BackupHDDVD, a tool to decrypt AACS protected movies

[LordSloth]

So to recap...

Search for VPLST000.XPL in WinDVD's memory (4th occurrence) and from that offset.

+0x0181 is the Decrypted TK table
+0x1571 is the Volume Unique Key

Granted these may vary from system to system and disc to disc.

Originally Posted by Janvitos

I believe the offsets vary from movie to movie and computer to computer.

Looks like Janvitos confirmed they do since they don't match what I posted. But just look somewhere around that region and you should be able to locate the TK table and the VUK.

[Jerky_san]

LOL! holy crap the keys are flying.. are the volume keys in the same place every time? Or do they vary?

[Janvitos]

Serenity Volume Unique Key: D075568AE6BB0B3F85446927B3794C28

KingKong Volume Unique Key: 802F78B1B20D1183638D84E1A96D6EDD

12 Monkeys Volume Unique Key: 2662C05B5238B0C50BD1BDF693223712

[Janvitos]

I believe the offsets vary from movie to movie and computer to computer.

And the keys stays in memory after a HD-DVD disc has been stopped again?

What tool do you use to get a memory dump?

Originally Posted by luders

You must be using the first version of BackupHDDVD. The new one has the date field though it is ignored by the program.

Yes, I opened up version 0.99 by mistake.

Originally Posted by Jerky_san

Yes won't we need the first version of the decryption to use a title key? Since the newest is for volumes?

No, version 1.00 can be used with either title or volume keys, it's your choice, you just have to define which type you use in Field 3 in the KEYDB.cfg file:

Field 1: SHA1 Hash of the VTKF000.AACS file on your HDDVD disk.

Next fields are pipe "|" delimited.

Field 2: Movie Title
Field 3: Key type (V or T for Volume or Title key)
Field 4: File creation date
This field is informational only. It's ignored by the program. It should be the creation date of the media file on the
disk.

Field 5:A variable number of Title key, pipe delimited or one volume key

In the case of a title keys, you have a key number followed by the key value like:

12-08A3DC61910280F2...

Key values are 128 bits long, so 16 bytes, or 32 hexadecimal characters long.

[Janvitos]

I use WinHEX to edit the memory directly.

[zeroprobe]

some screenshots would be nice. Wish I had the addon would love to play about with this for myself.

[Janvitos]

I think posting the Volume Unique Keys speaks for itself

[zeroprobe]

So if the players key in question gets revoked. Would any of the keys now found be any use in future players for tracking more? or would a new players key get totally different results on the exploited discs?

[oddball]

To beat the system I'm guessing you would need a hacked firmware that stops the revocation process from happening. Newer titles will likely contain lists of revocated keys etc?

Someone please explain in laymens terms how the new system works. I never understood the technical docs.

[Shinigami-Sama]

Originally Posted by zeroprobe

So if the players key in question gets revoked. Would any of the keys now found be any use in future players for tracking morei? or would a new players key get totally different results on the exploited discs?

doesn't matter if the player keys get revoked because the volume Unique and Title keys are on the disk - player keys are used to tell if the player is allowed to use the vku or tk

and its great to see that it was as simple to find the keys as I though it would be. It just makes sense that it'd have to be in memory and work like every other digital system out there

[Adub]

Yes!! Excellent job guys! I will order a Xbox 360 drive myself now. Excellent work!

[woah!]

great news

how do you config the key file exactly tho, as i cant seem to get it to go... me stupid... do i need to still find out the date etc from the king kong disc?

[oddball]

From what I understand when newer discs come out they will require you to play them with newer more secured software. You won't be able to use the software with the exploits to playback newer titles. It will be a game of cat and mouse as people try to find the newer methods of where they hide the keys.

[Jerky_san]

I don't think thats on HD DVD.. unless the software people do it.. Blue Ray on the other hand is a whole different story all together.. But what your going to have to worry about on HD DVD is the revocation of the player key which forces you to get those new software updates..

[oddball]

Effectively the same thing. Newer titles will require upgrading to play. Otherwise you are stuck with your old titles.

[calinb]

Originally Posted by Shinigami-Sama

doesn't matter if the player keys get revoked because the volume Unique and Title keys are on the disk - player keys are used to tell if the player is allowed to use the vku or tk

Okay, congrats to those who have won round one and yes--the keys are on the disk, but they are encrypted keys on the disk. We still need an (unrevoked) player to decrypt new keys for us or even play old encrypted disks. If your player is revoked, it's end of round one; you won't even be able to play old titles! Here's why: Take a look at Fig. 4-1 of AACS_Spec_Common_0.91.pdf. It appears that the drive holds a Host Revocation List and the host holds a Drive Revocation List. Maybe I'm missing something here but it seems that the first time you place a disk that contains any given player in its revocation list into the drive, that player will forever more no longer function with that drive--even after a fresh reinstall of the player software. Drive firmware hacks may soon be useful.

[The_ByteMaster]

Originally Posted by oddball

Effectively the same thing. Newer titles will require upgrading to play. Otherwise you are stuck with your old titles.

Unless the content gets revoked, the newer player will always have to determine the Volume Unique Key to decrypt the Title Keys. So unless your Serenity, King Kong and whatever else is compromised gets revoked, you *know* that at some point your new player will have to use that key. This will help to a large extent in compomising the new player (which will, in turn, compromise even more content). This is an avalanche that is hard to stop.

[Sy]

Originally Posted by Merlin7777

Yes!! Excellent job guys! I will order a Xbox 360 myself now. Excellent work!

No no!!! Don't order the 360... Just the Drive