BackupHDDVD, a tool to decrypt AACS protected movies - Page 32

13th January 2007, 01:49

deleted

13th January 2007, 01:54

Quote:

Originally Posted by blutach

Regarding LordSloth's link: I can not get it to load at all. I am loath to issue strikes until I can determine the content for myself.

I couldn't get the link working the first time either, but hitting the refresh button a couple of times made the site load.
The only contents of the link is the text I quoted above, which are suppoed to be used in Google to find decimal numbers.

Janvitos · 13th January 2007, 02:06

I just got my hands on the movie Serenity from a friends, i will update you with results (if any).

luders · 13th January 2007, 02:09

I have Serenity... Trying to figure out how to try it. If anyone wants to help with the .cfg file setup I should be using, hit me.

Janvitos · 13th January 2007, 02:18

I can confirm the following value "EF21329F7D838D9A7056882DBF665CD5" to be in WinDVD memory after playback of the movie "Serenity".

Will continue to research this and update you with results.

luders · 13th January 2007, 02:24

So this so far.....

0000000000000000000000000000000000000000=Serenity |T|MM/DD/YY|2-EF21329F7D838D9A7056882DBF665CD5

Janvitos · 13th January 2007, 02:27

Luders, replace the 0s with the SHA1 of the VTKF000.AACS file, which is "C8A57242AF4CB5C0D7848BDA10821F984DC656E0"

13th January 2007, 02:32

Quote:

Originally Posted by Janvitos

I can confirm the following value "EF21329F7D838D9A7056882DBF665CD5" to be in WinDVD memory after playback of the movie "Serenity".

Will continue to research this and update you with results.

If the above is the complete title key #2, then you only need to calculate the SHA1 hash value to put into the field 1 of TKDB.cfg file

[QUOTE]Field 1: SHA1 Hash of the VTKF000.AACS file on your HDDVD disk.

Next fields are pipe "|" delimited.

-Movie Title
-A variable number of Title key, pipe delimited

You have a key number followed by the key value like:

12-08A3DC61910280F2...

Key values are 128 bits long, so 16 bytes, or 32 hexadecimal characters long..[QUOTE]

Janvitos · 13th January 2007, 02:39

He-Man, how do you know this is key #2 ?

luders · 13th January 2007, 02:42

Hmmm I get a java error because I am using JRE 6 in vista. Might have to boot into xp to try this.

13th January 2007, 02:44

Quote:

Originally Posted by Janvitos

He-Man, how do you know this is key #2 ?

Because that's what LordSloth wrote in a previous post:

Quote:

Originally Posted by LordSloth

Serenity

It took me awhile to figure that out from the Reavers comment at the top...

Hope you have a copy.

Its the 2nd Title Key

LordSloth · 13th January 2007, 02:46

Now after I followed that crypted scavenger hunt and got the 2nd TK, I searched for the key in WinDVD's memory...and guess what I found...

The entire Title Key table decrypted!!!!

That's right....the next 16 bytes after the 2nd key is the 3rd key and so on...

Enjoy!

13th January 2007, 02:48

Quote:

Originally Posted by luders

So this so far.....

0000000000000000000000000000000000000000=Serenity |T|MM/DD/YY|2-EF21329F7D838D9A7056882DBF665CD5

Why do you have the MM/DD/YY filed in there?

I don't see this in the original TKDB.cfg file, only 4 fields:
1: hash value
2: title
3: title key number
4: title key in hex (128 bit)

13th January 2007, 02:51

Quote:

Originally Posted by LordSloth

Now after I followed that crypted scavenger hunt and got the 2nd TK, I searched for the key in WinDVD's memory...and guess what I found...

The entire Title Key table decrypted!!!!

That's right....the next 16 bytes after the 2nd key is the 3rd key and so on...

Enjoy!

How about the Volume Unique Key, is this in memory too?

Sy · 13th January 2007, 02:51

Quote:

Originally Posted by He-Man

Why do you have the MM/DD/YY filed in there?

I don't see this in the original TKDB.cfg file, only 4 fields:
1: hash value
2: title
3: title key number
4: title key in hex (128 bit)

That's the new structure in hdvdbackup 1.00 posted Jan 02

luders · 13th January 2007, 02:52

You must be using the first version of BackupHDDVD. The new one has the date field though it is ignored by the program.

Janvitos · 13th January 2007, 02:54

Alright, this is good news.
The key "EF21329F7D838D9A7056882DBF665CD5" is the 2nd key which decrypts the file UNILOGO.EVO from the movie Serenity. This is *CONFIRMED* and *WORKING*.

Here are all the keys for Serenity:

1-31325529846E19E90D88F414DA7D1661
2-EF21329F7D838D9A7056882DBF665CD5
3-46BE356597AD71BFFADEDA14FE335B64
4-8906E3E8B05EEC17E594E98D42C913FE
5-0F998F1C0C7FEB30381C01F135FBE8E9
6-97895F12C018845C9CDCE95DFF4101DF
7-6C005DA9DAA97E168129753319D748A1
8-0608D2628A9FE952398B0FB432BDB6B1
9-A24471CC766C6E7F7F56DB560CCD31E5
10-6EC977757A9E8AC378CC680770874E33
11-55962EA8084BF5135CB2ED5A5E795233

Here are the keys for KingKong:

1-7D743D3C92652CC16B66D9CB87F6D132
2-70B71C6E767E213AEB7456985BAAD8A4
3-4BC362995030035312A5B6030D76C817
4-A019B5101E904A700A44F056B7EB3579
5-896AB02D3D77554EABCE3CCE931DA39D
6-BEC07637E9C4EFA1F70FED6891DB277B
7-1DC0D276F2C5B9FCFDE1414C5002BAAB
8-BC7EB577D1936818AEB9241F024DE681

To find these keys, my best advice would be to search your memory for "VPLST000.XPL" and they will be near one of the instances of it.

Now we have to find the volume keys for a lot less trouble.

Jerky_san · 13th January 2007, 02:56

Yes won't we need the first version of the decryption to use a title key? Since the newest is for volumes? And I must say very good work on finding the key.. If the table has been reveled surely the volume key is with it..

LordSloth · 13th January 2007, 02:57

Volume Unique keys are located

+0x13C0 after the 2nd title key location

Janvitos · 13th January 2007, 02:59

LordSoth i dont have the same addresses, can you tell me exactly where the volume unique key is ?

13th January 2007, 01:49	#621 \| Link
He-Man Guest Posts: n/a	deleted Last edited by He-Man; 13th January 2007 at 12:57.

13th January 2007, 02:54	#637 \| Link
Janvitos Registered User Join Date: Jan 2007 Posts: 55	Alright, this is good news. The key "EF21329F7D838D9A7056882DBF665CD5" is the 2nd key which decrypts the file UNILOGO.EVO from the movie Serenity. This is CONFIRMED and WORKING. Here are all the keys for Serenity: 1-31325529846E19E90D88F414DA7D1661 2-EF21329F7D838D9A7056882DBF665CD5 3-46BE356597AD71BFFADEDA14FE335B64 4-8906E3E8B05EEC17E594E98D42C913FE 5-0F998F1C0C7FEB30381C01F135FBE8E9 6-97895F12C018845C9CDCE95DFF4101DF 7-6C005DA9DAA97E168129753319D748A1 8-0608D2628A9FE952398B0FB432BDB6B1 9-A24471CC766C6E7F7F56DB560CCD31E5 10-6EC977757A9E8AC378CC680770874E33 11-55962EA8084BF5135CB2ED5A5E795233 Here are the keys for KingKong: 1-7D743D3C92652CC16B66D9CB87F6D132 2-70B71C6E767E213AEB7456985BAAD8A4 3-4BC362995030035312A5B6030D76C817 4-A019B5101E904A700A44F056B7EB3579 5-896AB02D3D77554EABCE3CCE931DA39D 6-BEC07637E9C4EFA1F70FED6891DB277B 7-1DC0D276F2C5B9FCFDE1414C5002BAAB 8-BC7EB577D1936818AEB9241F024DE681 To find these keys, my best advice would be to search your memory for "VPLST000.XPL" and they will be near one of the instances of it. Now we have to find the volume keys for a lot less trouble. Last edited by Janvitos; 13th January 2007 at 02:56.

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

13th January 2007, 02:06	#623 \| Link
Janvitos Registered User Join Date: Jan 2007 Posts: 55	I just got my hands on the movie Serenity from a friends, i will update you with results (if any).

13th January 2007, 02:09	#624 \| Link
luders Registered User Join Date: Sep 2002 Posts: 60	I have Serenity... Trying to figure out how to try it. If anyone wants to help with the .cfg file setup I should be using, hit me.

13th January 2007, 02:18	#625 \| Link
Janvitos Registered User Join Date: Jan 2007 Posts: 55	I can confirm the following value "EF21329F7D838D9A7056882DBF665CD5" to be in WinDVD memory after playback of the movie "Serenity". Will continue to research this and update you with results.

13th January 2007, 02:24	#626 \| Link
luders Registered User Join Date: Sep 2002 Posts: 60	So this so far..... 0000000000000000000000000000000000000000=Serenity \|T\|MM/DD/YY\|2-EF21329F7D838D9A7056882DBF665CD5

13th January 2007, 02:27	#627 \| Link
Janvitos Registered User Join Date: Jan 2007 Posts: 55	Luders, replace the 0s with the SHA1 of the VTKF000.AACS file, which is "C8A57242AF4CB5C0D7848BDA10821F984DC656E0"

13th January 2007, 02:39	#629 \| Link
Janvitos Registered User Join Date: Jan 2007 Posts: 55	He-Man, how do you know this is key #2 ?

13th January 2007, 02:42	#630 \| Link
luders Registered User Join Date: Sep 2002 Posts: 60	Hmmm I get a java error because I am using JRE 6 in vista. Might have to boot into xp to try this.

13th January 2007, 02:46	#632 \| Link
LordSloth Registered User Join Date: Jan 2007 Posts: 8	Now after I followed that crypted scavenger hunt and got the 2nd TK, I searched for the key in WinDVD's memory...and guess what I found... The entire Title Key table decrypted!!!! That's right....the next 16 bytes after the 2nd key is the 3rd key and so on... Enjoy!

13th January 2007, 02:52	#636 \| Link
luders Registered User Join Date: Sep 2002 Posts: 60	You must be using the first version of BackupHDDVD. The new one has the date field though it is ignored by the program.

13th January 2007, 02:56	#638 \| Link
Jerky_san Registered User Join Date: Apr 2005 Posts: 18	Yes won't we need the first version of the decryption to use a title key? Since the newest is for volumes? And I must say very good work on finding the key.. If the table has been reveled surely the volume key is with it..

13th January 2007, 02:57	#639 \| Link
LordSloth Registered User Join Date: Jan 2007 Posts: 8	Volume Unique keys are located +0x13C0 after the 2nd title key location

13th January 2007, 02:59	#640 \| Link
Janvitos Registered User Join Date: Jan 2007 Posts: 55	LordSoth i dont have the same addresses, can you tell me exactly where the volume unique key is ?