Blu-ray and AACS

[kuklitis]

All the more reason to buy the original if you like the movie ...
Here in Europe we have prices 25-38 euros fro good Blu-ray movie, but price for BD-R is around 12-13 euros.
Let's say we are 4 friends - early adaptors with Blu-ray PC drives in our PC's. Then we each put together 3.5 euros, buy media, download from torrents ripped and decripted movie, burn to BD-R, and take turns watching it ! :) If we buy original, then our expenses would be 7-9 euros each.
And I hope that media prices will fall, but it's very unlikely that prices of new and popular Blu-ray movie releases would drop ...

[jokin]

Here in Europe we have prices 25-38 euros fro good Blu-ray movie, but price for BD-R is around 12-13 euros.
Let's say we are 4 friends - early adaptors with Blu-ray PC drives in our PC's. Then we each put together 3.5 euros, buy media, download from torrents ripped and decripted movie, burn to BD-R, and take turns watching it ! :) If we buy original, then our expenses would be 7-9 euros each.
And I hope that media prices will fall, but it's very unlikely that prices of new and popular Blu-ray movie releases would drop ...

This tool is meant to allow backing up you original copies of a movie so you can keep from damaging the original and/or to allow playback on a non-HDCP compliant monitor at full resolution. This is not meant to allow one to pirate the material.

[HyperHacker]

I can't see BD-R prices coming down soon. Them costing near as much as (or more than) the actual movies is another anti-piracy measure. Though for irony's sake you could burn smaller ones to HD-DVD disks. ;)
File got removed 'cos of too many "complaints" :(
Yeah, FYI, Rapidshare is absolute total crap.


Now someone make further progress on decrypting BD so we can get back on topic. :p

[blutach]

CONGRATULATIONS ! WE reached yet another milestone :)
Now we can start to think about semi-profesional piratism :D All we need is a PC device (Blu-Ray reader or burner), blank media, BackUPBluray utility to rip and decrypt and of corse the key would be WinDVD software that allows playing on PC monitor or other devices full 1920x1080 res. without any HDCP stuff. It know looks like it would be more easier paas friends and other eager people those BD-R media with movies - just pop in into PC drive and watch without any moving to local HDD and other rather complicated stuff ...

Here in Europe we have prices 25-38 euros fro good Blu-ray movie, but price for BD-R is around 12-13 euros.
Let's say we are 4 friends - early adaptors with Blu-ray PC drives in our PC's. Then we each put together 3.5 euros, buy media, download from torrents ripped and decripted movie, burn to BD-R, and take turns watching it ! :) If we buy original, then our expenses would be 7-9 euros each.
And I hope that media prices will fall, but it's very unlikely that prices of new and popular Blu-ray movie releases would drop ...

This tool is meant to allow backing up you original copies of a movie so you can keep from damaging the original and/or to allow playback on a non-HDCP compliant monitor at full resolution. This is not meant to allow one to pirate the material.Exactly jokin. :goodpost:

@kuklitis - any more talk along these lines will incur a rule 6 strike. Stick to the topic. You wanna talk about how you or other people can pirate DVDs/BR/HDDVD, please do it elsewhere. :readrule:

Regards

[Janvitos]

Get the other link !

[Galileo2000]

http://rapidshare.com/files/13113176/blu-ray_backup_audio.avi

Janvitos,

Most excellent! Great job!

Did you use HDV camera to make the video?

Congratulations!


I guess I am going to buy BD drive soon..

[hajj_3]

Nice:)! you should put the camcorder on something stable tho, picture qual aint great and very wobbly. also you should make a video showing how to do it from start to end, show backupbluray in action, getting the keys etc with keyfinder, decrypting, then watching off hdd unencrypted, state that your graphics card is non-hdcp (assuming it isnt) and then show video of it running like in here.

then put it on youtube.

[Galileo2000]

Nice:)! you should put the camcorder on something stable tho, picture qual aint great and very wobbly. also you should make a video showing how to do it from start to end, show backupbluray in action, getting the keys etc with keyfinder, decrypting, then watching off hdd unencrypted, state that your graphics card is non-hdcp (assuming it isnt) and then show video of it running like in here.

then put it on youtube.

and include your home address and phone number as well and see "Removed by the request of Sony Corporation" a few minutes after.

[Morbid]

Doom9 is getting more press (http://www.dailytech.com/article.aspx?newsid=5795) over these efforts than I can recall in all my years of coming by.

Somebody should hook Muslix64 with some Blu-Ray/HD-DVD equipment so he can further his studies.

MorBiD

[Galileo2000]

Doom9 is getting more press (http://www.dailytech.com/article.aspx?newsid=5795) over these efforts than I can recall in all my years of coming by.

Somebody should hook Muslix64 with some Blu-Ray/HD-DVD equipment so he can further his studies.

MorBiD

I do agree, and more than willing to contribute. But we have to figure out how to do it.

[bob0r]

http://rapidshare.com/files/13113176/blu-ray_backup_audio.avi

LOL @ powersupply sockets near the floor.... oh and nice video :D

[Spc01]

Muslix64 excellent work.
You made HD-DVD/ BluRay fair use.

http://forums.cgsociety.org/images/smilies/notworthy.gifhttp://forums.cgsociety.org/images/smilies/buttrock.gif

[Janvitos]

http://www.youtube.com/watch?v=pfzLVogXOpM

[mrazzido]

thx to the video janvitos , i think WB called youtube fast to remove the video ehhe :-D , like muslix64 video .

[HD Hell]

Hi muslix and janvitos - how is it coming with getting backupbluray to handle Volume unique keys?

[muslix64]

Janvitos told me he didn't seen that, but is there anyone who have seen a Blu-ray movie with more than one CPS unit key per disc? This will help me doing the volume key thing...

Look in the Unit_key_ro.inf file.

[mrazzido]

i test a backupped bd movie on ps3 jap. edition , it doesnt work :-( . " unknown disk "

@muslix64
i see only one cps key on my movies. if i see more i write you immediatly,get next day new delivery :-)

[2bigkings]

which movie @mrazzido?

[mrazzido]

i test 2 movies on BD-R and BD-RE ICE AGE II and The Fugitive both PAL . doenst work , can the ps3 handle PAL movie?

[2bigkings]

the fugitive should be playable on a PS3 because the movie is regionfree

PS3 JAPAN
Region A Movies (Japan / Asia / USA)

PS3 ASIA
Region A Movies (Japan / Asia / USA)

PS3 US
i dont know..

let's talk in a ps3 thread, because this thread is about blu-ray and aacs...

ps: have a look at blu-ray regionfree movies at http://bluray.lindsite.dk/

[hajj_3]

2bigkings, that will be the next step once we get ime working and a single app to do everything in backuphddvd and backupbluray. there is probably some bytes somewhere on the discs which tell the player what region it is, im sure we will find out where those bytes are and change the discs to ripped discs to multiregion, or even hack the firmware to multi-region.

[K40]

I heard that Standalone Blu-ray Players only can playback
AACS protected Discs.Would it be possible that this is the
case with the PS3?On this Forum it has been reported
that a backup from 5th Element on a SL Blu-ray R was
working in a Samsung Player.How was this done exactly?

[Janvitos]

I'm going to buy a PS3 later tonight and will keep you updated with the results.

[kuklitis]

I'm going to buy a PS3 later tonight and will keep you updated with the results.
>>>>>It sems that you trully mad esome investing sacrifice and I just hope that we al get benefif from it and even more is we all could do some kind of reward of yoyr financial and time investment to aou r common cause ! :)

[iampivot]

This is a very basic, but powerfull crypto attack that I have used to decrypt both format.

[...]
Because I know the keys are unprotected in memory, I can skip all the painfull process of code reversal.

I don't have any Blu-Ray equipment but I was able to recover the keys anyways... because I had access to a memory dump file and a media file.
[...]
Do you see something special? Do you see any pattern?

The first byte is always D1 and the 5th byte is always 47. Can we use that to mount the known-plaintext attack? Of course!
[...]
Any questions?

Based on this reasoning, can the same be done to do a known plaintext attack against the device key?

I'm assuming that the device key is also at one time present in the memory dump, and the title key is the known plaintext from the disc header. Thus, the attack described could in theory be used to try to decrypt the disc header to see if parts of it matches the title key.

The device key is probably discarded just after use, so a more elaborate memory dump scheme is probably needed.

[Janvitos]

Don't worry about it i'm returning the stuff anyways :)
Only the movies and BD-RE discs i can't return but they'll be useful to me anyways.

[Electrox3d]

I'm glad I can finally be of some help to this cause. So, the reason your PS3 cannot play your burned BD-R or BD-RE disc is because the Firmware isn't supporting it yet. We are on Firmware 1.5, and this feature won't be supported until at least 2.0.

I noticed someone mentioned it worked with the Samsung BD player, and that is great because the PS3 slowly but surely takes everything every other player can do and does it better with Firmware upgrades. :)

I have burners and PS3's available to do testing with, I just need enough HDD space hehe.

[nuclear bit]

Based on this reasoning, can the same be done to do a known plaintext attack against the device key?

I'm assuming that the device key is also at one time present in the memory dump, and the title key is the known plaintext from the disc header. Thus, the attack described could in theory be used to try to decrypt the disc header to see if parts of it matches the title key.

The device key is probably discarded just after use, so a more elaborate memory dump scheme is probably needed.

Well, it would be a lot more difficult, first of all there is no such thing as 'the one and only device key', each device is assigned a set of device keys together with their u,v subtree mask (cfr specs).
The media key in the MKB on the disc is encrypted using a number of keys (say n times with n keys), this number is dependent on the number of actual revocations (the larger the number of revocations, the more encrypted entries you will find).
The device will search for a working key in it's device key set (complicated search using the uv masks, the device number, the device keyset, and a key derivation alg...) and will be able to use it to decrypt just one of the n encrypted media key entries. If the device is revoked it will not find a matching key in it's set and will not be able to get to the title key.
So in order to use this 'device key mechanism', one needs to discover all the keys assigned to a player and their corresponding u,v subtree mask + the device number! So this is a lot more then finding 128 consecutive bits in memory.
In fact I consider the AACS spec quite secure and a 'real crack' would include cracking AES-128. The funny thing is that this whole complex MKB decoding algorithm is bypassed by a trick based on finding the title key immediately in memory.

[miro]

hopefully there will be such tools available for linux too...

[dvdguru]

The problem is that some devices only play BDAV and not BDMV if the support is a BD-RE or a BD-R.

BDAV= format for home made HD videos
BDMV= format for pre-recorded HD film

The Samsung BD-P1000 & the Panasonic BD-10 CAN play BDMV (so the ripped film) with menu & everything, I do all the test and I can confirm it.
The PS3 can't player BDMV, and is not for incompatibility but it's a Sony decision. They can unlock this when the want, like Samsung.

Samsung BD-P1000: first firmware plays BDMV. 1.1 & 1.2 don't play BDMV. And now the latest play BDMV. It's a politic reason.

There is only a problem now: if you burn a dual layer BD you can't replicate the layer change info & the disc doesn't work fine, when you arrive @ latyer change the playback stops.

[2bigkings]

thanks for information dvdguru. very interesting!
i think to change the layer info should not be a big problem.
they were successful with double layer media for xbox360, so there will be a tool for changing the layer info for blu-ray movies / games in the future.

[kuklitis]

The problem is that some devices only play BDAV and not BDMV if the support is a BD-RE or a BD-R.

BDAV= format for home made HD videos
BDMV= format for pre-recorded HD film

The Samsung BD-P1000 & the Panasonic BD-10 CAN play BDMV (so the ripped film) with menu & everything, I do all the test and I can confirm it.
I'am little bit confused regarding term "support is a BD-RE or a BD-R" ... Does it mean that device can phiscally tell the diference detwwen stamped media and BD-R/BD-RE media ? Or is just the firmware that allows playing BDAV folder = home made/authorized videos and therefore it also allows BD-R/BD-RE media ?
What if ripped film gets durned on BD-R under BDMV ?


The PS3 can't player BDMV, and is not for incompatibility but it's a Sony decision. They can unlock this when the want, like Samsung.

Samsung BD-P1000: first firmware plays BDMV. 1.1 & 1.2 don't play BDMV. And now the latest play BDMV. It's a politic reason.

Or is the whole sing going around that you removed whole AACS folder in order to play ripped movies all devices just considers it actions against existance/absance of this folder and not BDAV/BDMV namings ?

[xyz987]

I'am little bit confused regarding term "support is a BD-RE or a BD-R"


He means "disk is a BD-RE or a BD-R"

[dvdguru]

Sorry, support = disk.

Yes, the device can recoglize the type of disc. A player recognize if a disc is a BD-ROM, a BD-R or a BD-RE disc. There are some info about the support written into the inner area, so via firmware you can force the playback of a standard on a certain type of disk.

In BDAV there is a folder called BDAV into the disk root.

In BDMV (produced with Roxio DVDit HD) there is a folder called BDMV into the disk root.

In BDMV (prerecorder, for ex a film) there is a folder called BDMV into the disk root.

So if the player look only @ file structure, it plays everything without any problem. But it checks for disk type, so plays only format that are authorized. And BDMV is not authorized for some players like PS3.

Disc volume is not important when you burn: every blu ray has the same disc volume name but i change it in my backups without any problem.

Don't burn AACS directory: if you burn AACS dir the player look for encrypted M2TS, your disc is not encrypted and the player eject it. So burn only BDMV directory.

The layer change is a big problem in my opinion. When now you burn a DVD+R DL Nero adjust for you the information about layer break (that you must remove in ifo or during the ripping with DVD Decrypter option).
So in Blu-ray we need to find the layer break info (imo is in the playlist file), we have to cancel that info and then we need a burning software that put the layer break position during the burning @ the correct position.

Black Hawk Down is a 47 Gb BD. There is a 23 Gb M2TS file and another 23 Gb M2TS file. I think that the first file is on layer 0 and the second file is placed on layer 1. The player plays the first file, finds the layer break info and changes layers. And everything work.

But if I burn now this movie with Nero Nero put on the first layer 23 Gb + 2 Gb of the second file. Then change layer and write the other part of file. But the lyer change info are still here, and @ the end of the first file the player try to change layer.

[kuklitis]

Sorry, support = disk.

Yes, the device can recoglize the type of disc. A player recognize if a disc is a BD-ROM, a BD-R or a BD-RE disc. There are some info about the support written into the inner area, so via firmware you can force the playback of a standard on a certain type of disk.

In BDAV there is a folder called BDAV into the disk root.

In BDMV (produced with Roxio DVDit HD) there is a folder called BDMV into the disk root.

In BDMV (prerecorder, for ex a film) there is a folder called BDMV into the disk root.

So if the player look only @ file structure, it plays everything without any problem. But it checks for disk type, so plays only format that are authorized. And BDMV is not authorized for some players like PS3.

Disc volume is not important when you burn: every blu ray has the same disc volume name but i change it in my backups without any problem.

Don't burn AACS directory: if you burn AACS dir the player look for encrypted M2TS, your disc is not encrypted and the player eject it. So burn only BDMV directory.
OK, thanks, now all thing are getting more clear to me :)

In BDMV (produced with Roxio DVDit HD)
you first mentioned that home made video are stored into BDMA type folder ! Shouldn't stuff produced with Roxio DVDit HD must be considered as home made video ?
Waht happens if we rip the movie and then burn it on BD-R under BDMA folder to disguise it as home made ? Is it completely different structure or it somehow downgrades home made video quality playing back and it's no more 1080p ?

[dvdguru]

BDAV and BDMV are totally diferent format.

BDAV= only video, lower bitrate, no menu, no interactivity. And also a different file structure.

Roxio DVDit HD is a professional authoring tools and with it you can produce BDMV. BDAV is the format for Cyberlink PowerProducer or Ulead, mass market software.

[iampivot]

Well, it would be a lot more difficult, first of all there is no such thing as 'the one and only device key', each device is assigned a set of device keys together with their u,v subtree mask (cfr specs).
The media key in the MKB on the disc is encrypted using a number of keys (say n times with n keys), this number is dependent on the number of actual revocations (the larger the number of revocations, the more encrypted entries you will find).
The device will search for a working key in it's device key set (complicated search using the uv masks, the device number, the device keyset, and a key derivation alg...) and will be able to use it to decrypt just one of the n encrypted media key entries. If the device is revoked it will not find a matching key in it's set and will not be able to get to the title key.
So in order to use this 'device key mechanism', one needs to discover all the keys assigned to a player and their corresponding u,v subtree mask + the device number! So this is a lot more then finding 128 consecutive bits in memory.

Is this key derivation algorithm also part of the AES-128 specification, or is it specific to AACS?

[PepsiLee2001]

I got a problem......

The "SHA-1 hash code" under the CPSUnit00001.ccs are the same in the following 2 blu-ray titles:
"House of Flying Daggers" and "Ultraviolet"

[mrazzido]

i think its offtopic when pls delete.

i installed windvd jap. edition on a second pc , i made an iso of my ripped movie the iso is mounted by deamon tools. when i try to start the film he want that i change region code to B , is there a chance to change region on windvd without a bluray drive inside? the option is "locked" without Drive.

[johner23]

See above:

---> http://forum.videohelp.com/viewtopic.php?t=320788

Now, the other step is to deal with BD+ protection and some other schemes that industries will take, trying to solve the situation about Blu-Ray and Hd-DVD weak points.

---> http://en.wikipedia.org/wiki/BD+

All the help from community will help a lot Muslix64 and some other people, much willing to stop DRM abusive behaviours towards us, the consumers !!

Thanks.

devil (johner)

[Shinigami-Sama]

i think its offtopic when pls delete.

i installed windvd jap. edition on a second pc , i made an iso of my ripped movie the iso is mounted by deamon tools. when i try to start the film he want that i change region code to B , is there a chance to change region on windvd without a bluray drive inside? the option is "locked" without Drive.

try ghosting your drive?
that way you can play however you want and just restore the original

[nuclear bit]

Is this key derivation algorithm also part of the AES-128 specification, or is it specific to AACS?

The key derivation alg is part of what is called 'subset difference based key management', it is used by AACS.
I've been reading about this and it seems a very flexible way to implement the revocations. If you are interested in this don't read the AACS specs they are too short on explaining this topic. There is a much better explanation in : http://www.watersprings.org/pub/id/draft-irtf-smug-subsetdifference-00.txt
unbreakable if you ask me...

[6ixed]

Now, the other step is to deal with BD+ protection and some other schemes that industries will take, trying to solve the situation about Blu-Ray and Hd-DVD weak points.

devil (johner)

Here's an interesting observation I found, from an Industry Insider...who states, that its just a matter of time, before BD+ can be cracked too...along the lines of AACS crack....

Posts from forum somewhere... Link (http://www.avsforum.com/avs-vb/showthread.php?p=9532683&&#post9532683)

and then the Industry Insider proceeds to explain it in some detail in this Link (http://www.avsforum.com/avs-vb/showthread.php?p=9533539&&#post9533539)

6ixed

[HD Hell]

Any news on the Volume keys yet?

[Revgen]

and then the Industry Insider proceeds to explain it in some detail in this Link (http://www.avsforum.com/avs-vb/showthread.php?p=9533539&&#post9533539)


The "insider" is from "Washington State". Microsoft perhaps? ;)

They've invested quite a bit into HD-DVD.

[He-Man]

Here's an interesting observation I found, from an Industry Insider...who states, that its just a matter of time, before BD+ can be cracked too...along the lines of AACS crack....

Posts from forum somewhere... Link (http://www.avsforum.com/avs-vb/showthread.php?p=9532683&&#post9532683)

and then the Industry Insider proceeds to explain it in some detail in this Link (http://www.avsforum.com/avs-vb/showthread.php?p=9533539&&#post9533539)

6ixed
BD+ was turned down by the HD DVD forum and will only be implemented on Blu-Ray.
Of course Amir says BD+ on Blu-Ray will be easy to crack, he is a HD DVD insider (not Blu-Ray insider) who works for Mircosoft and Microsoft is supporting the competing format HD DVD which will not use BD+.

[mrazzido]

i find a way to change the region settings in windvd without have any bluray drive inside :-) yeah the movie works on my second pc yet .

[K40]

Can you explain how to change the region setting in Win DVD
without connected Blu-ray Drive?
Another question is about changing the Blu-ray regions A or B when the drive is connected.I heard you can change 5 times.
So if the first Disc inserted is region A,the drive will ask if you want set it to region A and then you can change it another 4 times.
Which means with the last change you have a region A drive.
Or after the first region set you can change 5 times which means
you end with a region B drive ?

[mrazzido]

here is the tool ...Click... (http://www.file-upload.net/download-187729/windvd_tool.rar.html) , it activate the "grey" windowze buttonz.

start the tool then push "start" , then start windvd BD edition, go to the window where change region , and watch the buttons avaible :-) (the timer is 0 but it works ehhe.

[hajj_3]

this topic should be renamed to: "BackupBLURAY, a tool to decrypt AACS protected movies"