BackupHDDVD, a tool to decrypt AACS protected movies - Page 22

CiTay · 7th January 2007, 15:45

"heise online" spoke with Cyberlink on the "CES Unveiled" event and reports that they deny any AACS-key-in-memory issue in PowerDVD.

http://www.heise.de/newsticker/meldung/83289 (german) and a badly translated version

Abstract: PowerDVD doesn't store the keys in memory, therefore they can't be found there. Since there's no loophole, nothing needs to be fixed. If there was one, they would have to report it to AACS LA, and new HD DVDs would contain a new keyset that would make them unplayable with the compromised PowerDVD version. Furthermore, all 18 months, there is a mandatory change of keys.

noclip · 7th January 2007, 16:56

Quote:

Originally Posted by blutach

After discussion with Doom9, it has been decided to allow publication of decryption keys and logs. This in no way implies a relaxation of rule 6 - certain information still may not be published, such as IFO files (or extracts therefrom).

Regards

I hope this helps the process, but I imagine everyone will be too scared of WIPO/MPAA lawsuits to post them anyway.

Doom9 · 7th January 2007, 18:47

Quote:

Here is an interesting opinion upon the "motives" of Muslix64.
Insightful, to say the least.

Edit: Here is the link, sorry.
http://www.hdnowonline.com/Comment_Who_Is_Muslix.html

A few pages ago, that's one of the articles I was thinking of when I wrote that I'm fed up with unfounded speculation. I realize we've been too lax in the past and have allowed this forum, or especially this subforum, with this thread and the fairuse4wm thread before it, to become a gossip column. It's time to correct that mistake so let me remind you to stay on topic or face the full brunt of the forum rules. If you ain't got nothing backed up by facts to say, then you must not post here - I'm sure there are places out there for speculation and gossip but this is not the place.

Sureshot324 · 7th January 2007, 21:00

Can anyone who's read the AACS spec tell me how the HD-DVD drive transfers the title key to the monitor? The title key is decrypted in the drive so it must be unencrypted when it is sent to the monitor. What stops this unencrypted key from being intercepted? Does it go directly through hardware without going into system memory?

Doom9 · 7th January 2007, 21:04

I think you're mixing up a couple things here. AACS is decrypted on your machine.. between your GFX card and the monitor we then have HCDP which is something else entirely (and afaik, but I could be wrong here, no disc uses ICT yet so the connection doesn't necessarily have to be encrypted).

Jerky_san · 7th January 2007, 21:58

So.. if HD-DVD player companies claims its not in memory. If you take their comments with something more then a grain of salt what does it leave you?

1. Registers
2. Perhaps the heap? or swap memory on the hard drive
3. What about the video card memory? Couldn't it be possible to use the video card as a storage place? Mainly since it seems Vista is more toward using the video card then any windows platform.
4. Where else? I'm a programmer but I can't think of many other places..

We as a group need to start at one end of the rope and slowly climb up the hill knocking out each place where it could perhaps be. Where ever it is it has to be the for the entirety of the movie shouldn't it? Since you have to decrypt each key as it comes and I doubt they left 1 key to protect a whole feature. Thus it would perhaps call on the key before each section comes up for decryption and will have it ready.

hvatum · 7th January 2007, 21:59

Quote:

Originally Posted by Merlin7777

Here is an interesting opinion upon the "motives" of Muslix64.
Insightful, to say the least.

Edit: Here is the link, sorry.
http://www.hdnowonline.com/Comment_Who_Is_Muslix.html

Insightful? More like a bunch of conspiracy mongering and unfounded gossip. Try using your critical thinking skills: He used Java, Sun uses Java, so he MUST be working for Sun! I mean, it's not like there is anyone else who uses Java except for Sun. Seriously, it's not like there's over 100,000 projects on sourceforge.net written in Java, and it's not like Java is a good langauge for cross-platform development, obviously this guy must be working for Sun!

Honestly, if Sun were actually behind this why would they have it written in a language which would obviously lead back to them. Doesn't make any sense, this is far too risky given the possible repurcussions for their entire corporation, which cannot afford any kind of financial loss right now. Secondly, they don't really stand to gain very much if Blu-Ray wins, Java is an open platform, that's why it was chosen, not because it's profitable for Sun.

Secondly, the "it's mueslix son," um, NO. Very few actual Germans are going to write Mueslix if they can't use an Umlaut, because it looks dumb. Also they tend to be lazy, in online chat with Germans I have NEVER not ONCE seen a German type a "ue" or "ae" in place of a "ü" or "ä." The only person who would do that is an AMERICAN writing for their GERMAN class. If anything this strongly suggests he is a European, and shows how ignorant that poster on hdnowonlinefanboys.com is.

"4) As a defence, he claims to only own an HD DVD player, which would indicate to most that he is an exclusive supporter of the HD DVD format. Yet he releases a so-called "tool" like this, and publicises it in a big way, knowing full well the damage that it could cause the format."

Come on, this site is not even pretending to be unbiased. It's equally possible that he happens to have an HD-DVD drive because it's the cheapest way of getting a next generation HD-Drive for your computer right now.

I'm not going to bother tearing down the other points on that HDnow site, suffice it to say that whole article is a farce. Please stop posting links to it, first of all it makes you look dumb, secondly it distracts from the issue at hand...

PS. CSS was broken by a 16 year old Norwegian kid.

hvatum · 7th January 2007, 22:19

Quote:

Originally Posted by Jerky_san

So.. if HD-DVD player companies claims its not in memory. If you take their comments with something more then a grain of salt what does it leave you?

1. Registers
2. Perhaps the heap? or swap memory on the hard drive
3. What about the video card memory? Couldn't it be possible to use the video card as a storage place? Mainly since it seems Vista is more toward using the video card then any windows platform.
4. Where else? I'm a programmer but I can't think of many other places..

We as a group need to start at one end of the rope and slowly climb up the hill knocking out each place where it could perhaps be. Where ever it is it has to be the for the entirety of the movie shouldn't it? Since you have to decrypt each key as it comes and I doubt they left 1 key to protect a whole feature. Thus it would perhaps call on the key before each section comes up for decryption and will have it ready.

I just called Cyberlink R&D about this. And I must say, there is absolutely no way Muslix could have gotten the keys from WinDVD.

This is for one very simple reason: The keys are stored Cyberlink's new patented "MAGIC MEMORY." Yes, instead of using any physical method of saving data (Memory, Magnetic Hard Drive, CPU Register) they have avoided any security issues by storing the keys in a new super-secret memory which only WinDVD can access. When the operating system or any other process tries to access this memory the data there magically dissapears, and then re-appears when WinDVD needs it. Pretty cool, eh?

The data is moved around by a bunch of DRM gremlins, who live inside of your computer. :P

VistaVick · 7th January 2007, 22:29

Magic Memory? Sounds pretty lame, not cool.

blutach · 7th January 2007, 22:38

Quote:

Originally Posted by hvatum

Insightful? More like a bunch of conspiracy mongering and unfounded gossip. Try using your critical thinking skills: He used Java, Sun uses Java, so he MUST be working for Sun! I mean, it's not like there is anyone else who uses Java except for Sun. Seriously, it's not like there's over 100,000 projects on sourceforge.net written in Java, and it's not like Java is a good langauge for cross-platform development, obviously this guy must be working for Sun!

Honestly, if Sun were actually behind this why would they have it written in a language which would obviously lead back to them. Doesn't make any sense, this is far too risky given the possible repurcussions for their entire corporation, which cannot afford any kind of financial loss right now. Secondly, they don't really stand to gain very much if Blu-Ray wins, Java is an open platform, that's why it was chosen, not because it's profitable for Sun.

Secondly, the "it's mueslix son," um, NO. Very few actual Germans are going to write Mueslix if they can't use an Umlaut, because it looks dumb. Also they tend to be lazy, in online chat with Germans I have NEVER not ONCE seen a German type a "ue" or "ae" in place of a "ü" or "ä." The only person who would do that is an AMERICAN writing for their GERMAN class. If anything this strongly suggests he is a European, and shows how ignorant that poster on hdnowonlinefanboys.com is.

"4) As a defence, he claims to only own an HD DVD player, which would indicate to most that he is an exclusive supporter of the HD DVD format. Yet he releases a so-called "tool" like this, and publicises it in a big way, knowing full well the damage that it could cause the format."

Come on, this site is not even pretending to be unbiased. It's equally possible that he happens to have an HD-DVD drive because it's the cheapest way of getting a next generation HD-Drive for your computer right now.

I'm not going to bother tearing down the other points on that HDnow site, suffice it to say that whole article is a farce. Please stop posting links to it, first of all it makes you look dumb, secondly it distracts from the issue at hand...

PS. CSS was broken by a 16 year old Norwegian kid.

Quote:

Originally Posted by VistaVick

Magic Memory? Sounds pretty lame, not cool.

Please refer to Doom9's post 424.

These posts simply perpetuate the discussion which is way off topic, which I have warned about many times before. It is clear my warnings have not been heeded.

Please confine your posts to BackupHDDVD and not about Muslix. Doom9 is not a chatline.

Strikes issued. Off post remarks will be struck in future.

Regards

Jerky_san · 7th January 2007, 22:40

hmm if this "magic memory" is true then I wonder if it acts like a virus.. You know the ones when you attempt to delete them or go into the folder where you virus scan say they are they move to a different folder.. If this is true then its going to be a very hard climb up the mountain. Although I'm curious if anyone has been playing a movie and did a memory dump at the same time while still playing the movie? Does it keep playing? or Does it stop due to the key was just transfer to a different area. And how to does the program know where the transfer went? It would have to keep track of it somehow..

hvatum · 7th January 2007, 23:28

Quote:

Originally Posted by Jerky_san

hmm if this "magic memory" is true then I wonder if it acts like a virus.. You know the ones when you attempt to delete them or go into the folder where you virus scan say they are they move to a different folder.. If this is true then its going to be a very hard climb up the mountain. Although I'm curious if anyone has been playing a movie and did a memory dump at the same time while still playing the movie? Does it keep playing? or Does it stop due to the key was just transfer to a different area. And how to does the program know where the transfer went? It would have to keep track of it somehow..

hehe, as far as I know there is not actually any such thing as "Magic Memory." I was just satrizing Cyberlink, if the values are stored somewhere, then they must also be able to be accessed. Cyberlink's argument that it "could not possibly" come from WinDVD is a red herring, because Muslix never stated he got the values from memory .

Jerky_san · 7th January 2007, 23:33

Quote:

Originally Posted by hvatum

hehe, as far as I know there is not actually any such thing as "Magic Memory." I was just satrizing Cyberlink, if the values are stored somewhere, then they must also be able to be accessed. Cyberlink's argument that it "could not possibly" come from WinDVD is a red herring, because Muslix never stated he got the values from memory .

Yeah thats the kinda stuff blutach is talking about..

anyway

Quote:

Originally Posted by qbyter

Btw: If HDDVDbackup works as it should and according to the above, it should set KEY_VF to 00b after decryption, otherwise a player would still asume the EVOB needs decryption - does hddvdbackup do that?? I´m no Java guy...

Well running through all the src I don't see where anything is set to that but it might be in a some part of the decryption that inside of the java stuff....

Lange · 7th January 2007, 23:40

Finally i can post,

I'm not really into file hashes e.d. but i thought it is possible to get the original string back from a hash by the use of rainbow tables?

Same thing is done with MD5 hashed passwords on websites...

still offcourse Muslix64 has to have posted the original hashes from the keys

8th January 2007, 00:56

Quote:

Originally Posted by Lange

Finally i can post,

I'm not really into file hashes e.d. but i thought it is possible to get the original string back from a hash by the use of rainbow tables?

Same thing is done with MD5 hashed passwords on websites...

still offcourse Muslix64 has to have posted the original hashes from the keys

Read the FAQ.txt file in backupHDDVD.zip!
The hash is not from any keys but it is the SHA1 Hash of the VTKF000.AACS file on your HDDVD disk.

Quote:

Originally Posted by FAQ.txt in backupHDDVD.zip

-What is the TKDB.cfg file?

This is the Title key Database file. It holds the decryption keys for the movies.

-What is the format of this file?

Field 1: SHA1 Hash of the VTKF000.AACS file on your HDDVD disk.

Borbus · 8th January 2007, 01:13

Since title keys are now allowed, here is one that is supposed to be for "The Hulk" HD-DVD:

554E4956455253414C5F48442D445644

It isn't necessarily for the feature, it could be for some of the other things like the menu etc. I haven't got a HD-DVD drive so I can't try it.

CiTay · 8th January 2007, 01:21

Quote:

Originally Posted by hvatum

Cyberlink's argument that it "could not possibly" come from WinDVD is a red herring, because Muslix never stated he got the values from memory .

Please remind Cyberlink to stop impersonating InterVideo (the makers of WinDVD), and also remind them that they are the makers of PowerDVD instead

He also stated that he found a key in memory: "I was very surprise to realize that the title key is there, in memory!"

cyber1 · 8th January 2007, 01:21

Quote:

Originally Posted by Borbus

Since title keys are now allowed, here is one that is supposed to be for "The Hulk" HD-DVD:

554E4956455253414C5F48442D445644

It isn't necessarily for the feature, it could be for some of the other things like the menu etc. I haven't got a HD-DVD drive so I can't try it.

Read the AACS spec first.
That's a Directory Key, DKF.DK.

The only keys that is interesting is Titlekeys or Mediakeys, only these types will work with backupHDDVD.

SvT · 8th January 2007, 01:28

Quote:

Originally Posted by Borbus

Since title keys are now allowed, here is one that is supposed to be for "The Hulk" HD-DVD:

554E4956455253414C5F48442D445644

It isn't necessarily for the feature, it could be for some of the other things like the menu etc. I haven't got a HD-DVD drive so I can't try it.

This value is the ASCII code for "UNIVERSAL_HD-DVD".

Doesn't look like a title key to me

Borbus · 8th January 2007, 01:37

Yes, you're right it is a directory key. I haven't read the spec but I just thought I'd help. It came from a text file which Universal probably accidentally put on The Hulk HD-DVD. A bit more:

// Directory Settings
[COMMON]
IN.ROOT=G:\TheHulk\TheHulk
OUT.ROOT=G:\AACS_output\TheHulk

// Volume ID Setting
[VID]
VID.UNQ_NO=271020061204020202020202

// Title Key Setting
[TKF]
TKF.BIN_FILE=<RANDOM>

// Title Key Setting
[DKF]
DKF.DK=554E4956455253414C5F48442D445644

// Managed Copy Settings
[MCM]
MCM.V-ISAN=0000-0001-4F66-0000-F-0000-0001-R
MCM.SERVER_URI=http://smc.universalhomentertainment.com/

So, the title key was random, damn.

7th January 2007, 15:45	#421 \| Link
CiTay Registered User Join Date: Jun 2003 Posts: 46	"heise online" spoke with Cyberlink on the "CES Unveiled" event and reports that they deny any AACS-key-in-memory issue in PowerDVD. http://www.heise.de/newsticker/meldung/83289 (german) and a badly translated version Abstract: PowerDVD doesn't store the keys in memory, therefore they can't be found there. Since there's no loophole, nothing needs to be fixed. If there was one, they would have to report it to AACS LA, and new HD DVDs would contain a new keyset that would make them unplayable with the compromised PowerDVD version. Furthermore, all 18 months, there is a mandatory change of keys. Last edited by CiTay; 7th January 2007 at 15:52.

7th January 2007, 21:04	#425 \| Link
Doom9 clueless n00b Join Date: Oct 2001 Location: somewhere over the rainbow Posts: 10,579	I think you're mixing up a couple things here. AACS is decrypted on your machine.. between your GFX card and the monitor we then have HCDP which is something else entirely (and afaik, but I could be wrong here, no disc uses ICT yet so the connection doesn't necessarily have to be encrypted). __________________ For the web's most comprehensive collection of DVD backup guides go to www.doom9.org

7th January 2007, 21:00	#424 \| Link
Sureshot324 Registered User Join Date: Oct 2006 Posts: 2	Can anyone who's read the AACS spec tell me how the HD-DVD drive transfers the title key to the monitor? The title key is decrypted in the drive so it must be unencrypted when it is sent to the monitor. What stops this unencrypted key from being intercepted? Does it go directly through hardware without going into system memory?

7th January 2007, 21:58	#426 \| Link
Jerky_san Registered User Join Date: Apr 2005 Posts: 18	So.. if HD-DVD player companies claims its not in memory. If you take their comments with something more then a grain of salt what does it leave you? 1. Registers 2. Perhaps the heap? or swap memory on the hard drive 3. What about the video card memory? Couldn't it be possible to use the video card as a storage place? Mainly since it seems Vista is more toward using the video card then any windows platform. 4. Where else? I'm a programmer but I can't think of many other places.. We as a group need to start at one end of the rope and slowly climb up the hill knocking out each place where it could perhaps be. Where ever it is it has to be the for the entirety of the movie shouldn't it? Since you have to decrypt each key as it comes and I doubt they left 1 key to protect a whole feature. Thus it would perhaps call on the key before each section comes up for decryption and will have it ready.

7th January 2007, 22:29	#429 \| Link
VistaVick Registered User Join Date: Jan 2007 Posts: 38	Magic Memory? Sounds pretty lame, not cool.

7th January 2007, 22:40	#431 \| Link
Jerky_san Registered User Join Date: Apr 2005 Posts: 18	hmm if this "magic memory" is true then I wonder if it acts like a virus.. You know the ones when you attempt to delete them or go into the folder where you virus scan say they are they move to a different folder.. If this is true then its going to be a very hard climb up the mountain. Although I'm curious if anyone has been playing a movie and did a memory dump at the same time while still playing the movie? Does it keep playing? or Does it stop due to the key was just transfer to a different area. And how to does the program know where the transfer went? It would have to keep track of it somehow..

7th January 2007, 23:40	#434 \| Link
Lange Registered User Join Date: Jan 2007 Posts: 1	Finally i can post, I'm not really into file hashes e.d. but i thought it is possible to get the original string back from a hash by the use of rainbow tables? Same thing is done with MD5 hashed passwords on websites... still offcourse Muslix64 has to have posted the original hashes from the keys

8th January 2007, 01:13	#436 \| Link
Borbus Registered User Join Date: Sep 2006 Posts: 52	Since title keys are now allowed, here is one that is supposed to be for "The Hulk" HD-DVD: 554E4956455253414C5F48442D445644 It isn't necessarily for the feature, it could be for some of the other things like the menu etc. I haven't got a HD-DVD drive so I can't try it.

8th January 2007, 01:37	#440 \| Link
Borbus Registered User Join Date: Sep 2006 Posts: 52	Yes, you're right it is a directory key. I haven't read the spec but I just thought I'd help. It came from a text file which Universal probably accidentally put on The Hulk HD-DVD. A bit more: // Directory Settings [COMMON] IN.ROOT=G:\TheHulk\TheHulk OUT.ROOT=G:\AACS_output\TheHulk // Volume ID Setting [VID] VID.UNQ_NO=271020061204020202020202 // Title Key Setting [TKF] TKF.BIN_FILE=<RANDOM> // Title Key Setting [DKF] DKF.DK=554E4956455253414C5F48442D445644 // Managed Copy Settings [MCM] MCM.V-ISAN=0000-0001-4F66-0000-F-0000-0001-R MCM.SERVER_URI=http://smc.universalhomentertainment.com/ So, the title key was random, damn.