HD DVD aca file extracter (and backuphddvd C++)

[Zotty]

For those who want to look inside the aca files aswell I've made a little tool that extracts and decrypts the ARF (=Advanced Resource File) files from it (png, wav, ttf, js, xmf and xmu). Could be usefull in making menu's work and what more.

I have no doubt that there are more gifted coders out there, but it works like a charm. It's very likely there are strange parts that can be rewritten. If you think so, say so and we can make this thing better. This is version 0.1 btw and only does extracting/decrypting. Verfication with hash/mac is planned.

There's 1 thing I'd like to specifically say; volume keys are read from an XML file (as suggested here http://forum.doom9.org/showthread.php?p=941284#post941284). However, this does not include the SHA-1 hash of the VTKF000.AACS file which is widely used. It only has the a TKFMAC field. As said the hash value is widely used, so I've been abusing TKFMAC to store the hash value. I'll change this in a later stadium, but for now it seemed like the right thing to do. Albeit I'm not thrilled with it. Just so you know.

Compiled executable and source are in there. Just run it from the console and usage is simple; arf_extracter source dest.
I've also tested it a bit on King Kong and output was 100% working.

Oh and there's a C++ version of backupHDDVD in there aswell ;) Also tested this one and the result is a 100% binairy compatible output compared to backuphdvd v1.00 (the original java version).

Disclaimer:
Don't hold me responsible if it crashes and burns down your computer gnagna. For the rest, feel free to use the code if you want (god knows I've kept a close eye at mulix64's code :)), but if you use (part of) it, it's only fair to give your source in return to the community. Well, you know what I mean.

edit:

Changelog
^^^^^^^^^
BackupHDDVD v0.5
- Complete overhaul of the code
- Fixed 4GB limit (only linux)
- Fixed memoryleak
- Disabled nav-chain fix
- Faster decryption

ACA decrypter v0.4
- Runs under Windows and Linux
- Added log output (aca_decrypter.log)
- Uses XML keydb

BackupHDDVD v0.2
- Runs under Windows and Linux
- Fixed potential problems with large EVOB's
- Uses XML keydb

cfg2xml v0.1
- Initial release (Windows and Linux)
[/quote]

backuphddvd_src_20070517.rar (http://www.sendspace.com/file/phvgou)
hddvd_cpp_20070129_bin.rar (http://www.sendspace.com/file/0lb0k4) (OLD!)

[LokiHD]

ur next!

edit: for the life of me, i cannot run it, sorry.. i thought its gui

[Zotty]

ur next!

edit: for the life of me, i cannot run it, sorry.. i thought its gui
Sorry, no GUI. Maybe in the future, but atm my priority is to get the underlying code functioning properly and get a better understanding of the whole picture.

Anyways, this should dump the extracted files in a directory called "acaoutput";
arf_extracter source destination_dir

[Momotte]

do you know if the .aca file has to be remastered so that power dvd will be able to show menu / U-CONTROL?

If so, I was thinking that instead of extracting all those files from it you could just decrypt them in place and have a .aca file that is unencrypted...

[Zotty]

do you know if the .aca file has to be remastered so that power dvd will be able to show menu / U-CONTROL?

If so, I was thinking that instead of extracting all those files from it you could just decrypt them in place and have a .aca file that is unencrypted...

arg, just found that out 5 mins before I read your post. Guess I must have missed that post, so that's what I'll be what I'll be doing tomorrow morning. On the other hand, it is called extracter and that's just what it does. When started I never thought that it might be usefull in getting menu's to work, just wanted a look inside.

On a side note, I've already got a message from someone who's messing with the data that is outputted, so at least it's usefull from a educational point of view ;) Besides, in the meantime editing that data is possible, which isn't an option if the data is written directly back into the aca file.

[Emon]

where's your "arf_extracter"? You have only linked your C++ version of backuphddvd

[aerox87]

where's your "arf_extracter"? You have only linked your C++ version of backuphddvd

Try the rapidshare link. That one contains the right tools.

[Janvitos]

I have tested the arf_extracter program, congradulations for that it did work on some movies.
But there are actually 2 important problems with it:

- In some movies, there is more than one aca file.
Right now, the program seems to choose the first aca file it encounters.
Maybe add an option to specify our own input filename.

- Unfortunately, the program crashes on more than 3/4 of my movies.
I currently have 15 titles and was only able to rip the aca files on 4 of them.
It looks like the arf_extracter is crashing on certain filenames because it decrypts some of the files and then suddenly crashes.

If it would be possible to have these issues corrected that would be amazing.
I currently was able to rip the menus for 4 of my movies and successfully recompress them unencrypted with CreateACA.exe (included with Microsoft HD DVD Interactivity Jumpstart).
The menus worked fine in the movies once everything was re-assembled properly.

P.S. Since CreateACA.exe only takes filenames or filelist as an input, my trick was to generate a file list from the unencrypted aca contents using the "dir /B > temp.txt" command.

[2themax]

Nice work. I was able to decrypt both ACAs from King Kong, recreate them, and use them for playback. The full menus and U-Control work perfect.

[frogman]

i "HATE" rabbitshare ... I been unable to get anything from them in weeks. Any where else.

[abe2000]

Could someone please upload CreateACA.exe? 'cause I cant install the jumpstart crap on Vista. Says I need atleast XP SP2.. nice coding there microsoft. (and no you cant use compatability mode on .msi files)

[Emon]

Could someone please upload CreateACA.exe? 'cause I cant install the jumpstart crap on Vista. Says I need atleast XP SP2.. nice coding there microsoft. (and no you cant use compatability mode on .msi files)

Direct link (http://download.microsoft.com/download/0/f/f/0ff3512c-fe1e-4526-96e7-dd4ccaaca6e8/HDDVDJumpstart.msi)

[abe2000]

Direct link (http://download.microsoft.com/download/0/f/f/0ff3512c-fe1e-4526-96e7-dd4ccaaca6e8/HDDVDJumpstart.msi)

No thats to the msi file which i cant install, thanks anyway though.

[Emon]

No thats to the msi file which i cant install, thanks anyway though.

http://www.sendspace.com/file/eljf22

[abe2000]

http://www.sendspace.com/file/eljf22

Thank you very much! :)

[Zotty]

- In some movies, there is more than one aca file.
Right now, the program seems to choose the first aca file it encounters.
Maybe add an option to specify our own input filename.
Hmmz, that's something I've overlooked. Should be easy enough to fix.


- Unfortunately, the program crashes on more than 3/4 of my movies.
I currently have 15 titles and was only able to rip the aca files on 4 of them.
It looks like the arf_extracter is crashing on certain filenames because it decrypts some of the files and then suddenly crashes.
That was unexpected. It could be related to related to MAC encapsulated ARF's, but atm that's a guess. In my test aca file these are not present, but I've had a message that for example the EU version of MI3 has MAC ARF's and that it crashes the thing. I've also noticed the test aca seems to order the type of capsulation according the spec. First encrypted, then encrypted and hashed, etc. Could be coincidence, but might explain why you're getting at least part of the data.
Looking into that today.

Thanks for the feedback Janvitos!

edit: it's not the MAC encapsulation, so time for a 2nd bugtrack attempt...
edit 2: ok, finally been able to reproduce a crash with serenity

[He-Man]

No thats to the msi file which i cant install, thanks anyway though.
You don't have to extract the msi archive, you should be able to just extract the files you want from the msi archive without installing it.
An msi archive is like a zip or rar archive, just use WinRAR or similar to extract files.

[ape]

hi again, i felt like helping out with the menu situation on hd-dvds, so i made an extractor for the .aca files.
the files this extracts should be decryptable with backuphddvd (i haven't tried, it will probably require a few modifications).
they will need to be packed into an .aca file again (i will try and code a program to do this tommorow).

usage:
place extract_aca.exe in the same folder as your .aca file (or vice versa)
in a command prompt from the directory containing both files type:
extract_aca.exe whatever.aca
it will output to a folder with the same name as the aca file.

binary:
http://mihd.net/2p1cy0

source (feel free to post bugfixes, improvements, etc):
http://mihd.net/kldzen


edit:
i just saw the post with zotty's program that does the same thing, so nevermind this i guess. his even decrypts the files :P.

[ape]

just posted my own .aca extractor, i didn't know zotty had already written one. i posted source as well incase anyone wants to mess with it/implement it into backuphddvd heh.

[Momotte]

I have tested the arf_extracter program, congradulations for that it did work on some movies.
But there are actually 2 important problems with it:

- In some movies, there is more than one aca file.
Right now, the program seems to choose the first aca file it encounters.
Maybe add an option to specify our own input filename.

- Unfortunately, the program crashes on more than 3/4 of my movies.
I currently have 15 titles and was only able to rip the aca files on 4 of them.
It looks like the arf_extracter is crashing on certain filenames because it decrypts some of the files and then suddenly crashes.

If it would be possible to have these issues corrected that would be amazing.
I currently was able to rip the menus for 4 of my movies and successfully recompress them unencrypted with CreateACA.exe (included with Microsoft HD DVD Interactivity Jumpstart).
The menus worked fine in the movies once everything was re-assembled properly.

P.S. Since CreateACA.exe only takes filenames or filelist as an input, my trick was to generate a file list from the unencrypted aca contents using the "dir /B > temp.txt" command.

LOL ! you are always ahead. I performed the same task last night and got KK working...

@Zotty: Great work ! Now just decrypting the .aca and allowing more than one file would be perfect. Big Thanks !

[Momotte]

just posted my own .aca extractor, i didn't know zotty had already written one. i posted source as well incase anyone wants to mess with it/implement it into backuphddvd heh.

Works fine, TY. Tested with KK.

[blutach]

just posted my own .aca extractor, i didn't know zotty had already written one. i posted source as well incase anyone wants to mess with it/implement it into backuphddvd heh.Threads merged.

Regards

[Zotty]

k, found a potential crasher within the code. The problem is that the filesize of certain files is too big for keeping it in mem within the decrypting code. Already fixed that thing, but not yet ready for upload. Soon, but also need to do my normal dayjob ;)

PS, only happend with one big file so far; Serenity, file navBGV2_Root.png which is 1,5 MB.

[aerox87]

Yep. Crashed at the same file with Happy Gilmore also.

[d1g1ta7]

I've noticed that it only takes the first *.aca file. So if there's an ime.aca file, it'll only decrypt that, and not the menu.aca that follows. So just copy the AACS and ADV_OBJ folders to the root of a drive, and delete the ime.aca file after you've decrypted it, etc.

Also, it still always seems to want to enable subtitles. Is there a fix for this without completely removing the subtitles?

[aerox87]

I've noticed that it only takes the first *.aca file. So if there's an ime.aca file, it'll only decrypt that, and not the menu.aca that follows. So just copy the AACS and ADV_OBJ folders to the root of a drive, and delete the ime.aca file after you've decrypted it, etc.

Also, it still always seems to want to enable subtitles. Is there a fix for this without completely removing the subtitles?

Just bring out the menu (there is a menu button in PowerDVD or you can right click and find Menu Title menu option) and just disable/enable subtitles in settings/set-up.
Works fine on the ones i tested with (serenity and Happy Gilmore).

[d1g1ta7]

Just bring out the menu (there is a menu button in PowerDVD or you can right click and find Menu Title menu option) and just disable/enable subtitles in settings/set-up.
Works fine on the ones i tested with (serenity and Happy Gilmore).

I know that works, but why does PowerDVD automatically enable subtitles?

On Smallville Season 5, Disc 1, when IME is activated, the subtitles turn on, and the option to turn them off is no longer in the settings.

[evdberg]

just posted my own .aca extractor, i didn't know zotty had already written one. i posted source as well incase anyone wants to mess with it/implement it into backuphddvd heh.

I had also already made my own resource extractor, but zotty released his before I had found the time to test it properly ... also I wanted it to be able to output a new resource file, instead of only extracting the files. Anyway, no need for it now anymore ...

[Zotty]

Quick changelog:
- Changed name to ACA decrypter
- Supports multiple ACA files
- Bugfix that caused crashes when working with large ARF's (e.g. 1,5MB in size)
- Seperate files are now stored in a directory called "<nameofaca>_files"
- A decrypted ACA file is constructed in the destination directory
- Replaced win32 specific filesystem calls with something more portable

See initial post for link

I've tested it with multiple aca files from different discs (King Kong, Batman Begins, MI3, Serenity). It runs stable over here and output looks good. The decrypted aca file I've compared with the results of createACA.exe on the king kong files and is 100% binary compatible. Since there's no such thing as perfect, let me know if you run into any trouble.

Usage is the same, except it's now called aca_decrypter. I hope crashes are solved now and the 1 decrypted aca file is also helpfull.

[Emon]

ACA decrypter v0.2 (http://www.sendspace.com/file/xuo37f)

Quick changelog:
- Changed name to ACA decrypter
- Supports multiple ACA files
- Bugfix that caused crashes when working with large ARF's (e.g. 1,5MB in size)
- Seperate files are now stored in a directory called "<nameofaca>_files"
- A decrypted ACA file is constructed in the destination directory
- Replaced win32 specific filesystem calls with something more portable

I've tested it with multiple aca files from different discs (King Kong, Batman Begins, MI3, Serenity). It runs stable over here and output looks good. The decrypted aca file I've compared with the results of createACA.exe on the king kong files and is 100% binary compatible. Since there's no such thing as perfect, let me know if you run into any trouble.

Usage is the same, except it's now called aca_decrypter. I hope crashes are solved now and the 1 decrypted aca file is also helpfull.

Sweet !!! I was eagerly waiting for you to release the new version.

[Momotte]

I will try it later tonight and let you know of my results...

[Zotty]

I will try it later tonight and let you know of my results...

That would be great. Been eagerly awaiting results from others.

Edit:
Reported and confirmed V for Vendetta is still an issue. I'll be damned...

[mb2696]

Zotty, despite any issues, this is still a great tool. Keep up the great work!

[Zotty]

Fixed: ACA decrypter v0.3 (http://www.sendspace.com/file/tlss7p)

Same memory allocation problem, only different place. Sorry for the inconvenience. Working with the feedback you and others give me ;) Just walking through the entire source to see if there are any other spots. At least now I know what to look for.

Btw, the XML format is still bothering me. Right now the TKFMAC is being occupied by the SHA-1 hash value that's been used all along. How about adding a hash field aswell so these can be seperated before too many keys are added to the DB in in essence the wrong field?

[Momotte]

I just tried it with T.I.J., works fine... thanks!

[moshmothma]

How do you rebuild the ACA file? MS's tool leaves a lot to be desired. Also, there are differences between the size of the original aca and the recreated one. Thanks

[Zotty]

How do you rebuild the ACA file? MS's tool leaves a lot to be desired. Also, there are differences between the size of the original aca and the recreated one. Thanks

As I didn't find any information on the exact format, I kinda reverse engeneered it with help from the MS tool. There's no AACS encryption, so it's not in the AACS specs. That also implies I don't have all the details (see below).

Here's what I do; allocate a block of memory (let's call this M) the size of the original encrypted file. The decrypted version has no extra data such as protection type, title key pointer, hashes and so on, so the end result will always be smaller than the original. Btw, make sure the order in which the ARF's are processed does not differ from the original or the rest of the story doesn't work.

Next I copy the original headerinfo, the ACA header and file index, to M. This contains offsets, filesizes, CRC values and MIME-types. At this stage these are unknown so they will need to be updated later.

Now I start decrypting all ARF's, one by one. Since only one ARF is processed at a time, right after decryption M needs to be updated since all needed info is now available. First the decrypted data is appended to M and next I overwrite the initally copied filesize and offset in M with the new values and determine the MIME-type and calc the new CRC.

This is done till all ARF's are decrypted and stored in M. Last thing to do is update the total filesize in the header and write the whole thing to disk. Tada, you've got a new and decrypted ACA file.

The only unknown is that I don't know all MIME-types. In the encrypted ACA all have an ID of 0xFF. Decrypted they need to have a specified value. So far I know the values for:
xpl, xmf, xmu, js, jpg, png, wav, ttf and xml.
Don't know them for these files (haven't encountered them yet):

- Advanced subtitle (.XAS)
- Capture image format (.CVI, .CDW)
- Multiple-network-graphic (.MNG)
- OpenType Font (.OTF)
- Style sheet (.XSS)
- Time map (.MAP)
- Timing sheet (.XTS)
- TrueType collection (.TTC)
- MMF
- XTS
- LPCM

Info on those would be appreciated.

[Emon]

I am having trouble getting it to work with "Lady in the Water" HDDVD.

Here's what I got when I first ran it:

Title Key File MAC: 8A21D06E2EE1A0EC1FC26161119ADD6E
Title Key File hash: A14D5F731B4A11524EF17BDED1B6FA0ED6B88B34
No Volume Key found... aborting!

So I took the the TKFMAC value and added a new entry into your keydb.xml like the following way:


<KeySet>
<Description>Lady in the Water</Description>
<Origin>US</Origin>
<Key type="TKFMAC">8A21D06E2EE1A0EC1FC26161119ADD6E</Key>
<Key type="Volume">DFCFFF93F0DA12BF8284D45B2779F704</Key>
</KeySet>


But it still failed.

EDIT: got it working. Sorry my bad .. I didn't RTFM

[2bigkings]

but i have to edit the VPLST000.XPL also or not? Or is this aca decrypter a 1:1 Copy? i've got kingkong , so what i have to do with all these files?

[evdberg]

Snippet from my source:

{ "XPL",1 },
{ "XMF",2 },
{ "XMU",3 },
{ "XTS",4 },
{ "XAS",5 },
{ "XSS",6 },
{ "JS", 7 },
{ "EVO",8 },
{ "MAP",9 },
{ "JPG",10 },
{ "PNG",11 },
{ "MNG",12 },
{ "CVI",13 },
{ "CDW",14 },
{ "WAV",15 },
{ "OTF",16 },
{ "TTF",16 },
{ "TTC",16 }

[calinb]

Oh and there's a C++ version of backupHDDVD in there aswell ;) Also tested this one and the result is a 100% binairy compatible output compared to backuphdvd v1.00 (the original java version).It appears to run under wine on Linux too. Thanks, Zotty! This is a good step toward cross-platform solutions--no C# or .NET needed! Your release notes say you usually run Linux. Have you found a Linux UDF 2.5 driver that you like yet?

[2bigkings]

the c++ version copy all files, but the most of the files are 0 bytes big.
this version decrypt the feature1.evo file only to 1,69gb and the feature2.evo is 0 byte big. But it says everythings okay. anybody got this problem too?

[Zotty]

A quick update after updating the MIME-types posted by evdberg: ACA decrypter v0.3.1 (http://www.sendspace.com/file/co9opl)

Quick changelog:
ACA decrypter v0.3.1
- Addition of xts, xas, xss, evo, map, mng, cvi, cdw, otf and ttc MIME-types

Snippet from my source:
<cut>
Thanks! May I ask how you got it so complete, curious?

It appears to run under wine on Linux too. Thanks, Zotty! This is a good step toward cross-platform solutions--no C# or .NET needed! Your release notes say you usually run Linux. Have you found a Linux UDF 2.5 driver that you like yet?
Sweet! Having it portable is the intention, but didn't get around yet to actually try it. So it's very nice to hear the first Linux result is a positive one. Been compiling with GCC, so I'm hoping it will run natively under Linux before the end.
Haven't looked at UDF drivers yet, since I don't have a real drive to experiment with. So unfortunately I can't tell you much about that... yet ;)

the c++ version copy all files, but the most of the files are 0 bytes big.
this version decrypt the feature1.evo file only to 1,69gb and the feature2.evo is 0 byte big. But it says everythings okay. anybody got this problem too?
I must confess you're the first to actually try the backuphddvd app and reported back about it. It was writen before the aca decrypter, so I'm pretty sure there will be bug in there looking at how it went with the decyrpter.
It was never tested on a real HD DVD. So I got encrypted menu and intro material to test it out and no bugs were found. But those were files of a couple of hundred MB's, not GB's. Will look into it this weekend. Need to clean up the source, so I'll try to address this issue aswell.

[evdberg]

Thanks! May I ask how you got it so complete, curious?
Quite simple actually ... I just created test files with all possible extensions, made an aca file using the MS CreateAca tool and used an hex editor to look at the mime type ...

[calinb]

the c++ version copy all files, but the most of the files are 0 bytes big.
this version decrypt the feature1.evo file only to 1,69gb and the feature2.evo is 0 byte big. But it says everythings okay. anybody got this problem too?
Yes--I reported too soon about Linux and Wine. I see this too.

[tonyp12]

I have tested this C++ port, it works with my TitleSorter GUI (http://forum.doom9.org/showthread.php?p=943657#post943657)

Just move Zotty's backuphddvd.exe to the same folder as the original backuphddvd.cmd
and my program with launch the C++ exe instead.

OR move my titlesorter.hta and keydb.cfg to Zotty's folder.

If you had problem with my xml, it have now been fixed.

[markrb]

Bourne Supremacy crashes when starting.
It finds the keys and such and then crashes hard.

I will try another title as this has been the only one I have tried so far.

Mark

Edit same thing with Dazed and Confused.

More info. .2 of aca_decrypter works while .3 crashes for me.
Both in stand alone and Gui mode.

[markrb]

.2 version does work for me.
Subtitles are forced on and won't shut off, but I will just kill them in the file myself.
I haven't tried switching audio yet, but I don't see any need to do that anyway as long
as the default continues to be English 5.1.
.3 and .31 both continue to crash.

Is there anyway to get the gui to write the keys to the xml file while saving it to the keydb file
or is that even needed anymore?

Mark

[Zotty]

Just a few words on the current situation; what started out as a quick experiment has turned into something with a much larger audience. Now I don't mind this (it's actually pretty nice to see it's been so usefull to so many people), but there apparently there are some problems with stability which I'm having a hard time to track down due to the lack of suffient testmaterial (HD DVD isn't sold here yet).
That combined with the fact that I also added a quick port of backuphddvd in the first packages (which still used the cfg instead of xml) and that other programs are including the decrypter in their own packages has led me to believe a few things should change before it get's too confusing for all of us.

So here's what I'm planning to do;

- Both apps will use the same keydb in XML format. So far the decrypter was using XML where the MAC filed was occupied by the hash value. Both values can be used now. Also backuphddvd was still using the old keydb.cfg, but the next update will work with the XML keydb. So one keydb for both apps.


<KeySet>
<Description></Description>
<Origin></Origin>
<Key type="CMAC"></Key>
<Key type="Hash"></Key>
<Key type="Volume"></Key>
</KeySet>


- I'll add a small tool to convert existing keydb.cfg to keydb.xml. This should make the transition easy. If I have the time I'll try to include a complete db. Think the counter is at 88 keys or something like that.

- Source and executables will be released seperate. Hopefully this will solve the "help how do I compile?" questions from people who only want to run the tool. It also speeds up the release of executables a bit.

- Last thing that'll be added is a log file. If you run into problems at least it'll be visible where the problem occured. PM or upload the log and it'll be much easier for me to track down potential problems.

So that's about it. I'm hoping it will work out in terms of improved stability and usabilitly. I'm no wizzkid or whatever, but I'll try to do my best to make the tools stable and usefull to everyone.

[Metro]

Nice work, Zotty! Can't wait to test it :)