Processing Key, Media Key and Volume ID found!!!

[evdberg]

Originally Posted by pacman2006

The new software players will do everything to hide the vuk's.

And because of Arnezami's work most likely also the other keys like the Media and Processing key ... and that is what I meant with 'playing his cards too soon'.

[arnezami]

Originally Posted by evdberg

And because of Arnezami's work most likely also the other keys like the Media and Processing key ... and that is what I meant with 'playing his cards too soon'.

Nonsense. I have no time now but will have later.

But this for now: the Processing Key and/or Device Keys of a player were already compromised before this thread even started. Keep your facts straight. I started this topic knowing AnyDVD had already done it. But that was not the only reason. Will explain more later.

Please concentrate now on doing something constructive. Like trying to build sniffing software, giving more Volume IDs, getting Blu-Ray C-values/Validate Media Key etc.

Regards,

arnezami

[evdberg]

Originally Posted by arnezami

I started this topic knowing AnyDVD had already done it.

Where did you read this? I can only find speculation and phrases like "So just how does AnyDVD HD work? Has SlySoft managed to really crack AACS? For now, no one is sure just how AnyDVD HD will work exactly.". I agree with you to keep the facts straight ...

[zeroprobe]

Originally Posted by evdberg

Where did you read this? I can only find speculation and phrases like "So just how does AnyDVD HD work? Has SlySoft managed to really crack AACS? For now, no one is sure just how AnyDVD HD will work exactly.". I agree with you to keep the facts straight ...

Every post you make is negative, you don't have a clue what your talking about.

Theres only two possible ways AnyDVD can work and I can 99.9% say that they didn't break aacs so it must be this way.

[evdberg]

Anyway ... in the meantime that this forum was down due to moving to another server, I made a small program that implements what is discussed in this thread. I can only conclude it works perfectly fine, and I am amazed that this one processing key every time works on the very first c-value (of 512 available). Obviously someone at the mastering facility was very lazy ...

[Dethis]

Originally Posted by evdberg

.... For now, no one is sure just how AnyDVD HD will work exactly.". ...

Except beta testers..

[evdberg]

Originally Posted by zeroprobe

Every post you make is negative, you don't have a clue what your talking about.

I can only conclude that you have no idea who I am ...

Originally Posted by zeroprobe

Theres only two possible ways AnyDVD can work and I can 99.9% say that they didn't break aacs so it must be this way.

For all we know they just include a lookup table with all known VUKs. Since they release twice a week a new version of AnyDVD, they can keep that table up-to-date. And since you can not read the Volume ID directly from a disk (must go through secured handshake commands through MMC commands), they can't use this new method. So indeed there are 2 methods: either the above mentioned lookup table of VUKs, or they use a device key and perform the whole protocol.

[xyz987]

Originally Posted by evdberg

Anyway ... in the meantime that this forum was down due to moving to another server, I made a small program that implements what is discussed in this thread. I can only conclude it works perfectly fine, and I am amazed that this one processing key every time works on the very first c-value (of 512 available).

Source code please :-)

[arnezami]

Originally Posted by zeroprobe

Every post you make is negative, you don't have a clue what your talking about.

Theres only two possible ways AnyDVD can work and I can 99.9% say that they didn't break aacs so it must be this way.

Thank you so much. For a moment I thought I was biased. I really considered spending (or should I say wasting) useful time on a response. But you said it very clearly in two sentences.

[evdberg]

Originally Posted by Dethis

Except beta testers..

They can only test functionality of the program, they do not know anything about its workings.

[Electrox3d]

I've got blu-ray drives coming out of my ears... anything you want me to try?

[arnezami]

Originally Posted by xyz987

Source code please :-)

Some sample code for those eagerly waiting:

	// Processing Key
	static unsigned char processing_key[16] = {0x09,0xF9,0x11,0x02,0x9D,0x74,0xE3,0x5B,0xD8,0x41,0x56,0xC5,0x63,0x56,0x88,0xC0};

	// Encrypted C Value
	static unsigned char encrypted_c_value[16] = {0x6D,0x02,0xCA,0xC6,0x7B,0x1A,0x7E,0x95,0xC2,0x16,0xEF,0xD4,0xC9,0x28,0x09,0xCF};

	//Decrypted C Value
	static unsigned char decrypted_c_value[16];
	static unsigned char uv[4] = {0x00,0x00,0x00,0x01};

	// Media Key
	static unsigned char media_key[16]; 

	//Encrypted Verification Data (King Kong)
	static unsigned char encrypted_verification_data[16] = {0x87,0xB8,0xA2,0xB7,0xC1,0x0B,0x9F,0xAD,0xF8,0xC4,0x36,0x1E,0x23,0x86,0x59,0xE5};

	//Decrypted Verification Data Should Be
	static unsigned char decrypted_verification_data_should_be[8] = {0x01,0x23,0x45,0x67,0x89,0xAB,0xCD,0xEF};

	//Decrypted Verification Data
	static unsigned char decrypted_verification_data[16];

	// Volume ID
	static unsigned char volume_id[16] = {0x40,0x00,0x09,0x18,0x20,0x06,0x08,0x41,0x00,0x20,0x20,0x20,0x20,0x20,0x00,0x00};
	
	//Decrypted Volume ID
	static unsigned char decrypted_volumeid[16];

	//Volume Unique Key
	static unsigned char volume_unqiue_key[16];
	

	// First decrypt the C-value with the processing key
	oRijndael.MakeKey((char *)processing_key, CRijndael::sm_chain0, 16, 16);
	oRijndael.DecryptBlock((char *)encrypted_c_value, (char *)decrypted_c_value);

	// Then XOR it with with the uv (of the corresponding C-value)
	for (j = 0; j < 16; j++)
	{
		if (j < 12)
		{
			media_key[j] = decrypted_c_value[j];
		}
		else
		{
			media_key[j] = decrypted_c_value[j]^uv[j-12];
		}
	}

	// Then check if the resulting media key is correct using the verify media key record
	oRijndael.MakeKey((char *)media_key, CRijndael::sm_chain0, 16, 16);
	oRijndael.DecryptBlock((char *)encrypted_verification_data, (char *)decrypted_verification_data);

	if (!memcmp(decrypted_verification_data_should_be, decrypted_verification_data, 8))
	{
		for (j = 0; j < 16; j++)
		{
			printf("%02X ", decrypted_verification_data[j]);
		}
	}
	printf("\n");

	// Then do a AES-G (basicly a decrypt and an XOR) on the media key + volumeID
	oRijndael.MakeKey((char *)media_key, CRijndael::sm_chain0, 16, 16);
	oRijndael.DecryptBlock((char *)volume_id, (char *)decrypted_volumeid);
	for (j = 0; j < 16; j++)
	{
		volume_unqiue_key[j] = volume_id[j]^decrypted_volumeid[j];
	}
	printf("\n");

	// This results in the Volume Unique Key
	for (j = 0; j < 16; j++)
	{
		printf("%02X ", volume_unqiue_key[j]);
	}
	printf("\n");

[xyz987]

Originally Posted by arnezami

Some sample code for those eagerly waiting:

Great!!

[xyz987]

Originally Posted by Electrox3d

I've got blu-ray drives coming out of my ears... anything you want me to try?

Of course, we want to know if arnezami's Processing Key works with BluRay movies.

I suppose arnezami will give you instructions soon.

[evdberg]

And a small PC prog to play around with it ... (had to convert it from my Mac test version)

Usage: mkb <mkb_file> [volume_id]

[blutach]

Guys - I wake up to something building to a flame a war?

Let's keep it on an even keel and stick to the technical please. We all have something to contribute - let's do it in a postive way!

Regards

[xyz987]

Originally Posted by evdberg

And a small PC prog to play around with it ... (had to convert it from my Mac test version)

Usage: mkb <mkb_file> [volume_id]

[appleguru]

Originally Posted by evdberg

And a small PC prog to play around with it ... (had to convert it from my Mac test version)

Usage: mkb <mkb_file> [volume_id]

Can I get the mac version?

[evdberg]

Originally Posted by appleguru

Can I get the mac version?

Sure ... if you explain me how you can read a HD-DVD using the Xbox-360 drive on the Mac? Because if I insert a disk in the drive, OS-X comes up with the message "Unknown format, Ignore or Eject".

[Electrox3d]

Originally Posted by xyz987

Of course, we want to know if arnezami's Processing Key works with BluRay movies.

I suppose arnezami will give you instructions soon.

So... Should I run the USBsniffer program using a blu-ray drive / movie / WinDVD like the HDDVD instructions did? or is it something else that needs to be tested w/blu-ray?

Arnezami - what test would you like done w/blu-ray?