FairUse4WM - a WM/DRM removal program

[protectyoursources]

Ah the Wonders of Microsofts Machine based DRM .

Microsoft in thier infinite wisdom use components in your PC as a indentifier .

If you replace your CPU and Motherbaord Mirsosoft considers that to be a new PC .

Contact your service provider and they might issue with new licences if you are nice .They might deactivate your old machine and activate your new one but its a right pain in the arse .....

Or just UnDRm them ;).

[Zenitram]

My view is that unDRM is perfectly legal.
If you get files that have copyrights then getting the files is illegal not unDRM them.
There are many valid cases where you would want to unDRM files.
In France, even for valid cases, it is forbidden to unDRM a file (this is explicitly written in the new DADVSI (http://en.wikipedia.org/wiki/DADVSI) law)
We are testing the reality with stopdrm.info (http://stopdrm.info) team (we have written to Microsoft and Apple about a website which provide FairUse4WM and QTFairUse, we are waiting for the reply :) )

[dirtminer]

so much for FU4DRM - Microsoft has finally released a significant upgrade to their components. They haven't updated the IBX number, so everyone reporting problems has the new version.
http://www.engadget.com/2006/09/25/microsoft-claims-successful-patch-against-fairuse4wm-1-2/

[garyhasbigfeet]

Another good reason to turn "automatic updates" Off!

Hopefully mayang can release a new patch to fix it.

[driftr]

so much for FU4DRM - Microsoft has finally released a significant upgrade to their components. They haven't updated the IBX number, so everyone reporting problems has the new version.
http://www.engadget.com/2006/09/25/microsoft-claims-successful-patch-against-fairuse4wm-1-2/

Sounds about right. I've built a test box and clean installed XP SP2 and am then finally able to extract a key from clips at ezdrm.com. I still have to get an update when I indiv. the box and have to download wmp10 but that's about it.

However my main goal is to attack my amazon unbox wmv and have yet to have success. Only have one file and no version of FU will work. Heck I'd buy more from them if I could remove the drm... anyone with unbox success have any tips?

[protectyoursources]

Looks like there will be an Update this week ;)



The Engadget Interview: Viodentia, creator of FairUse4WM

Posted Sep 25th 2006 1:03PM by Ryan Block
Filed under: Features, Interviews, Portable Audio, Portable Video
Instead of our usual run of interviews with industry luminaries and the like, today we're aiming the camera a different direction. We had a few things to ask the person whom we've identified as Viodentia, the creator of FairUse4WM -- the thorn in Microsoft's (and Yahoo's, and Napster's, and Real's, etc.) digital media business for a month now. Seems at once likely and not that the big DRM scheme developed by the largest software company was broken and broken again by a single person, but here we are -- and here's what Viodentia had to say about the digital music business, where Microsoft went wrong with PlaysForSure, and what s/he thinks about this latest memo and patch.

Thanks for granting this interview. So FairUse4WM caused quite a stir. How long did it take you to crack Microsoft's PlaysForSure DRM? Was anyone else involved?

Finding a way to extract key information took about a couple of weeks of spare time. Going from a prototype to a more general tool took a couple of months. I am the only developer, although my friends served as early beta testers and sounding boards, and with the initial release I've gotten to know some very helpful people.

So apart from any ideological or political distaste you may have for DRM, do you have any personal reasons for wanting to crack Windows Media DRM? Like, are you a Rhapsody or Napster subscriber?

No, due to geographic location, I'm unable to subscribe to those services. Only my selfish rationale is the challenge in pitting my skills against the industry leader.

Without revealing the secret sauce, what were the fundamental flaws with PlaysForSure that allowed you to break it? Did Microsoft know about these flaws?

Once code is released, there's really nothing secret anymore -- Microsoft didn't follow standard security practices, and left sensitive data unencrypted on the stack while calling routines out of kernel32.dll. Even when they fix this by changing malloc() to alloca(), it'll still be a big task to audit other sensitive routines for DLL calls. On a theoretical level, they have to send the decryption keys outside of their control, and their only defense is through obfuscation.

Microsoft apparently has teams working around the clock to fix the vulnerability -- and on the legal front they've started getting their lawyers involved, sending C&Ds to places hosting the software. What do you think of their responses to FairUse4WM?

I think they're fulfilling their contractual obligations, and I'm looking forward to their improved obfuscation technology. I certainly disapprove of Microsoft claiming copyright to my program, but realistically I can't do much about that. Nor can I advocate that folks mirror my program against their local laws.

Presently Microsoft has yet to been able to fix this vulnerability -- is it possible for them to repair PlaysForSure without totally starting over?

As soon as I release something, Microsoft can certainly patch around it. I can do the same. I don't believe that either of us has a nuclear option.

What do you think of Microsoft's latest memo, which claims to patch version 1.2?

I'll reserve full commentary until I've had a chance to examine the new IBX in more detail. I'll release a new version sometime this week.

How do you think FairUse4WM affects the industry? Do you worry that cracking PlaysForSure is going to lead to the end of subscription-based services?

I think FairUse4WM is a good thing for the industry -- it demonstrates that the entire world doesn't turn upside down when there's no effective protection on content. I doubt subscription based services are impacted -- programs exploiting the analog hole were already widely spamvertised. The value of a subscription is the continuing access to new titles, which isn't dependent on the protection. I wonder if any subscription company will publicly admit that FairUse4WM was good for them.

Microsoft supposedly has a new DRM scheme they've cooked up for their forthcoming Zune media player. What do you think about their jettisoning PFS for their own device, and this new DRM system of theirs?

I don't have any insight into the politics at Microsoft. If I come across a Zune, I might have more comments on their DRM system at that point. :)

I know a lot of people at Microsoft and its PlaysForSure partners read us -- what do you have to say to them?

I think the biggest mistake with the PlaysForSure / WM design is that it's targeted too broadly. By incorporating forced product obsolesence and platform restrictions, it misses the mark in managing content rights. My suggestion to future designers is simple: don't bother with weak client-side decryption. Instead, provide a public specification for licenses using digital signatures, manage the PKI through a not-for-profit organization, and apply social and legal pressure to programs that don't comform. Accept that folks can trivially patch around the system, but if the restrictions aren't onerous most people won't go through the hassle. If WM files were already interoperable and the license terms were clearly communicated, there wouldn't be anything left for a program like FairUse4WM to accomplish.

Thanks!

*

*
http://www.engadget.com/2006/09/25/the-engadget-interview-viodentia-creator-of-fairuse4wm/#comments[/B]

[AudioFreeq]

Thanks much for the advice...

OK, I found something.

Getting the "unhandled situation" error when I clean.
Assume that means my WMP has been updated?

[blutach]

Interesting interview

Regards

[UsedUser]

I have files with licenses I can no longer re-download. The music store closed down and the servers quit issuing new licenses.

I have working licenses and the files play fine in WMP9. I can't re-individualize or upgrade, or AFAIK, the licenses I have will no longer work, and they are the only licenses I will ever have for these files.

DrmClien.DLL v9.0.0.3250
IndivBox.key v8.0.0.4477

Perhaps because of the old version of the IBX, I have no drmstore.hds file.

I get the following errors:

FU4WM 1.1:
When trying to recover keys:
Pop-up titled "Unable to recover private key".
Error msg: "Windows Error 80030002 while DRM_HDS_OpenStore".

Somehow I get 2 keys in blackbox-keys.txt anyway.

When trying to decrypt:
"UNABLE TO DECRYPT: Windows Error 80030002 while DRM_HDS_OpenStore."

FU4WM 1.2:
When trying to recover keys:
Pop-up titled "Unable to recover private key".
Error msg: "Unhandled situation -8600 while Creating Windows Media instance."

Somehow I get 2 keys in blackbox-keys.txt anyway.

When trying to decrypt:
"UNABLE TO DECRYPT: Windows Error 80030002 while finding KID in V9 store."

DecryptIt opens the file in WMP, plays the file, closes WMP, and loops infinitely. Running drmdbg does nothing. I get a bunch of CRC statements in the cmd window, but then nothing happens. Nothing is written to the drm2 folder.

Anybody able to help? Much appreciated.

[krystof]

Hi guys !
Thank you very much for this great program !!!
And congratulation to Viodentia !
This program ( 1.2 fix) works with WMP ( 9.00.00.3250version ).
It' s so easy !!!
Thank you so much !!
Excuse my english, i' m french !
Does somebody know which upgrade from micro$oft can failed Fairuse4wm ?
Then, i won' dowloaded it.
Thank you !

[xpigeo]

im using 1.2 fix
and when i go to to recover the key for a music file
wmp 11 (beta 2) just freezes at the opening media screen
it doesnt exit automatically and if i close it manually then fu4wm stops responding
if anyone can tell me how to fix this then thank you
o ya heres all the information that pops up when i go to recover keys

at the extract DRM v1 keys window it says
DrmClien.DLL v10.0.0.3802

at recovering unique identifiers screen it say
Indiv01.key v11.0.5497.6285

I'm having the same problem. It had worked fine until I reinstalled my windows last week. Does anyone know how to fix this problem?

[rjamorim]

Version 1.3 is coming soon http://pessoal.onda.com.br/rjamorim/devil.gif

Actually it's already at my server, but I'll wait for viodentia to announce it.

[viodentia]

As some of you have encountered, Microsoft has released a new individualization version, without updating the IBX version number. This would cause the "Unhandled Situation -9000" error, as this new code has some minor differences.

This new version uses a new extraction approach, courtesy of c0redump. The method no longer requires the selection of a DRM protected file, and should retrieve all ECC keys at once.

FairUse4WM has been my own creation, and has never involved Microsoft source code. I link with Microsoft's static libraries provided with the compiler and various platform SDK files.

Thanks for Rjamorim for graciously hosting in Brazil.
http://pessoal.onda.com.br/rjamorim/FU4WMver13.zip

12815576c78a799114025b3b266dd156 *FairUse4WM.exe

[smsmasters]

EDIT: Works now

[rjamorim]

Thanks for Rarejim for graciously hosting in Brazil.

It's rjamorim, dude. Roberto José de Amorim :P

[sillKotscha]

but Rarejim sounds nice too :-P

[seanyseansean]

So has doom9 been subpoenad for IP addresses and stuff yet?

smsmasters: As i understand it the website you got that file from is a subscription service which terminates access to the porn once you stop paying. In which case you might want to read doom9's TOS.

[vice101]

hey guys..
i've got a few questions that i'd like to ask you guys
first of all, wat's this "individualization" that u guys've been talking about (sorry but i dont know much about computer)
and if anyone could write a step-by-step guide for me newb that would be very much appreciated

thanks

[Bend But Don't Break]

Glad to see 1.3, already have it in my grubby little paws. The one thing I still can't do, though, is apparently get past the DRM on the oldest of the files that I purchased, which apparently were done under WMP 9 DRM. I get the error about being unable to truncate the file. How does one remedy this?

Viodentia, once again - thank you. I continue to keep my purchased files to myself, only now I can listen to them more freely. You're a life saver!

[George64]

Hello,

I'm trying to use WMA-files from www.surf2music.nl. I'm using version 1.2 fix
The system check they perform worked out well. I downloaded my first album, no problem. I can play it as well. Than I started fairuse2wm:
- programms starts
- say's something that the license file is not avilable (I'm not sure because I cannot check it from this pc) and that I have to click the large button, so I did
- programm gives message about DLL. Clicked ok
- Programm askes for licened wma-files
- Went to the directory were I downloaded my wma-files to, and clicked on one of the files
- media player opens, and say's opening sourse
- no music to be heard and fairuse2wm hangs (based on the task manager)

I have:
DrmClien.DLL 10.0.0.3802
Invidbox.key 11.0.5497.6285
Windows Media Player 10.00.00.4036


Can anyone help?

Thnkx

[viodentia]

I apologize for the typo, rjamorim.

"not licensed to you" errors -

This is because the supplier of the WMV wants to track viewers. Some bonus tracks apparently choose to do this so they can get statistics on their audience or possibly for more nefarious purposes.

To work around these one-play license -
- Set your Wmplayer to prompt on license acquisition
- Open the file, and let Wmplayer acquire the license
- Do NOT click "Play", leave the Wmplayer license window open
- While the window is open, you can use FairUse4WM on the file


For the "truncated" errors -
I have plans to better handle ASF files that don't conform to the standard. I didn't get that implemented in time for this version.

[AudioFreeq]

As some of you have encountered, Microsoft has released a new individualization version, without updating the IBX version number. This would cause the "Unhandled Situation -9000" error, as this new code has some minor differences.

This new version uses a new extraction approach, courtesy of c0redump. The method no longer requires the selection of a DRM protected file, and should retrieve all ECC keys at once.

FairUse4WM has been my own creation, and has never involved Microsoft source code. I link with Microsoft's static libraries provided with the compiler and various platform SDK files.

Thanks for Rjamorim for graciously hosting in Brazil.
http://pessoal.onda.com.br/rjamorim/FU4WMver13.zip

12815576c78a799114025b3b266dd156 *FairUse4WM.exe


(:-D)

[skal]

http://www.robots.engadget.com/2006/09/26/microsoft-sues-viodenta-for-copyright-infringement/

(rhetoric question: imagine fairuse4wm.exe being propagated using IE's long-standing 0-day or VML exploits, would MS sue everybody that has IE installed?)

[rjamorim]

but Rarejim sounds nice too :-P

Your avatar is nice. Everything else is secondary :cool:

[josh2]

Awesome! Thanks for the new version viodentia. Working perfectly. The new key extraction process is SLICK.

There is only one thing that is semi-bugging me about FairUse4WM.. and that is that I can't set a path for the output files that FU4WM will remember. Is there any way I can add a path (my desktop) to the output path list, and have it stay on the list?

Josh

[smsmasters]

I apologize for the typo, rjamorim.

"not licensed to you" errors -

This is because the supplier of the WMV wants to track viewers. Some bonus tracks apparently choose to do this so they can get statistics on their audience or possibly for more nefarious purposes.

To work around these one-play license -
- Set your Wmplayer to prompt on license acquisition
- Open the file, and let Wmplayer acquire the license
- Do NOT click "Play", leave the Wmplayer license window open
- While the window is open, you can use FairUse4WM on the file


For the "truncated" errors -
I have plans to better handle ASF files that don't conform to the standard. I didn't get that implemented in time for this version.

WOW, it worked! By the way, you're famous now.

[Nqon]

Thanks for all the hard work! works fine for me!

Is it anyway to donate?

[George64]

I have a Dutch version of WMP. Where can I find the option:
- Set your Wmplayer to prompt on license acquisition?

www.surf2music.nl pop ups a window where I have to enter my user-id + pwd. If I don't enter this information, nothing is going to happen. Do I overlook something?

Thnkx

[rjamorim]

Thanks for all the hard work! works fine for me!

Is it anyway to donate?

That would probably make it all to easy for Microsoft - and whatever else holds a grudge against viodentia - to track him down and bring him to court.

[George64]

:eek: started the new version of FU4WM, and it worked! :thanks:

[usual_suspect]

Hi, I'm having problems. When I try to recover keys, the window pops up saying that fairuse has to close, gives the options to debug, send error report etc. This pops up as soon as it says testing 1282 possibilites for primary private key. Any ideas? cheers

[Unquist]

Viodentia: you're a genius sir! Thanks for the kick ass software.

[mayang]

It is ashamed on microsoft, that they claimed their source code was stolen to create Fairuse4WM.

"It does not need any access to the source code as Microsoft alleges in their federal lawsuit. It is totally not necessary to see the source code to execute this tool.

For those of you who are real software and crypto geeks, you know that the explanation makes perfect sense and leads one to suspect the allegations of source code theft. But then again, this is merely my opinion." ....GoodStorm

[protectyoursources]

Make Sure you Digg the engadget story

http://digg.com/tech_news/Viodentia_responds_to_Microsoft_releases_FairUse4WM_1_3#c3223201

[usual_suspect]

Hi agen, i worked out that i needed to be playing a drm file in wmp before i clicked start. are there any ways to get the keys for '-not licesnsed to you files' in 1.3?

[mayang]

Hi agen, i worked out that i needed to be playing a drm file in wmp before i clicked start. are there any ways to get the keys for '-not licesnsed to you files' in 1.3?

If the program say "not licensed to you" it mean you have not a valid license for the media. Please don't ask about this again. This tool as it name is Fair Use for your purchased media, hope this clearly to understand this tool is not a hacking tool.

USE THIS ONLY ON FILES THAT YOU *OWN*

[protectyoursources]

If the program say "not licensed to you" it mean you have not a valid license for the media. Please don't ask about this again. This tool as it name is Fair Use for your purchased media, hope this clearly to understand this tool is not a hacking tool.

USE THIS ONLY ON FILES THAT YOU *OWN*

I have some protected media that I legitamtly own that have been issued with invalid\incorrect licences from a content services DRM clearance house , so this person could be trying to excerise thier fair use rights and make thier media work like it is supposed to.

If you didnt get the protected content legitamtly then refer to rule 6.

[driftr]

I'm also getting the "UNABLE TO DECRYPT: Packet truncated, 1553400203 needed, 66 remains, at offset 25" error with 1.3. So 1.3 fixed getting the key which I couldn't do before, but now all versions give that error. This is on amazon unbox avis not asf files.

[usual_suspect]

sure thing, i wont try to use fairuse on any files that i dont own. as a matter of fact the files that brought up this error are owned by me, i bought them over napster- note i bought not rented.

[mayang]

If you sure you have the right or license installed for the media and you get this type of message or error please refer to this steps.
http://forum.doom9.org/showpost.php?p=880589&postcount=271

If still not work, you are not lucky because there are various protection scheme on DRM (restriction) such as limiting to date and number of plays as well as the permission to transfer to a portable device.

Look at this
_http://www.buydrm.com/demo.php

Pay Per View
Allows content owners to sell their content in a Video On Demand Format where customers buy access to a singular file at a time.

TOKEN
Allows content owners to sell their customers tokens instead of selling them files. When a customer plays a file, KeyOS subtracts the appropriate number of tokens from the customers account. When all the tokens are used, the customer is denied access to the content, until they buy more tokens.

SUBSCRIPTION
Allows content owners to sell their content in a Membership Type format. The content owner can allow users access to their entire content collection for a set period of time. When the time period expires, customers are denied access to the content, until they re-purchase access, or re-billed.

MARKETING
Allows content owners to give content away for free, but only after users have entered key demographic information such as age, gender, and email address.

SILENT
Allows content owners to protect their content with out forcing the user to perform any actions in order to get a key. This model allows content owners to freely distribute their content, but track the content, and expire the content globally at some point in the future.

PRE-DELIVERY
Using our Pre-Delivery Code for Membership sites, available in PHP or ASP, you can now seamlessly deliver a license directly to an enduser through Internet Explorer 5+, without compromising the overall end-user experience.

[Danj]

Some more details on the lawsuit Microsoft has filed against "John Does 1-10 a.k.a viodentia" have shown up on the web here (http://blog.seattlepi.nwsource.com/microsoft/archives/107132.asp) in PDF format.

[viodentia]

For the v11 individualization, v2ksndv.bla (or v2ks###.bla) is now an XML file. There are two tags of particular interest, the first 40 bytes of "c:PKCert" is the public key for ECC encryption and the "Keys" which stores all the secondary keys.

Each time you re-individualize, the DLL sends "escrowed" key information to Microsoft's servers which decrypts it and re-encrypts it inside this secondary key table. These are all the keys for previous individualizations.

The <Keys> tag is encrypted with AES in Counter mode using the displayed key. To decrypt, create a 16-byte BIG-ENDIAN counter (that is, 16 bytes of 0, next would be 15-bytes of 0's and one 1 byte, and so forth). Encrypt that with the AES key. XOR the output with the next 16-bytes from the tag.

Once decrypted, the Keys tag holds a XML document which in turn has both the old ECC keys (which v1.3 happily extracts for you), and some RSA keys - the RSA keys are apparently new for v11, and I don't know what they're for.

By the way, if one looks at the individualization process in Wireshark, it's conceivable that future individualizations can be handled with the assistence of Microsoft's own servers.

[rakesh]

Dear Viodentia you're a genius sir! Thanks for the kick ass software. Indeed one of the most amazing software I have ever used. HATS OFF TO YOU MY DEAR SIR.

[blutach]

Thanks for the update viodentia!

Regards

[valiant2]

Viodentia.......

Your new version works a treat....thanks. I hope the rest of this post isn't considered to be off-topic (if it is then, mods, feel free to delete it); but I feel some things need to be said/asked.

I hope you realise how many people are 'lurking' in this thread (the number of hits must be tasking the server!) and I hope you also realise how grateful hundreds/thousands of people like me are to see Microsoft's DRM strategy finally being made a fool of........it's a fascinating story and absolutely fascinating to watch! I've been glued to Google News for the past few weeks. Please don't be tempted to take ANY risks with your anonymity......there ARE temptations.....I'm sure you realise how important it is to ignore them, no matter where you live. Infamy can be an addictive drug. With those guys on your tail you need to be fastidiously careful.....we can't lose you!

I hope you're also aware of the extent of the support you have. If you need any help to keep this up (whatever it might be) then I hope you realise how easily you can get it. I hope you know that all you need to do is ask. It must take a lot of your time to analyse the code. Why not break some of the more tedious bits of it up into bite-sized pieces and publish your need for analysis (on Usenet or something). I get the impression that secrecy isn't a problem or a particular issue.

I've read all your posts on here and your interview with Engadget but if you find the time I'd really appreciate your views on the following. It's basically all part of the same question:

Realistically, how long do you think that you (or anyone else who's capable of taking the baton) can keep this up? Indefinitely? Everyone realises that Microsoft are SERIOUSLY embarrassed and you don't have to be a genius to realise that they'll probably respond by throwing a floor of programmers/money at the problem but, in the context of your statement to Engadget that "their only defense is through obfuscation", how likely is it that they could 'obfuscate' successfully enough in the near or distant future to make a future version of FairUse4WM take months (rather than hours) to develop?........even in the context of a team effort by those who you could recruit to help?





Valiant

[Lord_KiRon]

According to this http://www.cdfreaks.com/news/14031 - Microsoft sues viodentia for "code theift" since they do not know any other way he could hack their patch that quickly :)

What a morrons, I guess while sue itself has no basis it's all about reviealing his identity, after that they will try either to "buy" him or intimidate him.

viodentia , my advice - please give your sources to someone so if something happen to you (hope not, but you know "legal stuff") this "Someone" will publish them on the net without your knowlege so people could continue to develop and we will not end up with situation like with DVDDecripter.

Also you might consider using Tor ( http://tor.eff.org/index.html.en ) free anonimization network .

And for DOOM9 I think it would be wise to delete the logs and their backups before some court demends to hand them over.

[PatheticCockroach]

so people could continue to develop and we will not end up with situation like with DVDDecripter.
Yes, that would be a pity. RIP DVD Decrypter... :(

[Zenitram]

FairUse4WM has been my own creation
Is it possible to have the source code of FairUse4WM?

[garyhasbigfeet]

Is it possible to have the source code of FairUse4WM?
I'm sure if it was V would have released it by now.

Just enjoy the ride and once M$ really gets serious I'd imagine
Viondetta will post it up on Sourceforge, Smartpunters, Rapidshare, Megashare, and just about any other filestoring/blogging sites that hold more than 1mb of file :)

[vice101]

hey guys..
i've got a few questions that i'd like to ask you guys
first of all, wat's this "individualization" that u guys've been talking about (sorry but i dont know much about computer)
and if anyone could write a step-by-step guide for me newb that would be very much appreciated

thanks

anyone care to help me out ?? T-T