VUKeyfinder

[jokin]

Hi,

I have created a VUK keyfinder that utilizes a WinHex Script to find the VUK of a HD-DVD from a memory dump. All you have to do to run it is drag your memory dump file onto the BAT script and it goes from there. It takes me about 2 seconds max to pull out the key. It then creates a file with a filename that contains the key (ex. VUK-00000000000000000000000000000000) in the directory of your choice.

First of all you have to have WinHex for this to work.
Second there are a few things you will need to edit based on the location of your files.

1. Edit the VUKfinder.bat to reflect the location of your WinHEX install. *Fixed in 0.99b as long as WinHes is in the default Program Files directory.

2. Edit the findkey.whs and change the value "C:\AACSkeys\" to the location you want your key stored when done.

3. Enjoy

This may not find 100% of the keys. It uses the "00200000003F00000080000000" search method.

It does work for:

Superman Returns
Batman Begins
World Trade Center
King Kong
Apollo 13

Feel free to edit this and make improvements.

Please post some more titles that it works for and any that it doesnt. Thank you.

UPDATE:

version 0.99a fixed to account of US/GER discs.
version 0.99b made the .Bat utilize the Windows system variable for Program Files to be more user friendly.
version 0.99c added the ability to dump from WinDVD using pmdump automatically and then get the key. Pmdump needs to be in the folder with the script. (Im at work so it needs testing)
version 0.99d added english tasklist.exe and pmdump.exe to archive per request.

[xyz987]

MrDVD reported the hex search string starts with "0620" for euro HD-DVDs instead of "0020"

May be a good idea you modify your script to avoid first byte of current search string (i.e. a 12-byte search string instead of the current 13-byte long)

[jokin]

MrDVD reported the hex search string starts with "0620" for euro HD-DVDs instead of "0020"

May be a good idea you modify your script to avoid first byte of current search string (i.e. a 12-byte search string instead of the current 13-byte long)

Fixed.

[He-Man]

1. Edit the VUKfinder.bat to reflect the location of your WinHEX install.
I would suggest you change VUKfinder.bat from this:
"E:\Program Files\WinHEX\WinHex.exe" %1 findkey.whs

To this:
"%ProgramFiles%\WinHex\WinHex.exe" %1 findkey.whs

By using %ProgramFiles% it will choose your systems default installation drive+directory path (often "C:\Program Files" on English Windows versions). But this also works if your installation folder is not on C: or if you have a different Windows language versions where the installation folder is not named "Program Files".

If you type %ProgramFiles% in Windows Explorer it will open up your default installation folder.

[jokin]

I would suggest you change VUKfinder.bat from this:
"E:\Program Files\WinHEX\WinHex.exe" %1 findkey.whs

To this:
"%ProgramFiles%\WinHex\WinHex.exe" %1 findkey.whs

By using %ProgramFiles% it will choose your systems default installation drive+directory path (often "C:\Program Files" on English Windows versions). But this also works if your installation folder is not on C: or if you have a different Windows language versions where the installation folder is not named "Program Files".

If you type %ProgramFiles% in your browser or Windows Explorer it will open up your default installation folder.

Done.

[MrDVD]

MrDVD reported the hex search string starts with "0620" for euro HD-DVDs instead of "0020"

May be a good idea you modify your script to avoid first byte of current search string (i.e. a 12-byte search string instead of the current 13-byte long)

I have to correct me :) this 0620 is for german hddvds so maybe there are more diff hex out and we can locate it by this way. Maybe some FR or UK ppl can test this.

[2bigkings]

confirmed: tool work for Mission Impossible 2 [GER], the other 2 MI also i think. will check it later..

[dukey]

what do u use to create a memory dump ?

[2bigkings]

i use winhex and do a search, no "save as"

[2bigkings]

i forgot that the RAM is changing, but some titles seems to work without "save as" for me. (like mi2..)

4E8D74142E30E780B84905A62E70FBB58C3A0245=CSI NY (GER) |V|MM/DD/YY| C2B8E0A7E3384CC4C02F4AA5E396EF8B

this should be the volume key for CSI NY, but the main movie don't work really good. (black screen all few seconds), all other evo files works great! (search via vukkeyfinder)

[He-Man]

4E8D74142E30E780B84905A62E70FBB58C3A0245=CSI NY (GER) |V|MM/DD/YY| C2B8E0A7E3384CC4C02F4AA5E396EF8B

this should be the volume key for CSI NY, but the main movie don't work really good. (black screen all few seconds), all other evo files works great! (search via vukkeyfinder)
Please keep keys in the sticky Volume Unique Keys topic instead: http://forum.doom9.org/showthread.php?t=120611

[jokin]

what do u use to create a memory dump ?

I use pmdump (http://ntsecurity.nu/toolbox/pmdump/).

[He-Man]

I use pmdump (http://ntsecurity.nu/toolbox/pmdump/).
The next step must be to write a script to run pmdump and extract the key from the pmdump file-dump without using WinHex.
WinHex requires registration to run scripts, so it would be nice to be able to extract keys without having to install and register WinHex. This would make it easier for more people to use and the process can be more automated by running pmdump automatically and delete the memory dump file afterwards.
Anyone capable to writing a script to extract the key from the pmdump file without using WinHex Script? Maybe jokin?

[tonyp12]

I could add that function to TitleSorter (http://forum.doom9.org/showpost.php?p=938127&postcount=64) if needed.

It would be cool as my programs could calc hash,
read creation date and look in pmdump file for key.
Insert in proper form to keydb.cfg then sort and save.

But I not for a few days, I need get other things done.

[jokin]

I could add that function to TitleSorter (http://forum.doom9.org/showpost.php?p=938127&postcount=64) if needed.

It would be cool as my programs could calc hash,
read creation date and look in pmdump file for key.
Insert in proper form to keydb.cfg then sort and save.

But I not for a few days, I need get other things done.

That would be great. I will try to figure out how to get pmdump to work with a script.

[tonyp12]

I can start another executable file from within javascript.

So I could issue a C:\programfiles\pmdump -windvd -C:\mydocs\memdumps


If pmdump allows that, but running the program manually
and just later have my program read 1k at time form the memfile and look for keys could be done.

[He-Man]

I can start another executable file from within javascript.

So I could issue a C:\programfiles\pmdump -windvd -C:\mydocs\memdumps


If pmdump allows that, but running the program manually
and just later have my program read 1k at time form the memfile and look for keys could be done.
Should look something like this: %ProgramFiles%\BackupHDDVD\pmdump.exe <PID> <filename>

The problem is you can't use WinDVD.exe directly as input parameter for pmdump; you have to find the current PID (Process ID) value of WinDVD.exe by running the command pmdump -list. The problem is the PID value for WinDVD is not the same each time yo run WinDVD. So first you have to find the correct PID value to run pmdump with.
Maybe there's a better suited tool available to create a memory dumpMemory search and extraction or maybe just some C++/C# or Java code example that can do the trick. Maybe even an MS Windows tool/command?

[jokin]

I can start another executable file from within javascript.

So I could issue a C:\programfiles\pmdump -windvd -C:\mydocs\memdumps


If pmdump allows that, but running the program manually
and just later have my program read 1k at time form the memfile and look for keys could be done.

There is apparently a way to memory dump from within Java.
Hope this helps.dumpHeap (http://bugs.sun.com/bugdatabase/view_bug.do;jsessionid=32e2bd412cc2aa35b79581efcfcbb:WuuT?bug_id=4211929)

[markrb]

I am getting the file without it being converted. It is still Hex.
Are any of these commands version specific in regards to winhex?

Mark

[jokin]

I am getting the file without it being converted. It is still Hex.
Are any of these commands version specific in regards to winhex?

Mark

Which file. The final result is a 0 byte file named VUK-aacskey

[Mug Funky]

this may help:


tasklist > "c:\list.txt"
for /F "usebackq tokens=1,2 delims= " %%A in ("c:\list.txt") do IF "%%A"=="pmdump.exe" ECHO %%B


this will return the PID of the process named "pmdump.exe"

[jokin]

this may help:


tasklist > "c:\list.txt"
for /F "usebackq tokens=1,2 delims= " %%A in ("c:\list.txt") do IF "%%A"=="pmdump.exe" ECHO %%B


this will return the PID of the process named "pmdump.exe"

Thanks for the code. I used some of it for version C.

version 0.99c added the ability to dump from WinDVD using pmdump automatically and then get the key. (Im at work so it needs testing)

All that needs to be updated from the previous version is the BAT file.

Replace all with the following:
TASKLIST /FI "IMAGENAME eq WINDVD.EXE" /FO TABLE /NH > "list.txt"
ECHO %2
for /F "usebackq tokens=2 delims= " %%A in ("list.txt") do pmdump.exe %%A windvd.dump
"%ProgramFiles%\WinHEX\WinHex.exe" windvd.dump findkey.whs
exit

Also make sure to put pmdump in the folder with the script.

I will work on eliminating the need for WinHEX when I get home.

[markrb]

Which file. The final result is a 0 byte file named VUK-aacskey

But isn't the filename the key?
The filename for me is the Hex value of the key.

Mark

[jokin]

But isn't the filename the key?
The filename for me is the Hex value of the key.

Mark

for example:

4E8D74142E30E780B84905A62E70FBB58C3A0245=CSI NY (GER) |V|MM/DD/YY| C2B8E0A7E3384CC4C02F4AA5E396EF8B

file would be VUK-C2B8E0A7E3384CC4C02F4AA5E396EF8B

[jokin]

Anyone know of a freeware scriptable hex editor so I can get this working without WinHEX? I tried XVI32 but can't copy from file to a new file with scripts.

[He-Man]

Thanks for the code. I used some of it for version C.

version 0.99c added the ability to dump from WinDVD using pmdump automatically and then get the key. (I'm at work so it needs testing)

All that needs to be updated from the previous version is the BAT file.

Replace all with the following:
TASKLIST /FI "IMAGENAME eq WINDVD.EXE" /FO TABLE /NH > "list.txt"
ECHO %2
for /F "usebackq tokens=2 delims= " %%A in ("list.txt") do pmdump.exe %%A windvd.dump
"%ProgramFiles%\WinHEX\WinHex.exe" windvd.dump findkey.whs
exit

Also make sure to put pmdump in the folder with the script.

I will work on eliminating the need for WinHEX when I get home.
I just spent a couple of hours figuring out how come I couldn't get the above script working and figuring out a solution to the problem.
It turns out the filter name IMAGENAME is not supported by my non-English version of tasklist.exe despite the fact that the non-English help text claims it is supported if I type tasklist /? (I use a non-English version of Windows XP Pro).
So I figured out the best solution was to download an English version of tasklist.exe and drop it in the same folder as VUKfinder. (I first tried to replace the original tasklist.exe in Windows/System32, but it constantly gets overwritten by the original non-English version).
By placing the English tasklist.exe in the VUKfinder directory it will run this file instead of the one placed in Windows/System32.

Windows XP Home doesn't have tasklist.exe at all, so VUKfinder will not work on any XP Home + non-English Win XP Pro computers unless you place an English tasklist.exe somewhere in the path.

Because of this I suggest to include the English tasklist.exe in future distributions of VUKfinder and place the file in the VUKfinder install dir. This will also work on computers that already have the English tasklist.exe in the Windows/System32 folder.
Also include pmdump (http://ntsecurity.nu/toolbox/pmdump/) in future distibutions.

The file size of tasklist.exe is only 71 KB and version 5.1.2600.0 can be downloaded here: http://www.computerhope.com/download/winxp.htm

[jokin]

Done.

VUKeyfinder 0.99d mirror (http://www.sendspace.com/file/8nsnl3)

[He-Man]

I think you should add the two red lines to clean up by deleting list.txt and widvd.dump after each run.
Deleting list.txt is not that important as it will be overwritten next time you run VUKfinder.bat, but windvd.dump has to be deleted before pmdump tries to create a new one, otherwise it will just produce this an error message: "The output file already exists".
TASKLIST /FI "IMAGENAME eq WINDVD.EXE" /FO TABLE /NH > "list.txt"
ECHO %2
for /F "usebackq tokens=2 delims= " %%A in ("list.txt") do pmdump.exe %%A windvd.dump
"%ProgramFiles%\WinHEX\WinHex.exe" windvd.dump findkey.whs
DEL list.txt
DEL windvd.dump
exit


If you for debugging purposes prefer to keep list.txt and the large windvd.dump until next time you run VUKfinder.bat, then just move DEL windvd.exe to the start of VUKfinder.bat and then you canleave out DEL list.txt like this:
DEL windvd.dump
TASKLIST /FI "IMAGENAME eq WINDVD.EXE" /FO TABLE /NH > "list.txt"
ECHO %2
for /F "usebackq tokens=2 delims= " %%A in ("list.txt") do pmdump.exe %%A windvd.dump
"%ProgramFiles%\WinHEX\WinHex.exe" windvd.dump findkey.whs
exit

It's important to only have one WinDVD.exe open at the time you run VUKfinder.bat

[jokin]

Version 0.99e mirror (http://www.sendspace.com/file/aj9mwv)

[He-Man]

What's the purpose of the line "ECHO %2"? What does it do?

[markrb]

for example:

4E8D74142E30E780B84905A62E70FBB58C3A0245=CSI NY (GER) |V|MM/DD/YY| C2B8E0A7E3384CC4C02F4AA5E396EF8B

file would be VUK-C2B8E0A7E3384CC4C02F4AA5E396EF8B


Yes that is what I am expecting to see. However what I get is the filename VUK-(Hex value, not binary value)

I believe the line convert hex to binary is not working correctly for me in the whs file.

Mark

[He-Man]

Yes that is what I am expecting to see. However what I get is the filename VUK-(Hex value, not binary value)

I believe the line convert hex to binary is not working correctly for me in the whs file.

Mark
I suppose you mean ASCII and not binary?
Waht WinHex version do you use? IS it registed?

[He-Man]

I have rewritten VUKfinder so it can find the WinDVD.exe Process ID without the need for list.txt as Process ID temporary storage anymore.
@ECHO OFF
FOR /F "tokens=2" %%A in ('TaskList.exe /FI "IMAGENAME eq WinDVD.exe" /NH') DO pmdump.exe %%A WinDVD.dmp
"%ProgramFiles%\WinHEX\WinHex.exe" WinDVD.dmp FindKey.whs
DEL WinDVD.dmp

[guile]

I have rewritten VUKfinder so it can find the WinDVD.exe Process ID without the need for list.txt as Process ID temporary storage anymore.
@ECHO OFF
FOR /F "tokens=2" %%A in ('TaskList.exe /FI "IMAGENAME eq WinDVD.exe" /NH') DO pmdump.exe %%A WinDVD.dmp
"%ProgramFiles%\WinHEX\WinHex.exe" WinDVD.dmp FindKey.whs
DEL WinDVD.dmp

How difficult would it be to re-write to do mem dump with Powerdvd?

[honai]

PowerDVD doesn't store its keys in memory, so why would you want to do that?

[guile]

PowerDVD doesn't store its keys in memory, so why would you want to do that?


I guess that answers my question:D

[markrb]

I suppose you mean ASCII and not binary?
Waht WinHex version do you use? IS it registed?

Yes sorry for the confusion.
It is registered, version 13.4.

Mark

[gooki]

Working for me - thanks.

[He-Man]

"ape" has created a stand-alone C++ key extraction app here:
http://forum.doom9.org/showthread.php?t=120970
All you need is this app while WinDVD 8 HD is playing a HD DVD in the background.

[brutiger]

Which version of WinDVD? I have tried the US version and can't get the movies to play. I've heard you need the Japan version, but it looks to be locked down.

[Exiton]

Ok, I installed the WinDVD 8 HD version and when I go to open a HD-DVD, the player just sits there and never opens anything. Any ideas? The regular WinDVD 8 will open dvd's fine. I've also got PowerDVD 7.2 and it plays the HD-DVD's back fine. I can't for the life of me figure out why it won't open an HD-DVD.

[Momotte]

let me know if you figure it out, I have the same problem...

[He-Man]

Which version of WinDVD?
Which WinDVD version to use is discussed in this topic: http://forum.doom9.org/showthread.php?t=121205

[Exiton]

Which WinDVD version to use is discussed in this topic: http://forum.doom9.org/showthread.php?t=121205

I've got the Blue ray & HDDVD version that installs the HD add-on. I even launch the HD version. There are errors like invalid rpc server during install on two different computers.

Not sure what is going on as I'm just trying to back up my copy of The Ant Bully for the kids and find out the key is.

[Momotte]

I have the same problem as you (RPC...) to get rid of it, I unplugged the network cable while installing...

But still, even with a perfect install, when I run Windvd, it accesses the disk, then the screen flashes with garbage and it stops right away... I have no problem with PowerDVD... I suspect that this version of WinDVD is not perfect...

[guile]

I have the same problem as you (RPC...) to get rid of it, I unplugged the network cable while installing...

But still, even with a perfect install, when I run Windvd, it accesses the disk, then the screen flashes with garbage and it stops right away... I have no problem with PowerDVD... I suspect that this version of WinDVD is not perfect...

The "RPC" thing is the program trying to connect to a server to validate. Whether it connects or not it should still function. I can gaurantee it will work with either a decrypted disc and/or a "homemade" HD-DVD. That is exactly what it does/did on all systems I have tried. You are not "FULLY" hdcp compliant somewhere in the chain. That is the "issue" imo.

[Exiton]

If I recall correctly, VGA analog connection should stll work with HD-DVDs even without a 100% HDCP chain in WinDvd. It won't even play decrypted discs if there is a HD-DVD drive w/ disc attached.

[guile]

If I recall correctly, VGA analog connection should stll work with HD-DVDs even without a 100% HDCP chain in WinDvd. It won't even play decrypted discs if there is a HD-DVD drive w/ disc attached.

I tried it via analog as well and although it wouldn't play a commercial hd-dvd disc, it would play decrypted and/or homemade hd-dvd's. The only way I can truly confirm this is if I had a fully compliant hdcp chain (which I don't).