DRM10 cracked?

vsv · 31st January 2005, 13:07

Information from microsoft.public.windowsmedia.drm

Posted by Satoru Koshiba (JP):
"As far as I survey at this time some popular DRM Protected Video
Providers's contents were cracked...
Many many unlocked video files were distributiong with no payment...

And ...at 17:00(GMT+9:00) anonymous cracker named 'lark' upload source code of 'DRM crack software'
Software name is "DrmDbg.exe" and "DRM2WMV".

DrmDbg.exe will pick up "KID" and "Seed" from PC's memory when user
playback DRM Protected contents , and make "xxxxx.key" file.
DRM2WMV will unlock ProtectedFile using "xxxxx.key"."

Translate this from japanese language:
http://pc5.2ch.net/test/read.cgi/avi/1098298090/

Neo Neko · 31st January 2005, 20:57

Hehehehe. That aught to keep MS busy wasting time developing DRM11. Lord knows they will never learn that DRM is pointless.

Sharktooth · 1st February 2005, 14:04

If it can be watched it can be copied...

arman68 · 1st February 2005, 23:14

Great news! Now, if only our politicians realized that DRM is evil...

Quote:

Originally posted by vsv
DrmDbg.exe will pick up "KID" and "Seed" from PC's memory when user
playback DRM Protected contents

The correct translation is probably something to do with "child" object and encryption "seed"

E-Male · 2nd February 2005, 03:21

so watching HD-WMV files from dvd (for example) is now possible without i-net?

vsv · 2nd February 2005, 11:01

I think this is bad news...
99% of Hollywoods S##t must be DRMed

Goodies always is free!

hartiberlin · 3rd February 2005, 07:32

Can somebody please post a link,
where one can download these 2 programs:

drmdbg.exe and drm2wmv.exe

I have not found them yet.
I want to try them out on some test files.
Thanks !

Regards, Harti.

Elias · 7th February 2005, 15:48

Quote:

Originally posted by Neo Neko
Hehehehe. That aught to keep MS busy wasting time developing DRM11. Lord knows they will never learn that DRM is pointless.

They'll never learn their lesson that all these copy protections are going to get cracked sooner or later. Go ahead Micro$oft, waste another billion dollars on a new copy protection method that'll get ripped up in a matter of months. What a waste of time, money and effort.

k0r0n4 · 10th February 2005, 19:23

Quote:

Originally posted by Elias
They'll never learn their lesson that all these copy protections are going to get cracked sooner or later. Go ahead Micro$oft, waste another billion dollars on a new copy protection method that'll get ripped up in a matter of months. What a waste of time, money and effort.

Indeed. The sad part is that they don't realize how silly this goose chase is. It's just a matter of "who can release faster, M$ or some cracker?" The first hint should just be the fact that they are even up to DRM10 in the first place! Why don't they see what they are doing is pointless? Oh well, M$ does a lot of dumb things, this is just one more to add to a growing list.

hartiberlin · 10th February 2005, 20:11

Quote:

Originally posted by hartiberlin
Can somebody please post a link,
where one can download these 2 programs:

drmdbg.exe and drm2wmv.exe

I have not found them yet.
I want to try them out on some test files.
Thanks !

Regards, Harti.

So nobody has these 2 programs yet ???

Where are they ?

Sharktooth · 10th February 2005, 21:11

hartiberlin you wont find those programs here because it is illegal software.
You better search elsewhere.

stephanV · 10th February 2005, 21:26

also coz it seems to be a hoax

Neo Neko · 10th February 2005, 23:24

Quote:

Originally posted by Sharktooth
hartiberlin you wont find those programs here because it is illegal software.
You better search elsewhere.

Not really. No more illegal than most DVD decrypters etc. For this you have to have the key or license etc for it to work. From the information so far there is no way to brute force it yet. I think the issue is that it is a Japanese site and there are not many Japanese here to read it or search other Japanese sites for it.

Quote:

Originally posted by stephanV
also coz it seems to be a hoax

Always possible. But I would not go that far yet. Apparently there has been talk ok MS Usenet groups about site operators finding their content being distributed unencrypted after they used DRM 10.

lark · 30th March 2005, 15:15

Quote:

Originally posted by vsv
...

And ...at 17:00(GMT+9:00) anonymous cracker named 'lark' upload source code of 'DRM crack software'
Software name is "DrmDbg.exe" and "DRM2WMV".

...

sorry guys, it wasn't me ;-)
t

Yusaku · 30th March 2005, 22:07

Quote:

Originally posted by Neo Neko
Not really. No more illegal than most DVD decrypters etc. For this you have to have the key or license etc for it to work. From the information so far there is no way to brute force it yet.

Well, let's see. Even though I think you are right, there seem to be certain companies that law doesn't fully apply to, microsoft included.

Anyway, attached to this post is a little something I got off of winny. Should an operator approve it, enjoy

Note: I will not reply to any PM concerning these applications - neither asking me to send them, nor usage instructions.

communist · 31st March 2005, 17:02

Since no mod has approved the attachment and I doubt this is going to happen I have only one simple question:
Have you tried the tools and can you confirm that they really remove the DRM from locked files?

Yusaku · 2nd April 2005, 06:09

yes, I've successfully decrypted few trailers from http://www.microsoft.com/windows/win...tShowcase.aspx - it is not a hoax. It is just b**ch to set up.

buzzqw · 2nd April 2005, 08:19

an english help on how to use ?

BHH

Wilbert · 2nd April 2005, 14:33

This is a machine translation. Perhaps there are japanese people here who can provide a better translation?

--------------------

drm2wmv.txt

drm2wmv
It only converts it from ..peel.. data based on the DRM information removal etc. , KID, and SID to reproduce normally.
The DRM licensing twining done on WMP doesn't do anything at all (Decode is excluded).

Up to 2005/02/15 inside in the time limit type
Please teach if there are uncorrespondence and a bug.

drm1\*.key drm2\*.key
(It is execution ahead when the execution file was done. Each all folder is seen though did. )
However.
*/sees only DRM2WMV2 > < < drm2\ = DRM2WMV1 ../.. > < DRM2WMV2>. drm1\ = each < DRM2WMV1>
*Drm2\ is previously seen.

It comes in succession and < KID>abcdefg== < KID > cannot be converted.
(DRM1 doesn't have this in DRM2 in there is only MS sample. )
*KID DRM1=ASCII,KID DRM2=unicode

*Enco ..again.. is legally an out so as not to circulate. data that has released DRM
*I do not think that there is what cracks legally even if circulating though it is one a respondent book with DRM. (If it is the same as the origin. )

drmdbg.txt

------------------------------------------------------------------------------
Drmdbg is a debugger for wmp.
It is for NT, 2000, and XP in the kernel because it cannot wear the memory patch. 9x system cannot use it.
(NT unconfirmed)
-------------------------------------------------------------------------------
[wmp]
Place with exe=WMP(There is wmplayer.exe, too. )
The cash folder of Omoto of ieCache=IE ahead(End \ is not put. )
It disregards it when not is.
It 1 no 0=(When ending, stop)= stops with stop = breakpoint.
Drmclien = breakpoint 1 no 0== is done.
blackbox=
indivbox=
drmv2clt=
wmvcore=

[*.dll] It is possible to correspond to a lot of DLL by changing the content. (DLL for the break is : only by being in ini. )
Crcxx is crc32 of 0-0x400. (Display it. )
Adrxx is an address pulled from the base.
Regxx is a register. (push xx)
Addxx is a numerical value added to the address of the regxx register. (0-place combination is not needed. )
(It is DLL of wmp9 confirmed by 2000 to put as of now. )

*Numerical values are all hexadecimals.
*It is necessary to examine that it is not in crcxx for myself.
*Same Ver picks up with Windows Updata and is different putting. DLL
It differs when other encoder etc. are put.
*Crcxx is written and ok if keeping suitable. (Regxx shall not be corresponding. )
-------------------------------------------------------------------------------
Example of display
-----drm1-----
drmdbg Ver 0.31 by ...
CreateProcess: C:\Program Files\Windows Media Player\wmplayer.exe
010010C0 program entry point
IsDebuggerPresent: memwriteret=1 callret=0
mms://wms4.navi.flets/gsd-area1/sd_12_w_1000.wmv
crc: AC782817 c:\winnt\system32\drmclien.dll
setbp 091B527C 50
crc: 2850B98C c:\winnt\system32\drmv2clt.dll
setbp 09252BCC 50
crc: 0A3A07B3 c:\documents and settings\all users\drm\indivbox.key
setbp 02E17C56 56
eax 01B268A5

<DRM2WMV1>
<KID></KID>
<SID>abcdefg=</SID>
<INFO></INFO>
[mms://wms4.navi.flets/gsd-area1/sd_12_w_1000.wmv]
</DRM2WMV1>

CloseProces
Enter key run
-----drm1-----
-----drm2-----
drmdbg Ver 0.31 by ...
CreateProcess: C:\Program Files\Windows Media Player\wmplayer.exe
010010C0 program entry point
IsDebuggerPresent: memwriteret=1 callret=0
mms://stream3.highq.flets/hellopro/pv/p022/puchi_albu51_1.wmv
crc: 2850B98C c:\winnt\system32\drmv2clt.dll
setbp 09252BCC 50
crc: AC782817 c:\winnt\system32\drmclien.dll
setbp 091B527C 50
crc: 0A3A07B3 c:\documents and settings\all users\drm\indivbox.key
setbp 02EF7C56 56
esi 01B75F10
C:\Documents and Settings\*\Local Settings\Temporary Internet Files\Content.IE5\CLIRSPAB\puchi_albu51_1[1].dat

<DRM2WMV2>
<KID>abcdefg==</KID>
<SID>abcdefg=</SID>
<INFO></INFO>
[mms://stream3.highq.flets/hellopro/pv/p022/puchi_albu51_1.wmv]
</DRM2WMV2>

CloseProces
Enter key run
-----drm2-----

*IsDebuggerPresent cannot be normally reproduced if not becoming memwriteret=1 callret=0.
*It stops in the place of Enter key run at one o'clock.
*The following do not stop if the breakpoint stops once.
(Stop if DLL unloads and the reload. )
*Please pick up from wmv or pick up KID from drm2wmv.
-------------------------------------------------------------------------------
About the ID/PAS confirmation

Please let me approve usually first of all about DRM with the ID/PAS confirmation.
It is ok if it doesn't reproduce after it approves and it reproduces with drmdbg.
..html start standard.. is not tried. Cannot you do for IE?
*It is original window according to indivbox.key.
-------------------------------------------------------------------------------
About blackbox.dll

As for blackbox, the part is encrypted. It decodes before the correspondence is executed.
When DLL is loaded, the break cannot be set.
Because the break is set after it is examined that the breakpoint changes
It is ok if it does several times though there is Miss.
-------------------------------------------------------------------------------
About indivbox.key

C:\Documents and Settings\All Users\DRM\(standard)
It returns to blackbox.dll if the file in the inside is erased.
*Indivbox.key thinks that it changes into a thing different every time it picks it up.
-------------------------------------------------------------------------------
About drmclien.dll

The conversion processing is done with Decrypt at drm1 and search out the place where push is done here, please.
Add xxx and 6d push xxx of win2000+wmp9 are around. Rc4key is processed with call after this.
-------------------------------------------------------------------------------
About drmv2clt.dll

Because drmv2clt is a rapper of blackbox.dll and indivbox.key
Please search out the place where blackbox.dll and indivbox.key are done in call looking for C00D2723.

-------------------------------------------------------------------------------
About Win XP

When canceling if the breakpoint is done to indivbox.key
Drmv2clt.dll is tried.
-------------------------------------------------------------------------------
About the cash of IE

To the cash folder of IE when in real time seeing
It searches out and kid is found because it preserves it temporarily (Remain according to the license).
*Because DRM1 will not be cached maybe, kid cannot be acquired.
*The local file doesn't display the place today.
-------------------------------------------------------------------------------

key2find.txt

There is KID from the key file or key2find is searched out.

key2find kid

drm1\*.key drm2\*.key
(It is execution ahead when the execution file was done. Each all folder is seen though did. )
However.
*/sees only DRM2WMV2 > < < drm2\ = DRM2WMV1 ../.. > < DRM2WMV2>. drm1\ = each < DRM2WMV1>
*DRM2\ is previously seen.

Wilbert · 2nd April 2005, 14:51

I downloaded one of those trailors with drm, but I can't get it to work though.

drm2wmv -v Alexander_Trailer_1080p.wmv

doesn't do anything.

31st January 2005, 13:07	#1 \| Link
vsv Registered User Join Date: Mar 2002 Location: kitchen Posts: 141	DRM10 cracked? Information from microsoft.public.windowsmedia.drm Posted by Satoru Koshiba (JP): "As far as I survey at this time some popular DRM Protected Video Providers's contents were cracked... Many many unlocked video files were distributiong with no payment... And ...at 17:00(GMT+9:00) anonymous cracker named 'lark' upload source code of 'DRM crack software' Software name is "DrmDbg.exe" and "DRM2WMV". DrmDbg.exe will pick up "KID" and "Seed" from PC's memory when user playback DRM Protected contents , and make "xxxxx.key" file. DRM2WMV will unlock ProtectedFile using "xxxxx.key"." Translate this from japanese language: http://pc5.2ch.net/test/read.cgi/avi/1098298090/

31st January 2005, 20:57	#2 \| Link
Neo Neko Registered User Join Date: Mar 2002 Location: Kansas City, Missouri Posts: 1,812	Hehehehe. That aught to keep MS busy wasting time developing DRM11. Lord knows they will never learn that DRM is pointless. __________________ Opensource will not take over the world. But it will sure improve the lives of most of it! _______________________________________________ Inkscape - Scallable Vector Graphics for everyone. The GIMP - Free raster graphics and photo editing software. Planeshift - Free 3D MMORPG. Cause everyone needs some fun.

1st February 2005, 14:04	#3 \| Link
Sharktooth Mr. Sandman Join Date: Sep 2003 Location: Haddonfield, IL Posts: 10,818	If it can be watched it can be copied... __________________ MPEG-4 ASP Custom Matrices: EQM V1(old), EQM AutoGK Sharpmatrix (aka EQM V2), EQM V3HR (updated 01/10/2004), EQM V3LR, EQM V3ULR (updated 04/02/2005), EQM V3UHR (updated 17/12/2004) and EQM V3EHR (updated 05/10/2004) Info about my ASP matrices. MPEG-4 AVC Custom Matrices: EQM AVC-HR Info about my AVC matrices My x264 builds. Mooo!!!

10th February 2005, 21:11	#11 \| Link
Sharktooth Mr. Sandman Join Date: Sep 2003 Location: Haddonfield, IL Posts: 10,818	hartiberlin you wont find those programs here because it is illegal software. You better search elsewhere. __________________ MPEG-4 ASP Custom Matrices: EQM V1(old), EQM AutoGK Sharpmatrix (aka EQM V2), EQM V3HR (updated 01/10/2004), EQM V3LR, EQM V3ULR (updated 04/02/2005), EQM V3UHR (updated 17/12/2004) and EQM V3EHR (updated 05/10/2004) Info about my ASP matrices. MPEG-4 AVC Custom Matrices: EQM AVC-HR Info about my AVC matrices My x264 builds. Mooo!!!

2nd April 2005, 14:33	#19 \| Link
Wilbert Moderator Join Date: Nov 2001 Location: Netherlands Posts: 5,579	This is a machine translation. Perhaps there are japanese people here who can provide a better translation? -------------------- drm2wmv.txt drm2wmv It only converts it from ..peel.. data based on the DRM information removal etc. , KID, and SID to reproduce normally. The DRM licensing twining done on WMP doesn't do anything at all (Decode is excluded). Up to 2005/02/15 inside in the time limit type Please teach if there are uncorrespondence and a bug. drm1\.key drm2\.key (It is execution ahead when the execution file was done. Each all folder is seen though did. ) However. /sees only DRM2WMV2 > < < drm2\ = DRM2WMV1 ../.. > < DRM2WMV2>. drm1\ = each < DRM2WMV1> Drm2\ is previously seen. It comes in succession and < KID>abcdefg== < KID > cannot be converted. (DRM1 doesn't have this in DRM2 in there is only MS sample. ) KID DRM1=ASCII,KID DRM2=unicode Enco ..again.. is legally an out so as not to circulate. data that has released DRM I do not think that there is what cracks legally even if circulating though it is one a respondent book with DRM. (If it is the same as the origin. ) drmdbg.txt* ------------------------------------------------------------------------------ Drmdbg is a debugger for wmp. It is for NT, 2000, and XP in the kernel because it cannot wear the memory patch. 9x system cannot use it. (NT unconfirmed) ------------------------------------------------------------------------------- [wmp] Place with exe=WMP(There is wmplayer.exe, too. ) The cash folder of Omoto of ieCache=IE ahead(End \ is not put. ) It disregards it when not is. It 1 no 0=(When ending, stop)= stops with stop = breakpoint. Drmclien = breakpoint 1 no 0== is done. blackbox= indivbox= drmv2clt= wmvcore= [.dll] It is possible to correspond to a lot of DLL by changing the content. (DLL for the break is : only by being in ini. ) Crcxx is crc32 of 0-0x400. (Display it. ) Adrxx is an address pulled from the base. Regxx is a register. (push xx) Addxx is a numerical value added to the address of the regxx register. (0-place combination is not needed. ) (It is DLL of wmp9 confirmed by 2000 to put as of now. ) Numerical values are all hexadecimals. It is necessary to examine that it is not in crcxx for myself. Same Ver picks up with Windows Updata and is different putting. DLL It differs when other encoder etc. are put. Crcxx is written and ok if keeping suitable. (Regxx shall not be corresponding. ) ------------------------------------------------------------------------------- Example of display -----drm1----- drmdbg Ver 0.31 by ... CreateProcess: C:\Program Files\Windows Media Player\wmplayer.exe 010010C0 program entry point IsDebuggerPresent: memwriteret=1 callret=0 mms://wms4.navi.flets/gsd-area1/sd_12_w_1000.wmv crc: AC782817 c:\winnt\system32\drmclien.dll setbp 091B527C 50 crc: 2850B98C c:\winnt\system32\drmv2clt.dll setbp 09252BCC 50 crc: 0A3A07B3 c:\documents and settings\all users\drm\indivbox.key setbp 02E17C56 56 eax 01B268A5 <DRM2WMV1> <KID></KID> <SID>abcdefg=</SID> <INFO></INFO> [mms://wms4.navi.flets/gsd-area1/sd_12_w_1000.wmv] </DRM2WMV1> CloseProces Enter key run -----drm1----- -----drm2----- drmdbg Ver 0.31 by ... CreateProcess: C:\Program Files\Windows Media Player\wmplayer.exe 010010C0 program entry point IsDebuggerPresent: memwriteret=1 callret=0 mms://stream3.highq.flets/hellopro/pv/p022/puchi_albu51_1.wmv crc: 2850B98C c:\winnt\system32\drmv2clt.dll setbp 09252BCC 50 crc: AC782817 c:\winnt\system32\drmclien.dll setbp 091B527C 50 crc: 0A3A07B3 c:\documents and settings\all users\drm\indivbox.key setbp 02EF7C56 56 esi 01B75F10 C:\Documents and Settings\\Local Settings\Temporary Internet Files\Content.IE5\CLIRSPAB\puchi_albu51_1[1].dat <DRM2WMV2> <KID>abcdefg==</KID> <SID>abcdefg=</SID> <INFO></INFO> [mms://stream3.highq.flets/hellopro/pv/p022/puchi_albu51_1.wmv] </DRM2WMV2> CloseProces Enter key run -----drm2----- IsDebuggerPresent cannot be normally reproduced if not becoming memwriteret=1 callret=0. It stops in the place of Enter key run at one o'clock. The following do not stop if the breakpoint stops once. (Stop if DLL unloads and the reload. ) Please pick up from wmv or pick up KID from drm2wmv. ------------------------------------------------------------------------------- About the ID/PAS confirmation Please let me approve usually first of all about DRM with the ID/PAS confirmation. It is ok if it doesn't reproduce after it approves and it reproduces with drmdbg. ..html start standard.. is not tried. Cannot you do for IE? It is original window according to indivbox.key. ------------------------------------------------------------------------------- About blackbox.dll As for blackbox, the part is encrypted. It decodes before the correspondence is executed. When DLL is loaded, the break cannot be set. Because the break is set after it is examined that the breakpoint changes It is ok if it does several times though there is Miss. ------------------------------------------------------------------------------- About indivbox.key C:\Documents and Settings\All Users\DRM\(standard) It returns to blackbox.dll if the file in the inside is erased. Indivbox.key thinks that it changes into a thing different every time it picks it up. ------------------------------------------------------------------------------- About drmclien.dll The conversion processing is done with Decrypt at drm1 and search out the place where push is done here, please. Add xxx and 6d push xxx of win2000+wmp9 are around. Rc4key is processed with call after this. ------------------------------------------------------------------------------- About drmv2clt.dll Because drmv2clt is a rapper of blackbox.dll and indivbox.key Please search out the place where blackbox.dll and indivbox.key are done in call looking for C00D2723. ------------------------------------------------------------------------------- About Win XP When canceling if the breakpoint is done to indivbox.key Drmv2clt.dll is tried. ------------------------------------------------------------------------------- About the cash of IE To the cash folder of IE when in real time seeing It searches out and kid is found because it preserves it temporarily (Remain according to the license). Because DRM1 will not be cached maybe, kid cannot be acquired. The local file doesn't display the place today. ------------------------------------------------------------------------------- key2find.txt There is KID from the key file or key2find is searched out. key2find kid drm1\.key drm2\.key (It is execution ahead when the execution file was done. Each all folder is seen though did. ) However. /sees only DRM2WMV2 > < < drm2\ = DRM2WMV1 ../.. > < DRM2WMV2>. drm1\ = each < DRM2WMV1> DRM2\ is previously seen. Last edited by Koepi; 10th June 2005 at 15:22.

2nd February 2005, 03:21	#5 \| Link
E-Male mad computer-scientist Join Date: Mar 2002 Posts: 1,377	so watching HD-WMV files from dvd (for example) is now possible without i-net?

2nd February 2005, 11:01	#6 \| Link
vsv Registered User Join Date: Mar 2002 Location: kitchen Posts: 141	I think this is bad news... 99% of Hollywoods S##t must be DRMed Goodies always is free!

3rd February 2005, 07:32	#7 \| Link
hartiberlin Registered User Join Date: Jan 2004 Posts: 63	Can somebody please post a link, where one can download these 2 programs: drmdbg.exe and drm2wmv.exe I have not found them yet. I want to try them out on some test files. Thanks ! Regards, Harti.

10th February 2005, 21:26	#12 \| Link
stephanV gone Join Date: Apr 2004 Posts: 1,709	also coz it seems to be a hoax

31st March 2005, 17:02	#16 \| Link
communist Registered User Join Date: Jul 2003 Posts: 1,141	Since no mod has approved the attachment and I doubt this is going to happen I have only one simple question: Have you tried the tools and can you confirm that they really remove the DRM from locked files?

2nd April 2005, 06:09	#17 \| Link
Yusaku Registered User Join Date: Oct 2001 Location: Czech Republic Posts: 346	yes, I've successfully decrypted few trailers from http://www.microsoft.com/windows/win...tShowcase.aspx - it is not a hoax. It is just b**ch to set up.

2nd April 2005, 08:19	#18 \| Link
buzzqw HDConvertToX author Join Date: Nov 2003 Location: Cesena,Italy Posts: 5,959	an english help on how to use ? BHH

2nd April 2005, 14:51	#20 \| Link
Wilbert Moderator Join Date: Nov 2001 Location: Netherlands Posts: 5,579	I downloaded one of those trailors with drm, but I can't get it to work though. drm2wmv -v Alexander_Trailer_1080p.wmv doesn't do anything.

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode