Guide: Decrypt Blu-Ray Movies with a PS3 WITHOUT keys

[QuePaso]

Guys, i will elaborate with pics and much more later, but i thought you guys would like the gist of it so you can get started. Here is how i do it.

1. Install SAK (Swiss Army Knife) to the PS3 OtherOS and boot into it. I use the network connection and do it via the ps3 instead of the web browser and transfer the ISO over the network. You can hook up a FAT32 hard drive and get the ISO that way as well.

2. If you put the ISO on FAT32 hard drive, join them into 1 big iso with copy /b, then put it into a directory. If you did a network connection, then go to step 3.

3. Install Nero Premium v7.8.5.0 and once installed, go to StartSmart, Extras Tab, make sure its in Advanced Mode and then choose Mount ISO image. Mount the ISO of the blu-ray movie you have. It is VERY important to use nero, as Daemon Tools DOES NOT WORK PROPERLY FOR THIS METHOD.

4. Install AnyDVD HD 6.1.3.6. Once installed, go to windows explorer and check the mounted ISO drive to see if the AACS Directory has been renamed to SLY!. If so, you should be good.

5. In AnyDVD HD, right click on the icon in the taskbar, and you will see: Rip Video HD-DVD / Blu-Ray to Hard disk. Choose that, make sure the drive being chosen is the one with the Nero mounted Blu-Ray image and let it rip. I suggest not doing much while it works its magic.

5a. Now, a lot of people talked about how AnyDVD HD has errors with blu-ray, but that is because they fixed the ripping in the latest version ONLY if you use the special rip tool. If you go to windows explorer and copy over the files to your hard drive, THEY WILL ERROR. This is the ONLY way to do it properly, and i will show you how to verify next.

6. Once complete, you should have the full blu-ray in your hard drive and ready to go. As a test, close AnyDVD HD and try to play any of the .m2ts's on the image mounted, THEY WILL NOT WORK. But the ones off of the hard drive you decrypted will. Now, you need to check for errors. Most blu-ray movies come with MPEG2 Trailers which are ~100-300 megs a piece for other blu-ray movies. Copy 2-3 of them into a empty directory. You will need to check these for errors. When AnyDVD HD errors, it happens on every file, so you want to check at least 2-3 files for errors and make sure they are ok using MPEG2Repair.

7. MPEG2Repair WILL NOT accept Decrypted .m2ts files. You need to convert them to .ts. The program i use is called: m2tstots. It is command line based and lightening fast. Once you convert those files you have, go ahead and run them through MPEG2 repair, 1 by 1. You will have a stream error, dont worry about that, its because ALL blu-rays give that error. Once done, the only thing you want to look for is errors in the video/audio areas. I did this with 4 different movies i had no keys for and they worked perfectly.

If you guys have any issues i will be back later to help, but that is how ive SUCCESSFULLY decrypted blu-ray movies WITHOUT ANY ERRORS using no keys at all!!! Credit goes out my VERY good friend mart who without his help getting started, none of this would have been possible. Enjoy!

[Doom9]

Haven't I seen a similar procedure (just with AnyDVD and BackupBluRay swapped out) before ;)
It'll get interesting once the whole thing can be done on the PS3 proper.. wouldn't it be hilarous if Sony's trojan horse into the HD market would turn out to be a trojan horse for Sony and enable the millions of PS3 owners to back up their Blu-ray discs.

[FoxDisc]

install AnyDVD .... that is how ive SUCCESSFULLY decrypted blu-ray movies WITHOUT ANY ERRORS using no keys at all!!!

When you installed AnyDVD it would have provided the required keys. If it's AACS encrypted, and almost all theatrical releases are, you need keys to decrypt. I must admit, I am surprised that this works, as I wouldn't expect an iso image to have the Volume ID.

[arnezami]

This is amazing! What is most interesting is that apparently a BD ISO (created by the PS3) also holds the Volume ID somehow and that AnyDVD/Nero is able to retrieve it. Thats incredible.

So far it has been impossible to retrieve the Volume ID through the official (and seemingly blocked) AACS-Auth way. This seems to completely bypass that. So its really interesting to see what is going on here.

Great work !! :D

arnezami

PS. I guess technically its possible AnyDVD contains tons of VUKs but I doubt it...

[FoxDisc]

PS. I guess technically its possible AnyDVD contains tons of VUKs but I doubt it...
Or even tons of Volume IDs, but I doubt that too. It would be interesting to look at the iso to see if the Volume ID is there and to know whether AnyDVD is communicating to a database that might include it.

[QuePaso]

Guys, AnyDVD HD isnt allowed to talk to the internet on my pc, so it is not going to a outside network. Believe me, i was as shocked as anyone when i got to the point of it working. Also, AACSKeys doesnt work because when you use AnyDVD HD, it renames the AACS directory!! Also, i forgot to mention, when you load up the ISO and have AnyDVD HD running, you can load up PDVD and watch the movie 0 problems. Works greats. But when you try to use Windvd 8, it never works. I wanted to use WinDVD 8 and grab the keys, but it just doesnt play. More food for thought!

[arnezami]

I'm starting to think AnyDVD have found a general way of reading some (lead-in?) area on the disc that works with all drives and contains some (obfuscated?) volume id. And they might also have done this for HD DVDs but there I really wouldn't know how they would have pulled this off because (without our "hack") the xbox hd drive doesn't seem to give up lead-in area secrets...

Hats off to AnyDVD ;). And what role does Nero play here?

Much food for thought and testing/sniffing indeed.

[zeroprobe]

Im gonna try Nat Geo : Relentless Enemies as no key has been published and its quite a new release.

[FoxDisc]

Hats off to AnyDVD ;). And what role does Nero play here?

And what role does SAK play? It seems that SAK would have to read the lead-in to put that in the iso, if it's really there, but you'd expect access to the lead-in to be blocked.

This is very interesting.

[mrazzido]

it worxx!! I test it with DVD DECRYPTER , read the Hole Bluray disc as an iso to HD ,

then mount with NERO image drive.

installed new any dvd version!

M2ts workx fine in VLC !




And sometimes for testing purposes i burned many CRYPTED BLURAY Disc´s!!!

READ iso with DVDDECRYPTER and burned directly to BD DISC:

these disc workxx fine too!!!

[arnezami]

I think that this would mean that if we can figure out how the Volume ID is extracted from/stored inside the ISO and given the fact that the PS3 can read these parts of the orignal disc (since the ISO was created on the PS3) it should be possible to create a tool that would retrieve the Volume ID on the PS3 itself (and thus do direct playback on the PS3 :)). Which would make an awful lot of people very happy...

@mrazzido: i'm assuming you're doing all this with a PC BD drive right?

[edit]
The question is: will this work for HD DVD too...

Can somebody try to make an ISO of an HD DVD disc and try the same thing?

[mrazzido]

UPDATE :

Test it with new version of Daemon Tools too , mount the image workx!!


Watch my video ehhe CLICK DL (http://rapidshare.com/files/26529061/5757_Screen_Stream.avi)


yeah i read the Hole iso with a BD PC drive...

[mrazzido]

this post was wrong i test something yet..

[FoxDisc]

if we can figure out how the Volume ID is extracted from/stored inside the ISO

Questions:
1) Is the Volume ID really stored in the ISO?

2) If the Volume ID is stored in the ISO, then is it in the lead in area, or somewhere else? I was under the impression that you couldn't write the lead in area to prevent bit-for-bit copying. Even if an ISO has a simulated lead in area, how can a burned copy be decrypted by AnyDVD if the burned copy does not have a burned lead-in with the Volume ID. Could the Volume ID be stored in multiple places on a disc (seems unlikely ..... hmmmm)

3) If the Volume ID is not stored in the ISO, then where is AnyDVD getting it? Could there be a database inside AnyDVD (assuming no network access as reported)?

The internal database concept, as unlikely at it originally seemed, now strikes me as most consistent with the ability to decrypt a burned encrypted copy. I presume these burned encrypted copies won't play with regular software like WinDVD/PowerDVD. @mrazzido - would you test that?

[mrazzido]

hey!!!

i burned a BD-RE with some ( 3 GB )crypted files , with the original AACS FOLDER
i used nero!!


Anydvd works here to!!

[arnezami]

hey!!!

i burned a BD-RE with some ( 3 GB )crypted files , with the original AACS FOLDER
i used nero!!


Anydvd works here to!!

So only files right? No ISO burn?

We need more precise details... (3 GB only??)

[mrazzido]

yeah thats right!! no iso burn !!

AACS Folder

+ BDMV folder ( inclusive all files )

+ CERTIFICATE Folder

in the stream folder i delete the main movie because it a DUAL LAYER Movie ) disc is yet only 3gb. ( trailers... some extras ).


...

i made a new test yet disc is burning :-)

I made a Mixed Disc some Crypted files fron movie a and some files from movie b . and the aacs folder from one movie .

looking what happend later . ehhe.

[arnezami]

yeah thats right!! no iso burn !!

AACS Folder

+ BDMV folder ( inclusive all files )

+ CERTIFICATE Folder

in the stream folder i delete the main movie because it a DUAL LAYER Movie ) disc is yet only 3gb. ( trailers... some extras ).

That certainly indicates some kind of database of VUKs/VIDs. Because the Volume ID isn't present in the files.

OR some HUUUUUGE breaktrough... (very very unlikely)

Starting to put my hat on again. :( This is starting to look like "plain" VUK based decryption.

arnezami

@QuePaso and @mrazzido: what movies are we talking about here: common or relatively new/rare ones?

[mrazzido]

i test it with 3 crypted movies.

CASINO ROYAL

KINGDOM OF THE HEAVEN

FULL METAL JACKET

i read some times ago the hole images to HD´s , for testing.

some crypted iso i burned on BD-R for testing ( with aacskeys ) to get volume id ( from a BD-R / RE) we talked about but it was all 000000000....


the only thing is Anydvd must have yet a Databse with some keys inside ?? all keys posted sometimes in the Threads.

[arnezami]

i test it with 3 crypted movies.

CASINO ROYAL

KINGDOM OF THE HEAVEN

FULL METAL JACKET

i read some times ago the hole images to HD´s , for testing.

some crypted iso i burned on BD-R for testing ( with aacskeys ) to get volume id ( from a BD-R / RE) we talked about but it was all 000000000....


the only thing is Anydvd must have yet a Databse with some keys inside ?? all keys posted sometimes in the Threads.
Yeah. This seems to based on a database of VUKs. Possibly taken from this site...

Maybe AnyDVD uses this as a "fallback position" in case their Device/Host Private Keys don't work (anymore). Which is why they can claim old (known) discs will keep working of the HRL gets updated but thats just because of the database assembled here. Bah...

Its still a valid solution for PS3 owner though. Although we should make sure our own (open source/free) decrypters work on the PS3 properly (based on VUKs).

[mrazzido]

the mixed disc doesnt work ,

only the files from movie a works ( aacs folder is there )

the files from movie B doesn work.


--

i didn have yet a movie here where the key is not postet on forum yet. i try to get 1 new movie.!

[FoxDisc]

This is starting to look like "plain" VUK based decryption.

Yes, that's what it smells like to me. We need someone with a burned copy of a newly released movie and an older-than-the-movie copy of AnyDVD that has never been updated to see if it can decrypt without access to a lead-in. Perhaps AnyDVD uses both methods - use the known processing key and read the VID if it's there, and use a VUK/VID database if it's not.

[arnezami]

Just for the record: QuePaso did great work here. :) No matter how this pans out.


For a moment I did sort of had a (naive?) hope though that a commercial product would be able to achieve something really remarkable...

[QuePaso]

Flyboys and Scooby Doo blu-ray were done by me, there are NO KEYS for either of these anywhere on the net, trust me, ive been looking LOL. Its why i SERIOUSLY doubt it has a database of keys. And thank you for the compliment =) Me and Mart1001 (my partner in crime) really went at it guns blazing to confirm this was going on!

[mrazzido]

i played something with win hex changed some bytes in

CPSUnit00001.cci

Unit_Key_RO...


the orignal sha-1 hash is gone.

i made a small image with nero.

anydvd regonize this disc as a unknown bluray disc.

ok they have a small DB

[arnezami]

Flyboys and Scooby Doo blu-ray were done by me, there are NO KEYS for either of these anywhere on the net, trust me, ive been looking LOL. Its why i SERIOUSLY doubt it has a database of keys. And thank you for the compliment =) Me and Mart1001 (my partner in crime) really went at it guns blazing to confirm this was going on!

Hmmm...

These VUKs we clearly don't have yet.

We have to investigate this to make any definative conclusions.

For example: do these titles work if you only burn the files to a disc?

We need to sniff. Does anybody has a BD drive attached via USB? (and thus easely sniffable)

[Eeknay]

We need to sniff. Does anybody has a BD drive attached via USB? (and thus easely sniffable)

I do. Just lemme know what i need (I don't have any BD blanks though).

[arnezami]

I do.

We need to know what AnyDVD does when dercypting a disc. And whether it (always) retrieves the Volume ID the offcial way. So you have to sniff the USB port.

Look here for more Volume ID sniffing info : http://forum.doom9.org/showthread.php?t=121866 You would have to use the USB sniffer.

[FoxDisc]

Hmmm...
These VUKs we clearly don't have yet.
If you are right that they do both ProcessingKey/VID decryption and use a backup VUK/VID database, then whenever anyone decrypts a new disc with AnyDVD, perhaps it adds the new keys to its database and later phones home with all the new keys it knows about. That would very quickly build a big, up to date, database.

Even if it doesn't phone home, an internal database would reproduce a lot of what is seen here by individual users of AnyDVD. Once a disc was inserted by that user, AnyDVD would know the VUK secret for later use.

[arnezami]

If you are right that they do both ProcessingKey/VID decryption and use a backup VUK/VID database, then whenever anyone decrypts a new disc with AnyDVD, perhaps it adds the new keys to its database and later phones home with all the new keys it knows about. That would very quickly build a big, up to date, database.

That certainly makes sense. But we don't know that for sure. But if they did find something more special I just want to know ;).

[arnezami]

i played something with win hex changed some bytes in

CPSUnit00001.cci

Unit_Key_RO...


the orignal sha-1 hash is gone.

i made a small image with nero.

anydvd regonize this disc as a unknown bluray disc.

ok they have a small DB

So it won't work right? What "changes" did you make? It may have trouble with the changed cci file which maybe invalidates the AACS cert. But I doubt AndDVD cares much about those certs...

I guess this pretty much confirms they work with a database of VUKs/VIDs identified by hashes.

[mrazzido]

i change only one byte inside the files.

[theeMule]

If we want to sniff communication with a blu-ray drive, it might be worth trying to share the ps3 blu-ray drive to a PC via iSCSI (iSCSI server could be run within linux on the ps3, iSCSI clients available for windows and linux on the PC side). Then I'm not sure how easy it is to unwrap them, but the packets containing the SCSI commands could be sniffed with a network sniffer like ethereal.

On second thought, the fact that iSCSI wraps everything in scsi commands may break the usefulness of this. Perhaps this is why Daemon Tools doesn't work (Daemon Tools presents a virtual SCSI drive, does anyone know if nero's disc mounting emulates an IDE drive?)

[Eeknay]

I've got my log, looking in WinHex, what exactly am I looking for/trying to confirm?

[arnezami]

I've got my log, looking in WinHex, what exactly am I looking for/trying to confirm?

Look if the Volume ID is sniffed the normal way.

Searching for "00000000: 00 22 00 00" should reveal the response from the drive including the Volume ID (look if its in there). Be careful not to post too much (so no more than the Volume ID itself).

There should also be other responses like with "00000000: 00 72" and "00000000: 00 52". Don't post this stuff at all. But look if its in there.

These are AACS-Auth type responses and indicate the "official ways" are being used.

It is possible AnyDVD (when for some reason the Volume ID isn't found) switches to some kind of other mode where it simply accesses its (local) VUK database. In order to see this somehow you could burn (just) the files from an original disc to a recordable and see how AnyDVD handles that (by sniffing).

Personally (when given only the files from a original disc) I don't see how AnyDVD could decrypt the disc without actually using a VUK/VID from a (local) database. Since the Volume ID isn't on the burned disc and the Volume ID is really needed (and is not guessable) to calculate the VUK there really is no other way.

arnezami

[zeroprobe]

What would be the unique identifier of the disc if anydvd was using a database

[awhitehead]

What would be the unique identifier of the disc if anydvd was using a database


If they are using the database from doom9, then they most likely they use sha1 of AACS\CPSUnit00001.cci, and then try with each of the published keys to see what generates a valid decryption. That is what BackupBluRay uses.

Otherwise, probably AACS\Unit_Key_RO.inf, since it's known to be unique per disk.

Just guessing, but if I were building a database of VUKs using pre-published keys, that is what I'd use. Potentially I'd update my database with SHA1 of AACS\Unit_Key_RO.inf each time I found a match based on SHA1 of AACS\CPSUnit00001.cci since AACS\CPSUnit00001.cci is not unique.

[jokin]

anyone have a link for m2tstots? I googled it and found nothing helpful. Thank You

[SuperGoof]

We need someone with a burned copy of a newly released movie and an older-than-the-movie copy of AnyDVD that has never been updated to see if it can decrypt without access to a lead-in. Perhaps AnyDVD uses both methods - use the known processing key and read the VID if it's there, and use a VUK/VID database if it's not.

Did just that:

1) Disabled AnyDVD 6.1.3.6.
2) Created an 'encrypted' ISO of 'Happy Feet' with Roxio. 'Happy Feet' is a recent release and it is also very small - just 14GB.
3) Mounted the ISO with VirtualCloneDrive.
4) Checked that disc and .m2ts files cannot be played when AnyDVD is disabled and can be played when AnyDVD is enabled. Playback is somewhat jerky though for some reason (Probably the problem is VirtualCloneDrive: playback from disc or from ripped files on HD is fine).
5) Disabled the network.
6) Uninstalled AnyDVD 6.1.3.6.
7) Installed AnyDVD 6.1.3.0.
8) Confirmed that mounted 'Happy Feet' ISO cannot be played anymore with AnyDVD enabled. 'AACS' folder stays as well.
9) Inserted original disc - can play .m2ts files with AnyDVD 6.1.3.0 enabled. AnyDVD 6.1.3.0 decrypts it fine and 'AACS' folder is renamed to 'SLY!'.
10) Checked again mounted 'Happy Feet' ISO - still cannot be played. (I thought maybe it would update key database with keys from original movie).
11) Reinstalled AnyDVD 6.1.3.6.
12) Checked that it works as before.
13) Realised that maybe AnyDVD 6.1.3.0 did not have a feature to decrypt mounted images yet - will check it this evening by doing the same experiment with '5th Element'.

But even if AnyDVD uses key database, as it seems, I think it is very smart move by Slysoft. This way they will keep their promise that AnyDVD will not be affected when current host certificates are revoked (i.e. will still support titles released so far). Also, I do not think Doom9 is the only source of keys for them. They probably send keys to Slysoft as AnyDVD discovers them standard 'AACS way' if keys are not in the local database yet, and then every new version of AnyDVD comes with updated key database.

[Fahzuu]

For a moment I did sort of had a (naive?) hope though that a commercial product would be able to achieve something really remarkable...

Well they did use host certificates long before anyone here did, didn't they?
And they were using the processing key before it showed up on doom9, didn't they?
And they are removing BD region codes, which still nobody has achieved here yet, aren't they?
So if you say, that all this isn't remarkable, then nothing, that has been done here was either, right?

I did for my part try to look behind the curtains of region coding in BD myself and eventually gave up. There is a thread somewhere here, that gave me a start, but didn't get me nowhere.
Is there anybody still working on this? I sure would like to participate...

[dmz01]

anyone have a link for m2tstots? I googled it and found nothing helpful. Thank You

You can always write your own. The m2ts file is just a bunch of 192 byte packets. All you do is remove the first 4 bytes of each packet and write the 188 byte packets back to the disk into a new TS file.

[bob0r]

Ill let you guys know sooner or later if this method works with the S.W.A.T. .iso, this key is not known.

I have to wait for my North Korean guy to get online, so he can test an altered version of anydvd, good thing they dont have software lawls there :devil: :rolleyes:

[PepsiLee2001]

I will borrow a BD Rewriter without AACS to test it tomorrow.

The rewriter is a sample and can't decrypt any AACS disc before.

[bob0r]

Good news:

S.W.A.T. Bluray .iso will decrypt using nero+anydvd.
As key is not known on this forum:
1: they find keys themselfs for their database
2: anydvd has its own method of decrypting :)

[FoxDisc]

even if AnyDVD uses key database, as it seems, I think it is very smart move by Slysoft. This way they will keep their promise that AnyDVD will not be affected when current host certificates are revoked (i.e. will still support titles released so far).

I agree - if the Host Key they are using is revoked, the backup database will keep the AnyDVD software working for almost all titles while they try to respond.

It will be interesting to see if the AACSLA actually revokes any Host Keys. It does no good for old discs, since the keys are all released. It angers customers who suddenly can't play what played last week without the hassle of a software update. It does little against those who know the HK can be bypasssed via the Xbox HD-DVD drive hacks. Finally, you'd think they would want to minimize using new methods/keys to read/play old discs (where all keys are known) as that prior knowledge of the keys and answers makes it easier to track down what the revised/hardened software is doing.

[bob0r]

Hmm, can you find out the key of an encrypted .iso with this method?
Or does it remain hidden?

[enantiomer]

anyone have a link for m2tstots? I googled it and found nothing helpful. Thank You

It was posted on April 16 to Usenet: a.b.hdtv
I just spotted it myself today. I haven't tested it, but the C++ source is provided. Always a good thing.

[FoxDisc]

Good news:
S.W.A.T. Bluray .iso will decrypt using nero+anydvd.
As key is not known on this forum:
1: they find keys themselfs for their database
2: anydvd has its own method of decrypting :)

It's no surprise that they find keys themselves (although I would not call it their "own method" - it's the AACS method based on AACS authorized software player keys).

I don't think anyone was really suggesting that they get VUK or VID keys directly from posts here. It's been known for a long time (from USB sniffing) that they go through the AACS defined drive/host authentication process. That gave them the VID and the only other thing they needed for decryption would be the one known processing key or a device key from a software player.

The question was whether they had some totally new, amazing, and unauthorized cryptographic method to play ISO mounted encrypted copies.

[FoxDisc]

Hmm, can you find out the key of an encrypted .iso with this method?
The short answer is no.
If AnyDVD can play the encrypted .iso, then it has the key in its internal database, so you could, in theory, get it out (although I suspect it will be encrypted to make that hard). If it won't play it, then the key is not in the internal database and there's no way to get it, unless you can break the AACS AES-based encryption (which no one is even close to doing.)

[bob0r]

Thanks for the answers!

Now S.W.A.T. can waste 20GB on my HDD, just because i am an addicted collector of "firsties" :eek:


(Man, what a crap movie it is :p)