Get download url from mega.nz

megafetch.sh

#!/bin/bash

# Copyright 2018, 2019, 2020 Azure Zanculmarktum
# All rights reserved.
#
# Redistribution and use of this script, with or without modification, is
# permitted provided that the following conditions are met:
#
# 1. Redistributions of this script must retain the above copyright
#    notice, this list of conditions and the following disclaimer.
#
#  THIS SOFTWARE IS PROVIDED BY THE AUTHOR "AS IS" AND ANY EXPRESS OR IMPLIED
#  WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
#  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO
#  EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
#  SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
#  PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
#  OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
#  WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
#  OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
#  ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

# Dependencies:
#  openssl

# Usage:
#  $ ./megafetch.sh https://mega.nz/#!abcdefgh!1234567890abcdefghijklmnopqrstuvwxyzABCDEFG
#  http://gfs208n103.userstorage.mega.co.nz/dl/-abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890A
#  file.name
#  abcefghijklmnopqrstuvwxyz0123456
#  1234567890abcdef0000000000000000
#  $ wget -O file.name http://gfs208n103.userstorage.mega.co.nz/dl/-abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890A
#  $ cat file.name | openssl enc -d -aes-128-ctr -K abcefghijklmnopqrstuvwxyz0123456 -iv 1234567890abcdef0000000000000000 > file.name.new
#  $ mv -f file.name.new file.name

URL=""

if [[ $1 =~ ^https?:\/\/mega(\.co)?\.nz ]]; then
	URL="$1"
fi

if [[ ! $URL ]]; then
	echo "Usage: ${0##*/} url" >&2
	exit 1
fi

CURL="curl -Y 1 -y 10"

missing=false
for cmd in openssl; do
	if [[ ! $(command -v "$cmd" 2>&1) ]]; then
		missing=true
		echo "${0##*/}: $cmd: command not found" >&2
	fi
done
if $missing; then
	exit 1
fi

if [[ $URL =~ .*/file/[^#]*#[^#]* ]]; then
	id="${URL#*file/}"; id="${id%%#*}"
	key="${URL##*file/}"; key="${key##*#}"
else
	id="${URL#*!}"; id="${id%%!*}"
	key="${URL##*!}"
fi

raw_hex=$(echo "${key}=" | tr '\-_' '+/' | tr -d ',' | base64 -d -i 2>/dev/null | od -v -An -t x1 | tr -d '\n ')
hex=$(printf "%016x" \
	$(( 0x${raw_hex:0:16} ^ 0x${raw_hex:32:16} )) \
	$(( 0x${raw_hex:16:16} ^ 0x${raw_hex:48:16} ))
)

json=$($CURL -s -H 'Content-Type: application/json' -d '[{"a":"g", "g":"1", "p":"'"$id"'"}]' 'https://g.api.mega.co.nz/cs?id=&ak=') || exit 1; json="${json#"[{"}"; json="${json%"}]"}"
file_url="${json##*'"g":'}"; file_url="${file_url%%,*}"; file_url="${file_url//'"'/}"

json=$($CURL -s -H 'Content-Type: application/json' -d '[{"a":"g", "p":"'"$id"'"}]' 'https://g.api.mega.co.nz/cs?id=&ak=') || exit 1
at="${json##*'"at":'}"; at="${at%%,*}"; at="${at//'"'/}"

json=$(echo "${at}==" | tr '\-_' '+/' | tr -d ',' | openssl enc -a -A -d -aes-128-cbc -K "$hex" -iv "00000000000000000000000000000000" -nopad | tr -d '\0'); json="${json#"MEGA{"}"; json="${json%"}"}"
file_name="${json##*'"n":'}"
if [[ $file_name == *,* ]]; then
	file_name="${file_name%%,*}"
fi
file_name="${file_name//'"'/}"

#$CURL -s "$file_url" | openssl enc -d -aes-128-ctr -K "$hex" -iv "${raw_hex:32:16}0000000000000000" > "$file_name"

echo "$file_url"
echo "$file_name"
echo "$hex"
echo "${raw_hex:32:16}0000000000000000"

Amazing, it's working!
Thanks!

There is an issue on macOS Big Sur with receiving proper hex and raw_hex values. Something with key value not being converted with tr, od and base64 pipes, so it results with raw_hex variable to become empty, although the key value is the same as on Linux and can download on Linux system.

BTW I used https://mega.nz/#!8soDySiQ!Z6I57NiZ-K5CeE8E95ZKZyL1aSpdoo3eoDA_tE0Dlsc as example of this issue.
Resulting key value on both systems is Z6I57NiZ-K5CeE8E95ZKZyL1aSpdoo3eoDA_tE0Dlsc with Z6I57NiZ-K5CeE8E95ZKZyL1aSpdoo3eoDA_tE0Dlsc= used to be converted.

Here is a part where this goes wrong:

+ key=Z6I57NiZ-K5CeE8E95ZKZyL1aSpdoo3eoDA_tE0Dlsc
++ echo Z6I57NiZ-K5CeE8E95ZKZyL1aSpdoo3eoDA_tE0Dlsc=
++ tr '\-_' +/
++ tr -d ,
++ base64 -d -i
++ od -v -An -t x1
++ tr -d '\n '
+ raw_hex=
++ printf %016x 0 0
+ hex=00000000000000000000000000000000

I think that I found a very simple solution on macOS. Just add - to base64 command, so in the script should like this:

raw_hex=$(echo "${key}=" | tr '\-_' '+/' | tr -d ',' | base64 -d -i - 2>/dev/null | od -v -An -t x1 | tr -d '\n ')

Works on macOS and Linux with example https://mega.nz/#!8soDySiQ!Z6I57NiZ-K5CeE8E95ZKZyL1aSpdoo3eoDA_tE0Dlsc.

Mega decided to change the url's, so, this method it's not working for the moment.

I works as of 15 May, 2023

Works with old Mega URLs of the following two forms:

https://mega.nz/#!Wt0F1bpR!WlCGMYlOS_K23Q4wH5isOK7Oin6qsa2uyEAG3C5G3ro
https://mega.nz/file/Wt0F1bpR#WlCGMYlOS_K23Q4wH5isOK7Oin6qsa2uyEAG3C5G3ro

But not with the following forms:

https://mega.nz/folder/j9UklByL#UGECRD-W1P3gqv2na_GAmA/file/r8kA3KjI

The following CURL command would get the right JSON for the URL above, just not sure where the key is provided in this case, mega says it's "UGECRD-W1P3gqv2na_GAmA/file/r8kA3KjI" but not sure. Perhaps in the returned JSON string:

CURL -s -H 'Content-Type: application/json' -d '[{"a":"g","g":1,"ssl":1,"v":2,"n":"r8kA3KjI"}]' 'https://g.api.mega.co.nz/cs?n=j9UklByL'

All three URL forms specify the exact same file/resource.

$ ./megafetch.sh https://mega.nz/file/IfhCkAbK#FEokgrYNas-xRidBzYQ8FSuKfjQOBlu5zpK6HFpVt6Q

tell me to download a file not a folder show me code in python or curl whtever pls help

It works great in 2024!

Yes, working great in 2024

doesn't work in

$ ./megafetch.sh 'https://mega.nz/file/UvlSWDBS#xZq1LxAEKuMUFk1hZ077gKh3mFMJmhXJRgcCa3tADKY'
bad decrypt
38950000:error:1C80006B:Provider routines:ossl_cipher_generic_block_final:wrong final block length:../openssl-3.1.2/providers/implementations/ciphers/ciphercommon.c:429:
-3

6ded2d7c199e3f2a52114f0a1c0ef726
a8779853099a15c90000000000000000

@DarkTama works here

$ ./megafetch.sh 'https://mega.nz/file/UvlSWDBS#xZq1LxAEKuMUFk1hZ077gKh3mFMJmhXJRgcCa3tADKY'
http://gfs206n133.userstorage.mega.co.nz/dl/UVrTogmlOlMj4wLY4QynZQ7iwpC03dfDL26mS1wijvD2e5wlAB9LPPe4XjkUohK9V3Tn0a4KMLAfFh2nvtdYTEUjxLr_y8Cb-F0PD7yiFlloXAxej2OeQ6eQo6yoMA
 Green.Book.2018.1080p.BluRay.x264.DD5.1-Pahe.in.mkv
6ded2d7c199e3f2a52114f0a1c0ef726
a8779853099a15c90000000000000000

@DarkTama works here

$ ./megafetch.sh 'https://mega.nz/file/UvlSWDBS#xZq1LxAEKuMUFk1hZ077gKh3mFMJmhXJRgcCa3tADKY'
http://gfs206n133.userstorage.mega.co.nz/dl/UVrTogmlOlMj4wLY4QynZQ7iwpC03dfDL26mS1wijvD2e5wlAB9LPPe4XjkUohK9V3Tn0a4KMLAfFh2nvtdYTEUjxLr_y8Cb-F0PD7yiFlloXAxej2OeQ6eQo6yoMA
 Green.Book.2018.1080p.BluRay.x264.DD5.1-Pahe.in.mkv
6ded2d7c199e3f2a52114f0a1c0ef726
a8779853099a15c90000000000000000

i've been suspicious with the ISP, cause i specifically can't connect to the link or my drive, that's probably the main cause

URL="https://mega.nz/file/RwkXBIDT#uyW7dSc4nvSJkNg7Y_7LKtRMZnOno75Se2ywFP62bCE"

if [[ $1 =~ ^https?://mega(.co)?.nz ]]; then
URL="$1"
fi

if [[ ! $URL ]]; then
echo "Usage: ${0##*/} url" >&2
exit 1
fi

CURL="curl -Y 1 -y 10"

missing=false
for cmd in openssl; do
if [[ ! $(command -v "$cmd" 2>&1) ]]; then
missing=true
echo "${0##*/}: $cmd: command not found" >&2
fi
done
if $missing; then
exit 1
fi

if [[ $URL =~ ./file/[^#]#[^#]* ]]; then
id="${URL#file/}"; id="${id%%#}"
key="${URL##file/}"; key="${key###}"
else
id="${URL#!}"; id="${id%%!}"
key="${URL##*!}"
fi

raw_hex=$(echo "${key}=" | tr '-_' '+/' | tr -d ',' | base64 -d -i 2>/dev/null | od -v -An -t x1 | tr -d '\n ')
hex=$(printf "%016x"
$(( 0x${raw_hex:0:16} ^ 0x${raw_hex:32:16} ))
$(( 0x${raw_hex:16:16} ^ 0x${raw_hex:48:16} ))
)

json=$($CURL -s -H 'Content-Type: application/json' -d '[{"a":"g", "g":"1", "p":"'"$id"'"}]' 'https://g.api.mega.co.nz/cs?id=&ak=') || exit 1; json="${json#"[{"}"; json="${json%"}]"}"
file_url="${json##'"g":'}"; file_url="${file_url%%,}"; file_url="${file_url//'"'/}"

json=$($CURL -s -H 'Content-Type: application/json' -d '[{"a":"g", "p":"'"$id"'"}]' 'https://g.api.mega.co.nz/cs?id=&ak=') || exit 1
at="${json##'"at":'}"; at="${at%%,}"; at="${at//'"'/}"

json=$(echo "${at}==" | tr '-_' '+/' | tr -d ',' | openssl enc -a -A -d -aes-128-cbc -K "$hex" -iv "00000000000000000000000000000000" -nopad | tr -d '\0'); json="${json#"MEGA{"}"; json="${json%"}"}"
file_name="${json##'"n":'}"
if [[ $file_name == , ]]; then
file_name="${file_name%%,}"
fi
file_name="${file_name//'"'/}"

#$CURL -s "$file_url" | openssl enc -d -aes-128-ctr -K "$hex" -iv "${raw_hex:32:16}0000000000000000" > "$file_name"

echo "$file_url"
echo "$file_name"
echo "$hex"
echo "${raw_hex:32:16}0000000000000000"

URL="https://mega.nz/file/RwkXBIDT#uyW7dSc4nvSJkNg7Y_7LKtRMZnOno75Se2ywFP62bCE"

if [[ $1 =~ ^https?://mega(.co)?.nz ]]; then URL="$1" fi

if [[ ! $URL ]]; then echo "Usage: ${0##*/} url" >&2 exit 1 fi

CURL="curl -Y 1 -y 10"

missing=false for cmd in openssl; do if [[ ! $(command -v "$cmd" 2>&1) ]]; then missing=true echo "${0##*/}: $cmd: command not found" >&2 fi done if $missing; then exit 1 fi

if [[ $URL =~ ./file/[^#]#[^#]* ]]; then id="${URL#file/}"; id="${id%%#}" key="${URL##file/}"; key="${key###}" else id="${URL#!}"; id="${id%%!}" key="${URL##*!}" fi

raw_hex=$(echo "${key}=" | tr '-_' '+/' | tr -d ',' | base64 -d -i 2>/dev/null | od -v -An -t x1 | tr -d '\n ') hex=$(printf "%016x" ((0x{raw_hex:0:16} ^ 0x${raw_hex:32:16} )) ((0x{raw_hex:16:16} ^ 0x${raw_hex:48:16} )) )

json=$($CURL -s -H 'Content-Type: application/json' -d '[{"a":"g", "g":"1", "p":"'"$id"'"}]' 'https://g.api.mega.co.nz/cs?id=&ak=') || exit 1; json="${json#"[{"}"; json="${json%"}]"}" file_url="${json##'"g":'}"; file_url="${file_url%%,}"; file_url="${file_url//'"'/}"

json=$($CURL -s -H 'Content-Type: application/json' -d '[{"a":"g", "p":"'"$id"'"}]' 'https://g.api.mega.co.nz/cs?id=&ak=') || exit 1 at="${json##'"at":'}"; at="${at%%,}"; at="${at//'"'/}"

json=$(echo "${at}==" | tr '-' '+/' | tr -d ',' | openssl enc -a -A -d -aes-128-cbc -K "$hex" -iv "00000000000000000000000000000000" -nopad | tr -d '\0'); json="${json#"MEGA{"}"; json="${json%"}"}" file_name="${json##'"n":'}" if [[ $file_name == , ]]; then file_name="${file_name%%,_}" fi file_name="${file_name//'"'/}"

#$CURL -s "$file_url" | openssl enc -d -aes-128-ctr -K "$hex" -iv "${raw_hex:32:16}0000000000000000" > "$file_name"

echo "$file_url" echo "$file_name" echo "$hex" echo "${raw_hex:32:16}0000000000000000"

make it for folders and new type link version make a repo

It works for extracting the download link pretty well. But then we get the bandwidth limit exceeding error

HTTP request sent, awaiting response... 509 Bandwidth Limit Exceeded
2024-07-14 ERROR 509: Bandwidth Limit Exceeded.

Anyone knows any ways to bypass it?

@jakariyaa That may be due to non-premium accounts having a limited amount of bytes that they can download in a specific amount of time. Once that limit is reached, they probably throw that message to let you know they want you to go premium. That's likely enforced server-side so there is probably little you can do to circumvent it.