Can the in memory key searching trick for AACS cracking be used on CPRM cracking?

[jackchen]

Can the in memory key searching trick for AACS cracking be used on CPRM cracking?

Taking WinDVD as example, the WinDVD can play CPRM disks, regardless of whether it's DVD based or BD based. During the paly back of CPRM disks, it must decrypt the CPRM content first. So the decryption key must reside in the RAM/Memory of PC. This is a very similar situation just like the AACS case of HDDVD and BD. I am wondering whethere there will be someone working on the CPRM cracking using similar tricks.

Any ideas or comments? Anyone interested?

[evdberg]

The same trick would definitely work, as long as you know how the CPRM system works, just like it is exactly known how AACS works. So, if you have the CPRM specs, please share them with us and we can see further ...

[jackchen]

I do have the spec., actually you can download them from the link below

http://www.4centity.com/docs/versions.html

simply fill in some dummy info in the request form, then you can download the spec..

or if someone can open some share space, I can upload the spec. documents, too.

[evdberg]

No need to fill in dummy info, just download the specs from this page:
http://www.4centity.com/docs/doc_request_thanks.html

Now if someone has too much time on his hands and interest in dvd-audio ...

[evdberg]

Very funny ... these specs look a lot like the AACS specs (or more likely the other way around):
1) Use the device keys and MKB to calculate a Media Key.
2) Then use the Media Key and Album Identifier to calculate the Album Unique Key.
3) Then use this AUK to decrypt the data blocks.

Instead of AES for the actual encryption C2 is used. So just like HD-DVD and BluRay, it looks like we can make a list with AUKs for every dvd-audio disk ...

[jackchen]

well, agree with you. The CPRM seems to be very similar to AACS. But some thing missing are those DVD spec. books which are only available from DVDFLLC or DVDForum with $$. Without those book, it will be very difficult to know the IDs of each pack, which will prevent us from using the know plaintext attack.

[arnezami]

Does anyone have an CPRM or CPPM protected disc? If so will PowerDVD/WinDVD play it?

Or maybe a (hdd) sattellite/TV recording? Isn't this quite common in Japan?

Btw: the CPRM/CPPM system is very similar to AACS (well they are basicly from the same family, the MKB resembles the SKB in AACS). I believe for recordables it requires discs that already have an MKB on it. Not sure.

Its quite possible the same kind of techniques can be used to open this DRM system too ;).

The biggest problem is the C2 cipher: it has a secret value which first has to be found. But you need a working (PC based) playback system for that.

Is there any demand for this?

Regards,

arnezami

[tjf]

I tried DVD-A in PowerDVD Ultra and yes it works. However the sound is downsampled to 48kHz. The disk has DVDAUDIO.MKB file in AUDIO_TS directory, so I suppose it is CPPM protected. The file is 3072 kB big.

I have already backed up all my DVD-A with the old DVD-Audio ripper (http://forum.doom9.org/showthread.php?t=96860) that uses WinDVD hack, but that was very labourous process and probably not many people wanted to go through it, so easier decrypting would be welcomed.

Tomas

[evdberg]

Is there any demand for this?
Does that matter to you? Isn't it a challenge to break/bypass the protection? :)

DVD-Audio disks are protected using CPPM. I own 2 disks at this moment, and both play in PowerDVD (after it retrieved a new CPPM key from internet). WinDVD just plays the DVD-video that is on the disk, although it played the DVD-audio content with an older version of WinDVD before.

But you are right, the first thing we need is the secret value array for the C2 cipher.

[merbanan]

This page :http://en.wikipedia.org/wiki/Cryptomeria_cipher got me here:
http://web.archive.org/web/20050306065032/http://pbx.mine.nu/ch/c2bf/ and that got me this archive:
http://web.archive.org/web/20050306065032/http://www.marumo.ne.jp/c2/bf/c2bf-2.0.1.tar.gz

which contain the following SBOXes:


#if 0 /* Facsimile S-Box */
static const unsigned char sbox[256] = {
0xB6, 0xAA, 0xEB, 0xB3, 0x35, 0x5D, 0xEE, 0xB1,
0x72, 0x33, 0x05, 0x13, 0x6D, 0xC7, 0x6C, 0x27,
0x25, 0x54, 0xE9, 0x4C, 0xDE, 0xC3, 0x21, 0x39,
0xA9, 0xAB, 0xD6, 0xDF, 0xE8, 0x71, 0x94, 0xAE,
0x16, 0x44, 0x76, 0xCD, 0xB7, 0x78, 0x20, 0xF0,
0xC1, 0x9F, 0xCF, 0xAF, 0x0F, 0xCB, 0x59, 0x83,
0x3A, 0x5E, 0xB8, 0xB5, 0xF3, 0x47, 0x80, 0xC2,
0xF6, 0x14, 0xE6, 0x69, 0xFC, 0x17, 0xE0, 0xE5,
0x79, 0xF9, 0x12, 0xBF, 0x3C, 0xB4, 0x66, 0xAD,
0xF7, 0x65, 0x95, 0xF4, 0x4E, 0x02, 0xA0, 0x07,
0x4D, 0x2F, 0x0D, 0x7E, 0xE4, 0xEF, 0xA1, 0x8C,
0x6E, 0xD2, 0xFD, 0x19, 0x1C, 0x82, 0x42, 0xBB,
0x9A, 0x43, 0xC6, 0xE2, 0x1F, 0xF2, 0x75, 0x1A,
0x63, 0x45, 0xD1, 0x30, 0x81, 0x7F, 0x8E, 0x62,
0x3B, 0xA4, 0xFB, 0x1E, 0x5F, 0xBC, 0xB0, 0x40,
0x8B, 0x74, 0x38, 0x8A, 0xC4, 0x73, 0x9C, 0x09,
0xD4, 0xED, 0xD3, 0x5A, 0x60, 0x48, 0xC5, 0x9E,
0x01, 0xCC, 0x34, 0x1B, 0x58, 0x36, 0x23, 0x88,
0x7A, 0x90, 0x9B, 0x8F, 0xBD, 0x3F, 0xB9, 0x57,
0xA2, 0x3E, 0x04, 0xB2, 0x49, 0x37, 0x5C, 0x7D,
0x61, 0x4A, 0xA6, 0x67, 0xEC, 0x7C, 0x0E, 0x96,
0xDD, 0xE3, 0x2C, 0x56, 0x08, 0x0C, 0x8D, 0x2B,
0x6A, 0xFE, 0xEA, 0xA3, 0xCA, 0x3D, 0x91, 0xE7,
0xC9, 0xAC, 0x03, 0xD5, 0x89, 0x86, 0xDC, 0x10,
0x55, 0x77, 0xC8, 0xD7, 0x97, 0x24, 0x46, 0x9D,
0x0A, 0x1D, 0x22, 0xD9, 0xFF, 0x5B, 0x52, 0xD8,
0x00, 0xFA, 0x53, 0x26, 0x29, 0x2E, 0x2A, 0x11,
0xC0, 0x6F, 0x4F, 0x7B, 0x28, 0x99, 0x41, 0x92,
0xDB, 0xF8, 0x50, 0xA8, 0x51, 0xA5, 0x4B, 0x93,
0x87, 0xDA, 0x06, 0x85, 0x2D, 0xBA, 0x0B, 0x98,
0x70, 0x6B, 0xBE, 0xF1, 0x18, 0xD0, 0x31, 0x68,
0x15, 0x84, 0x64, 0xE1, 0xCE, 0xA7, 0xF5, 0x32,
};
#else /* DVD Audio S-Box */
static const unsigned char sbox[256] = {
0x3a, 0xd0, 0x9a, 0xb6, 0xf5, 0xc1, 0x16, 0xb7,
0x58, 0xf6, 0xed, 0xe6, 0xd9, 0x8c, 0x57, 0xfc,
0xfd, 0x4b, 0x9b, 0x47, 0x0e, 0x8e, 0xff, 0xf3,
0xbb, 0xba, 0x0a, 0x80, 0x15, 0xd7, 0x2b, 0x36,
0x6a, 0x43, 0x5a, 0x89, 0xb4, 0x5d, 0x71, 0x19,
0x8f, 0xa0, 0x88, 0xb8, 0xe8, 0x8a, 0xc3, 0xae,
0x7c, 0x4e, 0x3d, 0xb5, 0x96, 0xcc, 0x21, 0x00,
0x1a, 0x6b, 0x12, 0xdb, 0x1f, 0xe4, 0x11, 0x9d,
0xd3, 0x93, 0x68, 0xb0, 0x7f, 0x3b, 0x52, 0xb9,
0x94, 0xdd, 0xa5, 0x1b, 0x46, 0x60, 0x31, 0xec,
0xc9, 0xf8, 0xe9, 0x5e, 0x13, 0x98, 0xbf, 0x27,
0x56, 0x08, 0x91, 0xe3, 0x6f, 0x20, 0x40, 0xb2,
0x2c, 0xce, 0x02, 0x10, 0xe0, 0x18, 0xd5, 0x6c,
0xde, 0xcd, 0x87, 0x79, 0xaf, 0xa9, 0x26, 0x50,
0xf2, 0x33, 0x92, 0x6e, 0xc0, 0x3f, 0x39, 0x41,
0xaa, 0x5b, 0x7d, 0x24, 0x03, 0xd6, 0x2f, 0xeb,
0x0b, 0x99, 0x86, 0x4c, 0x51, 0x45, 0x8d, 0x2e,
0xef, 0x07, 0x7b, 0xe2, 0x4d, 0x7a, 0xfe, 0x25,
0x5c, 0x29, 0xa2, 0xa8, 0xb1, 0xf0, 0xb3, 0xc4,
0x30, 0x7e, 0x63, 0x38, 0xcb, 0xf4, 0x4f, 0xd1,
0xdf, 0x44, 0x32, 0xdc, 0x17, 0x5f, 0x66, 0x2a,
0x81, 0x9e, 0x77, 0x4a, 0x65, 0x67, 0x34, 0xfa,
0x54, 0x1e, 0x14, 0xbe, 0x04, 0xf1, 0xa7, 0x9c,
0x8b, 0x37, 0xee, 0x85, 0xab, 0x22, 0x0f, 0x69,
0xc5, 0xd4, 0x05, 0x84, 0xa4, 0x73, 0x42, 0xa1,
0x64, 0xe1, 0x70, 0x83, 0x90, 0xc2, 0x48, 0x0d,
0x61, 0x1c, 0xc6, 0x72, 0xfb, 0x76, 0x74, 0xe7,
0x01, 0xd8, 0xc8, 0xd2, 0x75, 0xa3, 0xcf, 0x28,
0x82, 0x1d, 0x49, 0x35, 0xc7, 0xbd, 0xca, 0xa6,
0xac, 0x0c, 0x62, 0xad, 0xf9, 0x3c, 0xea, 0x2d,
0x59, 0xda, 0x3e, 0x97, 0x6d, 0x09, 0xf7, 0x55,
0xe5, 0x23, 0x53, 0x9f, 0x06, 0xbc, 0x95, 0x78,
};
#endif



Should be easy to verify if this is correct.

[evdberg]

We need clearly the 2nd one ... the 1st is the test s-box from the 4c website. Funny that they bruteforce attacked this cipher !

[Fahzuu]

We need clearly the 2nd one ... the 1st is the test s-box from the 4c website. Funny that they bruteforce attacked this cipher !

Mar. 6 [2004] - The correct key was not found. We finished searching all 56 bit key space. I declare failure and finish of this project.

The fact that they failed doing so, suggests, that the S-Box shown there is incorrect, so that would be why the quest failed...

And the fact that all this information is 3 years old probably makes it useless - otherwise I would think, there would be a readily available solution already?

[merbanan]

http://web.archive.org/web/20041113022044/http://pbx.mine.nu/ch/test/read.cgi/general/1075424427/

gives a good explanation of the failure. And it also has a surprise.:)

Anyway all this should be quite easy to verify. Just search for a part of the S-BOX in a memory dump of WinDVD. We all know how secure their code is.

[Fahzuu]

http://web.archive.org/web/20041113022044/http://pbx.mine.nu/ch/test/read.cgi/general/1075424427/

gives a good explanation of the failure. And it also has a surprise.:)


Uhm, excuse me for being stupid - I read though a lot of tiresome chat there. What explanation did I miss? What surprise?

[evdberg]

What surprise?
Most likely that arnezami already took part in the discussion at that time?

S-Box currently tested is the DVD-Audio S-Box (DVD-A uses same C2 cipher),
so in the event that AVHDD was assigned a different S-Box by 4C entity (likely)
or if Matsushita decided to use a different S-Box (unlikely, this weakens
the algorithm), we are, again, screwed.

So this s-box should definitely work with dvd-audio, but obviously NOT with avhdd, which the project was focussing on.

[arnezami]

Most likely that arnezami already took part in the discussion at that time?

So this s-box should definitely work with dvd-audio, but obviously NOT with avhdd, which the project was focussing on.
Yes. Its very likely this s-box is the one used for dvd-audio.

If somebody would make a memdump during playback of a dvd-audio disc (best using the old WinDVD version evdberg talked about) and hex search for 3AD09AB6 in winhex (which are the first 4 bytes of the s-box) we could confirm this (of found of course).

Regards,

arnezami

PS. Question: does anybody have a CPRM (as in Recordable as opposed to Prerecorded) protected disc? Like a Satellite TV recording. Keep in mind it looks like there is no Bus encryption with CPRM while there is with CPPM (= DVD-audio).

[Wilbert]

If somebody would make a memdump during playback of a dvd-audio disc (best using the old WinDVD version evdberg talked about) and hex search for 3AD09AB6 in winhex (which are the first 4 bytes of the s-box) we could confirm this (of found of course).
I have a dvd-audio (the Corrs - in blue) and i got windvd7. I'm not sure whether it is encrypted (how do i find this out?), but there is a dvdaudio.mkb. I did a memdump during playback (when clicking on playlist i saw that it is indeed the first AOB file is being played, and not something in the video folder) using pmdump.

I couldn't find that string (3AD09AB6) in one piece. But if i search for two bytes i find all of them (all bytes in the s-box, not just the four you posted) in the correct order (but thus not in one piece). I think this is also the case for memdumps of windvd4, although (as far as i know) dvd-audio is not supported in this version.

I hope this is of any use ...

[evdberg]

@Wilbert,
Can you explain more in detail how the s-box is stored in WinDVD memory? You say it is in the correct order, but not in one piece? Maybe you can give a snippet as example?

[Wilbert]

@Wilbert,
Can you explain more in detail how the s-box is stored in WinDVD memory? You say it is in the correct order, but not in one piece?
No, that was nonsense. Sorry ... I can't find it.

I've been looking at the occurrences of strings of two and three bytes:

B7 58 F6: 2E8EE42
8C 57 FC: 2 times
57 FC FD: 75AFF8
0E 8E FF: 3 times
FF F3 BB: 6 times
BA 0A 80: 312405C
0A 80 15: 2B334AZ
80 15 D7: E860D1
...

3A D0: 174 times
9A B6: 35 times
F5 C1: 51 times
16 B7: 78 times
58 F6: 191 times
ED E6: 99 times
D9 8C: 27 times
...

nothing useful ... I don't know what to look for.

[tjf]

This page :http://en.wikipedia.org/wiki/Cryptomeria_cipher got me here:
http://web.archive.org/web/20050306065032/http://pbx.mine.nu/ch/c2bf/ and that got me this archive:
http://web.archive.org/web/20050306065032/http://www.marumo.ne.jp/c2/bf/c2bf-2.0.1.tar.gz

which contain the following SBOXes:


#if 0 /* Facsimile S-Box */
static const unsigned char sbox[256] = {
0xB6, 0xAA, 0xEB, 0xB3, 0x35, 0x5D, 0xEE, 0xB1,
0x72, 0x33, 0x05, 0x13, 0x6D, 0xC7, 0x6C, 0x27,
0x25, 0x54, 0xE9, 0x4C, 0xDE, 0xC3, 0x21, 0x39,
0xA9, 0xAB, 0xD6, 0xDF, 0xE8, 0x71, 0x94, 0xAE,
0x16, 0x44, 0x76, 0xCD, 0xB7, 0x78, 0x20, 0xF0,
0xC1, 0x9F, 0xCF, 0xAF, 0x0F, 0xCB, 0x59, 0x83,
0x3A, 0x5E, 0xB8, 0xB5, 0xF3, 0x47, 0x80, 0xC2,
0xF6, 0x14, 0xE6, 0x69, 0xFC, 0x17, 0xE0, 0xE5,
0x79, 0xF9, 0x12, 0xBF, 0x3C, 0xB4, 0x66, 0xAD,
0xF7, 0x65, 0x95, 0xF4, 0x4E, 0x02, 0xA0, 0x07,
0x4D, 0x2F, 0x0D, 0x7E, 0xE4, 0xEF, 0xA1, 0x8C,
0x6E, 0xD2, 0xFD, 0x19, 0x1C, 0x82, 0x42, 0xBB,
0x9A, 0x43, 0xC6, 0xE2, 0x1F, 0xF2, 0x75, 0x1A,
0x63, 0x45, 0xD1, 0x30, 0x81, 0x7F, 0x8E, 0x62,
0x3B, 0xA4, 0xFB, 0x1E, 0x5F, 0xBC, 0xB0, 0x40,
0x8B, 0x74, 0x38, 0x8A, 0xC4, 0x73, 0x9C, 0x09,
0xD4, 0xED, 0xD3, 0x5A, 0x60, 0x48, 0xC5, 0x9E,
0x01, 0xCC, 0x34, 0x1B, 0x58, 0x36, 0x23, 0x88,
0x7A, 0x90, 0x9B, 0x8F, 0xBD, 0x3F, 0xB9, 0x57,
0xA2, 0x3E, 0x04, 0xB2, 0x49, 0x37, 0x5C, 0x7D,
0x61, 0x4A, 0xA6, 0x67, 0xEC, 0x7C, 0x0E, 0x96,
0xDD, 0xE3, 0x2C, 0x56, 0x08, 0x0C, 0x8D, 0x2B,
0x6A, 0xFE, 0xEA, 0xA3, 0xCA, 0x3D, 0x91, 0xE7,
0xC9, 0xAC, 0x03, 0xD5, 0x89, 0x86, 0xDC, 0x10,
0x55, 0x77, 0xC8, 0xD7, 0x97, 0x24, 0x46, 0x9D,
0x0A, 0x1D, 0x22, 0xD9, 0xFF, 0x5B, 0x52, 0xD8,
0x00, 0xFA, 0x53, 0x26, 0x29, 0x2E, 0x2A, 0x11,
0xC0, 0x6F, 0x4F, 0x7B, 0x28, 0x99, 0x41, 0x92,
0xDB, 0xF8, 0x50, 0xA8, 0x51, 0xA5, 0x4B, 0x93,
0x87, 0xDA, 0x06, 0x85, 0x2D, 0xBA, 0x0B, 0x98,
0x70, 0x6B, 0xBE, 0xF1, 0x18, 0xD0, 0x31, 0x68,
0x15, 0x84, 0x64, 0xE1, 0xCE, 0xA7, 0xF5, 0x32,
};

This sbox is published on 4C Entity website, so obviously it is not the secret one:

The following documents are being provided by the 4C Entity as is with no implied warranty, as a tool to help you debug your implementation of the C2 Block Cipher. Note that the Secret Constants provided below will not work with standard CPRM/CPPM implementations.


http://www.4centity.com/docs/facsimile.html

Anyway I tried to do memdumps of WinDVD 7.0 B27.066 while playing CPPM protected DVD A and only interesting constant I was able to find was DEADBEEF which is used for verification of the Media Key with Dv - Verify media key that is at the begining of MKV. But I did not see the actual Dv in the memdump.

[Wilbert]

Anyway I tried to do memdumps of WinDVD 7.0 B27.066 while playing CPPM protected DVD A and only interesting constant I was able to find was DEADBEEF which is used for verification of the Media Key with Dv - Verify media key that is at the begining of MKV.
That's described in table 3-2, ok i see. I can't find that constant in my memory dump. Any idea what i'm doing wrong? Does it matter when you take the dump?

[tjf]

I can't find that constant in my memory dump. Any idea what i'm doing wrong? Does it matter when you take the dump?

Not at all. Actualy I can find 0xDEADBEEF it in memdump taken with fresh WinDVD without any disc. The values around it stay the same if there is a disc or not as well.

[arnezami]

I bought a DVD-Audio disc (man these are rare).

Just to play around a bit... ;)

But when using PowerDVD it first tries to update the CPPM keys and then seems to (always) play the video on the disc (well I get a typical dvd menu so I guess thats the video part of the disc). Its a DVD-video/audio combi disc apparently. I've tried setting the player to choose DVD-audio above video but this doesn't seem to have any effect. And there is no option (I think) to switch between audio/video.

How do I make sure the CPPM protected audio is played?

arnezami

[evdberg]

If you can select the MLP 96/24 5.1 track from the Audio menu, you are pretty sure you are playing the DVD-Audio ...

[arnezami]

Hmmm. I reinstalled the 2911 version and it says this at first startup:

PowerDVD will automatically play DVD-Video content because there is no CPPM key available. Please activate the CPPM key via the Internet.

And then at each startup (for a second):

Waiting to update CPPM key...

And then plays the video.

PowerDVD is activated btw.

Has anybody gotten this to work?

arnezami

PS. These guys (http://forums.afterdawn.com/thread_view.cfm/235076) seemed to have a similar problem.
PPS. WinDVD 8 (not HD) also play sthe DVD-video with ac3. There doesn't seem to be a way to force it to play the DVD-audio.

[tjf]

Try WinDVD Platinum 7.0.27.66. Even in trial mode it plays DVD-A. Google "WinDVD.v.7.0.27.66".

[Wilbert]

Sorry to bump in again :)
Try WinDVD Platinum 7.0.27.66. Even in trial mode it plays DVD-A. Google "WinDVD.v.7.0.27.66".
I'm using 7.0 B27.172. If i select the "i" of Info i see it's playing the mpeg2/ac3 stream. I've enabled "DVD-Audio navigation" in the Preferences tab. I've also enabled "96KHz/24bit decoding" in the Audio tab.

How can i select the MLP stream that evdberg is talking about? I don't see an audio menu. I see something called "Audio center", but i can't see/select any tracks in there.

edit: is it possible that there is no MLP stream on my disc?

[evdberg]

How can i select the MLP stream that evdberg is talking about? I don't see an audio menu.
I mean the menu on the DVD itself. As arnezami says, PowerDVD plays the dvd-video and -audio combined. I have "Queen - Night at the Opera". At start of the disk, you get a menu just like regular DVDs. Now you can enter the Audio selection menu, again just like regular DVDs have. In this menu you see 3 audio options: 2 for dvd-video (PCM and DTS) and 1 or dvd-audio (MLP 96/24 lossless 5.1). This last option only works when I play it in PowerDVD. In all other players (like the Apple DVD player) only the 1st 2 work.

[CZroe]

I backed up the LPCM tracks from my DVD-Audio of The Crystal Method - Legion of Boom album with DVD Decrypter. I never had any idea that there was some special kind of protection for DVD-A, just that PC software wasn't allowed to play it back without downsampling at one time. Is mine not protected like that or something? I just demuxed the streams and ran the output (WAV) through WMEncoder9 to Lossless WMA. Even the album information with bonus tracks + DVD-Audio cover art was avalable through WMP.

[mommyman]

Both keysets (CPPM/CPRM) have already been extracted from software and firmware. A long time ago... So, there is no reason to "just hack" them again:)

[arnezami]

Both keysets (CPPM/CPRM) have already been extracted from software and firmware. A long time ago... So, there is no reason to "just hack" them again:)

Can you give us a link or more info?

[mommyman]

As I know there are no available links today. Do you think that this would be a good idea to make these keys public? By now DVD-Audiio is a dying thing, seems that no one will be interested to incorporate this kind of "support" in software. And DMCA is not the last issue...

[evdberg]

Both keysets (CPPM/CPRM) have already been extracted from software and firmware. A long time ago... So, there is no reason to "just hack" them again:)

Hmmm ... I've been following this kind of stuff for years and the only 'hack' for dvd-audio I have ever seen is the one that uses WinDVD to capture the decoded audio from the soundcard output. And if you can not provide the previous hack, there is no other solution then to hack it again.

[mommyman]

Hmmm ... I've been following this kind of stuff for years and the only 'hack' for dvd-audio I have ever seen is the one that uses WinDVD to capture the decoded audio from the soundcard output. And if you can not provide the previous hack, there is no other solution then to hack it again.

If it is going to happen this way... http://www.sendspace.com/file/atzn56

[HyperHacker]

Not at all. Actualy I can find 0xDEADBEEF it in memdump taken with fresh WinDVD without any disc. The values around it stay the same if there is a disc or not as well.

0xDEADBEEF is commonly used to fill uninitialized memory, so that it stands out when debugging. IOW, you're probably looking at variables that haven't been used yet.

[evdberg]

@mommyman: that's some pretty solid proof ... stange I missed it back then ... thanks for sharing! Looks like this thread can be closed ...

[ron spencer]

it was not a hack/patch per se....you used WinDVD as it was....output was redirected to hard disk (not sound card). the tools were removed:

http://www.cdfreaks.com/news/DVD-Audios-CPPM-can-be-got-around-with-a-WinDVD-patch.html


The programs never got rid of the Verance watermarking (if used), so if you re-burned the content and your player saw the watermarking but no CPRM it would stop.

[Wilbert]

If it is going to happen this way... http://www.sendspace.com/file/atzn56
I tried to compile it, but got dozens of errors. Did someone else succeed?

[ron spencer]

what is it supposed to do this proof??

[evdberg]

I tried to compile it, but got dozens of errors. Did someone else succeed?

Which compiler did you use? From what I saw it looks like Visual C to me. To compile it with another compiler you need at least to change the pragma statements. And I am not sure, but maybe you also need some header files from the Platform SDK or DDK.

[evdberg]

what is it supposed to do this proof??

That CPPM/CPRM was already cracked/hacked in the past and we are wasting our time to try to do it again ...

[jesperl]

I tried to compile it, but got dozens of errors. Did someone else succeed?

I can compile it with Visual C++ 2005 Express and the Microsoft Platform SDK. You need to disable UNICODE support (in compiler options) or change two instances of CreateFile to CreateFileA in dvd_device.c.

I also tried gcc, but the MinGW Platform SDK replacement (w32api, v3.6) is missing some declarations, so it doesn't compile.

[moshmothma]

That CPPM/CPRM was already cracked/hacked in the past and we are wasting our time to try to do it again ...

Yeah, but it would sure be nice not to have to use a hacked version of Windvd to rip content.
And what about the watermark? Anyone thought of doing away with that?

Thanks

[ron spencer]

not all DVD-As have the watermark....few do from what I understand....the spec says if watermark is present then CPRM MUST be there....if your player sees that CPRM is not there it assumes your disc is ripped and stops playing after 30 sec. There is no way to get rid of the watermark...none. Really to stop ripping all you need are the rules I mentioned...and the studios would not need CPRM, ACSS, etc. It would be a hardware protection via audio watermarking - to get around this you would need to open your player up and hack the hardware/firmware. That really would mark the end of copying forever. However if you peruse audio forums the watermark seems to be audible in many instances...wouldn't want to hear that in a silent scene from Lord of the Rings or anything right? Hence it is rarely used. But if it is there you cannot get rid of it.

Again it was NOT a hacked version of WinDVD...those programs were just able to read the encryption keys...they patched nothing really...they just "intercepted" the audio. In any case I am sure that version of WinDVD was revoked long since then anyway. DVD-As from this year likely would not be played with those versions of WinDVD....all the old stuff would.

[Balwyn]

not all DVD-As have the watermark....few do from what I understand....

I have about 20 DVD-A's and about 70% are watermarked.
One however (Gary Moore Blues) isn't watermarked OR encrypted and the digital outputs of my Audigy 2 sound card are still enabled !

I ripped The Coors in Blue disk to wav files using the WinDVD and dvdaripper, then reauthored a new disk with Diskwelder. PPCMripper confirmed the presence of watermarks in each track. Sure enough, the player stops between 14 and 30 secs after each track begins.

Those with DSP experience should gain insight into a Edward Felten's successful Verance Watermark removals by looking here : http://www.usenix.org/events/sec01/craver.pdf

[tjf]

Why is watermark a problem? Once you rip the audio into uncompressed format, you can play it in any player that does not check the presence of watermark (Foobar, iPOD, ...). It is a problem only if you want to burn it to DVD-A disc and play with the DVD-A player, but why would you want to do that if you have the original disc?

[ron spencer]

even with that paper on watermarl removing there is no tool to do so.

yep they will play on pc


you can also author the audio into the DVD-Video zone with nice menus, etc....that will work perfectly as well. Since in DVD-Video zone DVD-A players will not care about watermark

[lightshadow]

you can also author the audio into the DVD-Video zone with nice menus, etc....that will work perfectly as well. Since in DVD-Video zone DVD-A players will not care about watermark
I agree.

Watermarking is a fair protection, that let's you backup your purchased media. Some are blaming Apple for storing personal info in their DRM free downloaded music, but only people with intention to illegally share the music are harmed by this.

I'll say watermarks OK, DRM not.

So if you ask me, don't waist your life and time on this, focus on DRM instead. =)

I store all my music in FLAC (http://en.wikipedia.org/wiki/Free_Lossless_Audio_Codec), and I have never looked back, and I think you would find that it would satisfy your needs too.

[ron spencer]

I disagree about watermarking....there is enough evidence (see hydrogen audio) to show that if not done properly the watermarking will degrade the audio...this may not be a great consquence for a movie, but for music this is not good.

DRM in general is falling away slowly in the music milieu....lots of legal drm free music now

[lightshadow]

I disagree about watermarking....there is enough evidence (see hydrogen audio) to show that if not done properly the watermarking will degrade the audio...this may not be a great consquence for a movie, but for music this is not good.

Removing the watermark decreases the quality even further.

[Balwyn]

Why is watermark a problem? Once you rip the audio into uncompressed format, you can play it in any player that does not check the presence of watermark (Foobar, iPOD, ...). It is a problem only if you want to burn it to DVD-A disc and play with the DVD-A player, but why would you want to do that if you have the original disc?

Your point is valid for PC playback, but I prefer the sound of my DVD-A player and sound system. My kids have already scratched some of my original discs, some of which are now unplayable and irreplaceable. As a child health preservation strategy, I wish to play only DVD-A copies and allow them to suffer the damage.

[Balwyn]

even with that paper on watermarl removing there is no tool to do so.

yep they will play on pc


you can also author the audio into the DVD-Video zone with nice menus, etc....that will work perfectly as well. Since in DVD-Video zone DVD-A players will not care about watermark

The ripped multichannel wav files play nicely on the PC.

Regarding your suggestion to put the nice audio in the video zone, I presume you are referring to making DTS encoded VOBs rather than putting AOBs into the Video_TS folder ?

[ron spencer]

no...use the PCM....no need to convert to DTS. You cannot put AOB into Video_TS

[Balwyn]

no...use the PCM....no need to convert to DTS. You cannot put AOB into Video_TS

Thanks for the reply. But wont the PCM will be limited to stereo only ? The sound from my DVD-A's is 5.1, hence the DTS proposal.

[ron spencer]

only limit pertains to bitrate in DVD-V....so use 0-GOP video (or something like DVDLab's audio feature) and away you go

[Balwyn]

only limit pertains to bitrate in DVD-V....so use 0-GOP video (or something like DVDLab's audio feature) and away you go

Ron, I will give it a go as you suggest. Thanks for the idea

[abcx]

no...use the PCM....no need to convert to DTS. You cannot put AOB into Video_TSSome bit-depth/sample rate combinations (like 5.1 96khz/24bit) need a higher bitrate than that supported by the DVD-V spec (which is 9.6 Mbps IIRC). So what you're saying doesn't always work...

Anyway, I belong to the rare breed of audiophiles who are still interested in this dying format. I've used the WinDVD tools many times and have copies of them that I can send links to anyone via PM. But I agree with previous posters that cracking CPPM/CPRM right now would be rather superfluous since the WinDVD hack works quite well. If people want to work on something, they should try circumventing the water-marking technology...if anyone is interested (arenzami?) in this, I can help provide source material, but I lack the technical knowledge to actually do this myself or help.

[evdberg]

^^^ Actually cracking CPPM/CPRM would be rather superfluous since it already has been done in the past ... see proof provided by mommyman above.

[HyperHacker]

I disagree about watermarking....there is enough evidence (see hydrogen audio) to show that if not done properly the watermarking will degrade the audio...this may not be a great consquence for a movie, but for music this is not good.It may also be a problem to us audophiles who can, in fact, hear the difference between FLAC and 320kbps MP3. Just because the people who made it can't hear it, doesn't mean nobody can.

[alstoneb]

how u doing reading you notes very help full how ever i found a small prob with playing my copy on my home systems get a msg saying no disc and c-13 i am using all the programs that i found on here not sure wut cause it it would play on my pc now but not my home system any ideas asking for some help thnk you the stone

[SvT]

how u doing reading you notes very help full how ever i found a small prob with playing my copy on my home systems get a msg saying no disc and c-13 i am using all the programs that i found on here not sure wut cause it it would play on my pc now but not my home system any ideas asking for some help thnk you the stone

Sound like your SAP isn't compatible with the CD/DVD you're using (C-13).

What brand/type of SAP are we talking about ?

[abcx]

^^^ Actually cracking CPPM/CPRM would be rather superfluous since it already has been done in the past ... see proof provided by mommyman above.Just looked at it. (Note to self: read the thread properly next time, you moron). I had no idea that CPPM was so comprehensively cracked. I'm on some online communities where we played around with the WinDVD hack and all the associated software like the Surcode MLP decoder, DigiOn Audio, DVDARipper etc., but nobody had heard of this. I wonder who wrote the proof of concept and when - I doubt it is MaximA (the guy who wrote the WinDVD hack). I'm really surprised that it managed to remain unknown for so long...

[HyperHacker]

(Note to self: read the thread properly next time, you moron).Rule 4! ;)

[abcx]

Rule 4! ;)But I'm calling myself a moron. Surely, I can do that?

[paradynamic]

link: http://rapidshare.com/files/44120246/adv.rar.html
archive password: n3tL4b%E2k@rU

command example:
dvdcpxm.exe D:\AUDIO_TS\ATS_01_1.AOB C:\dvda_rip

the new tool can decrypt CPRM/CPPM protected video and audio, i.e. both CPRM/CPPM protected AOBs and VOBs

[KillaByte]

Nice one! :thanks:

Now all we need is a free / open source MLP decoder and Bam! - no more dependencies on WinDVD ;)

[abcx]

Nice one! :thanks:

Now all we need is a free / open source MLP decoder and Bam! - no more dependencies on WinDVD ;)Though not open source/free, Surcode MLP Encoder (yes, the encoder) and DigiOn Audio (only handles stereo) do the jobs you mention. There's a work-around for DiscWelder chrome to decode MLP files too...I doubt that we'll get an open-source MLP decoder because of the format's proprietary nature. What we really need now is a way to get rid of the watermarks.

[jolson]

I will try to dig up the "Verance Removal Tool" i got a year or so ago, had no chance to try it out so I don't know if it works.

[tteich]

I will try to dig up the "Verance Removal Tool" i got a year or so ago, had no chance to try it out so I don't know if it works.
This would be a great start. I own a fair number of DVD-A's but am afraid of the day my DVD-Audio player (Technics DVD-A10) stops working. Therefor I've been following the DVD-A story for some time now.

Defending the Verance watermark was discussed in the Craver paper (linked above), and aim of the SDMI challenge. The method which lead to success was to change the audio data and introduce little time variations. The simple program which they were using (tinywarp.c) was later on filed under judicial seal by the court. Here is an entry for further reading: http://features.slashdot.org/article.pl?sid=01/11/30/1739226

There is a project which develops a software to author (legally) DVD-A's. See here: http://dvd-audio.sourceforge.net/ What they are still missing is a MLP encoder/decoder solution. So to make backup copies of our beloved DVD-Audios we can now
- rip the contents
- remove CPPM

What's still needed is:
- MLP decoding
- watermark removal (or attack using Feltens/Cravers tinywarp.c)
- MLP re-encoding
- DVD-A authoring

Watermark removal would be needed if we want to make backup copies work on DVD-Audio players. Interestingly, the mentioned Technics DVD-A10 does not contain a verance detector, but any other (later) model does. Following recent press releases about AACS and HD media, they will use watermarking again (a Verance based scheme, if I'm not completely wrong), so it's increasingly interesting to be prepared...

[jackchen]

though most people here talk about DVD audio decrypting, the orignal thought of me is to decrypt the content recorded from HDTV broadcasting. Some blueray HDTV recorders record the HDTV in CPRM disk (blue ray or DVD). a free decrypter is a good way to get the original TS or H264 stream. Though there are other ways to do it, but the have a CPRM/CPPM decrypter will be a good way, too.

[abcx]

Defending the Verance watermark was discussed in the Craver paper (linked above), and aim of the SDMI challenge. The method which lead to success was to change the audio data and introduce little time variations. The simple program which they were using (tinywarp.c) was later on filed under judicial seal by the court. Here is an entry for further reading: http://features.slashdot.org/article.pl?sid=01/11/30/1739226
Hmm, interesting reading. I am not a lawyer, but if the case was dismissed, doesn't the judicial seal on the code ought to be removed too? I'm going to try writing to Felten directly and see what he says. :p

[tteich]

Hmm, interesting reading. I am not a lawyer, but if the case was dismissed, doesn't the judicial seal on the code ought to be removed too? I'm going to try writing to Felten directly and see what he says. :p
I'm not a lawyer, too, and I did not follow the outcome of the case. If it was dismissed, then there's no reason why the code should remain sealed.

What I find very clever is the fact that all of these scientists/cryptoanalysts (I mean Felten, Craver, Ferguson) have signed declarations to the US court, in which they declare to not publish the results of their work regarding CPPM/CPRM, SDMI, etc., but in the very same declaration actually TEACH HOW THEY PERFORMED THE ATTACK! :D

Read for instance this one: http://www.macfergus.com/niels/dmca/felten_declaration.html

Same valuable information can be found in the Felten declaration, in which he mentioned the program "tinywarp.c", which points out that you only have to warp the audio signal in the time domain by a tiny amount in order to defeat the watermark detector. A programmer with mathematical background should be able to implement such a thing easily.

[tteich]

Nice one! :thanks:

Now all we need is a free / open source MLP decoder and Bam! - no more dependencies on WinDVD ;)
Note that DTS-HD:MA (master audio) is based on the MLP algorithm, and used now on a good number of european HD-DVDs from StudioCanal. The codec provides lossless compression for high-rez multichannel audio and I find it worth anyway to have an encoder/decoder for MLP / a.k.a. DTS-HD:Master.

[jolson]

I don't say no about DTS Master Audio, but I know that Dolby True-HD anyway is based on MLP.

When it comes to the watermark removal program I got it from someone who had read the Craver paper, but had no watermarked DVD-A to try it on. He thought it was a very good chance it would work, but also a pretty large risk it would be audible. I haven't found it, though. Have to hope for backup disks. And it was no source code, just a cmd-line program.

[tteich]

I don't say no about DTS Master Audio, but I know that Dolby True-HD anyway is based on MLP.

When it comes to the watermark removal program I got it from someone who had read the Craver paper, but had no watermarked DVD-A to try it on. He thought it was a very good chance it would work, but also a pretty large risk it would be audible. I haven't found it, though. Have to hope for backup disks. And it was no source code, just a cmd-line program.
Okay, it could be I'm mixing this up (DTS:MA vs. DTHD). Both DTS and Dolby have a lossless scheme, and one of them is basically MLP.

Tinywarp: I might (with help of a colleague who has a Panasonic DVD-V/DVD-A player) be able to run some tests. Last time we tried his player stopped after 15? seconds (watermark detected). What else comes to mind: I have the related verance patents somewhere on my harddisc, and with the help of Cravers report one should be able to determine the parameters of the watermarked signal. As far as I understand it's a complex echo signal. Removing the echo could be a real pain, if not impossible. However, ideas come with understanding how the detection mechanism work, and which parameters are involved.

[abcx]

BTW, the Craver paper mentions 4 watermarking schemes. Is the first one the one used on DVD-As? It seems to me that way because they could find a Verance patent for it...

[tteich]

BTW, the Craver paper mentions 4 watermarking schemes. Is the first one the one used on DVD-As? It seems to me that way because they could find a Verance patent for it...Seems likely, but I don't know. Verance bought the itellectual property from another company (the one which has filed the mentioned patent). The fact that after CSS was broken the companies had to develop new protection and watermarking schemes in a hurry let me believe that they just took something which was developed and already available at that time. To get a definite answer, one has to analyze wav files which were taken from a watermarked DVD-Audio using the mathematical methods as described in the paper (e.g. FFT and cepstral analysis).

[frenchglen]

Any news on this front?
Anyone have the tinywarp.c program?

[merbanan]

Well an Open Source decoder is in the works.

[Wilbert]

Ok, but he's referring to the watermark removal.

[tteich]

Well an Open Source decoder is in the works.
sounds very interesting. can you post a link to the project site?

Ok, but he's referring to the watermark removal.
Detecting the watermark is one side of the story. Removal of the complex echo very hard to achieve.

[mommyman]

Detecting the watermark is one side of the story. Removal of the complex echo very hard to achieve.
Verance told us about existence of detector/remarker products (see http://www.verance.com/vcms/products_consprod.html). This way echo doesn't have to be removed, only CCI bits should be set in "copying freely" position.

[merbanan]

sounds very interesting. can you post a link to the project site?


Detecting the watermark is one side of the story. Removal of the complex echo very hard to achieve.

ffmpeg.org

[gp2221]

link: http://rapidshare.com/files/44120246/adv.rar.html
archive password: n3tL4b%E2k@rU

command example:
dvdcpxm.exe D:\AUDIO_TS\ATS_01_1.AOB C:\dvda_rip

the new tool can decrypt CPRM/CPPM protected video and audio, i.e. both CPRM/CPPM protected AOBs and VOBs

I'm wondering if this is the right tool for the task I'm trying to do?

After spending the $6.50 or so for the rights to download the archive, I can't get it to work on my system. There aren't any instructions other than a sample command line.

I have the Barenaked Ladies 'Everything to Everyone' CD/DVD combo. The DVD "Everything else" has both the VIDEO_TS and AUDIO_TS folders. The audio includes both 24/96 surround and 24/96 stereo files. I would like to convert/decrypt to multichannel and stereo wav files and then I can encode to FLAC or WMA lossless to play from my computer.

At least the other tool, PPCMRipper, helps you generate to wav, but I couldn't get that to work either. I don't know what dvdcpxm.exe is suppose to create. When I run it -

C:\Rip\dvdcpxm.exe g:\audio_ts\ATS_01_1.AOB d:\barenaked

I get the following prompts:

Simple DVD-Audio AOB/VOB Decrypter

Processing media key block...
Unprotected media is loaded in drive g:
Nothing to do, exit!

This is after inserting the DVD in my DVD drive (G)

[alicizmar]

I'm bring this back to ask how the DVD files should appear on the disc with a drive that has CPRM.
Tried a CPRM disc I have in several computers. The ones that support CPRM don't see anything written on the DVD, whereas the ones that don't support CPRM show files on the disc, but because the drive doesn't support CPRM, they cannot be played.

[keysersose]

link: http://rapidshare.com/files/44120246/adv.rar.html
archive password: n3tL4b%E2k@rU

command example:
dvdcpxm.exe D:\AUDIO_TS\ATS_01_1.AOB C:\dvda_rip

the new tool can decrypt CPRM/CPPM protected video and audio, i.e. both CPRM/CPPM protected AOBs and VOBs

I have tried this on 2 discs and I get the response that they are not protected - nothing to do..

Using DVDa Explorer to try and extract the tracks - it fails and says File Encrypted..

Is this a case where there is no CPRM but the watermark is tripping dvda explorer?

[rasth]

I have tried this on 2 discs and I get the response that they are not protected - nothing to do..

Using DVDa Explorer to try and extract the tracks - it fails and says File Encrypted..

Is this a case where there is no CPRM but the watermark is tripping dvda explorer?

The watermark won't trip up DVDA Explorer. It doesn't know how to see the watermark in the data.

If you have a file \AUDIO_TS\DVDAUDIO.MKB then the disc is encrypted. If you don't have that file, DVDA Explorer should be able to copy tracks.

[keysersose]

The watermark won't trip up DVDA Explorer. It doesn't know how to see the watermark in the data.

If you have a file \AUDIO_TS\DVDAUDIO.MKB then the disc is encrypted. If you don't have that file, DVDA Explorer should be able to copy tracks.

Just tried a new version of DVDA Explorer (alpha 8) and it worked fine on a encrypted disc that wouldn't copy with the previous DVDA Explorer..

So all we have to do is find some way to get past the watermarking..

[rasth]

Cool. I just grabbed the new version. Thanks for the heads up.

[keysersose]

A HUGE thanks from me!! - this new version is a very nice improvement and really simplifies things - much better than recording thru a soundcard and having to remake the MLP files and mucking around with cue sheets..

:) :)

[sk11vengeance]

Ive just bought the LP Reanimation dvd-audio disc online and ive been trying to rip the stereo files off the disc but I cant get them off with dvdaudioexplorer, it says they are encrypted. I then try the dvdcpxm.exe and when I type the paths and filenames it doesnt do anything at the command line. it just keeps saying what it says when you type dvdcpxm,

Simple DVD-Audio AOB/VOB Decrypter

Use: src_file dest_directory

im typing it just like the example, but nothing happens outside of that. Any ideas?

Ive also tried following the guide at http://avisynth.org/mediawiki/DVDAGuide and ive tried the dvdfab but the latest version is much newer than the one listed and when i use it, it doesnt decrypt anything in the audio_ts folder, just gives a file copy error. So has anyone been able to successfully rip the stereo files off this disc? Thanks!

[Wilbert]

Ive just bought the LP Reanimation dvd-audio disc online and ive been trying to rip the stereo files off the disc but I cant get them off with dvdaudioexplorer, it says they are encrypted. I then try the dvdcpxm.exe and when I type the paths and filenames it doesnt do anything at the command line. it just keeps saying what it says when you type dvdcpxm,

Simple DVD-Audio AOB/VOB Decrypter

Use: src_file dest_directory

im typing it just like the example, but nothing happens outside of that. Any ideas?
Could you give the full command line which you typed.

[rasth]

Try the newer GUI version. See the latest posts in the thread

http://forum.doom9.org/showthread.php?t=96860

[keysersose]

Ive just bought the LP Reanimation dvd-audio disc online and ive been trying to rip the stereo files off the disc but I cant get them off with dvdaudioexplorer, it says they are encrypted.


You have to check off the box that says

Ignore Encrypted Stream

this will let you extract the stereo MLP files

[sk11vengeance]

You have to check off the box that says

Ignore Encrypted Stream

this will let you extract the stereo MLP files

When I do that it gives an error, MLP decoder failed during extraction when I have convert to wave selected. It will however extract the mlp file when store is selected.

The command line which I typed for dvdcpxm is

C:\Documents and Settings\Administrator\Desktop\adv>dvdcpxm L:\AUDIO_TS\ATS_01_1.AOB J:\New Folder

Edit: Ok, I made a folder on C: which is used in the command example in a previous post, C:\dvda_rip and now cpxm says theres nothing to do, on all the AOB's even though theres an .MKB file in the audio_ts folder. Now im really confused!

[keysersose]

When I do that it gives an error, MLP decoder failed during extraction when I have convert to wave selected. It will however extract the mlp file when store is selected.



yeah I don't know why it wont extract the waves for you..

what is the reason for wanting the wave files?

you can make a new stereo DVD-A disc using discwelder..

[sk11vengeance]

yeah I don't know why it wont extract the waves for you..

what is the reason for wanting the wave files?

you can make a new stereo DVD-A disc using discwelder..

I was just wanting to compare the 24bit to 16 bit files from the orignal Reanimation CD I have to see if I can tell any sound quality difference from my speakers.

Ive tried many different versions of dvdfab but most of them just gives the 103 error and stops immediately. One version goes up until 93% and stops at the audio_sv mpeg files with the same error.

[keysersose]

I was just wanting to compare the 24bit to 16 bit files from the orignal Reanimation CD I have to see if I can tell any sound quality difference from my speakers.



I don't get it?

why not just compare the stereo DVD-A against the CD??

MLP is merely a lossless means of compression..so in theory is the same as playing 24 bit wave files..

[sk11vengeance]

I don't get it?

why not just compare the stereo DVD-A against the CD??

MLP is merely a lossless means of compression..so in theory is the same as playing 24 bit wave files..

Id rather just rip it to the computer with the rest of my collection. I use Foobar to play all the files back so its just easier for me that way.