Quote:
Originally Posted by arnezami
Confirmed. This is a (sub) Device Key. 
....
Technically there could be more Device and sub Device Keys (that are parents of the found device key) in memory. But I've yet to find one. Given the right memdump it should be possible to retrace it back to the "given" Device Key (the one given to WinDVD 8). |
It looks like there should be 22 device keys given out to each device for use on this tree (the tree rooted at level 22 - one of the 512 largest trees in use and defined in the current MKB). There is one original device key for each level of a tree, except the root.
The PK key from arnezami matches up with an S-D set of devices rooted at level 22 and having a difference set ("revoked" pseudo device) in the lower left corner. Everyone below the upper root can calculate that PK key either from an assigned DK or a calculated sub DK.
If the device this key came from is adjacent to the lower left "revoked" device on this tree, then this would be the original device key assigned to that device. If not, then this must be a sub DK and there must be at least one other original DK at a higher level. The farther away this device is from the lower left, the more levels the device had to work through to get to the sub DK used to calculate arnezami's PK.
Are the device numbers for PowerDVD and WindDVD known? If they are different, then at least one of them must have another original DK at a higher level.