Finally handling BD+ (?)

[loo3aem3ON]

I've updated the documentation of the player status registers again using various patents and this posting by Pelican9.

I furthermore suggest to reverse engineer the java application as a short term solution. In the long run we need a fully functional BD-J interpreter + libraries.

[loo3aem3ON]

The logfile below shows in greater detail the communication between the java application and the content code:

// java code runs. It ...
// 1. writes PSR104 (set to 0x00000000)
// 2. writes PSR103 (set to 0xF1000000)
// 3. issues callback/event#0210 ?

// content code event#0210 handler called executing:
#004963 TRAP_DeviceAccess(1, 0, *) // read  PSR103 (== 0xF1000000)
#004964 TRAP_DeviceAccess(1, 0, *) // read  PSR103 (== 0xF1000000)
#004965 TRAP_DeviceAccess(2, 0, *) // read  PSR104 (== 0x00000000)
#004966 TRAP_DeviceAccess(2, 1, *) // write PSR104 (:= 0x00000001)
#004967 TRAP_DeviceAccess(2, 1, *) // write PSR104 (:= 0xFFFFFFFE)
#004968 TRAP_DeviceAccess(0, 1, *) // write PSR102 (:= 0x04000004) and start execution of java code (see below)

// java code runs. It ...
// 1. reads  PSR104
// 2. writes PSR103
// 3. issues callback/event#0210 ?

// content code event#0210 handler called executing:
#004970 TRAP_DeviceAccess(1, 0, *) // read  PSR103 (== 0x00004000)
#004971 TRAP_DeviceAccess(1, 0, *) // read  PSR103 (== 0x00004000)
#004972 TRAP_DeviceAccess(2, 1, *) // write PSR104 (:= 0x3EA9DAFF)
#004973 TRAP_DeviceAccess(0, 1, *) // write PSR102 (:= 0x04000008) and start execution of java code (see below)

// java code runs. It ...
// 1. reads  PSR104
// 2. writes PSR103
// 3. issues callback/event#0210 ?

// content code event#0210 handler called executing:
#004975 TRAP_DeviceAccess(1, 0, *) // read  PSR103 (== 0x00008000)
#004976 TRAP_DeviceAccess(1, 0, *) // read  PSR103 (== 0x00008000)
#004977 TRAP_DeviceAccess(2, 1, *) // write PSR104 (:= 0xB23259D5)
#004978 TRAP_DeviceAccess(0, 1, *) // write PSR102 (:= 0x0400000C) and start execution of java code (see below)

// java code runs. It ...
// 1. reads  PSR104
// 2. writes PSR103
// 3. issues callback/event#0210 ?

// content code event#0210 handler called executing:
#004980 TRAP_DeviceAccess(1, 0, *) // read  PSR103 (== 0x0000C000)
#004981 TRAP_DeviceAccess(1, 0, *) // read  PSR103 (== 0x0000C000)
#004982 TRAP_DeviceAccess(2, 1, *) // write PSR104 (:= 0x53B07B58)
#004983 TRAP_DeviceAccess(0, 1, *) // write PSR102 (:= 0x04000010) and start execution of java code (see below)

// java code runs. It ...
// 1. reads  PSR104
// 2. writes PSR103
// 3. issues callback/event#0210 ?

// content code event#0210 handler called executing:
#004985 TRAP_DeviceAccess(1, 0, *) // read  PSR103 (== 0x00010000)
#004986 TRAP_DeviceAccess(1, 0, *) // read  PSR103 (== 0x00010000)
#004987 TRAP_DeviceAccess(2, 1, *) // write PSR104 (:= 0x60FBC4BB)
#004988 TRAP_DeviceAccess(0, 1, *) // write PSR102 (:= 0x04000014) and start execution of java code (see below)

// java code runs. It ...
// 1. reads  PSR104
// 2. writes PSR103
// 3. issues callback/event#0210 ?

// content code event#0210 handler called executing:
#004990 TRAP_DeviceAccess(1, 0, *) // read  PSR103 (== 0x00014000)
#004991 TRAP_DeviceAccess(1, 0, *) // read  PSR103 (== 0x00014000)
#004992 TRAP_DeviceAccess(2, 0, *) // read  PSR104 (== 0x60FBC4BB)
#004993 TRAP_DeviceAccess(2, 1, *) // write PSR104 (:= 0x60FBC4BC)
#004994 TRAP_DeviceAccess(0, 1, *) // write PSR102 (:= 0x00000014) and start execution of java code (see below)

// java code runs. It ...
// 1. reads  PSR104
// 2. writes PSR104
// 3. writes PSR104 again
// 4. writes PSR103
// 5. issues callback/event#0210 ?

// content code event#0210 handler called executing:
#004996 TRAP_DeviceAccess(1, 0, *) // read  PSR103 (== 0x04014004)
#004997 TRAP_DeviceAccess(1, 0, *) // read  PSR103 (== 0x04014004)
#004998 TRAP_DeviceAccess(2, 0, *) // read  PSR104 (== 0xBC79595F)
#004999 TRAP_DeviceAccess(0, 1, *) // write PSR102 (:= 0x00004014) and start execution of java code (see below)

// java code runs. It ...
// 1. writes PSR104
// 2. writes PSR103
// 3. issues callback/event#0210 ?

// content code event#0210 handler called executing:
#005001 TRAP_DeviceAccess(1, 0, *) // read  PSR103 (== 0x04014008)
#005002 TRAP_DeviceAccess(1, 0, *) // read  PSR103 (== 0x04014008)
#005003 TRAP_DeviceAccess(2, 0, *) // read  PSR104 (== 0x97F05643)
#005004 TRAP_DeviceAccess(0, 1, *) // write PSR102 (:= 0x00008014) and start execution of java code (see below)

// java code runs. It ...
// 1. writes PSR104
// 2. writes PSR103
// 3. issues callback/event#0210 ?

// content code event#0210 handler called executing:
#005006 TRAP_DeviceAccess(1, 0, *) // read  PSR103 (== 0x0401400C)
#005007 TRAP_DeviceAccess(1, 0, *) // read  PSR103 (== 0x0401400C)
#005008 TRAP_DeviceAccess(2, 0, *) // read  PSR104 (:= 0x07A0ABF2)
#005009 TRAP_DeviceAccess(0, 1, *) // write PSR102 (:= 0x0000C014) and start execution of java code (see below)

// java code runs. It ...
// 1. writes PSR104
// 2. writes PSR103
// 3. issues callback/event#0210 ?

// content code event#0210 handler called executing:
#005011 TRAP_DeviceAccess(1, 0, *) // read  PSR103 (== 0x04014010)
#005012 TRAP_DeviceAccess(1, 0, *) // read  PSR103 (== 0x04014010)
#005013 TRAP_DeviceAccess(2, 0, *) // read  PSR104 (== 0xCC10F7C5) <-- last value the segment keys depend on
#005015 TRAP_DeviceAccess(2, 1, *) // write PSR104 (:= 0x10000000) <-- java code runs shortly afterwards ?! (no read/write access to PSRs)
#005016 TRAP_DeviceAccess(0, 1, *) // write PSR102 (:= 0x04010018) and start execution of java code (see below)

// java code runs. It ...
// 1. reads  PSR104
// 2. writes PSR103
// 3. issues callback/event#0210 ?

// content code event#0210 handler called executing:
#005018 TRAP_DeviceAccess(1, 0, *) // read  PSR103 (== 0x00018010)
#005019 TRAP_DeviceAccess(1, 0, *) // read  PSR103 (== 0x00018010)
#005020 TRAP_DeviceAccess(2, 1, *) // write PSR104 (:= 0x00000000)
#005021 TRAP_DeviceAccess(0, 1, *) // write PSR102 (:= 0x0201001A) and start execution of java code (see below)

// java code runs. It ...
// 1. reads  PSR104
// 2. writes PSR103
// 3. issues callback/event#0210 ?

// content code event#0210 handler called executing:
#005023 TRAP_DeviceAccess(1, 0, *) // read  PSR103 (== 0x0001A010)
#005024 TRAP_DeviceAccess(1, 0, *) // read  PSR103 (== 0x0001A010)
#005025 TRAP_DeviceAccess(2, 0, *) // read  PSR104 (== 0x00000000)
#005026 TRAP_DeviceAccess(2, 1, *) // write PSR104 (:= 0x00000001)
#005027 TRAP_DeviceAccess(0, 1, *) // write PSR102 (:= 0x0001001A) and start execution of java code (see below)

// java code runs. It ...
// 1. reads  PSR104
// 2. writes PSR104
// issues next event/callback?

Things i noticed:
- TRAP_ApplicationLayer(0, 1, *) starts the execution of the java code
- other calls of TRAP_ApplicationLayer seem to access the Player State Registers only
- java code still runs when TRAP_Finished is invoked (or TRAP_Finished calls some java functions as well?)
- it could be that some of the events are caused by the java application (see how the content code and the java code are active interchangeably -> synchronization?)
- some java opcodes are called which i couldn't find in my list eg. D2, DA, E2 (i've compared some of the first opcode descriptions with the handler code and i found no difference)

Note: between the TRAP_ApplicationLayer blocks TRAP_Finished is invoked so the content code is idle. I don't know how long the java code runs

Edit: i'm looking at this list. Maybe it's incomplete.

[loo3aem3ON]

I was able to show that the java code which is interacting with the content code in the above described manner is located on the same disc (as expected). I've uploaded the previously mentioned java archive here for analysis. The first access (setting of register PSR104 to zero) takes placed through the call at "com/macrovision/bdplus/c/a+58"

Sadly most of the function names have been obfuscated. You don't need any special disassembler because it's just normal java code.

[Rupan]

Originally Posted by loo3aem3ON

I was able to show that the java code which is interacting with the content code in the above described manner is located on the same disc (as expected). I've uploaded the previously mentioned java archive here for analysis. The first access (setting of register PSR104 to zero) takes placed through the call at "com/macrovision/bdplus/c/a+58"

Sadly most of the function names have been obfuscated. You don't need any special disassembler because it's just normal java code.

I have experience reverse engineering java binary classes. I don't have time to work on it today, but I will try to commit source classes to svn tomorrow.

EDIT: it looks like class c may be the entry point for everything else, as you describe. It references many of the other classes (BDClassLoaderException, BDPlusSocketException, Handshake, LibHandshakeException, a, e, f, g, i, k). I don't have specific details at this time, but class c opens files named 77771.jar and mk/MK.enc, both of which may well be of interest to have uploaded somewhere. Further, the Handshake class uses 00000.otf from the archive root somehow -- but I haven't analyzed Handshake in-depth yet. One of the smaller classes appears to act as a container for 4 32-bit words, whose use I do not yet understand. Also, there are references to "BD-J" in strings in at least one class.

EDIT2: exception handlers make analysis harder, but many of the classes do not use them. I will commit source for those without exception handling tomorrow.


EDIT3: We need to find package org.bluray.bdplus.*. jar 7770 directly imports classes from this package and will not build without it. 77771.jar and 77772.jar are referenced in several source files. I'm not sure what to make of this, but a string in Handshake seems to suggest that 00000.otf is a "font" file. Whether or not this is intended as indirection is unclear.

EDIT4: it turns out that 00000.otf really is a font ... specifically, an Open Type Font file (which is apparently the successor to TrueType). The font is Bitstream Vera Sans Mono release 1.10.

[loo3aem3ON]

Originally Posted by Rupan

EDIT3: We need to find package org.bluray.bdplus.*. jar 7770 directly imports classes from this package and will not build without it. 77771.jar and 77772.jar are referenced in several source files. I'm not sure what to make of this, but a string in Handshake seems to suggest that 00000.otf is a "font" file. Whether or not this is intended as indirection is unclear.

I've uploaded the JAR directory from the disc and the BDJ.JAR from the player here. Let me know if you need anything else. Thanks for looking into this.

[Rupan]

You can pick up jad to accelerate reverse engineering. Jad is free (as in beer) software that decompiles java bytecode. Yes, you heard me -- decompiles. No more guessing at pesky java opcodes... This software will produce java source code from bytecode, which is in many cases compilable out of the box.

http://www.kpdus.com/jad.html

It isn't perfect, but it sure beats poring over bytecode disassembly.

[loo3aem3ON]

I've extracted the BDJ.JAR and the 77770.jar into the same directory. But trying to run the code fails:

$ java com/macrovision/bdplus/Handshake
Exception in thread "main" java.lang.NoSuchMethodError: main

And indeed none of the jar files contains a class with a "main" function. How is the code executed? I noticed that the *.bdjo files in the BDJO directory are referencing the class files in the jar. That's the 07777.bdjo:

0000:0000 42 44 4a 4f 30 32 30 30 00 00 00 30 00 00 00 3e BDJO0200...0...>
0000:0010 00 00 00 5c 00 00 00 64 00 00 01 3a 00 00 01 3e ...\...d...:...>
0000:0020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0000:0030 00 00 00 0a 2a 2a 2a 2a 2a 1c 00 00 00 00 00 00 ....*****.......
0000:0040 00 1a 02 00 01 37 37 37 37 30 2a 2e 2a 00 00 00 .....77770*.*...
0000:0050 01 39 39 39 30 30 2a 2e 2a 00 00 00 00 00 00 04 .99900*.*.......
0000:0060 00 10 00 00 00 00 00 d2 02 00 01 10 7f ff 64 6c .......Ò.....ÿdl
0000:0070 77 77 00 00 00 00 00 64 00 00 00 00 10 00 00 01 ww.....d........
0000:0080 01 00 00 00 01 d0 00 0d 65 6e 67 09 42 44 53 74 .....Ð..eng.BDSt
0000:0090 75 62 58 6c 74 00 00 00 00 00 05 37 37 37 37 30 ubXlt......77770
0000:00a0 00 00 20 63 6f 6d 2e 6d 61 63 72 6f 76 69 73 69 .. com.macrovisi
0000:00b0 6f 6e 2e 62 64 70 6c 75 73 2e 48 61 6e 64 73 68 on.bdplus.Handsh
0000:00c0 61 6b 65 00 17 16 2d 42 44 2b 58 4c 45 54 3a 46 ake...-BD+XLET:F
0000:00d0 69 72 73 74 50 6c 61 79 58 6c 65 74 02 10 7f ff irstPlayXlet...ÿ
0000:00e0 64 6c 40 00 00 00 00 00 00 50 00 00 00 00 10 00 dl@......P......
0000:00f0 00 01 01 00 00 00 02 d0 00 11 65 6e 67 0d 46 69 .......Ð..eng.Fi
0000:0100 72 73 74 50 6c 61 79 58 6c 65 74 00 00 00 00 00 rstPlayXlet.....
0000:0110 05 39 39 39 30 30 00 00 1e 63 6f 6d 2e 62 79 64 .99900...com.byd
0000:0120 65 6c 75 78 65 2e 66 6f 78 2e 46 69 72 73 74 50 eluxe.fox.FirstP
0000:0130 6c 61 79 58 6c 65 74 00 00 00 00 00 00 00 00 08 layXlet.........
0000:0140 42 44 4d 56 2f 4a 41 52                         BDMV/JAR

Edit: BD-J introduction: link

[Rupan]

I've attached source code built using jad and edited by me for clarity and to compile. Some of the classes aren't fully fixed and the archive as a whole will not build, but it should give some idea of what is going on. It does appear that the jar includes more than bdplus code, so reversing all the classes may be a colossal waste of time. Better to understand the specific parts that do the bits that are interesting to us and reimplement them.

[KenD00]

That BD-J introduction is quite informative, thanks. As you probably have figured out yourself BD-J applications are applets and don't have a main method, they are controlled through the applet interface methods. So the entry point of the jar file is the Handshake class. That class name can be found in the bdjo file too, maybe this file contains the AMT the introduction mentions?

Running the applet won't get you far, you don't have the execution environment it requires. But this can be emulated, but i don't know how complicated that is. One big advantage is that everything is java, we have already our command interpreter (standard JRE) and we have our class library (provided by the player), we only need the player hardware. I have taken a very quick look at the BDJ.jar file, found the methods that access the BD+ PSR's. There are java methods that allow to read and write PSR's, these methods themselves call native methods which actually access the hardware. A good start for an emulator would be to extract all native methods and try to implement some of them. I will try to do the former when i have more time to get an overview.

[loo3aem3ON]

Thanks Rupan. I'll take a look at your work once the upload has been approved.

Originally Posted by KenD00

Running the applet won't get you far, you don't have the execution environment it requires. But this can be emulated, but i don't know how complicated that is.

I'm just playing around a bit to get a feeling of how it works. Maybe we can implement a simple environment to get this code running properly.

I've downloaded the Java Micro Edition "Personal Basis Profile 1.1 Reference Implementation (JSR 217)" from this site now. If you want to try this be careful to keep the directory structure and run the cvm like "./bin/cvm". If you only copy the binary (intel-i386 code btw) and run it you will get a pretty useless error message.

wikipedia has a few interesting details too:

Originally Posted by http://en.wikipedia.org/wiki/BD-J

BD-J, or Blu-ray Disc Java, is a specification supporting Java ME (specifically the Personal Basis Profile of the Connected Device Configuration or CDC) Xlets for advanced content on Blu-ray Disc and the Packaged Media profile of Globally Executable MHP (GEM).

Originally Posted by KenD00

I have taken a very quick look at the BDJ.jar file, found the methods that access the BD+ PSR's. There are java methods that allow to read and write PSR's, these methods themselves call native methods which actually access the hardware.

Yes these functions were my "entry point". I just followed the returns back to the com/macrovision/bdplus/c class

Originally Posted by KenD00

A good start for an emulator would be to extract all native methods and try to implement some of them. I will try to do the former when i have more time to get an overview.

I know the native code called by the setPSR() and getPSR() functions but i haven't studied the rest of the "interface" yet. It's probably a good idea to follow the "invokestatic" java instructions.

[Accident]

I took a glance at their implementation of RunNative, and most of which we already know.

uint32_t trap_RunNative(uint8_t *signature, uint32_t sigLen, uint8_t *code,
                        uint32_t codeLen)

Test of "signature" and "code" follow the regular "valid_ptr" tests, segLen should be 0x28 in length. codeLen fails if < 1. It then calls SHA on "code" (?) followed by ecdsa_verify, if that is ok it finally calls RunNative. What is peculiar is that there is a code-path that skips SHA and ecdsa_verify calls and directly calls RunNative.

RunNative itself is fairly boring, calls mkstemp("/tmp/run_native.XXXXXX"); write( , code, codeLen); chmod 0700; fork; execv / waitpid. The exit-code of the child process is eventually returned. RunNative itself blocks until script completes, although technically, scripts could easily put themselves in the background if so wanted. Scripts are run as player user, in this case root.

[Kraise]

Wow, I think that would work

[loo3aem3ON]

The Handshake between BD-J and BD+ involves AES but i haven't studied this in detail yet.

I found a stack trace:

	at sun.security.util.DerValue.init(Unknown Source)
	at sun.security.util.DerValue.<init>(Unknown Source)
	at com.cl.bdj.jar.BDJSecurityUtil.getPermRootCertDigest(Unknown Source)
	at com.cl.bdj.appmanager.BDJAppProxy.loadResources(Unknown Source)
	at com.cl.bdj.appmanager.BDJAppProxy.startBDJApp(Unknown Source)
	at com.cl.bdj.appmanager.BDJAppManager.runAutoStartApps(Unknown Source)
	at com.cl.bdj.appmanager.BDJAppManager.startTitle(Unknown Source)
	at com.cl.bdj.appmanager.BDJAppManager.initTitle(Unknown Source)
	at com.cl.bdj.main.BDJCFacade.initTitle(Unknown Source)

According to this execution starts in the com.cl.bdj.main.BDJCFacade class which then calls the application manager which then starts the BD-J Application Proxy which finally starts the application (which is marked as "Autostart").

All the code is inside the BDJ.jar you can download here

[loo3aem3ON]

It's my current understanding that the BD-J implementation consists of at least 3 major parts:

1. BD-J core implemented in java (vendor specific)
2. BD-J player interface (vendor specific) implemented in native code
3. common libraries implemented in java: javatv, GEM/MHP, ... (overview)

If we use all the jar packages from one vendor we would only have to implement the native interface. The interface is probably vendor specific too.

The source code of the virtual machine interpreter (Personal Basis Profile of the Connected Device Configuration) is available from the phoneme download page.

The undefined opcodes (eg. 0xDA) i saw during execution are generated by the interpreter during runtime. In other words the java bytecode is transformed during execution which is really confusing.

[OwenRW]

Originally Posted by loo3aem3ON

If anyone finds a description for some of the remaining unknown registers please post it here.

According to these...
http://www.wipo.int/pctdb/en/wo.jsp?...1&DISPLAY=DESC
http://www.wipo.int/pctdb/en/wo.jsp?...5&DISPLAY=DESC
http://www.freepatentsonline.com/y2007/0092223.html

Here are a couple more PSRs:

PSR30 Player Capability for Text Subtitle
PSR31 Player Version information
PSR32 Network Configuration
PSR33 Local Storage Size
PSR34 Streaming Media Capability

Hope that's useful for completing the list, if nothing else.

[loo3aem3ON]

Originally Posted by OwenRW

Hope that's useful for completing the list, if nothing else.

Thank you. I've updated the description.

[loo3aem3ON]

That's a build snapshot of the upcoming BD-J implementation: http://uploaded.to/?id=14h79o

The current debug log:

[BDRootScene.getRootScene()] BDRootScene.notifyDirty
[HGraphicsHelper.init()] m_image.getWidth 1920
[HGraphicsHelper.init()] m_image.getHeight 1080
[HGraphicsHelper.init()] m_image.type 1
JMFProperties: readProperties
[AppsDatabaseHelper.getInitHAVIResolution()] [ERROR!]unknown initial HAVI config id, set as 1920x1080
[BDRootScene.getRootScene()] BDJPluginImp.toolkitSync
[BDRootScene.getRootScene()] BDRootScene.notifyDirty
[BDRootScene.getRootScene()] BDJPluginImp.toolkitSync
[BDJCFacade.executeCommand()] Start init Title
java.lang.NoSuchMethodException: java.util.jar.JarFile.extractJar(java.security.cert.X509Certificate, java.lang.String, [Z)
	at java.lang.Class.getDeclaredMethod(Class.java:1937)
	at com.cl.bdj.jar.JarAuthenication.initialReflections(Unknown Source)
	at com.cl.bdj.jar.JarAuthenication.<clinit>(Unknown Source)
	at com.cl.bdj.appmanager.BDJAppManager.checkRootCerts(Unknown Source)
	at com.cl.bdj.appmanager.BDJAppManager.initTitle(Unknown Source)
	at com.cl.bdj.main.BDJCFacade.initTitle(Unknown Source)
	at com.cl.bdj.main.BDJCFacade.executeCommand(Unknown Source)
[BDJPlaneControlHelper.setScreenKeepResolution()] KeepResolution(false)
[BDJCFacade.executeCommand()] End init Title

Edit: error fixes. updated console output. It creates a graphic window on my screen now.

Edit: further bugfixes. Initialization succeeds. Problems after "init title" command (loading the application jar files from the disc).

Edit: updated debug log; new build snapshot

[loo3aem3ON]

The reference debug log from the player is:

created one file output stream : javaLog.txt


ä¸*æ–‡Log started: Fri Jan 30 11:22:50 GMT-08:00 2009
[BDRootScene.getRootScene()] BDRootScene.notifyDirty
[HGraphicsHelper.init()] m_image.getWidth 1920
[HGraphicsHelper.init()] m_image.getHeight 1080
[HGraphicsHelper.init()] m_image.type 2
JMFProperties: readProperties
[AppsDatabaseHelper.getInitHAVIResolution()] [ERROR!]unknown initial HAVI config id, set as 1920x1080
[BDRootScene.getRootScene()] BDJPluginImp.toolkitSync
[BDRootScene.getRootScene()] BDRootScene.notifyDirty
[BDRootScene.getRootScene()] BDJPluginImp.toolkitSync
[BDRootScene.checkGraphicsPlaneSize()] [ERROR!][resolution] screen size unknown
[BDJCFacade.executeCommand()] Start init Title
[BDJPlaneControlHelper.setScreenKeepResolution()] KeepResolution(false)
[BDJPlaneControlHelper.setScreenKeepResolution()] KeepResolution(false)
[BDJPrimitiveCommand.doLoadXlet()] load BD-J app : com.macrovision.bdplus.Handshake
[BDJCFacade.executeCommand()] End init Title
[BDJPrimitiveCommand.doLoadXlet()] load BD-J app ended : com.macrovision.bdplus.Handshake
[BDJPrimitiveCommand.doInitXlet()] init BD-J app : com.macrovision.bdplus.Handshake
[BDJPrimitiveCommand.doInitXlet()] init BD-J app ended: com.macrovision.bdplus.Handshake
[BDJPrimitiveCommand.doStartXlet()] start BD-J app : com.macrovision.bdplus.Handshake
[BDJPrimitiveCommand.doStartXlet()] start BD-J app ended: com.macrovision.bdplus.Handshake
[BDJPrimitiveCommand.doLoadXlet()] load BD-J app : com.bydeluxe.fox.FirstPlayXlet
[BDJPrimitiveCommand.doLoadXlet()] load BD-J app ended : com.bydeluxe.fox.FirstPlayXlet
[BDJPrimitiveCommand.doInitXlet()] init BD-J app : com.bydeluxe.fox.FirstPlayXlet
[BDJPrimitiveCommand.doInitXlet()] init BD-J app ended: com.bydeluxe.fox.FirstPlayXlet
[BDJPrimitiveCommand.doStartXlet()] start BD-J app : com.bydeluxe.fox.FirstPlayXlet
com.cl.bdj.appmanager.BDJThreadGroup[name=BDJThreadGroup-com.macrovision.bdplus.Handshake,maxpri=5]
[RegisterAccess.setGPR()] setGPR(1009)=0
[RegisterAccess.setGPR()] setGPR(1008)=0
[RegisterAccess.setGPR()] setGPR(1007)=0
[RegisterAccess.setGPR()] setGPR(1006)=0
[RegisterAccess.setGPR()] setGPR(1005)=0
[RegisterAccess.setGPR()] setGPR(1004)=0
[RegisterAccess.setGPR()] setGPR(1003)=0
[RegisterAccess.setGPR()] setGPR(1002)=0
[RegisterAccess.setGPR()] setGPR(1001)=0
[RegisterAccess.setGPR()] setGPR(1000)=0
[RegisterAccess.setGPR()] setGPR(1030)=0
[RegisterAccess.setGPR()] setGPR(1029)=0
[RegisterAccess.setGPR()] setGPR(1028)=0
[RegisterAccess.setGPR()] setGPR(1027)=0
[RegisterAccess.setGPR()] setGPR(1026)=0
[RegisterAccess.setGPR()] setGPR(1025)=0
[RegisterAccess.setGPR()] setGPR(1024)=0
[RegisterAccess.setGPR()] setGPR(1023)=0
[RegisterAccess.setGPR()] setGPR(1022)=0
[RegisterAccess.setGPR()] setGPR(1021)=0
[RegisterAccess.setGPR()] setGPR(1020)=0
[RegisterAccess.setGPR()] setGPR(1019)=0
[RegisterAccess.setGPR()] setGPR(1018)=0
[RegisterAccess.setGPR()] setGPR(1017)=0
[RegisterAccess.setGPR()] setGPR(1016)=0
[RegisterAccess.setGPR()] setGPR(1015)=0
[RegisterAccess.setGPR()] setGPR(1014)=0
[RegisterAccess.setGPR()] setGPR(1013)=0
[RegisterAccess.setGPR()] setGPR(1012)=0
[RegisterAccess.setGPR()] setGPR(1011)=0
[RegisterAccess.setGPR()] setGPR(1010)=0
[RegisterAccess.getPSR()] getPSR(20)=2
[RegisterAccess.getPSR()] getPSR(13)=255
[RegisterAccess.getPSR()] getPSR(31)=197120
[BDJSelectTitleEvent.callEvent()] [Begin] select title: 2
[BDJEventTicket.waitForEventStart()] [Start] process event com.cl.bdj.event.BDJEventTicket@478783
[BDJAppProxy.destroyBDJApp()] destroyBDJApp -- the app is not loaded
[BDJPrimitiveCommand.doStartXlet()] start BD-J app ended: com.bydeluxe.fox.FirstPlayXlet
[BDJPrimitiveCommand.doDestroyXlet()] destroy BD-J app : com.bydeluxe.fox.FirstPlayXlet
[BDJPrimitiveCommand.doDestroyXlet()] destroy BD-J app ended: com.bydeluxe.fox.FirstPlayXlet
[BDJCommandRunner.forceExit()] the runner: BDJCommandRunner:Name<PaintRunner>,Owner<com.cl.bdj.appmanager.MainXletContext@52bc4e( BDJAppProxy (2147443820, 16384, com.bydeluxe.fox.FirstPlayXlet) )> was not stopped
com.cl.bdj.appmanager.BDJThreadGroup[name=BDJThreadGroup-com.bydeluxe.fox.FirstPlayXlet,maxpri=5]
    Thread[AWTEventQueueThread-com.bydeluxe.fox.FirstPlayXlet,5,BDJThreadGroup-com.bydeluxe.fox.FirstPlayXlet]
    Thread[BDJPaintRunnerThread-com.bydeluxe.fox.FirstPlayXlet,5,BDJThreadGroup-com.bydeluxe.fox.FirstPlayXlet]
[BDJCFacade.executeCommand()] Start init Title
[BDJAppProxy.destroyBDJApp()] destroyBDJApp -- the app is not loaded
[AppsDatabase.getAppProxy()] Input AppID:(1)getOID()=2147443820,(2)getAID()=30583
[BDJAppProxy.sendStateChangeEvent()] App-orgID: 2147443820, App-appID: 30583 => getAppProxy(appID) returns null
[BDJPlaneControlHelper.setScreenKeepResolution()] KeepResolution(false)
[BDJPlaneControlHelper.setScreenKeepResolution()] KeepResolution(false)
[BDJCFacade.executeCommand()] End init Title
[BDJPrimitiveCommand.doLoadXlet()] load BD-J app : com.bydeluxe.fox.BDLiveReadyXlet
[BDJPrimitiveCommand.doLoadXlet()] load BD-J app ended : com.bydeluxe.fox.BDLiveReadyXlet
[BDJPrimitiveCommand.doInitXlet()] init BD-J app : com.bydeluxe.fox.BDLiveReadyXlet
[BDJSelectTitleEvent.callEvent()] [End] select title: 2
[BDJPrimitiveCommand.doInitXlet()] init BD-J app ended: com.bydeluxe.fox.BDLiveReadyXlet
[BDJPrimitiveCommand.doStartXlet()] start BD-J app : com.bydeluxe.fox.BDLiveReadyXlet
[BDJPrimitiveCommand.doStartXlet()] start BD-J app ended: com.bydeluxe.fox.BDLiveReadyXlet
[DiscFontManager.getFontIndexData()] fontindexDataBuffer is null
[HScene.reloadDefaultFont()] SetDefaultFont: style(0) Size(26)
Creating buffer: 1920 x 1080
, 8294400 bytes
1 images. 8294400bytes
https://0000-0000-1D6F-0000-5-0000-0003-G.foxbd-live.com/BDLiveServices/Service.asmx/BootLoader
VolumeID: 6C2C3851-D4BF-39AC-E53B-8EA78E866E45
[RegisterAccess.getPSR()] getPSR(18)=6647399
class java.lang.SecurityException Doesn't contain valid SocketPermission
java.lang.SecurityException: Doesn't contain valid SocketPermission
	at com.cl.bdj.jar.BDJSecurityManager.checkPermissionImp(Unknown Source)
	at com.cl.bdj.jar.BDJSecurityManager.access$000(Compiled Method)(Unknown Source)
	at com.cl.bdj.jar.BDJSecurityManager$1.run(Unknown Source)
	at java.security.AccessController.doPrivileged(Unknown Source)
	at com.cl.bdj.jar.BDJSecurityManager.checkPermission(Unknown Source)
	at java.lang.SecurityManager.checkConnect(Unknown Source)
	at java.net.InetAddress.getAllByName0(Unknown Source)
	at java.net.InetAddress.getAllByName0(Unknown Source)
	at java.net.InetAddress.getAllByName(Unknown Source)
	at java.net.InetAddress.getByName(Unknown Source)
	at sun.net.www.protocol.https.HttpsClient.<init>(Unknown Source)
	at sun.net.www.protocol.https.HttpsClient.a(Unknown Source)
	at sun.net.www.protocol.https.HttpsClient.a(Unknown Source)
	at sun.net.www.protocol.https.HttpsClient.a(Unknown Source)
	at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.plainConnect(Unknown Source)
	at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(Unknown Source)
	at sun.net.www.protocol.http.HttpURLConnection.getInputStream(Unknown Source)
	at sun.net.www.protocol.http.HttpURLConnection.getHeaderFieldKey(Unknown Source)
	at sun.net.www.protocol.https.HttpsURLConnectionImpl.getHeaderFieldKey(Unknown Source)
	at ae.a(Unknown Source)
	at w.k(Unknown Source)
	at w.run(Unknown Source)
	at java.lang.Thread.startup(Unknown Source)
java.lang.SecurityException: Doesn't contain valid SocketPermission
	at com.cl.bdj.jar.BDJSecurityManager.checkPermissionImp(Unknown Source)
	at com.cl.bdj.jar.BDJSecurityManager.access$000(Compiled Method)(Unknown Source)
	at com.cl.bdj.jar.BDJSecurityManager$1.run(Unknown Source)
	at java.security.AccessController.doPrivileged(Unknown Source)
	at com.cl.bdj.jar.BDJSecurityManager.checkPermission(Unknown Source)
	at java.lang.SecurityManager.checkConnect(Unknown Source)
	at java.net.InetAddress.getAllByName0(Unknown Source)
	at java.net.InetAddress.getAllByName0(Unknown Source)
	at java.net.InetAddress.getAllByName(Unknown Source)
	at java.net.InetAddress.getByName(Unknown Source)
	at sun.net.www.protocol.https.HttpsClient.<init>(Unknown Source)
	at sun.net.www.protocol.https.HttpsClient.a(Unknown Source)
	at sun.net.www.protocol.https.HttpsClient.a(Unknown Source)
	at sun.net.www.protocol.https.HttpsClient.a(Unknown Source)
	at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.plainConnect(Unknown Source)
	at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(Unknown Source)
	at sun.net.www.protocol.http.HttpURLConnection.getInputStream(Unknown Source)
	at sun.net.www.protocol.http.HttpURLConnection.getHeaderFieldKey(Unknown Source)
	at sun.net.www.protocol.https.HttpsURLConnectionImpl.getHeaderFieldKey(Unknown Source)
	at ae.a(Unknown Source)
	at w.k(Unknown Source)
	at w.run(Unknown Source)
	at java.lang.Thread.startup(Unknown Source)
Continue Normal Disc Execution
Removing 8294400 bytes.
0 images. 0bytes
4
[BDJEventTicket.waitForEventStart()] [Start] process event com.cl.bdj.event.BDJEventTicket@22a11b
[BDJSelectTitleEvent.callEvent()] [Begin] select title: 4
[BDJPrimitiveCommand.doDestroyXlet()] destroy BD-J app : com.bydeluxe.fox.BDLiveReadyXlet
[BDJPrimitiveCommand.doDestroyXlet()] destroy BD-J app ended: com.bydeluxe.fox.BDLiveReadyXlet
com.cl.bdj.appmanager.BDJThreadGroup[name=BDJThreadGroup-com.bydeluxe.fox.BDLiveReadyXlet,maxpri=5]
[BDJCFacade.executeCommand()] Start init Title
[BDJPlaneControlHelper.setScreenKeepResolution()] KeepResolution(false)
[BDJPlaneControlHelper.setScreenKeepResolution()] KeepResolution(false)
[BDJCFacade.executeCommand()] End init Title
[BDJPrimitiveCommand.doLoadXlet()] load BD-J app : com.bydeluxe.fox.OpeningSequenceXlet
[BDJSelectTitleEvent.callEvent()] [End] select title: 4
[BDJPrimitiveCommand.doLoadXlet()] load BD-J app ended : com.bydeluxe.fox.OpeningSequenceXlet
[BDJPrimitiveCommand.doInitXlet()] init BD-J app : com.bydeluxe.fox.OpeningSequenceXlet
[RegisterAccess.getPSR()] getPSR(18)=6647399
[RegisterAccess.getPSR()] getPSR(20)=2
[BDJPrimitiveCommand.doInitXlet()] init BD-J app ended: com.bydeluxe.fox.OpeningSequenceXlet
[BDJPrimitiveCommand.doStartXlet()] start BD-J app : com.bydeluxe.fox.OpeningSequenceXlet
Reading /VFS//BDMV/JAR/99801/opening.properties
[RegisterAccess.getPSR()] getPSR(16)=6647399
getPlaylistId interpol.eng.eng.B = null
getPlaylistId interpol.eng = -1
[RegisterAccess.getPSR()] getPSR(17)=6647399
getPlaylistId disclaimer.eng.eng.B = null
getPlaylistId disclaimer.eng = -1
getPlaylistId mpaa.eng.B = null
getPlaylistId mpaa = -1
getPlaylistId playlist1.eng.B = null
getPlaylistId playlist1 = 5
[RegisterAccess.getPSR()] getPSR(1)=1
[RegisterAccess.getPSR()] getPSR(2)=268374015
[BDJPrimitiveCommand.doStartXlet()] start BD-J app ended: com.bydeluxe.fox.OpeningSequenceXlet
[BDJCFacade.executeCommand()] ====== start do suspend ======
[BDJCFacade.executeCommand()] ====== end do suspend ======
[BDJPrimitiveCommand.doDestroyXlet()] destroy BD-J app : com.bydeluxe.fox.OpeningSequenceXlet
[BDJPlaneControlHelper.getAWTVideoSize()] [ERROR!]getPlaneControl return null
java.lang.Exception
	at com.cl.bdj.helper.BDJPlaneControlHelper.getAWTVideoSize(Unknown Source)
	at com.cl.bdj.media.control.AWTVideoSizeControlImpl.getSize(Unknown Source)
	at com.cl.bdj.media.control.BDJPlaylistAWTVideoSizeControl.getSize(Unknown Source)
	at com.cl.bdj.media.BDJPlayListPlayer.hookStop(Unknown Source)
	at com.cl.bdj.media.BDJJMFPlayerImpl.stop(Unknown Source)
	at c.j(Unknown Source)
	at c.a(Unknown Source)
	at com.bydeluxe.fox.OpeningSequenceXlet.destroyXlet(Unknown Source)
	at com.cl.bdj.appmanager.BDJPrimitiveCommand.doDestroyXlet(Unknown Source)
	at com.cl.bdj.appmanager.DestroyXletCommand.execute(Unknown Source)
	at com.cl.bdj.event.BDJCommandRunner.run(Unknown Source)
	at java.lang.Thread.run(Unknown Source)
	at java.lang.Thread.startup(Unknown Source)
[BDJPrimitiveCommand.doDestroyXlet()] destroy BD-J app ended: com.bydeluxe.fox.OpeningSequenceXlet
[BDJCommandRunner.forceExit()] the runner: BDJCommandRunner:Name<AppRunner>,Owner<XletRunnerContext<null>> was not stopped
com.cl.bdj.appmanager.BDJThreadGroup[name=BDJThreadGroup-com.bydeluxe.fox.OpeningSequenceXlet,maxpri=5]
[BDJCFacade.exitAll()] end exitAll(), clear Image Cache
[BDJCFacade.exitAll()] Clear Image Cache
[BDJCFacade.clearImageCache()] Finish clear image cache
[BDJCFacade.flushAllImageData()] Finish flush image psd
CBDJMediaProcessor has been stopped or finalized!
CBDJMediaProcessor has been stopped or finalized!
CBDJMediaProcessor has been stopped or finalized!

[loo3aem3ON]

I've uploaded a new binary snapshot (see posting #657). The developers should try to get it running so we can quickly proceed when it executes the 77770.jar (BD+ handshake). I expect this to happen in the next view days.

To execute: (example)

export LD_LIBRARY_PATH=${HOME}/bdj/jdk1.6.0_11/jre/lib/i386/:${HOME}/bdj/jdk1.6.0_11/jre/lib/i386/server
./bdj /absolute_path/jni/libbdjinterface.so

Look for a logfile: ${HOME}/javaLog.txt

to compile the bdj.c: (example; optional)

gcc -m32 -L/${HOME}/bdj/jdk1.6.0_11/jre/lib/i386/server -ljvm -I/${HOME}/bdj/jdk1.6.0_11/include/ -o bdj bdj.c

to compile the interface (jni): (optional)

cd jni
make

[KenD00]

I am very low on free time currently so i couldn't test this one earlier. After adjusting the paths to fit my installation and installing libqt3-mt i still can't get it running. The problem is the following

Exception in thread "main" [W] java.lang.UnsatisfiedLinkError: no qtawt in java.library.path

I can't convince java to find that damn shared library. I tried moving it around, added a java.library.path definition to the vmargs inside bdj.c but it still won't find that damn library . In the beginning i had that problem with DumpHD too but it was fixed adjusting java.library.path but this doesn't help right now. I will experiment around a little more but maybe someone else had the same problem and knows a solution.