Finally handling BD+ (?) - Page 35

880 · 23rd February 2009, 08:25

In the readme for BDVMDebug 0.1.5 it says to post the conversion table on the forum. Should I post conv_tab.bin here? Should I post console output?

loo3aem3ON · 23rd February 2009, 11:15

Quote:

Originally Posted by 880

In the readme for BDVMDebug 0.1.5 it says to post the conversion table on the forum. Should I post conv_tab.bin here? Should I post console output?

The readme is outdated but you still can upload the conversion table somewhere if you want to. Have you tried to view the table with ConvTableView? Are there any console messages?

loo3aem3ON · 25th February 2009, 00:25

I've started a new thread for BD-J related discussions: link
Rupan has imported Brian Gladman's AES implementation into libbluray which needs testing. I'll remove the BD-J stuff from the assembla repository soon. It's now available on launchpad (link).

loo3aem3ON · 4th March 2009, 16:55

Is someone willing to connect libbdjinterface and libbluray or do i have to do this myself too? Both libraries access the same PSR and GPR.

Remember:

Code:

PSR102  = BD+ to BD-J pipe
PSR103  = BD-J to BD+ pipe
PSR104  = BD-J/BD+ shared register

The call of pTriggerPSR103change means that the BD-J program has sent a message (PSR103) to the content code. The content code needs to handle this as EVENT#0210 next.
If in turn the content code writes PSR102 then EVENT#008 is passed to the BD-J code (see last view lines of bdj.c for an example).

Accident · 5th March 2009, 05:44

I can probably squeeze that in over the weekend, at least I can make an effort to.

loo3aem3ON · 6th March 2009, 14:42

@Rupan: Could you please explain your changes to TRAP_Aes and TRAP_SHA? What are the advantages of Brian Gladman's AES and SHA-1 implementations?

Rupan · 6th March 2009, 18:25

I didn't end up using BRG's SHA-1 code. There wasn't any point, really. BRG's AES code, however, is very fast (it is used in WinZip for their ZIP encryption).

I ended up using OpenSSL's SHA in trap_Sha. trap_helper has code to look up SHA contexts keyed on the destination address, so I believe it now should handle interleaved calls.

You can revert my changes to trap_Aes by commenting USE_GLADMAN_AES at the top of trap.c. trap_Sha has been modified to make use of trap_helper, in changesets 197 and 198.

**EDIT** Part of the reason I was looking at BRG's SHA-1 code was so that I could remove the dependency on OpenSSL. However, I wasn't able to find a suitable replacement for its ECDSA implementation so I didn't bother using BRG's SHA-1 code.

I've been reading over the traps and am trying to improve them where the comments say they need improvement.

Rupan · 8th March 2009, 00:55

Today I was attempting to validate the current changeset with libbluray. I wanted to make sure that my changes to the source code weren't causing breakage. However, it appears that libbluray has been broken for sime time before I started working on it.

I'm testing with a region A release of "Live Free or Die Hard". I specifically remember this working a while back, so I was surprised when libbluray failed with it today. I went back through the svn revisions, bisecting from revision 168 (which I remember it working with). It turns out that svn revision 170 was what broke it.

With svn rev 169 it works fine, creating a conv_tab.bin as expected. However, with svn revision 170 it no longer works:

./convtab -d /mnt/cdrom -I <VID> -s conv_tab.bin
[dlx] BREAK! PC=000010B4. WD=FFFFFFFF (old R28 00001000, event 1)
[dlx] BREAK! PC=000010B4. WD=00000000 (old R28 000010B4, event 1)
[dlx] BREAK! PC=000010B4. WD=00000000 (old R28 000010B4, event 1)
[dlx] BREAK! PC=000010B4. WD=FFFFFFFF (old R28 000010B4, event 1)
^C

svn info claims that the last revision to libbluray prior to 169 was by Accident, in revision 165. Revision 170 was also committed by Accident, so he/she might be the right person to debug this.

loo3aem3ON · 11th March 2009, 18:27

I'm having problems building libbluray:

Code:

$ automake
configure.ac:208: required file `win32/Makefile.in' not found
configure.ac:208: required file `win32/libbluray/Makefile.in' not found
configure.ac:208: required file `win32/libbluray/libbluray/Makefile.in' not found
configure.ac:208: required file `win32/libbluray/convtab/Makefile.in' not found

Please advise. There is still no "autogen.sh".

Rupan · 12th March 2009, 01:03

run this to rebuild all of the autotools cruft in one shot:

# autoreconf -sfi

The win32 stuff was apparently added by someone with the intent of making libbluray work with Windows. It has been there since before I first saw the source code, so I'm assuming that the effort is abandoned. Personally I am not willing to touch the Windows application layer; the idea of writing source code for Windows is distasteful to me in the extreme.

If you're okay with it, just remove all references to win32 from Makefile.am and configure.ac then commit the changes. Otherwise just modify them locally before running autoreconf.

**EDIT** I do believe that I've forgotten to add the trap_helper source files to Makefile.am. You can add them in if you get to it first; I'll fix it later tonight when I get home.

Quote:

Originally Posted by loo3aem3ON

I'm having problems building libbluray:

Code:

$ automake
configure.ac:208: required file `win32/Makefile.in' not found
configure.ac:208: required file `win32/libbluray/Makefile.in' not found
configure.ac:208: required file `win32/libbluray/libbluray/Makefile.in' not found
configure.ac:208: required file `win32/libbluray/convtab/Makefile.in' not found

Please advise. There is still no "autogen.sh".

loo3aem3ON · 14th March 2009, 20:09

@Rupan: I still can't compile libbluray because of missing symbols so i'll revert your changes. You may commit a complete patch later.

@Accident: Could you please send me the AACS source code you have?

Rupan · 15th March 2009, 02:26

I've committed a fixed patch in revision 201.

**EDIT**

@Accident: can you take a look at what happened between rev 165 and 170 to libbluray? I just confirmed, convtab fails for both "The Simpsons Movie" and "Live Free or Die Hard" for svn >= 170 (165 works fine).

@loo3aem3ON: svn rev 201 compilable for you?

Accident · 17th March 2009, 08:08

Apologies for my tardiness. I was ready to start coding, when things at work went belly-up, only caught up on sleep now. I will try to catch up:

@Rupan: I wrote my code to be portable, so I did the Windows massaging (with a patch from a contributor to remove warnings). The Makefile.am for Windows are just stubs to tell autoconf to include required files when you do "make dist-gzip". Both Unix and Windows is just untar, and make.

When you check it out of svn, you should run "autoreconf", sometimes if the .ac files have changed, you may need "autoreconf --install --force".

@loo3aem3ON: The best I have found (sent to me by contributors) are:
101603 Dec 23 21:42 libaacs_v0.5.tar.bz2

All my attempts to reach the original author has failed. We might as well consider checking it into our repository, and start working on API to use both libraries.

Edit:
It appears that I changed segment_NextSegment() to instead of returning the "table index" to return the "table ID" of the table index. (Which I think is more correct... anyone?) but segment_SetSegment() still took "table index". So, I returned table = 60 as the next one to decrypt, and posted events for key 60,1. But when I went to decrypt it, "60 > numTables of 43". Can I get it confirmed that the BD+ code deals with TableID when you post the playback event to retrieve the keys, or should it be pure conv_tab index?

Edit2:

loo3aem3ON: In previous testing of older disks, the table index (subtable number) in conv_tab, and TableID were always the same. 0 to numSubTables in conv_tab. But in testing LiveAndLetDie, table index 34 (the first we need to decrypt) has table ID 60. We then post events to get the key, do we send 34, or 60. Looking at debugger, it appears that it uses
segmentID[0] = subtables[i].subtable_id; //(conv_tab_main.java:79)
which would confirm it uses only tableIDs when communicating with content code, whereas libbluray previously never used tableID at all. It would make sense to me that content-code uses tableID, and I should convert to subtable index internally, but it would be nice to be confident about this change

Rupan: So you say you can't test rev 202, but it is still broken.... what?

Rupan · 17th March 2009, 10:09

I'm not in any state at the moment to analyze rev 202 (seeing as it is 2 am), but I'm still getting the same results:

$ ./convtab -I <VID> -s conv_tab.bin -d /mnt/cdrom
[dlx] BREAK! PC=000010B4. WD=FFFFFFFF (old R28 00001000, event 1)
[dlx] BREAK! PC=000010B4. WD=00000000 (old R28 000010B4, event 1)
[dlx] BREAK! PC=000010B4. WD=00000000 (old R28 000010B4, event 1)
[dlx] BREAK! PC=000010B4. WD=FFFFFFFF (old R28 000010B4, event 1)
[dlx] BREAK! PC=000010B4. WD=FFFFFFFF (old R28 000010B4, event 1)
[dlx] BREAK! PC=000010B4. WD=FFFFFFFF (old R28 000010B4, event 1)

And yeah, might as well commit libaacs..

loo3aem3ON · 17th March 2009, 19:16

I suggest to merge the code from libbluray into libaacs and call the resulting library libbluray. The current libbluray code needs to be restructured a bit. For example the dlx.c is overloaded with functions which have nothing to to with the DLX processor (eg. traces/snapshots, slots, conversion table, events, trap calls,...). It should be better to split the code into modules (e.g. DLX, trap_interface, trap_implementation, events, conversion_table, debugging_helpers).
Furthermore I would like if you could use the parameter checks without modifications from the documentation.

Quote:

Originally Posted by Accident

It appears that I changed segment_NextSegment() to instead of returning the "table index" to return the "table ID" of the table index. (Which I think is more correct... anyone?) but segment_SetSegment() still took "table index".

By "table" you mean the subtable associated with a specific *.m2ts file?

Quote:

Originally Posted by Accident

So, I returned table = 60 as the next one to decrypt, and posted events for key 60,1. But when I went to decrypt it, "60 > numTables of 43". Can I get it confirmed that the BD+ code deals with TableID when you post the playback event to retrieve the keys, or should it be pure conv_tab index?

I don't fully understand what you mean. The subtable ID can be higher than the total number of subtables. I don't know which part of the player generates the events 0x0110 and 0x0220. It's still unknown what exactly the second parameter of EVENT_#0110 means. Somehow it's related to the number of the m2ts file. The second parameter of EVENT_#0220 seems to be the subtable ID == number of m2ts file.

Edit: It's known that EVENT#0210 is related to BD-J and since EVENT#0220 is in the same group it's probably related as well.

Accident · 24th March 2009, 08:17

This is the latest version that people managed to find me me.

libaacs_v0.5.tar.bz2

I was initially just going to check it into libbluray as a sub-directory, but it does have the two keys embedded so I thought I should wait an see first. We should probably take those keys from command-line arguments, or env vars. Or at the very least obfuscate them so the repositories do not need to worry.

Switching to bazaar has been a hassle so far, but I should have what I need in a bit..

loo3aem3ON · 24th March 2009, 21:41

Have you made any progress "connecting" the BD-J platform to libbluray? Do you need help?

bumbo · 24th March 2009, 23:40

Quote:

Originally Posted by Accident

This is the latest version that people managed to find me me.

libaacs_v0.5.tar.bz2

It seems I have a more recent version of libaacs, checked out from decrypthd svn repository quite some time ago...

libaacs-svn-r51.tar.bz2

It does not compile here because of some missing include directives. I've attached a patch to solve that.
It also requires CMake.

loo3aem3ON · 28th March 2009, 00:24

Thanks for the AACS source.

I'd like to make a suggestion regarding the connection between libbluray and the experimental bd-j platform i proposed. As i understand there has been little progress and it seems to be quite a difficult task. How about running both libbluray and bdj in two different processes and let them communicate via network or some other form of inter process communication? This would probably be easier and require fewer changes to both programs.

SamNZDat · 28th March 2009, 23:53

Have we looked into comparing the signals sent to CRT monitor(s) with signals sent to LCD or plasma monitors, or into comparing signals sent by optic fiber(s) to signals sent by TV transmitter, satellite, cable, or DSL? Is there another way to back-engineer the technology? I have a fiber optics installer's field guide, if it can be of use to anyone.

4th March 2009, 16:55	#684 \| Link
loo3aem3ON Registered User Join Date: Sep 2008 Posts: 189	Is someone willing to connect libbdjinterface and libbluray or do i have to do this myself too? Both libraries access the same PSR and GPR. Remember: Code: PSR102 = BD+ to BD-J pipe PSR103 = BD-J to BD+ pipe PSR104 = BD-J/BD+ shared register The call of pTriggerPSR103change means that the BD-J program has sent a message (PSR103) to the content code. The content code needs to handle this as EVENT#0210 next. If in turn the content code writes PSR102 then EVENT#008 is passed to the BD-J code (see last view lines of bdj.c for an example). Last edited by loo3aem3ON; 4th March 2009 at 16:57.

6th March 2009, 18:25	#687 \| Link
Rupan Registered User Join Date: Nov 2008 Posts: 62	I didn't end up using BRG's SHA-1 code. There wasn't any point, really. BRG's AES code, however, is very fast (it is used in WinZip for their ZIP encryption). I ended up using OpenSSL's SHA in trap_Sha. trap_helper has code to look up SHA contexts keyed on the destination address, so I believe it now should handle interleaved calls. You can revert my changes to trap_Aes by commenting USE_GLADMAN_AES at the top of trap.c. trap_Sha has been modified to make use of trap_helper, in changesets 197 and 198. EDIT Part of the reason I was looking at BRG's SHA-1 code was so that I could remove the dependency on OpenSSL. However, I wasn't able to find a suitable replacement for its ECDSA implementation so I didn't bother using BRG's SHA-1 code. I've been reading over the traps and am trying to improve them where the comments say they need improvement. Last edited by Rupan; 7th March 2009 at 02:15.

8th March 2009, 00:55	#688 \| Link
Rupan Registered User Join Date: Nov 2008 Posts: 62	libbluray broken since svn revision 170? Today I was attempting to validate the current changeset with libbluray. I wanted to make sure that my changes to the source code weren't causing breakage. However, it appears that libbluray has been broken for sime time before I started working on it. I'm testing with a region A release of "Live Free or Die Hard". I specifically remember this working a while back, so I was surprised when libbluray failed with it today. I went back through the svn revisions, bisecting from revision 168 (which I remember it working with). It turns out that svn revision 170 was what broke it. With svn rev 169 it works fine, creating a conv_tab.bin as expected. However, with svn revision 170 it no longer works: ./convtab -d /mnt/cdrom -I <VID> -s conv_tab.bin [dlx] BREAK! PC=000010B4. WD=FFFFFFFF (old R28 00001000, event 1) [dlx] BREAK! PC=000010B4. WD=00000000 (old R28 000010B4, event 1) [dlx] BREAK! PC=000010B4. WD=00000000 (old R28 000010B4, event 1) [dlx] BREAK! PC=000010B4. WD=FFFFFFFF (old R28 000010B4, event 1) ^C svn info claims that the last revision to libbluray prior to 169 was by Accident, in revision 165. Revision 170 was also committed by Accident, so he/she might be the right person to debug this.

15th March 2009, 02:26	#692 \| Link
Rupan Registered User Join Date: Nov 2008 Posts: 62	I've committed a fixed patch in revision 201. EDIT @Accident: can you take a look at what happened between rev 165 and 170 to libbluray? I just confirmed, convtab fails for both "The Simpsons Movie" and "Live Free or Die Hard" for svn >= 170 (165 works fine). @loo3aem3ON: svn rev 201 compilable for you? Last edited by Rupan; 15th March 2009 at 12:09.

17th March 2009, 08:08	#693 \| Link
Accident Registered User Join Date: Aug 2002 Posts: 111	Apologies for my tardiness. I was ready to start coding, when things at work went belly-up, only caught up on sleep now. I will try to catch up: @Rupan: I wrote my code to be portable, so I did the Windows massaging (with a patch from a contributor to remove warnings). The Makefile.am for Windows are just stubs to tell autoconf to include required files when you do "make dist-gzip". Both Unix and Windows is just untar, and make. When you check it out of svn, you should run "autoreconf", sometimes if the .ac files have changed, you may need "autoreconf --install --force". @loo3aem3ON: The best I have found (sent to me by contributors) are: 101603 Dec 23 21:42 libaacs_v0.5.tar.bz2 All my attempts to reach the original author has failed. We might as well consider checking it into our repository, and start working on API to use both libraries. Edit: It appears that I changed segment_NextSegment() to instead of returning the "table index" to return the "table ID" of the table index. (Which I think is more correct... anyone?) but segment_SetSegment() still took "table index". So, I returned table = 60 as the next one to decrypt, and posted events for key 60,1. But when I went to decrypt it, "60 > numTables of 43". Can I get it confirmed that the BD+ code deals with TableID when you post the playback event to retrieve the keys, or should it be pure conv_tab index? Edit2: loo3aem3ON: In previous testing of older disks, the table index (subtable number) in conv_tab, and TableID were always the same. 0 to numSubTables in conv_tab. But in testing LiveAndLetDie, table index 34 (the first we need to decrypt) has table ID 60. We then post events to get the key, do we send 34, or 60. Looking at debugger, it appears that it uses segmentID[0] = subtables[i].subtable_id; //(conv_tab_main.java:79) which would confirm it uses only tableIDs when communicating with content code, whereas libbluray previously never used tableID at all. It would make sense to me that content-code uses tableID, and I should convert to subtable index internally, but it would be nice to be confident about this change Rupan: So you say you can't test rev 202, but it is still broken.... what? Last edited by Accident; 18th March 2009 at 02:09.

23rd February 2009, 08:25	#681 \| Link
880 Registered User Join Date: Jan 2009 Posts: 125	In the readme for BDVMDebug 0.1.5 it says to post the conversion table on the forum. Should I post conv_tab.bin here? Should I post console output?

25th February 2009, 00:25	#683 \| Link
loo3aem3ON Registered User Join Date: Sep 2008 Posts: 189	I've started a new thread for BD-J related discussions: link Rupan has imported Brian Gladman's AES implementation into libbluray which needs testing. I'll remove the BD-J stuff from the assembla repository soon. It's now available on launchpad (link).

5th March 2009, 05:44	#685 \| Link
Accident Registered User Join Date: Aug 2002 Posts: 111	I can probably squeeze that in over the weekend, at least I can make an effort to.

6th March 2009, 14:42	#686 \| Link
loo3aem3ON Registered User Join Date: Sep 2008 Posts: 189	@Rupan: Could you please explain your changes to TRAP_Aes and TRAP_SHA? What are the advantages of Brian Gladman's AES and SHA-1 implementations?

14th March 2009, 20:09	#691 \| Link
loo3aem3ON Registered User Join Date: Sep 2008 Posts: 189	@Rupan: I still can't compile libbluray because of missing symbols so i'll revert your changes. You may commit a complete patch later. @Accident: Could you please send me the AACS source code you have?

17th March 2009, 10:09	#694 \| Link
Rupan Registered User Join Date: Nov 2008 Posts: 62	I'm not in any state at the moment to analyze rev 202 (seeing as it is 2 am), but I'm still getting the same results: $ ./convtab -I <VID> -s conv_tab.bin -d /mnt/cdrom [dlx] BREAK! PC=000010B4. WD=FFFFFFFF (old R28 00001000, event 1) [dlx] BREAK! PC=000010B4. WD=00000000 (old R28 000010B4, event 1) [dlx] BREAK! PC=000010B4. WD=00000000 (old R28 000010B4, event 1) [dlx] BREAK! PC=000010B4. WD=FFFFFFFF (old R28 000010B4, event 1) [dlx] BREAK! PC=000010B4. WD=FFFFFFFF (old R28 000010B4, event 1) [dlx] BREAK! PC=000010B4. WD=FFFFFFFF (old R28 000010B4, event 1) And yeah, might as well commit libaacs..

24th March 2009, 08:17	#696 \| Link
Accident Registered User Join Date: Aug 2002 Posts: 111	This is the latest version that people managed to find me me. libaacs_v0.5.tar.bz2 I was initially just going to check it into libbluray as a sub-directory, but it does have the two keys embedded so I thought I should wait an see first. We should probably take those keys from command-line arguments, or env vars. Or at the very least obfuscate them so the repositories do not need to worry. Switching to bazaar has been a hassle so far, but I should have what I need in a bit..

24th March 2009, 21:41	#697 \| Link
loo3aem3ON Registered User Join Date: Sep 2008 Posts: 189	Have you made any progress "connecting" the BD-J platform to libbluray? Do you need help?

28th March 2009, 00:24	#699 \| Link
loo3aem3ON Registered User Join Date: Sep 2008 Posts: 189	Thanks for the AACS source. I'd like to make a suggestion regarding the connection between libbluray and the experimental bd-j platform i proposed. As i understand there has been little progress and it seems to be quite a difficult task. How about running both libbluray and bdj in two different processes and let them communicate via network or some other form of inter process communication? This would probably be easier and require fewer changes to both programs.

28th March 2009, 23:53	#700 \| Link
SamNZDat Registered User Join Date: Aug 2008 Posts: 7	Have we looked into comparing the signals sent to CRT monitor(s) with signals sent to LCD or plasma monitors, or into comparing signals sent by optic fiber(s) to signals sent by TV transmitter, satellite, cable, or DSL? Is there another way to back-engineer the technology? I have a fiber optics installer's field guide, if it can be of use to anyone.