DRM Hacking Question--

[makkura]

So, I read just about all 23,000 pages of the DRM10 thread, but it didn't quite answer my question.

If I have the username/password to the DRM'd files, is there anyway to strip the DRM?

The big long thread mainly dealt with trying to crack it w/o having the passwords, etc.

Thanks for your time!

[WarDog]

You might find that answer over at Warez9.com :sly:

[makkura]

Thanks for the reply...

But, er, that website seems to not exist. Unless it's some sort of 1337-code that I'm not cool enough to understand, which is probably the likely story.

Help anyone?

[blutach]

I think WarDog was being sarcastic. Let's keep the focus WarDog please.

Regards

[makkura]

So I guess everyone's just too cool to help someone out.

My mistake.

[blutach]

@makkura - please be polite. Sarcastic posts in return will not get a desired response.

Regards

[WarDog]

I think WarDog was being sarcastic. Let's keep the focus WarDog please.

Regards
Nope, I am not being sarcastic and I am focus. Use to be a site by that name. Dunno what happen to it?

If you don't know everything, don't accuse me of being sarcastic, please!

[blutach]

@WarDog

No-one knows everything. And the OP was not asking about warez.

I am sorry to have to do this, but you are seriously in breach of rule 4.

Strike issued.

Regards

[WarDog]

4) Be nice to each other and respect the moderator. Profanity and insults will not be tolerated. If you have a problem with another member turn to the respective moderator and if the moderator can't help you send a private message to Doom9.
I do not see where I breached this rule in any of my post here in this thread. I replied with an answer and you came back at me with your smart remarks (which you are very well known for).
Maybe I should be the one contacting the administrator here at doom9 about your behavior as a mod when someone says something that is true and you get offended by it and strike out. This is not what I consider very professional of a mod on a highly ranked forum as this one.

WarDog

[viodentia]

So, I read just about all 23,000 pages of the DRM10 thread, but it didn't quite answer my question.
If I have the username/password to the DRM'd files, is there anyway to strip the DRM?
The big long thread mainly dealt with trying to crack it w/o having the passwords, etc.
Thanks for your time!

It is not clear what you are asking, as WMDRM is not password based - although some points may ask for a username/password.

Any WMDRM-encumbered file is encrypted using a 56-bit symmetric key (search out "freeme" for the details). In a header of the file, visible with a hex editor, is a key identifier (KID) and an URL.

When you attempt to use this file, the player searches a database for a license matching this KID. If it doesn't find it, it will load the URL into an embedded IE object. The server may prompt you for an username and password, may check whether you are in the right country, and hopefully provides your player with a license. The player may store this license in a local database.

The license is an XML document which is signed by a private key of a microsoft partner (which, in turn, is signed by microsoft, which in turn is checked by the player), and contains code that determines whether the license is play once, when it expires, and possibly other evils. In addition, the license has a message, encrypted TO a private key hidden in your player, which contains the 56-bit key to decrypt the file (the "content key")

This is great for content providers - you can host a WMV file on any website, even let it be shared on p2p networks, and whenever it gets played, you get usage information (IP/browser type/machine type), and can ask for payment.

If you have WM 10.0.0.3646, you can use solutions based on drmdbg (which goes through Wmplayer's memory image to extract the 56-bit content key (it actually extracts an "expanded" form, called the "SID", although the effect is the same). drm2wmv uses this to remove the encryption from the wmv file itself. There are various tools posted throughout the drm removal thread which automate the drmdbg/drm2wmv process.

All you need the license for is that SID - so it's conceivable that some folks might think that sharing a line of text (the SID) is less of a problem than sharing the actual file. Legit forms (this included) tend to disallow this exchange since it's not necessary for you to play files that you *own*.

[blutach]

@WarDog - contacting Doom9 is your right. You are running the risk of another strike and suspension. Your post has nothing to do with the topic. Please, stay on topic.

Regards

[hellgauss]

@viodentia
Thanks for the sintetic and clear explanation!

Only 56 bit? I thought that it use aes-128.
Do you know what symmetric algorithm is used (maybe DES?)

[viodentia]

Even the latest WMDRM does not use AES as yet.
The technical portion from "freeme" is still accurate in describing the algorithms
http://www.spinnaker.com/crypt/drm/freeme/Technical

The file doesn't cover "chained licenses" - this is just an additional level of DES encryption on the content key), but the rest is still current.

the saga of getting from a KID to a SID ..
ASF File yields KID
KID is looked up in database (drmstore.hds)
XML license is parsed to find "ENABLINGBITS" tag
"VALUE" is decrypted by ECC-160 private key in indivbox.key
decrypted data (56-bits) is hashed in SHA-1 to make SID
SID is used as keys for DES, RC4, and "multiswap"