So what will actually happen if AACS revokes keys from Cyberlink and Intervideo?

[Galileo2000]

I keep hearing people scared to death of the prospective that AACS will revoke keys from Cyberlink and Intervideo.

I would like someone more knowledgeable in the situation than I am to give an overview of such scenario and it's effect to BackupHDDVD development.

My take it is non-issue, but maybe I am missing something here.

[diogen]

I'm not knowledgeable to give a definite answer, but based on AVS posts the player manufacturer issues a patch, gets a new AACS key, and after that every newly released disk has the the old AACS key blacklisted (patch has to be applied).

That is the theory.

Real life might change this scenario: if AACS LA decides that keys can't be protected under XP, players might get a new key valid only in Vista; playback under XP is banned alltogether.

Amir sounded upset in one of his rare comments on this issue, it looks like not everything is honky-dory in AACS land. A decision what to do might take a while. Some studios might opt to halt new releases until this decision is made.

Diogen.

[honai]

The point is that PowerDVD and WinDVD themselves have to implement key revocation, i.e. key revocation isn't like a program on a disc that gets automagically executed but rather PowerDVD/WinDVD have to have some code in there that finds out they're being revoked, and then disable themselves.

I find this scenario highly unlikely. Would Cyberlink/Intervideo risk consumer charges when their software suddenly stops working? I don't think so. Both companies make their money from consumers, not from the AACS-LA. And the prospective fines by the latter for Cyberlink/Intervideo not implementing/executing key revocation are still much smaller than the money they'd lose from customers who sue them, or just choose not to buy new versions but rely on cracked ones because they still want to exercise their fair use rights.

[diogen]

The point is that PowerDVD and WinDVD themselves have to implement key revocation... PowerDVD/WinDVD have to have some code in there that finds out they're being revoked, and then disable themselves.True, and if they want to stay in business, they will do just that. It's in the licensing agreement.

Diogen.

[muslix64]

They will eventualy revoke software players.

Will they allow more secure soft player on Windows? May be, may be not... Will the restrict software player to Vista? May be, may be not...

We have to extract a maximum of keys while we can. That way, when more secure version of player will be there, we will know what values to look for in memory, speeding up the process of reversal. Once you know the key protection method in memory, it will be easy to extract keys, like we are doing now.

Another scenario, is to fully implement AACS process (with MKB and all the stuff) and steal some player keys. We don't disclose the devices keys, be we disclose volume keys like we are doing now... bypassing the revocation system

I'm not scared at all... it will be harder but still possible, no big deal.

People forget that you can also extract key from standalone (in your living room) player.

Just dump the memory through the JTAG port...

What do you think?

[honai]

@diogen

I'm quite sure that both players have a "bug" that prevents key revocation from "functioning properly" ...

@muslix64

Toshiba's players might be another good attack vector. They run custom versions of Red Hat Linux, but I don't think that Toshiba had the budget to implement protection layers like in the XBOX360 or PS3, so injecting custom software into the machine should work.

[Galileo2000]

They will eventualy revoke software players.

Will they allow more secure soft player on Windows? May be, may be not... Will the restrict software player to Vista? May be, may be not...

We have to extract a maximum of keys while we can. That way, when more secure version of player will be there, we will know what values to look for in memory, speeding up the process of reversal. Once you know the key protection method in memory, it will be easy to extract keys, like we are doing now.

Another scenario, is to fully implement AACS process (with MKB and all the stuff) and steal some player keys. We don't disclose the devices keys, be we disclose volume keys like we are doing now... bypassing the revocation system

I'm not scared at all... it will be harder but still possible, no big deal.

People forget that you can also extract key from standalone (in your living room) player.

Just dump the memory through the JTAG port...

What do you think?

Muslix,

Extract the keys from the standalone players is an excellent idea. I am pretty sure it will be even easie than what's you and others have already done on this project.

After that any key revocation will be a kiss of death for AACS.

CE manufacturers and consumers will be very very upset if they need to put a new firmware on millions of the devices.

[dvdguru]

Toshiba's players might be another good attack vector. They run custom versions of Red Hat Linux, but I don't think that Toshiba had the budget to implement protection layers like in the XBOX360 or PS3, so injecting custom software into the machine should work.

In the new generation of toshiba player the firmware is inside a totaly protected eprom:

http://img263.imageshack.us/img263/7590/dsc007638lj.jpg

anche the network adapter is totally protected.

http://img297.imageshack.us/img297/8206/dsc007566uv.jpg

You can damage the components if you try to remove the glue.

[2bigkings]

wow great pictures dvdguru. thanks

[diogen]

CE manufacturers and consumers will be very very upset if they need to put a new firmware on millions of the devices.This isn't neccessary.
Given enough time and determination, only the "guilty" ones can be forced to do it.
And if it is a BD player, BD+ (at least in theory) can just "kill" it for good.

Diogen.

[mikeathome]

Hi,
how do you get a Volume Key from PowerDVD. As far as I know only the Jap WinDVD 8 HD player has been compromised. So, it's easy to blacklist, PowerDVD does not store keys in mem, game over...

mike
P.S. I would like somebody prove me wrong :script:

Edit: I know quite a few SAP (Standalone Players) that use encrypted FW procedures, means the FW itself is protected in Flash and will be decrypted only in Ram for execution AND there's no such JTAG access to RAM at all. I fear the whole hole was just 'initiated' to boost HD sells and very soon, game over... Well, if by this time the Software Player will work correctly and respect the investment some of us made in HDCP compatible HW I can live with that, sorry... not meant to be provoking!

[Galileo2000]

This isn't neccessary.
Given enough time and determination, only the "guilty" ones can be forced to do it.
And if it is a BD player, BD+ (at least in theory) can just "kill" it for good.

Diogen.

They all will be "guilty", they all run some stripped-down Linux with exactly the same structure, at least those on the market right now.

If my BD player will be murdered, I will revenge it's death, and so will others.

[calinb]

You can damage the components if you try to remove the glue.Yeah--but for someone who's skilled at reworking fine pitch components on tightly spaced traces, that glue shouldn't pose much of a challenge.

[Galileo2000]

Hi,
how do you get a Volume Key from PowerDVD. As far as I know only the Jap WinDVD 8 HD player has been compromised. So, it's easy to blacklist, PowerDVD does not store keys in mem, game over...

mike
P.S. I would like somebody prove me wrong :script:

Yes it (PowerDVD) does.

Search is your friend.

[diogen]

They all will be "guilty", they all run some stripped-down Linux...Yes, the revocation process will be some sort of never ending cat-n-mouse game.
You should read Felten's 6-part series (http://www.freedom-to-tinker.com/) about AACS.

Diogen.

[dvdguru]

Yeah--but for someone who's skilled at reworking fine pitch components on tightly spaced traces, that glue shouldn't pose much of a challenge.

It's not a soft glue. It's similar to glass... :D

[mikeathome]

Yes it (PowerDVD) does.

Search is your friend.

Hi,
easy to proof me wrong and post your link. I did search as I do not have this jap. version but a few HDs with no keys available yet...

mike

[zeroprobe]

there is more or us than them so we will prevail. :)

[Galileo2000]

Hi,
easy to proof me wrong and post your link. I did search as I do not have this jap. version but a few HDs with no keys available yet...

mike

Mike, you need to work on your search skills...

http://forum.doom9.org/showthread.php?p=934036&highlight=powerdvd#post934036

[mikeathome]

Mike, you need to work on your search skills...

http://forum.doom9.org/showthread.php?p=934036&highlight=powerdvd#post934036

Hi,
THANKS!

Actually now I am curious why everybody's developing keyextractors is using WinDVD jap. HD Version and is not focussing on the more spread PowerDVD? Btw. which PowerDVD are we speaking about 6.5 or 7.1 Ultra? I'll give it a try anyway, need to see with my own eyes, one can write and tell a lot...

mike

[K40]

Would the info for revoked Softwareplayers be stored in the
drive the first time a newer HDDVD with updated list is
inserted?IF so,must a HDDVD player be installed on this PC to
pass this update to the drive or is it possible it gets there on
a system with only BackupHDDVD installed?

[guile]

Mike, you need to work on your search skills...

http://forum.doom9.org/showthread.php?p=934036&highlight=powerdvd#post934036

Although it seems Janvitos may have "found" a key (or keys) through Power DVD (it was never mentioned what version he may have been using), he never elaborated (nor has anybody else for that matter) further. It seems more people are using PowerDVD as a player (imo). As I do have the Jap version of Windvd, I don't have an HDCP compliant card or monitor so it is impossible for me to search out keys. I am eager to do this through Powerdvd though.

[Galileo2000]

"It’s believed that wrongly implemented AACS-compliant PowerDVD 6.5 HD DVD player retrieves the encrypted title key from the HD-DVD disc and stores the key in a database-formatted configuration file that PowerDVD at some points loads into unencrypted portion of memory in clear text format. By using this title key, the revocation system which intends to protect the DRM from crack can be bypassed or failed as useless too."

http://www.mydigitallife.info/2007/01/01/crack-decrypt-and-copy-hd-dvd-aacs-drm-protected-movies-with-backuphddvd/

Why don't you guys contact Janvitos, in his threads or through PM and ask him what he did?

[tonyp12]

http://forum.doom9.org/showthread.php?p=934036&highlight=powerdvd#post934036

It's a quote a few post below there they talk about powerdvd.
It does not mean that the quote is how to find keys in powerdvd.

I have done 10 memory dump with powerdvd and search for
known keys, it never finds it.

Windvd does not run on my computer so I can not contribute
to new keys until someone figure out how to do it in powerdvd.

[mikeathome]

Although it seems Janvitos may have "found" a key (or keys) through Power DVD (it was never mentioned what version he may have been using), he never elaborated (nor has anybody else for that matter) further. It seems more people are using PowerDVD as a player (imo). As I do have the Jap version of Windvd, I don't have an HDCP compliant card or monitor so it is impossible for me to search out keys. I am eager to do this through Powerdvd though.

Hi,
I actually found something, so there's hope ...

... more info about the PowerDVD trick not very specific though.

http://forum.doom9.org/showthread.php?p=935102#post935102

mike

[Galileo2000]

Hi,
I actually found something, so there's hope ...

... more info about the PowerDVD trick not very specific though.

http://forum.doom9.org/showthread.php?p=935102#post935102

mike

So now you can ask both Janvitos and Bystander what they did.

It will be really interesting when Intervideo finally releases their HD pack for English WinDVD 8.

[dito]

back to topic...

I thought the keys was revoked every 18 months... Is this not the case?

Best regards!

[He-Man]

It's not a soft glue. It's similar to glass... :D
It might be easier to use a Dremel to remove the outside of plastic on the IC itself. The chip die is only in the middle and the SMD soldering pins goes a bit inside the chips where they are connected to very small wires that connects to the die itself. With careful use of a Dremel you can expose the pins at the outside of the IC under the plastic and attach a logic analyzer. It might be easier to drill in this plastic than the glue.

[Galileo2000]

Hi,
how do you get a Volume Key from PowerDVD. As far as I know only the Jap WinDVD 8 HD player has been compromised. So, it's easy to blacklist, PowerDVD does not store keys in mem, game over...

mike
P.S. I would like somebody prove me wrong :script:

Edit: I know quite a few SAP (Standalone Players) that use encrypted FW procedures, means the FW itself is protected in Flash and will be decrypted only in Ram for execution AND there's no such JTAG access to RAM at all. I fear the whole hole was just 'initiated' to boost HD sells and very soon, game over... Well, if by this time the Software Player will work correctly and respect the investment some of us made in HDCP compatible HW I can live with that, sorry... not meant to be provoking!

Yeah, now muslix is an agent of the HD consortium.

Mike, you are not contributing, on the contrary IMHO.

[HyperHacker]

Seems if you looked up datasheets for those chips, you might find one that tells you the exact pin spacing (many do). From there, if the "glue" is soft/strong enough, you could drill right through it to the pins themselves and simply stick wires in the holes. You wouldn't even need to solder or worry about touching other pins if you used a small enough bit.

Or of course you can try to trace the printed circuits and simply splice into some exposed traces. Maybe melt the glue off. Attack the RAM chips. Put huge amounts of data in fields on discs (file names, etc) and try to overflow buffers. Really, putting a blob of goo over the firmware and network chips is hardly protection.

[Spc01]

In the new generation of toshiba player the firmware is inside a totaly protected eprom:

http://img263.imageshack.us/img263/7590/dsc007638lj.jpg

anche the network adapter is totally protected.

http://img297.imageshack.us/img297/8206/dsc007566uv.jpg

You can damage the components if you try to remove the glue.
OMG.
They actually protected the chips.
:eek:

[bomlat]

This black glue is a good news for us.

First, it mean that they didn't implemented any sophysticated crypto+efuse style protection like in the xb2.
Second, this thing is removable, as you can see on this page: http://forums.xbox-scene.com/index.php?showtopic=560275

This glue is similar to this: http://www.maxconsole.net/content_img/bl336.jpg
.This is the protection for the xb2 dvd rom firmware that is used by the M$.
So,there are guys out there that are able to remove this glue with a pyro pen.
Sorry,but as I see the youtube has deleted this video.

[He-Man]

Sorry,but as I see the youtube has deleted this video.
The video is mirrored here: http://www.360mods.net/files/Untitled-1.html

Direct link if you want to download the flash movie before watching it (16.1 MB): http://www.360mods.net/files/epoxy.flv

[blutach]

Hi,
easy to proof me wrong and post your link. I did search as I do not have this jap. version but a few HDs with no keys available yet...

mike

@mikeathome - please do not hijack this thread.

Observe rule 1a - this has been discussed before. And to retort as you have borders on a rule 4 violation.

Regards

[ernysmuntz]

Its not hard to remove the glue, its just very time consuming. I removed that black epoxy stuff on my Xbox 360 drive in about 5 hours by heating\cooling\heating cooling it, it becomes brittle over time and is then much easier to scrape out, I used a bent safety pin. Time consuming but by no means difficult.

[bomlat]

Yeah,and as I said:they don't want to protect it if it haven't got any sensible informations.:D

The volume/player key is under the black glue.

[mikeathome]

@mikeathome - please do not hijack this thread. Observe rule 1a - this has been discussed before. And to retort as you have borders on a rule 4 violation.
Regards

Thread Title: So what will actually happen if AACS revokes keys from Cyberlink and Intervideo?

Correct?

There's no way to extract keys from PowerDVD. I tried for hours (both 6.5 and 7.1), search the board others did as well. I find sections look like TKs but no VK.

@ALL: Try it and let us know if you find typical byte sequences.

Cyberlink stated there's no leak. When WinDVD HD 8 will be blacklisted, game over ... until somebody helps us finding the keys in other players.

I wanted to initiate this AND HELP, if nobody's interested, you'll be soon, wait for Babel HD. AND if it is not Babel then Lotr or SW ... Actually the thread moves toward chip extraction.

Kick me, I am not contributing anyway, since 2001...

mike

[mikeathome]

Its not hard to remove the glue, its just very time consuming. I removed that black epoxy stuff on my Xbox 360 drive in about 5 hours by heating\cooling\heating cooling it, it becomes brittle over time and is then much easier to scrape out, I used a bent safety pin. Time consuming but by no means difficult.

Hi,
the way I used to do this is using a gas solder with brought (SMD) nozzle, then quickly supercool with cooler spray, be careful and heat only the glue. Actually that way the glas/ceramic stuff is easier to remove than rubber like stuff (an acetonic solution might help).

mike

[Galileo2000]

Thread Title: So what will actually happen if AACS revokes keys from Cyberlink and Intervideo?

Correct?

There's no way to extract keys from PowerDVD. I tried for hours (both 6.5 and 7.1), search the board others did as well. I find sections look like TKs but no VK.

@ALL: Try it and let us know if you find typical byte sequences.

Cyberlink stated there's no leak. When WinDVD HD 8 will be blacklisted, game over ... until somebody helps us finding the keys in other players.

I wanted to initiate this AND HELP, if nobody's interested, you'll be soon, wait for Babel HD. AND if it is not Babel then Lotr or SW ... Actually the thread moves toward chip extraction.

Kick me, I am not contributing anyway, since 2001...

mike

Did you contact Janvitos and Bystander?

I see no reason not to believe those guys, they have posted a lot of useful stuff on this forum.

If you cannot do it, it does not mean it cannot be done. No one thought things will be completely taken apart just a month ago until muslix got in.

Now, I am pretty sure if keys are revoked, they are revoked from all the software players in existence. Or did you think they will trust Cyberlink word that there are no vulnerabilities in thier players?

Original intention of the thread was "what if.." we no longer can use any player in existense to extract the keys.

Now, you sure had contributed to the forum since 2001 and I am just a newbee so feel free to ignore me.

[Rufus210]

Just a note, AACS has both Content Revocation along with Device Revocation. Knowing exactly what to look for (title and volume keys from WinDVD) makes hacking anything else a lot easier. No need to try decoding using something you found, just check it against the known-good list.

AACS thought of this. Look at page 5 of the AACS Prerecorded book:
A Content Revocation List (CRL) is also embedded onto media and then stored in non-volatile memory by players and contains a list of content that contains a valid signature but has since been revoked.

There's little question that the Device Keys for WinDVD will be revoked, since it's trivial to just say "upgrade to the new version to play the new movies". Revoking content is a far trickier thing, since it would force everyone with a movie that's been revoked to trade it in or something for a new copy. Also as long as you never play any "post-revocation" content you'll never get an updated CRL so the old movies with known keys will still play.

Just another aspect to think of in what will inevitably become an arms race between "us" and "them".

[zeroprobe]

I cant see them revoking 150 titles which will mean these will playback in new software players with the exploited keys.

Voila easy to find the keys again.

[mikeathome]

Just a note, AACS has both Content Revocation along with Device Revocation. Knowing exactly what to look for (title and volume keys from WinDVD) makes hacking anything else a lot easier. No need to try decoding using something you found, just check it against the known-good list.

AACS thought of this. Look at page 5 of the AACS Prerecorded book:

There's little question that the Device Keys for WinDVD will be revoked, since it's trivial to just say "upgrade to the new version to play the new movies". Revoking content is a far trickier thing, since it would force everyone with a movie that's been revoked to trade it in or something for a new copy. Also as long as you never play any "post-revocation" content you'll never get an updated CRL so the old movies with known keys will still play.

Just another aspect to think of in what will inevitably become an arms race between "us" and "them".

Hi,
eventually the allready decrypted content won't be recognised as 'decrypted' and not compromised after all :-) This might lead to an increase in illegal P2P downloads ...

For those of you owning a XBox 360 addon connected to a PC thru USB, since the Mem Unit in the drive is not accessible -lack of Windows driver- the content revocation won't work for this drive at all, I guess...

mike

[Galileo2000]

For those of you owning a XBox 360 addon connected to a PC thru USB, since the Mem Unit in the drive is not accessible -lack of Windows driver- the content revocation won't work for this drive at all, I guess...

mike


Unless it is forced thru Automac updates on XP/Vista or included into Vista Service pack(s).

[Mug Funky]

revoking commercial titles is suicide. i think AACS allows it more because it can than it should.

a single DVD recall can cost huge amounts of money to the distributor (i wont say how much of course - a lot though). a revoked key would mean a product recall, meaning a tremendous loss (to say nothing about all the wasted plastic and hazardous chemicals - really a horrible thought that all those discs would be shredded and discarded. environmentally criminal in my opinion).

in fact, content revokation in the wrong hands could mean big distributors committing commercial sabotage on smaller ones - what would happen to an independent distributor of HD-DVDs having ALL their titles revoked at once? they'd be completely sunk in a matter of weeks and fall into massive, crippling debt (the customers and thus stores will all want refunds that the distributor will not be able to give).

of course, that's speculation, but food for thought nonetheless. think what would happen if certain governments had less liberal views on dissent in the media?

[Metro]

Hi,

For those of you owning a XBox 360 addon connected to a PC thru USB, since the Mem Unit in the drive is not accessible -lack of Windows driver- the content revocation won't work for this drive at all, I guess...

mike

Actually, if you allow the hardware wizard to connect to Windows Update, those 'unknown devices' will be installed as "XBOX 360 HD-DVD Interface 0" and "1" respectively, allegedly working correctly and 'no driver needed' according to XP's device manager. I haven't yet isolated the file that gets downloaded and allows them to be identified, and I suspect it's not going to be much help anyway.

The actual external drive shows up as a Generic USB Hub with four ports. The first port is a USB Composite Device (the "Memory Unit") with the two mysterious Interfaces "0" and "1" hanging off that. The second and third ports are the rather-underpowered USB outlets on the back of the case - you can't plug anything needing more than a few milliamps into these. The last port is a USB Mass Storage Controller with the Toshiba X807616 HD-DVD drive hanging off that.

The point of this is that once you've updated your hardware the Memory Unit is recognized by Windows even if it doesn't know what to do with it yet. It's not beyond the bounds of possibility that MS will send a package that makes use of the Memory Unit for something if it suits them...

Edit: Of course, if you pull the Tosh drive out of the case and hook it up with an adapter rather than use the MS circuit board, you've taken the "Memory Unit" right out of the equation.

[mb2696]

Edit: Of course, if you pull the Tosh drive out of the case and hook it up with an adapter rather than use the MS circuit board, you've taken the "Memory Unit" right out of the equation.



Is anyone aware of this being done successfully? I'd like to do this but I don't have the guts to be the first. Any links would be appreciated.

[Galileo2000]

Is anyone aware of this being done successfully? I'd like to do this but I don't have the guts to be the first. Any links would be appreciated.

Please, let's stay on the topic.

Either start your own thread or Please, Use Search.

It's been discussed before and people reported success.

Search is your friend.

[Metro]

Is anyone aware of this being done successfully? I'd like to do this but I don't have the guts to be the first. Any links would be appreciated.

There's a collection of pictures here: http://uneasysilence.com/archive/2006/11/8303/ - though they weren't too bright at identifying the plug - it's a mini-IDE, and you can get an adapter to connect it to IDE on eBay for less than $10.

I don't think it's too far off-topic, since removing the Memory Unit components from the drive would certainly reduce the likelihood of the drive hardware being used to lock out decryption. But I agree, we should stop this line of discussion here.

[Foreigner999]

I think the AACS creators have long ago had these hard back-room discussions on what they would do if the encyption and protection methods were compromised by some exploit in the wild. I believe they must have been well aware of the consequences of revoking software and devices and hosts and are absolutely going to implement revocation.

I don't think in the future it will be intelligent to play a cat and mouse game, because in the end after every attempt that is made to bypass the protection, we will indirectly be helping them to find better implementations and further secure against exploits both on hardware and software. Therefore, this IMHO, is a losing battle for the consumer/fair use side of the battle.

Knowing that they _WILL_ revoke software that is currently working in these sets of exploits, I persinally believe it would be more intelligent in the long run to add a serious penalty to every attempt to use the revocation lists. Such as:

Implement hardware exploits:
Everytime they issue revocations for hardware they will at least affect a thousand or more people. This is good for encouraging lawsuits. The first few times they can get away with replacement of hardware or telling joe nobody that it is a firmware issue. But the more they do this the worse the companies selling products look and incur stereotypes, and that will hurt their bottom line.

Software exploits while the "easiest" and least expensive of these exploits will hardly be noticed by joe nobody when they are asked to update thier software and in 9 or 12 months we will be finding the situation out that far to be a rather difficult one. The AACS creators will easily require that the software giants implement internet checks for updates before playback; Or worse, like crippled cd's that they phone home every playback attempt to easily fish out who is doing rather odd playback behavior. I believe I read on doom9 that this was actually in the specs but on the hardware side.

Get them to revoke hardware and tv panels of all kinds because they might reveal the keys and in probably 7 months down the road after two or three revocation updates they will have a major consumer backlash over HDCP and AACS copy protection/revocation. Make Consumers Care ;)

Off Topic is it possible to model in software the different interactions of MKB VKU's and whatever other key type acronym I might have missed? In other words a software emulator to mimic the processes of key veryfication and software revocation to better understand how the system might have flaws or weaknesses.

[blutach]

Well, we each have a view and can only wait to see what, if anything, will happen. No-one's crystal ball is better than anyone else's. FWIW: I agree with Mug Funky, whom I know has been around the industry for a while.

And Foreigner, every time something is stepped up, someone else finds a smarter way round it. Take ARccOS/Ripguard for example - the biggest fizzer around.

Regards