BackupHDDVD, a tool to decrypt AACS protected movies [Archive] - Page 16

2bigkings

14th January 2007, 11:15

hi guys,

first post here.
i don't like this java thing, everytime i try to start backuphddvd it says "unable to access jarfile backuphddvd.jar".
What i have to do? i have jre 1.4.2, jre 1.6.0 and jre 1.5.0.10 but everytime i get the same error. It would be helpful to make a tool without java!
thank you very much.

regards

Amir

14th January 2007, 12:12

About player revocation for when new discs are out...

I was wondering, how is a player identified as being that exact one?. if the version string is somehow sent back to the player then cant we simply edit the .exes resources to send back the vesion of the newly released player?.

e.g. if you use powerdvd6.5 and then 7 is released with 6.5 being the "revoked" one. Would it not be feasible to alter 6.5 to report back as 7?

I'm unsure if there are any checksums returned as part of the return message but was just wondering..

zeroprobe

14th January 2007, 12:16

Amir

14th January 2007, 12:19

It's not the program revoked its the players key. So they will get a new key when they have fixed up there player.

BTW has windvd responded to anything yet lol?

Whoops sorry you are right, this thread is so long stuff at the beginning is getting forgotten :-o

JackSnap

14th January 2007, 13:08

I was wondering about that, is it not possible to create a revocation list, with say one player key in it that no one cares about, and set the version number to the highest possible allowed by the structure, then in theory no player will bother importing anymore files as it will always think it has the latest.

zeroprobe

14th January 2007, 13:27

my god, again software players have KEYS which are used to get the volume, title keys.

if this players key is on the revocation list on the hddvd its not going to work.

He-Man

14th January 2007, 13:47

http://rapidshare.com/files/11616301/BackupHDDVD.rar

2 'requested' features added:

1) Will report the calculated Disc Hash
2) If Hash not found in key file, will add it after prompting for the name of the movie.

Given I don't have neither HDDVD Drive nor any HD Movies, I'll need bug reports from somebody on if these work or not :)

Also, this was compiled against Java 5.0 so if it gives errors, try:

http://rapidshare.com/files/11615854/BackupHDDVD.rar which was compiled as 1.4 compat.
Just wondering, isn't the movie title stored somewhere at the HD-DVD disc (maybe the disc title itself, a folder name or in some unencrypted text file) so you can automatically extract the movie title along with the hash value and date?

markrb

14th January 2007, 13:53

I successfully ripped the entirety of King Kong to my drive with the volume key supplied in this thread. I do not have an HD copy of WinDVD, as I do not want to buy the jap copy. I do have the HD ver of Power DVD 6.5, and I can play everything except the feature film in it just fine. On Vista Ultimate x86, I can play the universal logo and various menu files after they are ripped, but attempting to play the FEATURE_1/2.evos causes PDVD to crash. Same goes on an XP Pro box with entirely different hardware. What I found interesting is that the Vista box I am on now only has a 3.0ghz P4 and 1024mb PC3200 and a meager Geforce 5200, and plays back on a 1280x1024 monitor without hiccups. Pretty sweet, but I wish I could get the feature to play.

Same thing for me on King Kong (XP only), but Serenity plays fine.
What could it be? Different Key?
Tried it twice, once with the new modified version.
Any thoughts as to what else to try?

Mark

hajj_3

14th January 2007, 15:07

can someone upload the rapidshare file to sendspace.com please. rapidshare.com isnt working very well for uk users at the moment.

thanks.

blanchg

14th January 2007, 15:09

Revocation facts from: http://www.aacsla.com/specifications/specs091/AACS_Spec_Common_0.91.pdf

MKB has three methods of revocation, two specifically for PC's with separate devices/playback software and is described in detail in Section 4 of above document.

Summary here:

1. Device Revocation List (DRL): Each device (i.e. XBOX360 HDDVD Drive) has an id attached to it in a record that has been signed by AACS_LA private key (Section 4.1) and is verified as having not been modified by the Host using the AACS_LA public key. This is versioned inside the MKB which is also signed by the AACS_LA private key (Section 3.2.5.8) and checked it is not modified before use. This pretty much discounts modifying the device id or setting the version of the DRL to it's maximum. (unless we have the AACS_LA private key which is nearly impossible to get/brute force)

2. Host Revocation List (HRL): This is the software running on the pc i.e. (PowerDVD, WinDVD) has it's own id again in a record that has been signed by the AACS_LA private key (Section 4.2) and prevents the same kind of attacks as per the DRL above.

3. Key revocation via Subset-Difference Tree or NNL-Tree: (Seciton 3) This is used both to calculate the Volume Key used by BackupHDDVD and to revoke DEVICE KEYS. Again this is part of the AACS_LA signed MKB and can't be altered. The interesting part of this is that each device calculates the same Volume Key for each disk with the same MKB (this will usually be the same for each "title" in a particular batch as has been proved).

Hope that dispels some of the incorrect information/questions being posted.

Hellreaper

14th January 2007, 15:14

There is a new article on "heise online".

http://www.heise.de/newsticker/meldung/83671 (german)

It tells about the "Serenity riddle", the weakness in the japanese version of WinDVD and the volume key thread.

The author says that the compromised WinDVD version will probably withdrawn. He also says that you probably won't be able to play future generations of HD-DVDs with it.

Ronin-7

14th January 2007, 17:22

Same thing for me on King Kong (XP only), but Serenity plays fine.
What could it be? Different Key?
Tried it twice, once with the new modified version.
Any thoughts as to what else to try?

Mark

Those having problems with King Kong are normal I believe as PowerDVD 7 Ultra had problems playing this when it was released from reading the thread on the AVS Forums & ironically bugs to do with the HDCP implementation as it wasn't working for some even with the right hardware :rolleyes:

hajj_3

14th January 2007, 17:25

we need to create a very in depth user guide as a .pdf with screenshots etc. also a table of keys and compatible hd-dvd titles needs to be created.

who fancies doing these?

He-Man

14th January 2007, 17:57

also a table of keys and compatible hd-dvd titles needs to be created.
This has already been done in a separate topic. Look at the sticky topic named Volume Unique Keys (http://forum.doom9.org/showthread.php?t=120611) in this forum. So far 30 titles and keys has been posted.

hajj_3

14th January 2007, 18:16

didnt know that. well we just need to create a very detailed pdf guide then i guess and add more titles to the list. im gunna be ordering a hd-dvd drive in a few days as a result of this thread:)!

Bystander

14th January 2007, 19:12

Power DVd 7.1 is not immune. Have a looksee

Van HelsingSHA1 Hash of VTKF000.AACS: 486198E3855B57CD40F6DC0C60645BDE8E1E9AC5

Title Keys:

43030103CB010B02304A8605F8AE7F06
70B07F062C4A860570B07F06689E7E06
FEC90F16A5075797B3C158BAA726B491
D09B373FFCD5950043AA83400A9E54A6
6688A295A241144512CC4C99C0C061A4
CCB6AB1337D4AAA6871553F676AA98B6
0F797221B5BB9FEC7B640E47B5A186CA
79A8626B10580955779CBA9328EE3459
BF6235C9C5F2E5448175DA4FBC3EFB2B
DD60CFF1D991A2579D0FD3E7AF269C96
B342601AF6660A83040D4D1AB728C778
C9DF108A6A7A19CBBF626F52D4B12456
33072BF6386FCE3A91A80DB8B4F6DD90
2AEC2F11B4A43884CE66B3DF005A3F26
2E52CFAFE2ED5C2AD735AE9791590C3C
98A0CD3CA24531365D660746D3EF31C3
2F290DF0416120F122128EB8AC82854B
92E04EB34DD8DD72D212677B253CEA57
FB940AA831093584CA4A674A442BA712
D4EE9FEEDB6F483053F98EA78F6024C3
444F3EF7F7867997FB5BB4D45274E7D1
4F2689FA1C1DCA4D1A78D33E3896657D
8A86BC850B99240DD2D951A21F835EE3
0FC3BC1F20BEAE53B1EAD64B103BDB50
A9C3459600D6F9353FA890DCCBA85959
AC0469A8BECDCDFB097CF76004CAEA65
21DE26210F177A5787E81EABEE20FED9
1869FAD6D6B59D5EAFC37546567D7A9A
848AE12CD408702476711B0A1887520F
DF455DAA553B6E93B06FE2A5D3A8F3C4
987DD26BBDAAEBAD015165B5133D7CAC

Volume Key: C3EE61AFEED85EB5285C60DBEE61545B

Phantom of the OperaSHA1 Hash of VTKF000.AACS: 0592DA47B8E0C8071C05A55C568F0F2531C28751

Title Keys:

4303010365010B02304A7605F8AE6F06
70B06F062C4A760570B06F06689E6E06
DA690991F3E0875AA553ACB93653F8A1
D1120C8D07D6FA0D3058E19FA3EC0D5C

Volume Key: 4B58600E51C5A8756D618AFA6F54499A

jokin

14th January 2007, 19:26

Power DVd 7.1 is not immune. Have a looksee

Any hints as to the general area to look? The same VPLST000.XPL as before?

Bystander

14th January 2007, 19:35

Why risk having both players changed and starting from scratch? Let's wait and see what happens to WinDVD first mkay?

jokin

14th January 2007, 19:42

Why risk having both players changed and starting from scratch? Let's wait and see what happens to WinDVD first mkay?

OK, but posting that you found the keys in PowerDVD 7.1 and posting the keys pretty much tells AACS LA that they need to revoke the PowerDVD key along with WinDVDs. It also makes a larger number of people try to figure out that method instead.

I assumed you were willing to help out with that method since you posted the keys. Ahh well, gives me something to do in the meantime. Thanks for confirming it though.

hajj_3

14th January 2007, 19:44

these hd-dvd's seem to have been ripped and are on torrent sites, 25gb, 25gb and 20gb:

The Chronicles Of Riddick, Batman Begins, Serenity

e.g: The Chronicles Of Riddick HD DVD 1080p VC-1 DDPlus 5.1

they are .evo files.

VistaVick

14th January 2007, 19:50

these hd-dvd's seem to have been ripped and are on torrent sites, 25gb, 25gb and 20gb:

The Chronicles Of Riddick, Batman Begins, Serenity

Aaaaaah, can't play these in windows media center, need to find a way to convert.

Doom9

14th January 2007, 20:00

I believe it's time that I remind some people here of our rules with regards to downloaded content. As we cater to an international audience, they are more strict than your local laws may be.
Bottom line: decrypting and converting discs you own: OK, downloading ripped discs via P2P and further processing them: Not OK.
So tread carefully please.

noclip

14th January 2007, 20:06

blanchg: Can't we just modify WinDVD so that it ignores the revocation lists completely?

zeroprobe

14th January 2007, 20:10

blanchg: Can't we just modify WinDVD so that it ignores the revocation lists completely?

no as its windvds KEY that is revoked........... ( how many times )

noclip

14th January 2007, 20:18

no as its windvds KEY that is revoked........... ( how many times )

WinDVD's key will simply be wrong for decrypting further disks? How would they manage that?

tonyp12

14th January 2007, 20:34

WinDVD's key will simply be wrong for decrypting further disks? How would they manage that?

As I understand it, the disc have space allotted for a list of revoked keys.

But say you do hack the software player to ignore this list somehow
and still being able to play the title.

Or does AACS just encrypt new movie titles (from a specific date on and forward)
with a new masterkey that simple can not work with windvd's key.

Zag

14th January 2007, 20:41

As I understand it, the disc have space allotted for a list of revoked keys.

But say you do hack the software player to ignore this list somehow
and still being able to play the title.

Or does AACS just encrypt new movie titles (from a specific date on and forward)
with a new masterkey that simple can not work with windvd's key.

The problem is not the player that needs to ignore the revocation list, it is the disc. Once the disc sees the players key is on it's revocation list, it will refuse to pass its keys to the player. If the keys are never given to the player than there is no way to extract them.

tonyp12

14th January 2007, 20:46

Once the disc sees the players key is on it's revocation list, it will refuse to pass its keys to the player.

The disc does not have a chip in it to make that kind of decisions,
Do you mean the DRIVE will check and will stop streaming data.

If so can't the firmware for the drive be hacked?

arnezami

14th January 2007, 21:20

The disc does not have a chip in it to make that kind of decisions,
Do you mean the DRIVE will check and will stop streaming data.

If so can't the firmware for the drive be hacked?

Nope. Please read the aacs specs. I know its complicated, but I believe the basic idea is fairly simple:

1) Each device (read: software player here) has a set of device keys.
2) Each disc has a Media Key Block (MKB) which is pretty large btw.
3) Each disc is essentially encrypted with a volume/media key. This key is also on the disc but it is itself encrypted.
4) Using a combination of the device keys and the MKB you can decrypt the Media/Volume key. But only if they (that is: device keys and MKB) are "compatible".
5) If you have the media/volume key you can decrypt the title keys which in turn can be used to decrypt the content.

For a new HD DVD (which still to be pressed/released) they can make the MKB so that all devices except certain compromised (software) players can decrypt the media/volume key. So even if you have an old player (with its old player keys) you can't decrypt the media key because the information simply isn't in the MKB anymore. This also explains why you can still decrypt all old HD DVDs released so far but not those in the future.

Right now WinDVD can decrypt all media/volume keys for all HD DVDs so far. For each HD DVD we can look into the memory dump what the decrypted volume key is. But if new HD DVDs come out with updated MKBs then this version of WinDVD can't decrypt anything and we won't be able to use its memory dump. We'll have to hack the new version of WinDVD (or PowerDVD).

Hope I'm making myself clear here.

Regards,

arnezami

Shinigami-Sama

14th January 2007, 21:31

if they have a place on the physical disk
can't you just do that black sharpie trick like with the - I believe sony protected disks?
havn't had a chance to read that part of the specs yet...

Lord_KiRon

14th January 2007, 21:42

Just an idea (I haven't bothered to read the AACS specs :o ) :

If we have a Tilte and Volume Keys and a disk can't we perform reverse process and calculate player key ?

In this case I believe generic decryption utility can be created that can decrypt any disk that does not blacklist that player key ...

Or am I missed something ?

Bystander

14th January 2007, 21:49

Right now WinDVD can decrypt all media/volume keys for all HD DVDs so far. For each HD DVD we can look into the memory dump what the decrypted volume key is. But if new HD DVDs come out with updated MKBs then this version of WinDVD can't decrypt anything and we won't be able to use its memory dump. We'll have to hack the new version of WinDVD (or PowerDVD).

You may be able to inject aka cut/paste PowerDVD's key into WinDVD to convert them again. Food for thought.

CiTay

14th January 2007, 22:06

We'll have to hack the new version of WinDVD (or PowerDVD).

First, Cyberlink and/or InterVideo have to admit that they have a security hole (Cyberlink denied it already). When they report that to AACS LA, they can do a player revocation.

But so far it remains more or less a theoretical threat for the movie industry. Who knows, if enough people hear that they can handle their HD-DVD movies more freely, it might boost popularity of HD-DVDs and make it the media of choice. The protection of DVDs is circumvented and they still sell, what's the deal with that?

And they can't carry player revocation and other restrictions too far anyway. I doubt that customers would constantly want to update their player when yet another version is compromised and all they see is an error message when they try to play that new movie. They might start to think that the paying customer is the idiot here and turn to other means of getting that movie...

Syris2k4

14th January 2007, 22:23

Imho - I dont think they will bother.

Backing up HD-DVD's requires disk space, time and some know-how that 99% of consumers dont really have. So bothering to discomfort that many people would be kinda silly, specially considering how many of these players they licence. Think almost every mid range+ gfx card/Mobo.

And atm - this is making the format look muuuch better than BR to people that care about DRM etc.

As long as copies dont flood the market within the next 2/3 months - I dont see it changing, they know we will adapt anyway.

appleguru

15th January 2007, 00:08

Here's to hoping this will let me play the movie in OS X with DVD Player... Decrypting Batman Begins atm to find out; I'll report back :)

markrb

15th January 2007, 00:13

I am so glad there are smart people on this board.
I have tried time and time again and I cannot locate the keys in memory using winhex. I have tried searching for all the text strings listed in this thread and even looked for known keys on King Kong with no luck.

Is the key findable with a search in memory if you know the key or does it have to be translated somehow?

I can find the hash no problem so I know I have the same version that is listed in the volume key thread.

I am planning on buying some movies not listed so I might contribute, but if I can't find a known key how will I know what to look for in an unknown disc?

I guess I am just discouraged. Any help anyone can give I would appreciate it.

Thanks,
Mark

Shinigami-Sama

15th January 2007, 00:15

rubycon

15th January 2007, 00:42

Such a blatant post about how you copy material you do not own is clearly against the spirit and intention of rule 6. I have warned users about this previously in this very sensitive thread.

Strike issued.

As well, I fail to see what a person's hair has to do with it. Please be more polite on this forum.

Regards

As far as in my conutry is related, Copying for private use from a "legally acquired original" is legitimate fair use. A rented copy is a legally accquired copy, so it is legal to make a copy of it for private use-(Is the same action as time shifting when recording from a TV).

So what's all this warnings about something that is legal in many countries?

R.

arfster

15th January 2007, 01:45

So what's all this warnings about something that is legal in many countries?

It's their forum - they can ban or warn you for whatever they like.

Given how aggressive the legal people can be wrt copyright, you can hardly blame them.

Shinigami-Sama

15th January 2007, 01:55

As far as in my conutry is related, Copying for private use from a "legally acquired original" is legitimate fair use. A rented copy is a legally accquired copy, so it is legal to make a copy of it for private use-(Is the same action as time shifting when recording from a TV).

So what's all this warnings about something that is legal in many countries?

R.

This forum is currently hosted in the USA; therefore it must abide by the rules and regulations of the USA. So in order to operate the users of this forum must also abide by these rules or the forum may be subject to legal battles that would force Doom9 to close down. Please try to be more aware of the rules in the future or else you may not be here long.

toytown

15th January 2007, 03:05

This forum is currently hosted in the USA

Its hosted in france, i believe.

bass4040

15th January 2007, 03:13

Once an hd-dvd movie is on the hard drive and the correct key is used, do you still need an hdcp video card for play back?

Shinigami-Sama

15th January 2007, 03:16

Its hosted in france, i believe.

I remember doom9 saying ateme - I thought that was in the USA
hmm
just doing a lookup the IP resolves to an ampserdam company so I'm not sure anymore.

anyways this is kinda getting offtopic...

Shinigami-Sama

15th January 2007, 03:19

Once an hd-dvd movie is on the hard drive and the correct key is used, do you still need an hdcp video card for play back?

not if you remux the stream into a container/format that doesn't use that restriction

Bystander

15th January 2007, 03:26

You would have to locate the Content Restriction Token/Flag and disable it or force it to always be "off".

This can be done by patching the player or removing it from the decoded .evo file itself.

Gradius

15th January 2007, 03:27

Imho - I dont think they will bother.

Backing up HD-DVD's requires disk space, time and some know-how that 99% of consumers dont really have.

So true. :cool:

Bystander

15th January 2007, 03:42

Just a verification note and brief comment (if I may have a pass on strikes for the support to the project)

1) Van Helsing works just fine with the volume key I posted earlier.

2) Now that this project is well on it's way I can finally go buy HD DVD's and start storing them on my 10TB media server and keeping the originals safely stored in their cases. I've been waiting for this since HD was released. Looks like Blu Ray will be left in the cold *** wondering what happend when HD DVD takes off like a sky rocket now. Also the PR0n disks won't get covered in goo now that they announced HD DVD instead of Blu Ray.

OverlordQ

15th January 2007, 04:38

Just wondering, isn't the movie title stored somewhere at the HD-DVD disc (maybe the disc title itself, a folder name or in some unencrypted text file) so you can automatically extract the movie title along with the hash value and date?

Not a clue, I dont have a HDDVD Drive, if somebody could tell me where that info is stored, I'd be greatly appreciated so I could add it.

woah!

15th January 2007, 04:41

not if you remux the stream into a container/format that doesn't use that restriction

well the movies i have i couldnt playback on my main rig as my x1800xt vcard wasnt hdcp. but after the dump to the HD it plays just fine on the x1800xt :)

so i would say that yes you can play them once on your drive.

Janvitos

15th January 2007, 04:41

Alot of movies are not ripping properly at the moment.
It seems like all the movies with some sort of enhanced experience content do not assemble properly after decryption.
I have ripped and tried all of my HD-DVD movies and around 1/3 of them don't play well at all (very choppy playback, image distortion).

This is a list of my movies that DON'T work properly once ripped:

- V for Vendetta
- Batman Begins
- King Kong
- Mission Impossible 3
- Charlie and the Chocolate Factory
- Enter the Dragon

There might be many more so i guess it's time to start working on a solution for this.
Obviously, we will need a total re-write of the BackupHDDVD program and most importantly, an experienced coder who can work this out.