bootloader, modifying system partitions, or running custom ROMs frequently trips hardware cryptographic checks, causing the device to drop permanently or temporarily from L1 to L3.

Inspecting DRM Subsystem State with dumpsys

To inspect the status of the DRM subsystem and installed crypto plugins, connect your Android device with USB debugging enabled and run:

# Query the DRM system service diagnostics
adb shell dumpsys media.drm

The output presents a comprehensive breakdown of installed DRM plugins, cryptographic engines, and active media sessions:

DrmHal Service:
  Installed plugins:
    [Widevine] UUID: edef8ba9-79d6-4ace-a3c8-27dcd51d21ed
    [ClearKey] UUID: e2719d58-a985-b3c9-781a-b030e4d41e12
  Active sessions: 1
  Max concurrent sessions: 16

Every DRM vendor possesses a standardized UUID. The UUID edef8ba9-79d6-4ace-a3c8-27dcd51d21ed universally identifies Google Widevine Modular DRM across all Android platforms.

Verifying Widevine Security Level (L1 vs L3)

To specifically audit whether your device is operating at Widevine L1 or L3, filter the dumpsys media.drm output for security level properties:

# Query Widevine security level details
adb shell dumpsys media.drm | grep -i -E "securityLevel|systemId|vendor"

The terminal returns the active cryptographic properties:

securityLevel: L1
systemId: 19842
vendor: Google
description: Widevine CDM 17.0.0

If securityLevel reports L3 on a device that previously supported full HD streaming, the hardware TEE attestation has failed, explaining why media applications cap streaming resolution at 480p.

Inspecting Active Cryptographic Sessions and Memory Leaks

Media applications create a MediaDrm session when preparing an encrypted video stream and must explicitly close the session when playback terminates. If an app contains memory leaks or fails to release sessions during rapid video scrolling, the hardware crypto engine exhausts its maximum concurrent session limit (typically 8 to 16 sessions), causing subsequent playback attempts to fail with fatal exceptions.

You can audit open sessions and their allocated memory buffers in real time:

# Inspect active DRM sessions and memory handles
adb shell dumpsys media.drm | grep -A 15 "Active sessions:"

The output lists each open session ID, its owning process ID (PID), cipher algorithms in use, and session duration:

Active sessions: 2
  Session [0]:
    Owner PID: 12450 (com.netflix.ninja)
    Cipher: AES/CBC/NoPadding
    HDCP Level: HDCP_V2_3
  Session [1]:
    Owner PID: 18210 (com.google.android.youtube)
    Cipher: AES/CTR/NoPadding
    HDCP Level: HDCP_NO_DIGITAL_OUTPUT

Auditing HDCP Levels and External Display Protection

When an Android phone or tablet is connected to an external monitor or television via USB-C DisplayPort Alternate Mode or HDMI, High-bandwidth Digital Content Protection (HDCP) is enforced across the physical cable. If the external display does not support HDCP 2.2 or higher, 4K streaming is blocked.

You can verify active HDCP negotiation metrics directly from the DRM dump:

# Check negotiated HDCP levels on connected displays
adb shell dumpsys media.drm | grep -i "hdcp"

The dump displays both the maximum HDCP capability of the device hardware and the currently negotiated link status (such as HDCP_V2_2 or HDCP_NONE).

Using dumpsys media.drm provides developers and engineers with complete visibility into mobile encryption engines, allowing fast diagnosis of streaming resolution limits and playback errors across Android devices.