Blu-ray and AACS

Janvitos · 18th January 2007, 06:30

Well, since i was interested in HD DVD , i am now interested in blueray.
I bought an 800$ (CAD) Blueray burner and bought the "Lord of War " movie and will be working on this (for a while i guess).
PowerDVD BD doesn't play the movie properly AT ALL (looks like when you have a defective pipeline in your video card).
WinDVD plays it just fine, and i'm about to go through the memory with WinHEX.

Here is what the directory structure looks like:

Volume in drive E is LOGICAL_VOLUME_ID
Volume Serial Number is 3C05-DB57

Directory of E:\

05/31/2006 05:21 AM <DIR> BDMV
05/31/2006 05:21 AM <DIR> AACS
05/31/2006 05:21 AM <DIR> CERTIFICATE
0 File(s) 0 bytes

Directory of E:\BDMV

05/31/2006 05:18 AM 180 index.bdmv
05/31/2006 05:18 AM 33,714 MovieObject.bdmv
05/31/2006 05:21 AM <DIR> PLAYLIST
05/31/2006 05:21 AM <DIR> CLIPINF
05/31/2006 05:21 AM <DIR> STREAM
05/31/2006 05:21 AM <DIR> AUXDATA
05/31/2006 05:21 AM <DIR> META
05/31/2006 05:21 AM <DIR> BDJO
05/31/2006 05:21 AM <DIR> JAR
05/31/2006 05:21 AM <DIR> BACKUP
2 File(s) 33,894 bytes

Directory of E:\BDMV\PLAYLIST

05/31/2006 05:18 AM 470 00000.mpls
05/31/2006 05:18 AM 234 00001.mpls
05/31/2006 05:18 AM 216 00002.mpls
05/31/2006 05:18 AM 232 00003.mpls
05/31/2006 05:18 AM 159,954 00004.mpls
05/31/2006 05:18 AM 168 00005.mpls
6 File(s) 161,274 bytes

Directory of E:\BDMV\CLIPINF

05/31/2006 05:18 AM 65,924 00000.clpi
05/31/2006 05:18 AM 292 00005.clpi
05/31/2006 05:18 AM 824 00001.clpi
05/31/2006 05:18 AM 2,016 00002.clpi
05/31/2006 05:18 AM 940 00003.clpi
05/31/2006 05:18 AM 612 00004.clpi
05/31/2006 05:18 AM 292 00006.clpi
05/31/2006 05:18 AM 396 00007.clpi
8 File(s) 71,296 bytes

Directory of E:\BDMV\STREAM

05/31/2006 05:17 AM 22,602,240,000 00000.m2ts
05/31/2006 05:18 AM 4,546,560 00005.m2ts
05/31/2006 05:17 AM 142,307,328 00001.m2ts
05/31/2006 05:17 AM 372,750,336 00002.m2ts
05/31/2006 05:18 AM 167,755,776 00003.m2ts
05/31/2006 05:18 AM 61,009,920 00004.m2ts
05/31/2006 05:18 AM 1,419,264 00006.m2ts
05/31/2006 05:18 AM 7,127,040 00007.m2ts
8 File(s) 23,359,156,224 bytes

Directory of E:\BDMV\BACKUP

05/31/2006 05:18 AM 180 index.bdmv
05/31/2006 05:18 AM 33,714 MovieObject.bdmv
05/31/2006 05:21 AM <DIR> PLAYLIST
05/31/2006 05:21 AM <DIR> CLIPINF
05/31/2006 05:21 AM <DIR> BDJO
2 File(s) 33,894 bytes

Directory of E:\BDMV\BACKUP\PLAYLIST

05/31/2006 05:18 AM 470 00000.mpls
05/31/2006 05:18 AM 234 00001.mpls
05/31/2006 05:18 AM 216 00002.mpls
05/31/2006 05:18 AM 232 00003.mpls
05/31/2006 05:18 AM 159,954 00004.mpls
05/31/2006 05:18 AM 168 00005.mpls
6 File(s) 161,274 bytes

Directory of E:\BDMV\BACKUP\CLIPINF

05/31/2006 05:18 AM 65,924 00000.clpi
05/31/2006 05:18 AM 292 00005.clpi
05/31/2006 05:18 AM 824 00001.clpi
05/31/2006 05:18 AM 2,016 00002.clpi
05/31/2006 05:18 AM 940 00003.clpi
05/31/2006 05:18 AM 612 00004.clpi
05/31/2006 05:18 AM 292 00006.clpi
05/31/2006 05:18 AM 396 00007.clpi
8 File(s) 71,296 bytes

Directory of E:\AACS

05/31/2006 05:18 AM 1,048,576 MKB_RO.inf
05/31/2006 05:18 AM 1,048,576 MKB_RW.inf
05/31/2006 05:18 AM 1,048,576 ContentRevocation.lst
05/31/2006 05:18 AM 65,536 Unit_Key_RO.inf
05/31/2006 05:18 AM 192 Content000.cer
05/31/2006 05:18 AM 2,048 CPSUnit00001.cci
05/31/2006 05:18 AM 1,571 mcmf.xml
05/31/2006 05:21 AM <DIR> DUPLICATE
05/31/2006 05:18 AM 950,552 ContentHash000.tbl
8 File(s) 4,165,627 bytes

Directory of E:\AACS\DUPLICATE

05/31/2006 05:18 AM 1,048,576 MKB_RO.inf
05/31/2006 05:18 AM 1,048,576 MKB_RW.inf
05/31/2006 05:18 AM 1,048,576 ContentRevocation.lst
05/31/2006 05:18 AM 65,536 Unit_Key_RO.inf
05/31/2006 05:18 AM 192 Content000.cer
05/31/2006 05:18 AM 2,048 CPSUnit00001.cci
05/31/2006 05:18 AM 1,571 mcmf.xml
05/31/2006 05:18 AM 950,552 ContentHash000.tbl
8 File(s) 4,165,627 bytes

Directory of E:\CERTIFICATE

05/31/2006 05:21 AM <DIR> BACKUP
0 File(s) 0 bytes

Total Files Listed:
56 File(s) 23,368,020,406 bytes
16 Dir(s) 0 bytes free

--------------------------------------------

I hope i have some other people to help out with this...
We need to kick DRM in the butt !

Eeknay · 18th January 2007, 07:48

It wouldn't be too hard to modify BackupHDDVD to recognize the BD file structure. Just change a few things here and there, I don't see why it wouldn't work.

mrazzido · 18th January 2007, 11:04

hey guys my first post :-) , i have a bluray burner too the "lg gbw-h10n" i have the german version of "ICE AGE II" as a bluray movie. its same powerdvd does not work :-( on Analog Monitor , WINDVD works for me fine to!!

i uploaded the directory structe of the movie to an upload center
LINK my movie has more files then Janvitos movie .

i search the memory dump for .bdmv i think die index.bdmv its the same as VPLST000.XPL i found the .bmdv many times in memory.

sorry for the bad English writing :-) cant write good English

when i can help any one to cracking BD i am here :-)

noclip · 18th January 2007, 14:58

Your best bet looks like Unit_Key_RO.inf in the AACS directory.

Janvitos · 18th January 2007, 17:27

My Unit_Key_RO.inf is almost empty (full of zeros). Theres a few ones at the begining, and then a few lines below theres a 16 byte string.

mrazzido · 18th January 2007, 17:47

i check my Unit_Key_RO.inf of ice age II pal german , its the same many 00 then some bytes , and then many 00 :-D

Janvitos · 18th January 2007, 21:00

I have uploaded a WinHEX memory dump of the playback of "Lord of War" Blueray movie for the ones interested.

Here is the link:

* deleted for scecurity reasons *

Enjoy !

Janvitos · 19th January 2007, 15:54

Alright. Here's an update on the situation with blueray.

I've been reading the documents concerning AACS and the blueray format.
There are a lot of interesting things in there but it seems that we're gonna have a harder time with this than HD DVD.

First of all, it seems like the blueray format has a tendency to only use 1 key instead of many.
This might be a problem when trying to search the memory dumps since we are looking for a single 128 bit key rather than 8, 11 or even 60.
Just to let you know, the blueray format employs the term "CPS Unit Key" rather than "Title Key" but both are the same.
They also talk about Volume Unique Key which means they most likely also use it.

One of the other major drawback would be the lack of clues residing inside the CPS Unit Key File (Title Key File).
The Title Key File for the HD DVD format has plain text strings (such as VPLST000.XPL) but the CPS Unit Key File has none.
The file is mostly comprised of zeros and the encrypted key.

In the end of the line, we pretty much will have to follow a different path than we did with HD DVD.

Another important matter, and a question i will dare ask, are the keys for blueray in WinDVD's memory ?
Unfortunately i cannot check PowerDVD's memory because the program tells me my graphics driver is not HDCP compliant (although i can playback blueray movies through WinDVD just fine).
I also tried a most recent version of PowerDVD but this one doesn't seem to playback video properly as i get sound, but really ugly / scrambled-like video.

I will continue to work on this like i did with HD DVD.

2bigkings · 19th January 2007, 16:03

@janvitos, what tft screen you have? but you can playback hd-dvd or?

good luck with blu-ray cracking ;-)

Janvitos · 19th January 2007, 16:05

I have a 37" 1080p (DVI / VGA) screen.
It's currently plugged through VGA since the DVI port is not HDCP compliant.

2bigkings · 19th January 2007, 16:16

oh so thats a tv and not only a tft pc screen..
i got a non-hdcp tft screen and it works fine (hddvd). What says the cyberlink bd/hd advisor to your pc system?

Janvitos · 19th January 2007, 16:40

It says my graphics driver is not compatible.
I believe i have the most recent Catalyst driver (7.1) and the problem might be that the PowerDVD version that shipped with the blueray drive doesn't recognize the drivers.

2bigkings · 19th January 2007, 18:08

i don't got a bd-drive, but i got the catalyst driver 7-1_xp_dd_40211 and powerdvd ultra and bd advisor says that everythings ok!
which blu-ray powerdvd version you have?

Janvitos · 19th January 2007, 18:15

The LG version that came with the drive.
As i said above, the newer standalone version doesn't play the movie well at all.

muslix64 · 20th January 2007, 05:24

In less that 24 hours, without any Blu-Ray equipment, but with the help of Janvitos, I managed to decrypt and play a Blu-Ray media file using my known-plaintext attack...

The file from the movie "Lord of war", play well with VideoLan.

Janvitos gave me few files on the BD disc and a memory dump...

Note that I don't address BD+. The file don't seem to be BD+ protected.

I will keep you informed If I found anything new...

muslix64 · 20th January 2007, 05:38

You can have a look at that file at:

http://rapidshare.com/files/12497232...pted.m2ts.html

Adub · 20th January 2007, 05:43

Yeah!!!!!
Way to roll, muslix64! Kick ass!!
can't wait till the drives drop down in price though.

20th January 2007, 06:19

PWNZ0RZ!

The nice thing about Bu-ray is that DD+ tracks are coded differently than for HD-DVD, namely that they contain a DD-compatible core, i.e. ripped DD+ tracks from Blu-ray titles should play fine with conventional A/52 (a.k.a AC3) audio decoders.

Galileo2000 · 20th January 2007, 06:51

Amazing.

Muslix64 should be served and protected by the freedom-loving HDCP-hating people of the world!

woah! · 20th January 2007, 07:05

BR is now doing there encodes with the VC-1 codec aswell like hd-dvd does. these are mpeg2 files i assume yes?

18th January 2007, 21:00	#7 \| Link
Janvitos Registered User Join Date: Jan 2007 Posts: 55	I have uploaded a WinHEX memory dump of the playback of "Lord of War" Blueray movie for the ones interested. Here is the link: * deleted for scecurity reasons * Enjoy ! Last edited by Janvitos; 19th January 2007 at 01:24.

19th January 2007, 15:54	#8 \| Link
Janvitos Registered User Join Date: Jan 2007 Posts: 55	Alright. Here's an update on the situation with blueray. I've been reading the documents concerning AACS and the blueray format. There are a lot of interesting things in there but it seems that we're gonna have a harder time with this than HD DVD. First of all, it seems like the blueray format has a tendency to only use 1 key instead of many. This might be a problem when trying to search the memory dumps since we are looking for a single 128 bit key rather than 8, 11 or even 60. Just to let you know, the blueray format employs the term "CPS Unit Key" rather than "Title Key" but both are the same. They also talk about Volume Unique Key which means they most likely also use it. One of the other major drawback would be the lack of clues residing inside the CPS Unit Key File (Title Key File). The Title Key File for the HD DVD format has plain text strings (such as VPLST000.XPL) but the CPS Unit Key File has none. The file is mostly comprised of zeros and the encrypted key. In the end of the line, we pretty much will have to follow a different path than we did with HD DVD. Another important matter, and a question i will dare ask, are the keys for blueray in WinDVD's memory ? Unfortunately i cannot check PowerDVD's memory because the program tells me my graphics driver is not HDCP compliant (although i can playback blueray movies through WinDVD just fine). I also tried a most recent version of PowerDVD but this one doesn't seem to playback video properly as i get sound, but really ugly / scrambled-like video. I will continue to work on this like i did with HD DVD. Last edited by Janvitos; 19th January 2007 at 15:58.

20th January 2007, 05:24	#15 \| Link
muslix64 Registered User Join Date: Dec 2006 Posts: 35	Oups, I did it again! In less that 24 hours, without any Blu-Ray equipment, but with the help of Janvitos, I managed to decrypt and play a Blu-Ray media file using my known-plaintext attack... The file from the movie "Lord of war", play well with VideoLan. Janvitos gave me few files on the BD disc and a memory dump... Note that I don't address BD+. The file don't seem to be BD+ protected. I will keep you informed If I found anything new...

20th January 2007, 05:38	#16 \| Link
muslix64 Registered User Join Date: Dec 2006 Posts: 35	The decrypted file You can have a look at that file at: http://rapidshare.com/files/12497232...pted.m2ts.html

18th January 2007, 07:48	#2 \| Link
Eeknay Registered User Join Date: Jul 2005 Posts: 54	It wouldn't be too hard to modify BackupHDDVD to recognize the BD file structure. Just change a few things here and there, I don't see why it wouldn't work.

18th January 2007, 11:04	#3 \| Link
mrazzido Registered User Join Date: Jan 2007 Posts: 114	hey guys my first post :-) , i have a bluray burner too the "lg gbw-h10n" i have the german version of "ICE AGE II" as a bluray movie. its same powerdvd does not work :-( on Analog Monitor , WINDVD works for me fine to!! i uploaded the directory structe of the movie to an upload center LINK my movie has more files then Janvitos movie . i search the memory dump for .bdmv i think die index.bdmv its the same as VPLST000.XPL i found the .bmdv many times in memory. sorry for the bad English writing :-) cant write good English when i can help any one to cracking BD i am here :-)

18th January 2007, 14:58	#4 \| Link
noclip Registered User Join Date: Dec 2006 Posts: 154	Your best bet looks like Unit_Key_RO.inf in the AACS directory.

18th January 2007, 17:27	#5 \| Link
Janvitos Registered User Join Date: Jan 2007 Posts: 55	My Unit_Key_RO.inf is almost empty (full of zeros). Theres a few ones at the begining, and then a few lines below theres a 16 byte string.

18th January 2007, 17:47	#6 \| Link
mrazzido Registered User Join Date: Jan 2007 Posts: 114	i check my Unit_Key_RO.inf of ice age II pal german , its the same many 00 then some bytes , and then many 00 :-D

19th January 2007, 16:03	#9 \| Link
2bigkings Registered User Join Date: Jan 2007 Posts: 117	@janvitos, what tft screen you have? but you can playback hd-dvd or? good luck with blu-ray cracking ;-)

19th January 2007, 16:05	#10 \| Link
Janvitos Registered User Join Date: Jan 2007 Posts: 55	I have a 37" 1080p (DVI / VGA) screen. It's currently plugged through VGA since the DVI port is not HDCP compliant.

19th January 2007, 16:16	#11 \| Link
2bigkings Registered User Join Date: Jan 2007 Posts: 117	oh so thats a tv and not only a tft pc screen.. i got a non-hdcp tft screen and it works fine (hddvd). What says the cyberlink bd/hd advisor to your pc system?

19th January 2007, 16:40	#12 \| Link
Janvitos Registered User Join Date: Jan 2007 Posts: 55	It says my graphics driver is not compatible. I believe i have the most recent Catalyst driver (7.1) and the problem might be that the PowerDVD version that shipped with the blueray drive doesn't recognize the drivers.

19th January 2007, 18:08	#13 \| Link
2bigkings Registered User Join Date: Jan 2007 Posts: 117	i don't got a bd-drive, but i got the catalyst driver 7-1_xp_dd_40211 and powerdvd ultra and bd advisor says that everythings ok! which blu-ray powerdvd version you have?

19th January 2007, 18:15	#14 \| Link
Janvitos Registered User Join Date: Jan 2007 Posts: 55	The LG version that came with the drive. As i said above, the newer standalone version doesn't play the movie well at all.

20th January 2007, 05:43	#17 \| Link
Adub Fighting spam with a fish Join Date: Sep 2005 Posts: 2,714	Yeah!!!!! Way to roll, muslix64! Kick ass!! can't wait till the drives drop down in price though. __________________ FAQs:Bond's AVC/H.264 FAQ Site:Adubvideo Zsmooth - Cross-platform smoothing for Vapoursynth

20th January 2007, 06:19	#18 \| Link
honai Guest Posts: n/a	PWNZ0RZ! The nice thing about Bu-ray is that DD+ tracks are coded differently than for HD-DVD, namely that they contain a DD-compatible core, i.e. ripped DD+ tracks from Blu-ray titles should play fine with conventional A/52 (a.k.a AC3) audio decoders.

20th January 2007, 06:51	#19 \| Link
Galileo2000 Registered User Join Date: Jan 2007 Posts: 224	Amazing. Muslix64 should be served and protected by the freedom-loving HDCP-hating people of the world! Last edited by Galileo2000; 20th January 2007 at 08:02.

20th January 2007, 07:05	#20 \| Link
woah! Registered User Join Date: Oct 2003 Posts: 435	BR is now doing there encodes with the VC-1 codec aswell like hd-dvd does. these are mpeg2 files i assume yes?

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode