AACS Keys - A program revealing all AACS Keys needed to decrypt (HD DVD and Blu-ray)

[lchiu7]

I am still using aacekeys but this is for my older BD titles and my entire HD-DVD collection which I am ripping to AVCHD format. But if folks post keys MKBV16 and above and I have that title I presume I can just put that key into the config.db and then dumphd can use it?

[spock2000]

That is correct as long as the volume unique key matches the region of the Blu ray disc you are trying to decypt. Then Dumphd will decrypt and rip it to your hard drive. By the way, new BD+ protection such as the movie Avatar won't work.

[_akmal_]

Hi, i have question about aacskeys implementation.
In authType == AACSAUTH mode, when it needed to read volume id of media, for prerecorded(read-only media) it just read volume id, but when for recordable(rewritable media) it also reads bn(binding nonce?). So my question is why? I read spec(AACS_Common_cryp...) but there is nothing about reading binding nonce to get volume id, where you get this info?

P.S. sorry for my english.

[KenD00]

Originally Posted by _akmal_

but when for recordable(rewritable media) it also reads bn(binding nonce?).

Not also, but instead . Recordables don't have a Volume ID. If you compare the decryption process of prerecorded and recordable media you can see that the Volume ID and Binding Nonce actually fit the same purpose and are used in the same manner. For prerecorded media you use the Volume ID to calculate the Volume Unique Key in the same way like you use the Binding Nonce to calculate the Protected Area Key for recordable media. The VUK and PAK's are then used in the same way to calculate the Unit Keys. Just take a look at the description of the decryption process in the prerecorded and recordable books.

[_akmal_]

thanks alot KenD00!
I compared content decrypting procedure for prerecorded and recordable media, and understood that Binding Nonce and Volume ID is used for same purpose. But one thing is not clear to me, how to get Binding Nonce(volume id is simple, after we get bus_key, we simply call for function to read volume id).
In AACS_Common... book, i find procedure to read binding nonce from media, but we must send to it some LBA, so what LBA we must send? I think "For BD-R / RE, the
Binding Nonce shall be stored in the User Control Data associated with the first logical Sector of the CPS Unit
Key File and shall be non-zero value.", am i right?

[KenD00]

Yes, you have to send the starting LBA of the corresponding Unit_Key_RW.inf file.

[_akmal_]

Hi KenD00, now i\'m learning MKB processing part of the aacskeys programm, and have some questions. Before finding appropriate Subset-Difference Record value via
if ((u_mask == device_key_u_mask) && (v_mask == device_key_v_mask))
but before this we must check this condition, or not?
((Dnode & mu ) == (uv & mu)) and ((Dnode & mv) != (uv & mv))
(i get it from aacs_common...)
where i must get Dnode(from Subset-Difference index record?).

btw, i also want to know, is it possible to know protection type of media, e.g. BD+, AACS or no protection?

Thanks, alot! Sorry for my english.

[_akmal_]

3.2.3 Storing Device Keys
Each device is given its Device Keys and a 31-bit number d called the device number. For each Device Key,
there is an associated number denoted the path number, and the “u” bit mask, mu, and the “v” bit mask, mv.

...

3.2.4 Calculation of Media Key
It finds the appropriate stored
Device Key as follows: assuming the Explicit Subset-Difference Record value is uv, mu, and mv, and the stored
Device Key has uv’, m’u, and m’v, the appropriate Device Key is the one that meets the following condition:
(mu == m’u) and ((uv & m’v) == (uv’ & m’v))

it is from aacs_common....
where i can find device\'s m\'v, m\'u and uv\'?

[KenD00]

btw, i also want to know, is it possible to know protection type of media, e.g. BD+, AACS or no protection?

For AACS there are two ways to figure that out, the quick and easy way and the proper way . aacskeys actually uses both but it only displays a warning if the proper way says it's not encrypted. The easy way is to check if the AACS directoy is present and maybe contains some files like the MKB. The correct way would be to read the AACS Feature Descriptor and check if it's enabled (aacskeys does this after querying the drive for its firmware version).

The presence of BD+ seems to be determined by the presence of the BDSVM directory (and maybe the 3 VM files inside it) only, but i don't know that much about BD+.


About the Subset Difference algorithm you are asking the wrong guy . I never really understood how it works and im afraid i already forgot the part i did understand . Afaik we don't have the uv number of the device keys but just brute force all possible values but i'm really not sure about this, i'm afraid you have to look at the code and figure that out yourself.

[_akmal_]

somebody tested the program on the HD DVD or DVD media with AACS protection? What was the results?

[neXyon]

Hi!

[EDIT: Ahh, I just read some where, that currently only MKB up to v16 work, right? :-/]

I've installed the patched firmware version 1.03 on my GGC-H20L and it seems to work (I get some info after the sg_raw commands), but when I try to use aacskeys with the last 16 bytes of output I get still:

% aacskeys /media/cd XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
aacskeys 0.4.0 by arnezami, KenD00

MKBv: 17
Could not find a Processing Key or Device Key resulting in the Media Key.
...


ERROR: PROCESSMKB, errnr: -3

Any hints, why it doesn't work?

Regards

[neXyon]

Okay, it doesn't seem to be a MKBv17 problem, a MKBv14 disk also doesn't work.

[Rinse&Repeeat]

I'm having a similar problem. using the DumpHD GUI

DumpHD 0.61 by KenD00

Opening Key Data File... OK
Initializing AACS... OK
Loading aacskeys library... OK
aacskeys library 0.4.0 by arnezami, KenD00
Loading BDVM... OK
BDVM 0.1.5

Initializing source... 
Disc type found: Blu-Ray BDMV
Collecting input files...
Source initialized
Identifying disc... OK
DiscID : ---------
Searching disc in key database...
Disc not found in key database
Retrieving keys from source... 
aacskeys 0.4.0 by arnezami, KenD00

Current path:                   -----

MKBv:                           12
Could not find a Processing Key or Device Key resulting in the Media Key.
Possible key tried:             -----
Possible key tried:             -----
Possible key tried:             -----
Possible key tried:             -----
Possible key tried:             -----
Possible key tried:             -----


ERROR: PROCESSMKB, errnr: -3


aacskeys ERROR: PROCESSMKB, errnr: -3
Failed retrieving keys from source

I read all the read me files, got OK's on every thing. The MKBv is 12 as you can see. I was understanding that this program could do MKBv 17.. or higher?

I removed a lot of the key information I didn't want to take a chance on breaking a rule in my first post.
Thanks for all the great work. If only I knew what I was doing..

[pynux]

only mkbv 1 to 10 are in aacskeys
you want to decrypt mkbv >10
if you want to decrypt mkbv >10 add keys in ProcessingKeys.txt (only if you have this key , only makemkv / dvdfab / anydvd and legal software have this key ...)

[hoppel118]

Hey guys,

when I compile "aacskeys-0.4.0c" I get the following error:

make
==== Building aacskeys ====
ioctl.cpp
src/ioctl.cpp: In constructor ‘Drive::Drive()’:
src/ioctl.cpp:12:61: warning: converting to non-pointer type ‘int’ from NULL
mmc.cpp
aacs_ecdsa.cpp
cmac_aes.cpp
aacs_aes.cpp
aacskeys.cpp
cmac.cpp
Linking aacskeys
==== Building libaacskeys ====
ioctl.cpp
src/ioctl.cpp: In constructor ‘Drive::Drive()’:
src/ioctl.cpp:12:61: warning: converting to non-pointer type ‘int’ from NULL
mmc.cpp
aacs_ecdsa.cpp
cmac_aes.cpp
aacs_aes.cpp
aacskeys.cpp
In file included from src/aacskeys.cpp:33:0:
src/aacskeys.h:8:17: fatal error: jni.h: Datei oder Verzeichnis nicht gefunden
compilation terminated.
make[1]: *** [obj/linux/ReleaseLib/aacskeys.o] Fehler 1
make: *** [libaacskeys] Fehler 2

If I change the JDK_INCLUDE-path in "premake.lua" to the path where the jni.h is located (/usr/lib/jvm/java-6-openjdk/include/) I get get the following error:

==== Regenerating Makefiles ====
make: premake: Kommando nicht gefunden
make: *** [Makefile] Fehler 127

Where is the problem? What is wrong?

----------------------------------------------------------------------
EDIT:

Ok, I got it. Had to install sun-java6-jdk from a special rep. and activate it under ubuntu 11.04.
----------------------------------------------------------------------

Greetings

Hoppel

[Wild Penquin]

Btw. just noting there are some new MKB keys at the Japanese site. Did someone already test them? I only have a few MKBv19 and some MKBv17 disks, they work fine....

[noodle1]

Originally Posted by Wild Penquin

Btw. just noting there are some new MKB keys at the Japanese site. Did someone already test them? I only have a few MKBv19 and some MKBv17 disks, they work fine....

Thanks! I hadn't seen that upload.

I've only got discs up to MKBv19, so I can't vouch for the last 2 keys either. The lower ones work on all of the discs I wasn't able to decrypt yet though.

[spock2000]

@ Wild Penquin,
Thanks for the link man! I just tested 2 movies Salt(Mkbv19) and Thor(Mkbv23). That last movie thor works with the last Processing Device Key on the list.

[spock2000]

Check this out!

spock-desktop aacskeys-0.4.0c # aacskeys -v /media/SOURCE_CODE
aacskeys 0.4.0 by arnezami, KenD00

Current path: /bin/aacskeys-0.4.0c

MKBv: 25
Processing key: C32238976FF44A51E2D33553CFE85772
Encrypted C-value: 21453D416FAC679D0B5785C35506F045
Corresponding uv: 00000384

Decrypted C-value: 0CD5953716C906557AA362D5EC030855
Media key: 0CD5953716C906557AA362D5EC030BD1

Encrypted verification data: 50B076C4E6A45575263D47D488138839
Decr verif data should be: 0123456789ABCDEF
Decrypted verification data: 0123456789ABCDEF3BD1C55692D74042

Drive FW info: YL05
AACS Version: 01
Number of concurrent AGIDs: 1
Supports BN generation: YES
BN Block Count: 1
Inserted medium AACS protected: YES

AGID: 00

Volume ID (AACSBYPASS): EF0627C1BE85BF658399F665B67C45B4

Volume Unique Key: 8141810DCD755C64F38200D2393990EB
Unit Key File Hash (Disc ID): 168106D53C544B57395FCE6CD3EF8D0B5CC97FA6

Encrypted Unit Key 1: 9E0446F068D84C6799B771A009440777
Encrypted Unit Key 2: A6BEEDE353622F48425602DABB570A50
Encrypted Unit Key 3: 08F66271FEC236E8FEAC58B821003D4C
Encrypted Unit Key 4: A053961713EC96FD7A64F82B59CD7615

Decrypted Unit Key 1: 947573F10C07E3C2AC45C12B04A3512E
Decrypted Unit Key 2: 7B7A09E9451E320B0F5EAE899DE0E7EB
Decrypted Unit Key 3: 752E9F700DB971D1FE73CF44B092CDB0
Decrypted Unit Key 4: 8841D33A4FD57589A827CE16AC343125

[jyavenard]

Following an attempt to play a BD disk (Pink Floyd The Dark Side of the moon)

Any attempts to read another disk is now failing with an error "The given Host Certficate / Private Key has been revoked by your drive."

aacskey returns the same errors.

Thanks in advance
JY