Processing Key, Media Key and Volume ID found!!!

[Electrox3d]

I've got blu-ray drives coming out of my ears... anything you want me to try?

[arnezami]

Source code please :-)

Some sample code for those eagerly waiting:

// Processing Key
static unsigned char processing_key[16] = {0x09,0xF9,0x11,0x02,0x9D,0x74,0xE3,0x5B,0xD8,0x41,0x56,0xC5,0x63,0x56,0x88,0xC0};

// Encrypted C Value
static unsigned char encrypted_c_value[16] = {0x6D,0x02,0xCA,0xC6,0x7B,0x1A,0x7E,0x95,0xC2,0x16,0xEF,0xD4,0xC9,0x28,0x09,0xCF};

//Decrypted C Value
static unsigned char decrypted_c_value[16];
static unsigned char uv[4] = {0x00,0x00,0x00,0x01};

// Media Key
static unsigned char media_key[16];

//Encrypted Verification Data (King Kong)
static unsigned char encrypted_verification_data[16] = {0x87,0xB8,0xA2,0xB7,0xC1,0x0B,0x9F,0xAD,0xF8,0xC4,0x36,0x1E,0x23,0x86,0x59,0xE5};

//Decrypted Verification Data Should Be
static unsigned char decrypted_verification_data_should_be[8] = {0x01,0x23,0x45,0x67,0x89,0xAB,0xCD,0xEF};

//Decrypted Verification Data
static unsigned char decrypted_verification_data[16];

// Volume ID
static unsigned char volume_id[16] = {0x40,0x00,0x09,0x18,0x20,0x06,0x08,0x41,0x00,0x20,0x20,0x20,0x20,0x20,0x00,0x00};

//Decrypted Volume ID
static unsigned char decrypted_volumeid[16];

//Volume Unique Key
static unsigned char volume_unqiue_key[16];


// First decrypt the C-value with the processing key
oRijndael.MakeKey((char *)processing_key, CRijndael::sm_chain0, 16, 16);
oRijndael.DecryptBlock((char *)encrypted_c_value, (char *)decrypted_c_value);

// Then XOR it with with the uv (of the corresponding C-value)
for (j = 0; j < 16; j++)
{
if (j < 12)
{
media_key[j] = decrypted_c_value[j];
}
else
{
media_key[j] = decrypted_c_value[j]^uv[j-12];
}
}

// Then check if the resulting media key is correct using the verify media key record
oRijndael.MakeKey((char *)media_key, CRijndael::sm_chain0, 16, 16);
oRijndael.DecryptBlock((char *)encrypted_verification_data, (char *)decrypted_verification_data);

if (!memcmp(decrypted_verification_data_should_be, decrypted_verification_data, 8))
{
for (j = 0; j < 16; j++)
{
printf("%02X ", decrypted_verification_data[j]);
}
}
printf("\n");

// Then do a AES-G (basicly a decrypt and an XOR) on the media key + volumeID
oRijndael.MakeKey((char *)media_key, CRijndael::sm_chain0, 16, 16);
oRijndael.DecryptBlock((char *)volume_id, (char *)decrypted_volumeid);
for (j = 0; j < 16; j++)
{
volume_unqiue_key[j] = volume_id[j]^decrypted_volumeid[j];
}
printf("\n");

// This results in the Volume Unique Key
for (j = 0; j < 16; j++)
{
printf("%02X ", volume_unqiue_key[j]);
}
printf("\n");

[xyz987]

Some sample code for those eagerly waiting:


Great!!

:thanks:

[xyz987]

I've got blu-ray drives coming out of my ears... anything you want me to try?

Of course, we want to know if arnezami's Processing Key works with BluRay movies.

I suppose arnezami will give you instructions soon.

[evdberg]

And a small PC prog to play around with it ... (had to convert it from my Mac test version)

Usage: mkb <mkb_file> [volume_id]

[blutach]

Guys - I wake up to something building to a flame a war?

Let's keep it on an even keel and stick to the technical please. We all have something to contribute - let's do it in a postive way!

Regards

[xyz987]

And a small PC prog to play around with it ... (had to convert it from my Mac test version)

Usage: mkb <mkb_file> [volume_id]

:thanks:

[appleguru]

And a small PC prog to play around with it ... (had to convert it from my Mac test version)

Usage: mkb <mkb_file> [volume_id]


Can I get the mac version? :)

[evdberg]

Can I get the mac version? :)

Sure ... if you explain me how you can read a HD-DVD using the Xbox-360 drive on the Mac? Because if I insert a disk in the drive, OS-X comes up with the message "Unknown format, Ignore or Eject".

[Electrox3d]

Of course, we want to know if arnezami's Processing Key works with BluRay movies.

I suppose arnezami will give you instructions soon.

So... Should I run the USBsniffer program using a blu-ray drive / movie / WinDVD like the HDDVD instructions did? or is it something else that needs to be tested w/blu-ray?

Arnezami - what test would you like done w/blu-ray?

[appleguru]

Sure ... if you explain me how you can read a HD-DVD using the Xbox-360 drive on the Mac? Because if I insert a disk in the drive, OS-X comes up with the message "Unknown format, Ignore or Eject".

Leopard my friend ;)

[evdberg]

Here you go ... the Mac OS-X Universal binary ! :)

[appleguru]

RE: reading HD DVD discs in leopard.. they mount, but show up in the finder as empty. If you ls -a them in the terminal you can see that it does indeed show the files. Seems apple updated the UDF drivers for leopard in preparation for next gen video support.

[arnezami]

So... Should I run the USBsniffer program using a blu-ray drive / movie / WinDVD like the HDDVD instructions did? or is it something else that needs to be tested w/blu-ray?

Arnezami - what test would you like done w/blu-ray?

The things we need to see if this processing key works with Blu-Ray aswell (I've already heard the proc key is in a Blu-Ray memdump so its very likely now) is in this post (http://forum.doom9.org/showthread.php?p=952954#post952954).

So we need:

(1) Title of the Movie (not really needed but is nice to know)
(2) The Verify Media Key Record in the MKBROM.AACS
(3) The first C-Value in the MKBROM.AACS file

Then we will know if it works for Blu-Ray aswell.

And if you will (optional) :

(4) To go towards the VUK we also need the Volume ID (you either should use a sniffer or if you don't have it usb connected: a memdump which is harder, read the instruction in this thread)

[appleguru]

Here you go ... the Mac OS-X Universal binary ! :)

Thanks... Not quite sure what it does yet, but I like to play around :)

[xyz987]

So... Should I run the USBsniffer program using a blu-ray drive / movie / WinDVD like the HDDVD instructions did? or is it something else that needs to be tested w/blu-ray?


No, in fact arnezami just needs 2 data from your BluRay disk (Verify Media Key Record and first C-Value) to test the Processing Key.

On HD-DVD disk these data are stored in MKBROM.AACS file. Unfortunately I don't know if file name or key offsets inside file are the same in BluRay.

[Electrox3d]

The things we need to see if this processing key works with Blu-Ray aswell (I've already heard the proc key is in a Blu-Ray memdump so its very likely now) is in this post (http://forum.doom9.org/showthread.php?p=952954#post952954).

So we need:

(1) Title of the Movie (not really needed but is nice to know)
(2) The Verify Media Key Record in the MKBROM.AACS
(3) The first C-Value in the MKBROM.AACS file

Then we will know if it works for Blu-Ray aswell.

And if you will (optional) :

(4) To go towards the VUK we also need the Volume ID (you either should use a sniffer or if you don't have it usb connected: a memdump which is harder, read the instruction in this thread)

OK, so where do I find the MKBROM.AACS file? It is not located on the BD movie disc, is this file created when the movie is played somewhere?

I can use the sniffer for (4), and I read the instructions for it, so when I make the log file using the sniffer, is it called VolumeID in the log?

[xyz987]

OK, so where do I find the MKBROM.AACS file? It is not located on the BD movie disc, is this file created when the movie is played somewhere?


No, it is on BluRay disk (may be with another name, but it is on disk). Did you look at AACS directory on disk?

Edit:

From ACCS specification for prerecorded BluRay:

"Each BD-ROM disc that contains content encrypted by AACS [using a CPS Unit Key that is provided in the
AACS directory] shall include two Read-Only Media Key Blocks (MKB). The MKB “MKB_RO.inf” shall be
stored in the “\AACS” directory and in the “\AACS\DUPLICATE” directory."

[arnezami]

No, in fact arnezami just needs 2 data from your BluRay disk (Verify Media Key Record and first C-Value) to test the Processing Key.

On HD-DVD disk these data are stored in MKBROM.AACS file. Unfortunately I don't know if file name or key offsets inside file are the same in BluRay.

Sorry. (i'm not used to Blu-Ray yet) it should be called MKB_RO.inf. And I think it should have the same layout of that of a MKBROM.AACS file (on a HD DVD disc). So my other directions should stay the same. Keep us informed ;).

Keep in mind you have to open it with a hex editor (best is WinHex).

[ioakougroup]

YES YES YES!! It works! :D :D :D

I'm going to take some rest now (I need it ;)). But will tell all later.

Here is the Processing Key which should work on all HD DVD discs (and maybe even Blu-Ray discs) released so far:

09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0

Save it. Store it. :)

Regards,

arnezami

PS. As explained before in order to get a VUK you now only need a Volume ID (which should be fairly easy to get or even to guess...).

WELL DONE MATE!!! :thanks:

[Electrox3d]

Sorry. (i'm not used to Blu-Ray yet) it should be called MKB_RO.inf. And I think it should have the same layout of that of a MKBROM.AACS file (on a HD DVD disc). So my other directions should stay the same. Keep us informed ;).

Keep in mind you have to open it with a hex editor (best is WinHex).

Ok, so far here's what I've got:

(1) Title: Talladega Nights (disc included w/PS3, not uncut retail copy)
(2) The Verify Media Key Record in the MKB_RO.inf file:
81 00 00 14 B3 85 A4 20 78 21 99 80 71 06 27 B2 7B F7 C5 41 7F 00 00 xx
(3) The First C-Value in the MKB_RO.inf file:
05 00 20 14 CB B1 61 65 DD C1 96 FC 65 D0 E6 A0 33 30 45 F5 32 62 2D 6D

So for (4), when I use the USB sniffer and I open the program, I have over ten "USB Mass Storage Device" items listed... is there a way of being sure I've selected the correct one? EDIT: I think I got it... post in a minute.

[arnezami]

Ok, so far here's what I've got:

(1) Title: Talladega Nights (disc included w/PS3, not uncut retail copy)
(2) The Verify Media Key Record in the MKB_RO.inf file:
81 00 00 14 B3 85 A4 20 78 21 99 80 71 06 27 B2 7B F7 C5 41 7F 00 00 xx
(3) The First C-Value in the MKB_RO.inf file:
05 00 20 14 CB B1 61 65 DD C1 96 FC 65 D0 E6 A0 33 30 45 F5 32 62 2D 6D

So for (4), when I use the USB sniffer and I open the program, I have over ten "USB Mass Storage Device" items listed... is there a way of being sure I've selected the correct one?

It works!!! :D :D :D :D :D

Much thanks.

Blu-Ray is also decryptable with this Processing Key. You just confirmed this.

The Media Key that is. As for selecting the right USB Mass Storage Device I really don't know. What else have you attached on your usb? Maybe just try: whatever generates large log files after starting your Software Player is the right one ;).

[evdberg]

My small prog should also work with BluRay, just use the MKB_RO.INF as 1st parameter (instead of MKBROM.AACS). Les, can you approve the attachment?

[Founditalso]

Sorry. (i'm not used to Blu-Ray yet) it should be called MKB_RO.inf. And I think it should have the same layout of that of a MKBROM.AACS file (on a HD DVD disc). So my other directions should stay the same. Keep us informed ;).

Keep in mind you have to open it with a hex editor (best is WinHex).

Another one (if I did everything right)

House Of Flying Daggers
81 00 00 14 0E 6C 59 50 9C 1C 9D 8C CC DD 5F 26 CF C7 28 8F
05 00 20 14 8D C1 F2 60 95 D0 6B 48 B4 F2 01 C3 30 D8 35 2D
Does it help?

[arnezami]

Another one (if I did everything right)

House Of Flying Daggers
81 00 00 14 0E 6C 59 50 9C 1C 9D 8C CC DD 5F 26 CF C7 28 8F
05 00 20 14 8D C1 F2 60 95 D0 6B 48 B4 F2 01 C3 30 D8 35 2D
Does it help?

Works too! :) Another confirmation...

[xyz987]

It works!!! :D :D :D :D :D

Blu-Ray is also decryptable with this Processing Key.


Congratulations again :-)

They are using the same root/master key for both BluRay and HD-DVD. So any Processing/Device Key should work for both.

Are you reading this, AnyDVD guys?. Start developing the new version with BluRay support ;-D

[xyz987]

(1) Title: Talladega Nights (disc included w/PS3, not uncut retail copy)
(2) The Verify Media Key Record in the MKB_RO.inf file:
81 00 00 14 B3 85 A4 20 78 21 99 80 71 06 27 B2 7B F7 C5 41 7F 00 00 xx
(3) The First C-Value in the MKB_RO.inf file:
05 00 20 14 CB B1 61 65 DD C1 96 FC 65 D0 E6 A0 33 30 45 F5 32 62 2D 6D


Now you can say everybody you helped to break BluRay :-)

:thanks:

[arnezami]

Congratulations again :-)

They are using the same root/master key for both BluRay and HD-DVD. So any Processing/Device Key should work for both.

Are you reading this, AnyDVD guys?. Start developing the new version with BluRay support ;-D

Don't forget AnyDVD do not need to extract the Volume ID. Which could mean 1 of 2 things: they have the Host private key or they are guessing the HD DVD Volume IDs.

Which brings us to our most needed information from those who have HD DVD discs.

Please post Volume IDs of this type (if you find any)

Appollo 13:
Hex: 40 00 04 06 32 04 20 11 57 47 48 44 56 4D 00 00
Ascii: W G H D V M

Batman Begins:

Hex: 40 00 40 06 26 08 10 15 57 47 48 44 56 4D 00 00
Ascii: W G H D V M

Please help us here. :)

This could be very useful in determining a way of guessing the Volume IDs for HD DVDs (which might be the reason AnyDVD is only supporting HD DVD atm ;)).

[Electrox3d]

Ok, so far here's what I've got:

(1) Title: Talladega Nights (disc included w/PS3, not uncut retail copy)
(2) The Verify Media Key Record in the MKB_RO.inf file:
81 00 00 14 B3 85 A4 20 78 21 99 80 71 06 27 B2 7B F7 C5 41 7F 00 00 xx
(3) The First C-Value in the MKB_RO.inf file:
05 00 20 14 CB B1 61 65 DD C1 96 FC 65 D0 E6 A0 33 30 45 F5 32 62 2D 6D

So for (4), when I use the USB sniffer and I open the program, I have over ten "USB Mass Storage Device" items listed... is there a way of being sure I've selected the correct one? EDIT: I think I got it... post in a minute.

OK, for the VolumeID, I *think* you are asking for the 6 bytes after the 00 22 00 00, right? Here's what I found for this disc:
00000000: 00 22 00 00 7f 58 3c b4 6c 30

EDIT: I read a little more about the blu-ray VolumeID, and it seems more complicated than this... From what I understand, there is only one place that has 32 random bytes after the 00 22 00 00... how do I find the correct one? Do I have to get multiple logs and compare them?

[arnezami]

OK, for the VolumeID, I *think* you are asking for the 6 bytes after the 00 22 00 00, right? Here's what I found for this disc:
00000000: 00 22 00 00 7f 58 3c b4 6c 30

EDIT: I read a little more about the blu-ray VolumeID, and it seems more complicated than this... From what I understand, there is only one place that has 32 random bytes after the 00 22 00 00... how do I find the correct one? Do I have to get multiple logs and compare them?

I need 16 bytes (not 6 bytes) after the 00 22 00 00. So 10 more ;). But not more than that! (for your own protection)

[Electrox3d]

I need 16 bytes (not 6 bytes) after the 00 22 00 00. So 10 more ;).

Here's the full string, making it 16 bytes including the 00 22 00 00:
00000000: 00 22 00 00 7f 58 3c b4 6c 30 99 e5 c8 99 44 08

Is this it? It seems the 00 22 00 00 shouldn't be part of the 16 bytes... after 99 44 08 there's a period, then it starts a new line with "0000010: xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx"

[arnezami]

Here's the full string, making it 16 bytes:
00000000: 00 22 00 00 7f 58 3c b4 6c 30 99 e5 c8 99 44 08

Is this it?

Sorry no still 4 bytes short.

What is the title of the movie? For full confirmation I probably also need the encrypted title key in the CPS unit key file. I'll try to find out where you can find that.

[Electrox3d]

Yes thats it :). Perfect.

What is the title of the movie? For full confirmation I probaly also need something the encrypted CPS unit key. I'll try to find out where you can find that.

Talladega Nights The Ballad of Ricky Bobby (the edition that comes with ps3, not the uncut retail edition)

Ok, in addition, I found that the three lines in the hex editor equal up to 32 characters total (minus the 00 22 00 00) and this is probably the VolumeID and MAC, wouldn't you think?
00000000: 00 22 00 00 7f 58 3c b4 6c 30 99 e5 c8 99 44 08
00000010: 07 f7 41 4b xx xx xx xx xx xx xx xx xx xx xx xx
00000020: xx xx xx xx

So VolumeID is probably: 7f 58 3c b4 6c 30 99 e5 c8 99 44 08 07 f7 41 4b

[xyz987]

Don't forget AnyDVD do not need to extract the Volume ID. Which could mean 1 of 2 things: they have the Host private key or they are guessing the HD DVD Volume IDs.


No, there is another method. They can redirect through Internet the USB conection between HD-DVD device (at home of AnyDVD user) and an authorized HD-DVD host (WinDVD, PowerDVD, whatsoever) running on an AnyDVD developers server. They can sniff VolumeID that way.

And another method: a hacked device firmware can algo give you the VolumeID sans Host Private Key.

[arnezami]

Talladega Nights The Ballad of Ricky Bobby (the edition that comes with ps3, not the uncut retail edition)

Ok, in addition, I found that the three lines in the hex editor equal up to 32 characters total (minus the 00 22 00 00) and this is probably the VolumeID and MAC, wouldn't you think?
00000000: 00 22 00 00 7f 58 3c b4 6c 30 99 e5 c8 99 44 08
00000010: 07 f7 41 4b xx xx xx xx xx xx xx xx xx xx xx xx
00000020: xx xx xx xx

So VolumeID is probably: 7f 58 3c b4 6c 30 99 e5 c8 99 44 08 07 f7 41 4b
Yes this is right.

This results in the following Volume Unique Key:

9A C3 7C 74 93 F6 BA 64 A7 AE E2 D4 E8 6C 0F 8C

Now if you have a memdump its probably in it. Otherwise we would have to use it to decrypt the encrypted CPS Unit Key (=Title Key for HD DVD).

PS. I have to go to sleep ....

[Electrox3d]

Yes this is right.

This results in the following Volume Unique Key:

9A C3 7C 74 93 F6 BA 64 A7 AE E2 D4 E8 6C 0F 8C

Now if you have a memdump its probably in it. Otherwise we would have to use it to decrypt the encrypted CPS Unit Key (=Title Key for HD DVD).

PS. I have to go to sleep ....

Tell me how to get a memdump. (aww... sleep?? where do u live??, its mid-day here)

[xyz987]

Now if you have a memdump its probably in it. Otherwise we would have to use it to decrypt the encrypted CPS Unit Key (=Title Key for HD DVD).


CPS Unit Key of Talladega Nights (US PS3 version) is a previously published key. It was published at Janvitos thread. Here is the key:

243302819492872FB60BF20BCCE28531

[guile]

WOW!! A LOT has happened in a few days. Excellent work here. Please approve Edvberg's file, I would like to play with it.

[HyperHacker]

General question: does anybody have an (old) PowerDVD version that doesn't support HD/BD playback? Does it also have *.fcl files?

Do you still need this? I have PowerDVD 6 "2CH" that came with a DVD burner I bought recently. I see no mention of Blu-ray or HD-DVD on the disc; I've never actually used it (just now, to check the version, was the first time I ever even took it out of the sleeve) since VLC does the job nicely. (It wasn't an HD-DVD or Blu-ray drive, though, so I highly doubt they included software that could play those. ;))

[arnezami]

Tell me how to get a memdump. (aww... sleep?? where do u live??, its mid-day here)

I'm sort of awake again ;). My biological clock is totally screwed.

Anyway.

Here is an easier check (I did the reverse by doing some encrypting). If all is correct (no typos, no mistakes, exact same movie, no bus encryption etc) this should be the encrypted CPS Unit Key:

81 9C CC E5 F7 FC F2 C8 F3 0F D5 59 F0 DD CA 0E

To check if this is correct you can open your Unit_Key_RO.inf file with winhex and hex search for 819CCCE5 and if found you can check if all 16 bytes are the same. If they are then we know the sniffed Volume ID is working for Blu-Ray aswell... (that would be great news)

Btw: anybody with this movie (Talladega Nights - US PS3 version) can check this: the unit key file is on the disc.

[arnezami]

And a small PC prog to play around with it ... (had to convert it from my Mac test version)

Usage: mkb <mkb_file> [volume_id]

I can confirm it works correctly. Well done :).

Thanks. That also saves me quite some time.

Regards,

arnezami

[blutach]

For people suggesting AnyDVD do things:

1. We are not Slysoft's forum, although I know they read us.

2. I fervently hope that the work done freely and with such fervour, intellect and imagination by our members will not simply result in a commercial product being launched that takes advantage of all your good work. I truly hope that the work done here can merge into a user friendly freeware product to enable the soon to be many HD-DVD/BR users to backup their material.

Regards

[xyz987]

[color=blue]For people suggesting AnyDVD do things:


I was just making a joke :-)

In fact I am a Linux user and a free software zealot, so I am not interested on AnyDVD :-)

[He-Man]

Tell me how to get a memdump. (aww... sleep?? where do u live??, its mid-day here)
You don't actually need a memdump to get the Blu-ray Volume Unique Key and CPS Unit Key, just use ape's Blu-ray Key Finder while WindDVD is playing the Blu-ray disc:
http://forum.doom9.org/showthread.php?t=121021

ape has also made a similar HD DVD Voulme Unique Key Finder:
http://forum.doom9.org/showthread.php?t=120970

[christopherw]

Happy days :D Can't believe I only just heard about this!

Well done to all involved. Place your bets on when the movie industry'll finally take a hint :D

[FoxDisc]

That basicly means that having a Volume ID (IDv) and a Media Key (Km) you can calculate the Volume Unique Key (Kvu).

Or to illustrate it (I removed the currently unused parts):

http://img349.imageshack.us/img349/5159/progress6km3.png

The red part is the hard part: getting the Media Key** (usually from a software player by debugging/memory snooping). But this only has to be done once per MKB and can be done by a pro.

The yellow part is what I described above: we either can (nearly) predict the Volume ID or we can get it via simple USB sniffing (the software player can't do much about that apart from bus encryption which is not implemented yet).

The blue part is the easiest: if we have the Volume ID (also called IDv) and the Media Key (Km) we can calculate the Volume Unique Key (Kvu) and then the Title Keys (Kt). This of course enables us to decrypt the content itself.

Hope that clarifies a bit.

Regards,

arnezami

** Later in this thread it became clear we need a Processing Key. But it amounts to basicly the same thing.

I would appreciate a summary/restatement/explanation of this. I've looked at some of the AACS source documents, but I still don't understand where the "processing key" fits into the picture. Specifically, it looked to me like the player stores a device key (in the player or player software) that was created from some master key in the secret possession of the AACS licensing authority. The device key is used to decrypt the MKB (on the disk) to get the media key (Km). The device key is subject to revocation by the AACSLA by changing the MKB on future disks such that the old revoked device key no longer works with the new MKB on the new disks to get a valid media key.

The media key is used with the volume ID (stored on the disk) to get the volume unique key (Kvu) After processing, this decrypted Kvu volume unique key is in the memory of WinDVD and can be grabbed by other tools developed here. It is specific to the disk. The volume unique key can be used to decrypt an encrypted title key (stored on the disk) to get the decrypted title key Kt which is now in memory of WinDVD and can also be grabbed by tools here when decrypted and being used in the memory.

If we had the device key, then the disk could be read directly to obtain the final decrypted title key without any of the memory reading. Memory reading to find title key/volume unique key is subject to attack by making it more difficult to find in memory simply by updating software players, without changing any issued device keys or MKBs. Knowledge of the device key makes it easy to write a decrypting program and is only subject to revocation using the MKB changing - device key revocation process, something the AACS LA may not be really anxious to do on a regular basis.

Where does the "processing key" of the title of this thread fit into this picture? Is it the same as the device key or am I missing an important piece of this puzzle and the decrypting process? Thanks for filling in any gaps/errors in my summary above.

[oddball]

I predict by the time they start revoking (If ever) the whole thing will have been broken wide open. Well I hope so anyhow. Everything that can be made by man can also be broken with some enginuity. The first Quantum computer was recently announced. When those start appearing on desktops the encrytion used will become moot. But it will probably be cracked before then even looking at the speed it's moving right now.

[mrazzido]

sorry offtopic..

on german news site HEISE (http://www.heise.de/newsticker/meldung/85258) is an article all about this *g.

[FoxDisc]

I predict by the time they start revoking (If ever) the whole thing will have been broken wide open. Well I hope so anyhow. Everything that can be made by man can also be broken with some enginuity. The first Quantum computer was recently announced. When those start appearing on desktops the encrytion used will become moot. But it will probably be cracked before then even looking at the speed it's moving right now.

It may look like things are moving fast, but IMHO, nothing being done here comes anywhere near to breaking the cryptography that AACS relies on. Let's face it. The **AA has a near hopeless task. They have to let people watch movies, so no matter how much advanced cryptography they use, they have to give the users the keys to decrypt the data. The keys have to be inside the player, so the best they can do is make it hard to get those keys. That's what's being done here - people are finding the keys that they give us. I see no sign that anyone is breaking any encryption by figuring out keys they don't give us (the master key held by the AACS LA) or even calculating the keys they've already given us (device keys) as opposed to finding them in memory when being used.

Of course, no one needs to break the encryption - finding keys they give us is good enough. It's probably harder for the AACS LA to change device keys and MKBs than it is for others to find them.

Perhaps quantum computing will eventually allow the encryption to be broken, but until then, the AACS system still technically "works" and they can revoke device keys and force them to be found again. All they manage to do is piss off their customers when authorized equipment won't work and DRM free backups do. Eventually, they are bound to see the light.

[Electrox3d]

I'm sort of awake again ;). My biological clock is totally screwed.

Anyway.

Here is an easier check (I did the reverse by doing some encrypting). If all is correct (no typos, no mistakes, exact same movie, no bus encryption etc) this should be the encrypted CPS Unit Key:

81 9C CC E5 F7 FC F2 C8 F3 0F D5 59 F0 DD CA 0E

To check if this is correct you can open your Unit_Key_RO.inf file with winhex and hex search for 819CCCE5 and if found you can check if all 16 bytes are the same. If they are then we know the sniffed Volume ID is working for Blu-Ray aswell... (that would be great news)

Btw: anybody with this movie (Talladega Nights - US PS3 version) can check this: the unit key file is on the disc.

Yup, I opened Unit_Key_RO.inf and found that CPS Unit Key.
81 9C CC E5 F7 FC F2 C8 F3 0F D5 59 F0 DD CA 0E

Awesome!