|
I think the memory area we're usually searching for is a c-structure - and that the relevant information (volumeid, mediakey, vuk) is still there, but not in plaintext any longer... I also noticed that the beginning of the structure is different now, so basically it might be possible to detect if it's a plaintext structure or an obfuscated one without even validating the vuk, but for the moment I'll just check the version of DVDfab and Passkey and exit in case an unsupported version is discovered.
If anyone is interested: I already created a brute-force application that is simply searching for a valid VUK in a memory dump - using 4 threads that check simultaneously it takes about 2min to check all possible combinations in a 100mb binary file and personally I've no idea how I could optimize this any further (AES encoding / decoding is already done with libgcrypt because the internal purebasic methods are way too slow) and with 4 threads my cpu is already on it's limit.
So for the moment it's easier to use an older release of the dvdfab applications (and I can install different releases without restarting windows - so I think it's no problem at all to switch to an older release for FindVUK and install the current one again afterwards).
|