BackupHDDVD, a tool to decrypt AACS protected movies [Archive] - Page 14

oddball

13th January 2007, 03:46

To beat the system I'm guessing you would need a hacked firmware that stops the revocation process from happening. Newer titles will likely contain lists of revocated keys etc?

Someone please explain in laymens terms how the new system works. I never understood the technical docs.

Shinigami-Sama

13th January 2007, 03:48

So if the players key in question gets revoked. Would any of the keys now found be any use in future players for tracking morei? or would a new players key get totally different results on the exploited discs?

doesn't matter if the player keys get revoked because the volume Unique and Title keys are on the disk - player keys are used to tell if the player is allowed to use the vku or tk

and its great to see that it was as simple to find the keys as I though it would be. It just makes sense that it'd have to be in memory and work like every other digital system out there

Adub

13th January 2007, 04:03

Yes!! Excellent job guys! I will order a Xbox 360 drive myself now. Excellent work!

woah!

13th January 2007, 04:12

great news :)

how do you config the key file exactly tho, as i cant seem to get it to go... me stupid... do i need to still find out the date etc from the king kong disc?

oddball

13th January 2007, 04:13

From what I understand when newer discs come out they will require you to play them with newer more secured software. You won't be able to use the software with the exploits to playback newer titles. It will be a game of cat and mouse as people try to find the newer methods of where they hide the keys.

Jerky_san

13th January 2007, 04:17

I don't think thats on HD DVD.. unless the software people do it.. Blue Ray on the other hand is a whole different story all together.. But what your going to have to worry about on HD DVD is the revocation of the player key which forces you to get those new software updates..

oddball

13th January 2007, 04:19

Effectively the same thing. Newer titles will require upgrading to play. Otherwise you are stuck with your old titles.

calinb

13th January 2007, 04:25

doesn't matter if the player keys get revoked because the volume Unique and Title keys are on the disk - player keys are used to tell if the player is allowed to use the vku or tkOkay, congrats to those who have won round one and yes--the keys are on the disk, but they are encrypted keys on the disk. We still need an (unrevoked) player to decrypt new keys for us or even play old encrypted disks. If your player is revoked, it's end of round one; you won't even be able to play old titles! Here's why: Take a look at Fig. 4-1 of AACS_Spec_Common_0.91.pdf. It appears that the drive holds a Host Revocation List and the host holds a Drive Revocation List. Maybe I'm missing something here but it seems that the first time you place a disk that contains any given player in its revocation list into the drive, that player will forever more no longer function with that drive--even after a fresh reinstall of the player software. Drive firmware hacks may soon be useful.

The_ByteMaster

13th January 2007, 04:32

Effectively the same thing. Newer titles will require upgrading to play. Otherwise you are stuck with your old titles.

Unless the content gets revoked, the newer player will always have to determine the Volume Unique Key to decrypt the Title Keys. So unless your Serenity, King Kong and whatever else is compromised gets revoked, you *know* that at some point your new player will have to use that key. This will help to a large extent in compomising the new player (which will, in turn, compromise even more content). This is an avalanche that is hard to stop.

13th January 2007, 04:38

Yes!! Excellent job guys! I will order a Xbox 360 myself now. Excellent work!

No no!!! Don't order the 360... Just the Drive :)

Adub

13th January 2007, 04:53

Oh, right. Okay I mean the drive. And then Hi-def hear I come!

muslix64

13th January 2007, 04:58

Congratulations!
So now you see BackupHDDVD is not a fake...
Now we have to make movies with the IME feature playable with PowerDVD.

Then, ... BD+!

Adub

13th January 2007, 05:04

Thanks alot for the program Muslix64!
And I share your want for IME and ... BD=!
Excellent job everyone!

oddball

13th January 2007, 05:11

Remember guys. You read it here first. Another notch in the history of the digital copyright wars. ;)

woah!

13th January 2007, 05:21

well i was missing the SHA1 hash number and now king king is working on a non-HDCP vcard in powerdvd... amazing stuff guyz...

dont know how long this will work but hats off to all of you that know your stuff. i like video encoding but the heady stuff i know little about.

Testing source
Found valid HD-DVD source.
Look for this movie in my database
Found movie: KING KONG
Start backup on Fri Jan 12 20:00:13 PST 2007
Scaning video directory
Processing BLACK.EVO key = 3
Processing DELOGO.EVO key = 5
Processing MAINMENU.EVO key = 1
Processing MENULOOP.EVO key = 1
Processing SCREENSAVER.EVO key = 6
Processing UCONTROL.EVO key = 7
Processing UNILOGO.EVO key = 2
Processing FEATURE_1.EVO key = 4

oddball

13th January 2007, 05:25

Dammit guys it's 4:25am here and I don't want to go to bed this is so damned exciting! :)

moshmothma

13th January 2007, 05:29

Using what has been posted I am ripping Serenity. Is Powerdvd the only plahyback mechanism. There seems to be some directshow filters but not able to make them work in graphedit.

Please keep the keys coming (especially since I can't get Windvd to work ;(

Adub

13th January 2007, 05:31

Ha! Drink some coffee, take some artificial adrenaline, whatever you can do stay with us!

Okay, so what is the next step? Coding a program to do this automatically for us non-debugger smart people?

rbmcgee

13th January 2007, 05:35

In the war of HD-DVD vs Blu-Ray ... it looks like I'm going with HD-DVD.

Well done.

I agree, we need a program so that us technically challenged individuals can play as well.

oddball

13th January 2007, 05:43

Does anyone know how to get around the chain nav lag?

setarip_old

13th January 2007, 05:47

Again, as an outside observer, I'd like to congratulate those of you who have actively participated (and are still participating) in this remarkable accomplishment - and also in such a remarkably short period of time!

What is most impressive to me is how foreshortened the effort became once the teamwork truly started amongst you.

If I wore a hat, it would be off to all of you - Great Work ;>}

(Looking forward to the GUI and underlying program)

woah!

13th January 2007, 06:06

moshmothma

13th January 2007, 06:09

Could someone help me with playback? I noted none of the map files were moved over with backuphdvd. Is this normal? I just copied them from the hddvd but that does not seem right. Playback with Cyberlink yields a blank screen. Thanks

VistaVick

13th January 2007, 06:23

yes it would seem lag is a major issue now on the backed up EVOB's. the menu evob seems to play fine but the feature is terrible with spikes in the bitrate upto 300+ mbps :(

still we cant run before we can walk :)

Plays ok for me, a few glitches here and there, though I have a very fast cpu and graphics card.

However, I imagine these will be commonly converted to different formats that play more smoothly.

woah!

13th January 2007, 06:27

Plays ok for me, a few glitches here and there, though I have a very fast cpu and graphics card.

However, I imagine these will be commonly converted to different formats that play more smoothly.

i suppose my quadcore isnt fast enough :(

i have a X1800XT vcard bolted to it. it might be the sound thats the problem then maybe?

luders

13th January 2007, 06:28

Applying the following solution to my Vista and Java 6 setup fixed the problem with running BackupHDDVD incase anyone has the same error.

http://forum.java.sun.com/thread.jspa?threadID=5120332

hajj_3

13th January 2007, 06:30

maybe a program can be written to find these keys out as the average person wont be able to do this.

OR (if not technically possible)

create a detailed pdf guide with screenshots showing how to do this.

ALSO: get posting more movie's in here with there keys, create a list.
ALSO: if anyone get a hd-dvd writer test it by trying to burn a backup of the hd-dvd you just unencypted. imagine seeing that on youtube of a guy burning a hd-dvd and then playing it, how cool would that be!!!
ALSO: whens the next version of backuphddvd coming out??? maybe you could get the program to auto search for keys or atleast make a GUI for the current version.

do playback work on non-hdcp capable monitors, i know you said it works with non hdcp capable graphics cards, but what about monitors?

there are very few gpu's that support hdcp only 8800 series, some of 7600gt's, x1650 pro saphire i think.

there are only 2 gpu's that have hdmi out too, 1 7600gt and 1 x1650 by saphire. i hope to see alot more hdmi outputs and hdcp capable cards soon.

i think we should create a table with hd-dvd's that work with this program and those which dont!

woah!

13th January 2007, 06:49

well ulead moviefactory 5 can author TO hd-dvd format but cant READ from a EVO file? so it can make one but cant read one...

Shinigami-Sama

13th January 2007, 07:05

Okay, congrats to those who have won round one and yes--the keys are on the disk, but they are encrypted keys on the disk. We still need an (unrevoked) player to decrypt new keys for us or even play old encrypted disks. If your player is revoked, it's end of round one; you won't even be able to play old titles! Here's why: Take a look at Fig. 4-1 of AACS_Spec_Common_0.91.pdf. It appears that the drive holds a Host Revocation List and the host holds a Drive Revocation List. Maybe I'm missing something here but it seems that the first time you place a disk that contains any given player in its revocation list into the drive, that player will forever more no longer function with that drive--even after a fresh reinstall of the player software. Drive firmware hacks may soon be useful.

I was under the impression from the quick glance I had the chance to grab that the volume unique keys would work with any player
once we've gotten them we have them and no longer need the player Key

as for the drive, I'm sure there will be a flash dump made so you just reflash it after every 'update' to the revoke list

tonyp12

13th January 2007, 07:15

Adub

13th January 2007, 07:27

Yeah, I would just stick with the latest stock update form java, nothing fancy.

luders

13th January 2007, 07:38

Isochroma

13th January 2007, 07:56

Try this: HashCalc (http://www.slavasoft.com/hashcalc/index.htm)

tonyp12

13th January 2007, 07:57

What I'm missing from this?

0e75082678aad5cd4410a28a662d6832d21eb325=KING KONG |V|MM/DD/YY|802F78B1B20D1183638D84E1A96D6EDD

Adub

13th January 2007, 08:04

nothing. The date is not necessary. Or are you recieving and error?

alanisrox69

13th January 2007, 08:06

What I'm missing from this?

0e75082678aad5cd4410a28a662d6832d21eb325=KING KONG |V|MM/DD/YY|802F78B1B20D1183638D84E1A96D6EDD

I believe the hash is case sensitive...so

0E7.....

you can also change the date to 00/00/00

jokin

13th January 2007, 08:08

Ok, now that this is proven to work, could someone post a semi in-depth tutorial on what to do and what to look for.

Thanks

tonyp12

13th January 2007, 08:09

nothing. The date is not necessary. Or are you recieving and error?

"can not find in in my database, please update your key file"

luders

13th January 2007, 08:10

Yes that is because it has to be all caps as was said.

luders

13th January 2007, 09:07

You guys having any trouble with the decrypted King Kong feature evo's?
They dont play back for me in PowerDVD 6.5 HD but the Serenity evo's do.
This is what I have so far.
C8A57242AF4CB5C0D7848BDA10821F984DC656E0=Serenity |V|MM/DD/YY| D075568AE6BB0B3F85446927B3794C28
0E75082678AAD5CD4410A28A662D6832D21EB325=King Kong |V|MM/DD/YY| 802F78B1B20D1183638D84E1A96D6EDD
0000000000000000000000000000000000000000=12 Monkeys |V|MM/DD/YY| 2662C05B5238B0C50BD1BDF693223712

oddball

13th January 2007, 09:10

Not full res but you get the drift. BTW they disabled screencap in PowerDVD. Probably the same will apply to all players.

http://filexoom.com/public/pview/7856/3.png

oddball

13th January 2007, 09:11

[QUOTE=luders;933624]You guys having any trouble with the decrypted King Kong feature evo's?
They dont play back for me in PowerDVD 6.5 HD but the Serenity evo's do.[/quaote]

Which is probably why Muslix did not include it in his list of movies. I think some titles have some other stuff in them that might need to be overcome. Some extra level of crap.

luders

13th January 2007, 09:16

Oh sure.. I forgot, that whole ucontrol deal. Thanks.

luders

13th January 2007, 09:18

Anybody got keys for Batman Begins and Van Helsing so I can see if those suffer the same fate?

tonyp12

13th January 2007, 09:26

PowerDVD7.2 (@Horse+donkey) plays decrypted king kong.

But skips and stutters so bad it's not watchable.

I only have a Opteron 146 at 2.3ghz and it just barely can handle playing the movie back from the 360-drive.

What about creating a Daemon Image file so powerdvd actually thinks is playing from a disc?

Feature title 26.9 GB, that is huge!
I can not see that being transcoded down to 8.5gb (DL DVDR)
without loosing major quility.

evdberg

13th January 2007, 09:55

I am still wondering on the Nav chain problem and the fix. From the source I saw that Muslix64 sets the MSB of the VOBU_EndAddress to 0x7F (in V0.99 to 0x0F). This can never be a good idea. It would also explain why the bitrate spiked to 300Mbit/s. Would it be possible that the problem was in PowerDVD 6.5 and that 7.2 plays the files fine with the original value? Because from what I checked in the original streams, the value for VOBU_EndAddress is just correct.

generalnewbie

13th January 2007, 10:19

Congratulations!
So now you see BackupHDDVD is not a fake...
Now we have to make movies with the IME feature playable with PowerDVD.

Then, ... BD+!

I now am a believer. Glad you came back from vacation.

Secondly Was it PowerDVDs memory that you guys dumped to find the key? or was it WinDvD? Or can you find it in both? Just wondering if PowerDvds Media remark was true.

He-Man

13th January 2007, 11:21

For those interested in getting the SHA1 hash for the VTKF000.AACS files. I used this method.

Download this tool from Microsoft.
http://download.microsoft.com/download/c/f/4/cf454ae0-a4bb-4123-8333-a1b6737712f7/windows-kb841290-x86-enu.exe
After downloading, install to Windows\System32 directory.
Open command prompt and type:
fciv -sha1 i:\AACS (Where "i" is the HD-DVD drive letter)
Take the hash for the VTKF000.AACS file.
Note that the hash has to be all caps in the keydb.cfg file.Try this: HashCalc (http://www.slavasoft.com/hashcalc/index.htm)
WinHex (http://www.winhex.com/) can calculate the hash value for a file. You probably need WinHex for the memory dump anyway, so why not use if for the hash calculation too.
In WinHex use these two step to find the SHA-1 hash value:
1) Open VTKF000.AACS with File -> Open [Ctrl+O]
2) Calculate hash value with Tools -> Compute Hash [Ctrl+F2] and choose SHA-1 (160 bit) and hit OK.

If you don't want to use WinHex for this task, then there's also the nice little HashTab Windows Shell Extension (http://www.beeblebrox.org/hashtab/)
that can do the calculation for you.
After installation of HashTab just right-click on VTKF000.AACS in Windows Explorer, then choose Properties and click at the new File Hashes tab shown below:
http://www.beeblebrox.org/hashtab/hashtab.jpg

He-Man

13th January 2007, 11:44

Java is giving me problems.

An unexpected error has been detected by HotSpot Virtual Machine:
# Internal Error (4E41544956452C4F4F4B55500E43505000D5), pid=3704, tid=3304
# Java VM: Java HotSpot(TM) Server VM (1.5.0_10-b03 mixed mode)

I take it I ony need the JDK 6 from here:
http://java.sun.com/javase/downloads/index.jsp
(http://java.sun.com/javase/downloads/index.jsp)

Update: I uninstalled all versions that was on my computer, downloaded the 53mb java file
Copied the folder
C:\Program Files\Java\jdk1.6.0\jre\bin\server
to
C:\Program Files\Java\jre1.6.0\bin\server

it now works!

The FAQ.txt says Java Runtime 1.5 is required, maybe it should have said 1.6 instead of 1.5?

-What are the system requirements to use "Backup HDDVD"

1 - A Windows based system
2 - A HDDVD disk drive
3 - A HDDVD player software (like PowerDVD)
4 - A HDDVD movie(s)
5 - Java runtime 1.5
6 - The possibility to access the content of the disk with a drive letter under windows.
(you may need UDF 2.5 file system driver for this)
7 - A lot of free hard disk space to backup your movies!

calinb

13th January 2007, 12:33

For those interested in getting the SHA1 hash for the VTKF000.AACS files. I used this method.<snip>
Or simply modify Muslix64's code in the BackupHDDVD.java file to have it report the hash it reads from the disk and recompile with the Sun JDK:

<snip>
System.out.println("Found valid HD-DVD source.");

byte[] keyFileHash = Utils.hashFile(keyFile);
System.out.println("Look for this movie in my database");
Properties TitleKeyDatabase = new Properties();
try{
TitleKeyDatabase.load(new FileInputStream("TKDB.cfg"));
System.out.println("Hash read...");
System.out.println(Utils.toHexString(keyFileHash));
<snip>