BackupHDDVD, a tool to decrypt AACS protected movies

[GIR]

Originally Posted by Mug Funky

blu-ray will be broken soon enough.

http://www.hdtvblogger.com/?p=39

I have received numerous (more than 3) independent reports that an exploit has been found on the PS3 that will reveal the title/volume keys for Blu-ray disks using a PS3. The procedure involves some minor modding of the boot process and Linux.

I have not been told of the exact process but the information makes it seem that the process is not that difficult once you know what you are doing and the lengthy steps are duplicated.

I do not own a PS3 so there is no way for me to deny/verify any of this information.

[Ábudos]

Originally Posted by HD Hell

Hi muslix64 - I'm one of those who thinks that you are doing this as a partisan attack on HD DVD. I suspect that you are going to stall on the Blu-Ray version of this.

Are you going to prove me wrong, or just continue to stall? I suspect you could have the Blu-Ray version working in only a couple of days given the work you have already done here.

It's not fair that you attack only one format - if you are true to what you say you are, you would have already released a Blu-Ray version of this program by now...

Color me skeptical of your true motives at the moment.

Are you kidding me? You are flamming him for not cracking blueray because of his involvement with HDDVD?

As he said, he has no Blueray drive. If you want to send him $500 so that he can buy one, I bet he would really love that.

Seriously, seeing as how you haven't done anything yourself, you have no room to criticize.

[blutach]

Originally Posted by HD Hell

Hi muslix64 - I'm one of those who thinks that you are doing this as a partisan attack on HD DVD. I suspect that you are going to stall on the Blu-Ray version of this.

Are you going to prove me wrong, or just continue to stall? I suspect you could have the Blu-Ray version working in only a couple of days given the work you have already done here.

It's not fair that you attack only one format - if you are true to what you say you are, you would have already released a Blu-Ray version of this program by now...

Color me skeptical of your true motives at the moment.

What more can I say? Strike issued (R4).

Everybody else - please get back on topic.

Regards

[blizc]

I found the keys for Swordfish and Training Day and was able to decrypt them using BackupHDDVD but when played it's just a black screen with no sound. King Kong is fine and by fine I mean a jittery mess but at least that's what everyone is getting anyways. So what's up with these 2 Warner Brothers movies. Is it cuz of the added stream for In-Movie Experience(IME)?

[Warren]

Originally Posted by blizc

Is it cuz of the added stream for In-Movie Experience(IME)?

Yes BackupHDDVD doesn't properly handle movies with IME yet.

[cyberpass]

Is there anyway we can find the spec for the IME?

[Warren]

Not without signing a bunch of NDAs and paying $5000 to the DVD Consortium.

[blutach]

Wonder if that might be their next protection layer - adding IME to everything?

Regards

[Warren]

There are ways to get the raw frames out of IME movies for which graphedit filter graphs are posted in the sister threads to this one but they are not optimal for watching HD DVDs.

[Nutrition24]

Originally Posted by jimfcarroll

Take a look at "Pre-recorded Video Book" - which is a different spec. Specifically chapter 3.

http://www.aacsla.com/specifications...orded_0.91.pdf

Yes, you're right, there indeed, the Title Key is used as is to decrypt the Content (C) as follows:
C = AES-128CBCD(Kt, Ce) so no talking about content key Kc.

I was referring to the HDDVD AACS prerecorded spec
http://www.aacsla.com/specifications...rded_0_912.pdf
section 4.3.2 where the pack encryption is described. and where the content is encrypted/decrypted with a variant of the Title key.

But maybe it's only HL_PCK packs that are encrypted with a Kt variant (Kc) and so if such packs are encountered, they won't be decrypted correctly by backuphddvd.

[HD Hell]

With full respect, apologies to anyone who took that as a personal attack.

Now, doesn't anyone here have a Blu-Ray drive of any sort? Using it with the Power DVD software should allow the keys to be seen in the same way. It seems right that one should be able to back up one's Blu-Ray discs as well.

Let's get a head start until someone releases a mod'ed version of "backup".

Originally Posted by HD Hell

Now, doesn't anyone here have a Blu-Ray drive of any sort? Using it with the Power DVD software should allow the keys to be seen in the same way. It seems right that one should be able to back up one's Blu-Ray discs as well.

Let's get a head start until someone releases a mod'ed version of "backup".

Please keep posts about Blu-Ray in the "BackupBluRay" topic instead: http://forum.doom9.org/showthread.php?t=120672

[romgohan]

Maybe create somewhere a repository of different encountered packs, to widen our knowledge and help find troublesome ones?

[jimfcarroll]

Originally Posted by Nutrition24

Yes, you're right, there indeed, the Title Key is used as is to decrypt the Content (C) as follows:
C = AES-128CBCD(Kt, Ce) so no talking about content key Kc.

I was referring to the HDDVD AACS prerecorded spec
http://www.aacsla.com/specifications...rded_0_912.pdf
section 4.3.2 where the pack encryption is described. and where the content is encrypted/decrypted with a variant of the Title key.

But maybe it's only HL_PCK packs that are encrypted with a Kt variant (Kc) and so if such packs are encountered, they won't be decrypted correctly by backuphddvd.

The relationship between "HD DVD and DVD Pre-recorded Book" spec and "Pre-recorded Video Book" spec is somewhat cloudy in my mind (though they reference each other). The later is much easier to read and seems to be written at a much higher level. Take a look at Chapter 4 which appears to be a technical sales pitch to various media conglomerates on how well protected their content will be (and, IMO, in the long run, they are right).

Unfortunately I don't have any of the requisite hardware, software, or content to experiment or I'd be digging in; all I can do is watch from the sidelines and read the publicly available specs and code.

[jkenzie]

Originally Posted by blizc

I found the keys for Swordfish and Training Day and was able to decrypt them using BackupHDDVD but when played it's just a black screen with no sound. King Kong is fine and by fine I mean a jittery mess but at least that's what everyone is getting anyways. So what's up with these 2 Warner Brothers movies. Is it cuz of the added stream for In-Movie Experience(IME)?

No, It's because you didn't find the volume key. Or you found a Title key. Backuphddvd will backup the movie with any group of numbers inputed into the Keybd.cfg, but it will be garbage.

[The_ByteMaster]

Originally Posted by jkenzie

No, It's because you didn't find the volume key. Or you found a Title key. Backuphddvd will backup the movie with any group of numbers inputed into the Keybd.cfg, but it will be garbage.

Would it be hard to modify BackupHDDVD so it will (optionally) check the Verify Media Record (see 3.2.5.4 AACS_Spec_Common_0.91)?

i.e. Bytes 4-19 of the MKB (MKBROM.AACS) = Dv and
[AES_128D(Km, Dv)]msb_64 == 0x0123456789ABCDEF

[jimfcarroll]

Originally Posted by The_ByteMaster

Would it be hard to modify BackupHDDVD so it will (optionally) check the Verify Media Record (see 3.2.5.4 AACS_Spec_Common_0.91)?

i.e. Bytes 4-19 of the MKB (MKBROM.AACS) = Dv and
[AES_128D(Km, Dv)]msb_64 == 0x0123456789ABCDEF

If that formula is correct, and my recollection of the spec is correct (I don't have it in front of me here), then it would be difficult since Km (I think) is the "media key" - which BackupHDDVD doesn't have and cannot get from what it does have (the Title Key and/or the Volume Unique key ). In fact, it's the reverse that happens in a normal player (the media key yields the Kvu and Kt).

[Nutrition24]

Originally Posted by The_ByteMaster

Would it be hard to modify BackupHDDVD so it will (optionally) check the Verify Media Record (see 3.2.5.4 AACS_Spec_Common_0.91)?

i.e. Bytes 4-19 of the MKB (MKBROM.AACS) = Dv and
[AES_128D(Km, Dv)]msb_64 == 0x0123456789ABCDEF

For this to work, we'll need to have the Km (Media key) itself, which we don't have. Using the Km, it's simply decrypting the Dv (Verification data from the MKB) and checking if the left part of the decrypted result is 0123456789ABCDEF.

The Volume ID and the Km (media key) are used to create the Kvu (Volume Unique key), but this step is not reversable (AESG)

But if the idea is to check the correctness of the Kvu, another possibility exists using the TKF (Title Key File). The last entry of this file is the TKF MAC:

This field stores the CMAC value of the data ranging from the 0th to
the 2463rd byte of the Title Key File. The key for the CMAC calculation is the Volume Unique Key
(Kvu).

[tdent1138]

Originally Posted by HD Hell

Hi muslix64 - I'm one of those who thinks that you are doing this as a partisan attack on HD DVD. I suspect that you are going to stall on the Blu-Ray version of this.

Are you going to prove me wrong, or just continue to stall? I suspect you could have the Blu-Ray version working in only a couple of days given the work you have already done here.

It's not fair that you attack only one format - if you are true to what you say you are, you would have already released a Blu-Ray version of this program by now...

Color me skeptical of your true motives at the moment.

I'd be more likely to guess he works for the HD-DVD group in an effort to spur sales.

Thanks Muslix64.

It may be that we have to wait for a stand alone BR drive that can be accessed by an operating system before that get's worked around like HD DVD now is.

EDIT: If this is considered off-topic, I am sorry. I'll delete if requested.

[trueimage]

anyone put together a howto yet? i have training day, but I didn't see the key posted here, so I'll try to find it myself...