Can the in memory key searching trick for AACS cracking be used on CPRM cracking?

[jackchen]

Can the in memory key searching trick for AACS cracking be used on CPRM cracking?

Taking WinDVD as example, the WinDVD can play CPRM disks, regardless of whether it's DVD based or BD based. During the paly back of CPRM disks, it must decrypt the CPRM content first. So the decryption key must reside in the RAM/Memory of PC. This is a very similar situation just like the AACS case of HDDVD and BD. I am wondering whethere there will be someone working on the CPRM cracking using similar tricks.

Any ideas or comments? Anyone interested?

[evdberg]

The same trick would definitely work, as long as you know how the CPRM system works, just like it is exactly known how AACS works. So, if you have the CPRM specs, please share them with us and we can see further ...

[jackchen]

I do have the spec., actually you can download them from the link below

http://www.4centity.com/docs/versions.html

simply fill in some dummy info in the request form, then you can download the spec..

or if someone can open some share space, I can upload the spec. documents, too.

[evdberg]

No need to fill in dummy info, just download the specs from this page:
http://www.4centity.com/docs/doc_request_thanks.html

Now if someone has too much time on his hands and interest in dvd-audio ...

[evdberg]

Very funny ... these specs look a lot like the AACS specs (or more likely the other way around):
1) Use the device keys and MKB to calculate a Media Key.
2) Then use the Media Key and Album Identifier to calculate the Album Unique Key.
3) Then use this AUK to decrypt the data blocks.

Instead of AES for the actual encryption C2 is used. So just like HD-DVD and BluRay, it looks like we can make a list with AUKs for every dvd-audio disk ...

[jackchen]

well, agree with you. The CPRM seems to be very similar to AACS. But some thing missing are those DVD spec. books which are only available from DVDFLLC or DVDForum with $$. Without those book, it will be very difficult to know the IDs of each pack, which will prevent us from using the know plaintext attack.

[arnezami]

Does anyone have an CPRM or CPPM protected disc? If so will PowerDVD/WinDVD play it?

Or maybe a (hdd) sattellite/TV recording? Isn't this quite common in Japan?

Btw: the CPRM/CPPM system is very similar to AACS (well they are basicly from the same family, the MKB resembles the SKB in AACS). I believe for recordables it requires discs that already have an MKB on it. Not sure.

Its quite possible the same kind of techniques can be used to open this DRM system too ;).

The biggest problem is the C2 cipher: it has a secret value which first has to be found. But you need a working (PC based) playback system for that.

Is there any demand for this?

Regards,

arnezami

[tjf]

I tried DVD-A in PowerDVD Ultra and yes it works. However the sound is downsampled to 48kHz. The disk has DVDAUDIO.MKB file in AUDIO_TS directory, so I suppose it is CPPM protected. The file is 3072 kB big.

I have already backed up all my DVD-A with the old DVD-Audio ripper (http://forum.doom9.org/showthread.php?t=96860) that uses WinDVD hack, but that was very labourous process and probably not many people wanted to go through it, so easier decrypting would be welcomed.

Tomas

[evdberg]

Is there any demand for this?
Does that matter to you? Isn't it a challenge to break/bypass the protection? :)

DVD-Audio disks are protected using CPPM. I own 2 disks at this moment, and both play in PowerDVD (after it retrieved a new CPPM key from internet). WinDVD just plays the DVD-video that is on the disk, although it played the DVD-audio content with an older version of WinDVD before.

But you are right, the first thing we need is the secret value array for the C2 cipher.

[merbanan]

This page :http://en.wikipedia.org/wiki/Cryptomeria_cipher got me here:
http://web.archive.org/web/20050306065032/http://pbx.mine.nu/ch/c2bf/ and that got me this archive:
http://web.archive.org/web/20050306065032/http://www.marumo.ne.jp/c2/bf/c2bf-2.0.1.tar.gz

which contain the following SBOXes:


#if 0 /* Facsimile S-Box */
static const unsigned char sbox[256] = {
0xB6, 0xAA, 0xEB, 0xB3, 0x35, 0x5D, 0xEE, 0xB1,
0x72, 0x33, 0x05, 0x13, 0x6D, 0xC7, 0x6C, 0x27,
0x25, 0x54, 0xE9, 0x4C, 0xDE, 0xC3, 0x21, 0x39,
0xA9, 0xAB, 0xD6, 0xDF, 0xE8, 0x71, 0x94, 0xAE,
0x16, 0x44, 0x76, 0xCD, 0xB7, 0x78, 0x20, 0xF0,
0xC1, 0x9F, 0xCF, 0xAF, 0x0F, 0xCB, 0x59, 0x83,
0x3A, 0x5E, 0xB8, 0xB5, 0xF3, 0x47, 0x80, 0xC2,
0xF6, 0x14, 0xE6, 0x69, 0xFC, 0x17, 0xE0, 0xE5,
0x79, 0xF9, 0x12, 0xBF, 0x3C, 0xB4, 0x66, 0xAD,
0xF7, 0x65, 0x95, 0xF4, 0x4E, 0x02, 0xA0, 0x07,
0x4D, 0x2F, 0x0D, 0x7E, 0xE4, 0xEF, 0xA1, 0x8C,
0x6E, 0xD2, 0xFD, 0x19, 0x1C, 0x82, 0x42, 0xBB,
0x9A, 0x43, 0xC6, 0xE2, 0x1F, 0xF2, 0x75, 0x1A,
0x63, 0x45, 0xD1, 0x30, 0x81, 0x7F, 0x8E, 0x62,
0x3B, 0xA4, 0xFB, 0x1E, 0x5F, 0xBC, 0xB0, 0x40,
0x8B, 0x74, 0x38, 0x8A, 0xC4, 0x73, 0x9C, 0x09,
0xD4, 0xED, 0xD3, 0x5A, 0x60, 0x48, 0xC5, 0x9E,
0x01, 0xCC, 0x34, 0x1B, 0x58, 0x36, 0x23, 0x88,
0x7A, 0x90, 0x9B, 0x8F, 0xBD, 0x3F, 0xB9, 0x57,
0xA2, 0x3E, 0x04, 0xB2, 0x49, 0x37, 0x5C, 0x7D,
0x61, 0x4A, 0xA6, 0x67, 0xEC, 0x7C, 0x0E, 0x96,
0xDD, 0xE3, 0x2C, 0x56, 0x08, 0x0C, 0x8D, 0x2B,
0x6A, 0xFE, 0xEA, 0xA3, 0xCA, 0x3D, 0x91, 0xE7,
0xC9, 0xAC, 0x03, 0xD5, 0x89, 0x86, 0xDC, 0x10,
0x55, 0x77, 0xC8, 0xD7, 0x97, 0x24, 0x46, 0x9D,
0x0A, 0x1D, 0x22, 0xD9, 0xFF, 0x5B, 0x52, 0xD8,
0x00, 0xFA, 0x53, 0x26, 0x29, 0x2E, 0x2A, 0x11,
0xC0, 0x6F, 0x4F, 0x7B, 0x28, 0x99, 0x41, 0x92,
0xDB, 0xF8, 0x50, 0xA8, 0x51, 0xA5, 0x4B, 0x93,
0x87, 0xDA, 0x06, 0x85, 0x2D, 0xBA, 0x0B, 0x98,
0x70, 0x6B, 0xBE, 0xF1, 0x18, 0xD0, 0x31, 0x68,
0x15, 0x84, 0x64, 0xE1, 0xCE, 0xA7, 0xF5, 0x32,
};
#else /* DVD Audio S-Box */
static const unsigned char sbox[256] = {
0x3a, 0xd0, 0x9a, 0xb6, 0xf5, 0xc1, 0x16, 0xb7,
0x58, 0xf6, 0xed, 0xe6, 0xd9, 0x8c, 0x57, 0xfc,
0xfd, 0x4b, 0x9b, 0x47, 0x0e, 0x8e, 0xff, 0xf3,
0xbb, 0xba, 0x0a, 0x80, 0x15, 0xd7, 0x2b, 0x36,
0x6a, 0x43, 0x5a, 0x89, 0xb4, 0x5d, 0x71, 0x19,
0x8f, 0xa0, 0x88, 0xb8, 0xe8, 0x8a, 0xc3, 0xae,
0x7c, 0x4e, 0x3d, 0xb5, 0x96, 0xcc, 0x21, 0x00,
0x1a, 0x6b, 0x12, 0xdb, 0x1f, 0xe4, 0x11, 0x9d,
0xd3, 0x93, 0x68, 0xb0, 0x7f, 0x3b, 0x52, 0xb9,
0x94, 0xdd, 0xa5, 0x1b, 0x46, 0x60, 0x31, 0xec,
0xc9, 0xf8, 0xe9, 0x5e, 0x13, 0x98, 0xbf, 0x27,
0x56, 0x08, 0x91, 0xe3, 0x6f, 0x20, 0x40, 0xb2,
0x2c, 0xce, 0x02, 0x10, 0xe0, 0x18, 0xd5, 0x6c,
0xde, 0xcd, 0x87, 0x79, 0xaf, 0xa9, 0x26, 0x50,
0xf2, 0x33, 0x92, 0x6e, 0xc0, 0x3f, 0x39, 0x41,
0xaa, 0x5b, 0x7d, 0x24, 0x03, 0xd6, 0x2f, 0xeb,
0x0b, 0x99, 0x86, 0x4c, 0x51, 0x45, 0x8d, 0x2e,
0xef, 0x07, 0x7b, 0xe2, 0x4d, 0x7a, 0xfe, 0x25,
0x5c, 0x29, 0xa2, 0xa8, 0xb1, 0xf0, 0xb3, 0xc4,
0x30, 0x7e, 0x63, 0x38, 0xcb, 0xf4, 0x4f, 0xd1,
0xdf, 0x44, 0x32, 0xdc, 0x17, 0x5f, 0x66, 0x2a,
0x81, 0x9e, 0x77, 0x4a, 0x65, 0x67, 0x34, 0xfa,
0x54, 0x1e, 0x14, 0xbe, 0x04, 0xf1, 0xa7, 0x9c,
0x8b, 0x37, 0xee, 0x85, 0xab, 0x22, 0x0f, 0x69,
0xc5, 0xd4, 0x05, 0x84, 0xa4, 0x73, 0x42, 0xa1,
0x64, 0xe1, 0x70, 0x83, 0x90, 0xc2, 0x48, 0x0d,
0x61, 0x1c, 0xc6, 0x72, 0xfb, 0x76, 0x74, 0xe7,
0x01, 0xd8, 0xc8, 0xd2, 0x75, 0xa3, 0xcf, 0x28,
0x82, 0x1d, 0x49, 0x35, 0xc7, 0xbd, 0xca, 0xa6,
0xac, 0x0c, 0x62, 0xad, 0xf9, 0x3c, 0xea, 0x2d,
0x59, 0xda, 0x3e, 0x97, 0x6d, 0x09, 0xf7, 0x55,
0xe5, 0x23, 0x53, 0x9f, 0x06, 0xbc, 0x95, 0x78,
};
#endif



Should be easy to verify if this is correct.

[evdberg]

We need clearly the 2nd one ... the 1st is the test s-box from the 4c website. Funny that they bruteforce attacked this cipher !

[Fahzuu]

We need clearly the 2nd one ... the 1st is the test s-box from the 4c website. Funny that they bruteforce attacked this cipher !

Mar. 6 [2004] - The correct key was not found. We finished searching all 56 bit key space. I declare failure and finish of this project.

The fact that they failed doing so, suggests, that the S-Box shown there is incorrect, so that would be why the quest failed...

And the fact that all this information is 3 years old probably makes it useless - otherwise I would think, there would be a readily available solution already?

[merbanan]

http://web.archive.org/web/20041113022044/http://pbx.mine.nu/ch/test/read.cgi/general/1075424427/

gives a good explanation of the failure. And it also has a surprise.:)

Anyway all this should be quite easy to verify. Just search for a part of the S-BOX in a memory dump of WinDVD. We all know how secure their code is.

[Fahzuu]

http://web.archive.org/web/20041113022044/http://pbx.mine.nu/ch/test/read.cgi/general/1075424427/

gives a good explanation of the failure. And it also has a surprise.:)


Uhm, excuse me for being stupid - I read though a lot of tiresome chat there. What explanation did I miss? What surprise?

[evdberg]

What surprise?
Most likely that arnezami already took part in the discussion at that time?

S-Box currently tested is the DVD-Audio S-Box (DVD-A uses same C2 cipher),
so in the event that AVHDD was assigned a different S-Box by 4C entity (likely)
or if Matsushita decided to use a different S-Box (unlikely, this weakens
the algorithm), we are, again, screwed.

So this s-box should definitely work with dvd-audio, but obviously NOT with avhdd, which the project was focussing on.

[arnezami]

Most likely that arnezami already took part in the discussion at that time?

So this s-box should definitely work with dvd-audio, but obviously NOT with avhdd, which the project was focussing on.
Yes. Its very likely this s-box is the one used for dvd-audio.

If somebody would make a memdump during playback of a dvd-audio disc (best using the old WinDVD version evdberg talked about) and hex search for 3AD09AB6 in winhex (which are the first 4 bytes of the s-box) we could confirm this (of found of course).

Regards,

arnezami

PS. Question: does anybody have a CPRM (as in Recordable as opposed to Prerecorded) protected disc? Like a Satellite TV recording. Keep in mind it looks like there is no Bus encryption with CPRM while there is with CPPM (= DVD-audio).

[Wilbert]

If somebody would make a memdump during playback of a dvd-audio disc (best using the old WinDVD version evdberg talked about) and hex search for 3AD09AB6 in winhex (which are the first 4 bytes of the s-box) we could confirm this (of found of course).
I have a dvd-audio (the Corrs - in blue) and i got windvd7. I'm not sure whether it is encrypted (how do i find this out?), but there is a dvdaudio.mkb. I did a memdump during playback (when clicking on playlist i saw that it is indeed the first AOB file is being played, and not something in the video folder) using pmdump.

I couldn't find that string (3AD09AB6) in one piece. But if i search for two bytes i find all of them (all bytes in the s-box, not just the four you posted) in the correct order (but thus not in one piece). I think this is also the case for memdumps of windvd4, although (as far as i know) dvd-audio is not supported in this version.

I hope this is of any use ...

[evdberg]

@Wilbert,
Can you explain more in detail how the s-box is stored in WinDVD memory? You say it is in the correct order, but not in one piece? Maybe you can give a snippet as example?

[Wilbert]

@Wilbert,
Can you explain more in detail how the s-box is stored in WinDVD memory? You say it is in the correct order, but not in one piece?
No, that was nonsense. Sorry ... I can't find it.

I've been looking at the occurrences of strings of two and three bytes:

B7 58 F6: 2E8EE42
8C 57 FC: 2 times
57 FC FD: 75AFF8
0E 8E FF: 3 times
FF F3 BB: 6 times
BA 0A 80: 312405C
0A 80 15: 2B334AZ
80 15 D7: E860D1
...

3A D0: 174 times
9A B6: 35 times
F5 C1: 51 times
16 B7: 78 times
58 F6: 191 times
ED E6: 99 times
D9 8C: 27 times
...

nothing useful ... I don't know what to look for.

[tjf]

This page :http://en.wikipedia.org/wiki/Cryptomeria_cipher got me here:
http://web.archive.org/web/20050306065032/http://pbx.mine.nu/ch/c2bf/ and that got me this archive:
http://web.archive.org/web/20050306065032/http://www.marumo.ne.jp/c2/bf/c2bf-2.0.1.tar.gz

which contain the following SBOXes:


#if 0 /* Facsimile S-Box */
static const unsigned char sbox[256] = {
0xB6, 0xAA, 0xEB, 0xB3, 0x35, 0x5D, 0xEE, 0xB1,
0x72, 0x33, 0x05, 0x13, 0x6D, 0xC7, 0x6C, 0x27,
0x25, 0x54, 0xE9, 0x4C, 0xDE, 0xC3, 0x21, 0x39,
0xA9, 0xAB, 0xD6, 0xDF, 0xE8, 0x71, 0x94, 0xAE,
0x16, 0x44, 0x76, 0xCD, 0xB7, 0x78, 0x20, 0xF0,
0xC1, 0x9F, 0xCF, 0xAF, 0x0F, 0xCB, 0x59, 0x83,
0x3A, 0x5E, 0xB8, 0xB5, 0xF3, 0x47, 0x80, 0xC2,
0xF6, 0x14, 0xE6, 0x69, 0xFC, 0x17, 0xE0, 0xE5,
0x79, 0xF9, 0x12, 0xBF, 0x3C, 0xB4, 0x66, 0xAD,
0xF7, 0x65, 0x95, 0xF4, 0x4E, 0x02, 0xA0, 0x07,
0x4D, 0x2F, 0x0D, 0x7E, 0xE4, 0xEF, 0xA1, 0x8C,
0x6E, 0xD2, 0xFD, 0x19, 0x1C, 0x82, 0x42, 0xBB,
0x9A, 0x43, 0xC6, 0xE2, 0x1F, 0xF2, 0x75, 0x1A,
0x63, 0x45, 0xD1, 0x30, 0x81, 0x7F, 0x8E, 0x62,
0x3B, 0xA4, 0xFB, 0x1E, 0x5F, 0xBC, 0xB0, 0x40,
0x8B, 0x74, 0x38, 0x8A, 0xC4, 0x73, 0x9C, 0x09,
0xD4, 0xED, 0xD3, 0x5A, 0x60, 0x48, 0xC5, 0x9E,
0x01, 0xCC, 0x34, 0x1B, 0x58, 0x36, 0x23, 0x88,
0x7A, 0x90, 0x9B, 0x8F, 0xBD, 0x3F, 0xB9, 0x57,
0xA2, 0x3E, 0x04, 0xB2, 0x49, 0x37, 0x5C, 0x7D,
0x61, 0x4A, 0xA6, 0x67, 0xEC, 0x7C, 0x0E, 0x96,
0xDD, 0xE3, 0x2C, 0x56, 0x08, 0x0C, 0x8D, 0x2B,
0x6A, 0xFE, 0xEA, 0xA3, 0xCA, 0x3D, 0x91, 0xE7,
0xC9, 0xAC, 0x03, 0xD5, 0x89, 0x86, 0xDC, 0x10,
0x55, 0x77, 0xC8, 0xD7, 0x97, 0x24, 0x46, 0x9D,
0x0A, 0x1D, 0x22, 0xD9, 0xFF, 0x5B, 0x52, 0xD8,
0x00, 0xFA, 0x53, 0x26, 0x29, 0x2E, 0x2A, 0x11,
0xC0, 0x6F, 0x4F, 0x7B, 0x28, 0x99, 0x41, 0x92,
0xDB, 0xF8, 0x50, 0xA8, 0x51, 0xA5, 0x4B, 0x93,
0x87, 0xDA, 0x06, 0x85, 0x2D, 0xBA, 0x0B, 0x98,
0x70, 0x6B, 0xBE, 0xF1, 0x18, 0xD0, 0x31, 0x68,
0x15, 0x84, 0x64, 0xE1, 0xCE, 0xA7, 0xF5, 0x32,
};

This sbox is published on 4C Entity website, so obviously it is not the secret one:

The following documents are being provided by the 4C Entity as is with no implied warranty, as a tool to help you debug your implementation of the C2 Block Cipher. Note that the Secret Constants provided below will not work with standard CPRM/CPPM implementations.


http://www.4centity.com/docs/facsimile.html

Anyway I tried to do memdumps of WinDVD 7.0 B27.066 while playing CPPM protected DVD A and only interesting constant I was able to find was DEADBEEF which is used for verification of the Media Key with Dv - Verify media key that is at the begining of MKV. But I did not see the actual Dv in the memdump.

[Wilbert]

Anyway I tried to do memdumps of WinDVD 7.0 B27.066 while playing CPPM protected DVD A and only interesting constant I was able to find was DEADBEEF which is used for verification of the Media Key with Dv - Verify media key that is at the begining of MKV.
That's described in table 3-2, ok i see. I can't find that constant in my memory dump. Any idea what i'm doing wrong? Does it matter when you take the dump?

[tjf]

I can't find that constant in my memory dump. Any idea what i'm doing wrong? Does it matter when you take the dump?

Not at all. Actualy I can find 0xDEADBEEF it in memdump taken with fresh WinDVD without any disc. The values around it stay the same if there is a disc or not as well.

[arnezami]

I bought a DVD-Audio disc (man these are rare).

Just to play around a bit... ;)

But when using PowerDVD it first tries to update the CPPM keys and then seems to (always) play the video on the disc (well I get a typical dvd menu so I guess thats the video part of the disc). Its a DVD-video/audio combi disc apparently. I've tried setting the player to choose DVD-audio above video but this doesn't seem to have any effect. And there is no option (I think) to switch between audio/video.

How do I make sure the CPPM protected audio is played?

arnezami

[evdberg]

If you can select the MLP 96/24 5.1 track from the Audio menu, you are pretty sure you are playing the DVD-Audio ...

[arnezami]

Hmmm. I reinstalled the 2911 version and it says this at first startup:

PowerDVD will automatically play DVD-Video content because there is no CPPM key available. Please activate the CPPM key via the Internet.

And then at each startup (for a second):

Waiting to update CPPM key...

And then plays the video.

PowerDVD is activated btw.

Has anybody gotten this to work?

arnezami

PS. These guys (http://forums.afterdawn.com/thread_view.cfm/235076) seemed to have a similar problem.
PPS. WinDVD 8 (not HD) also play sthe DVD-video with ac3. There doesn't seem to be a way to force it to play the DVD-audio.

[tjf]

Try WinDVD Platinum 7.0.27.66. Even in trial mode it plays DVD-A. Google "WinDVD.v.7.0.27.66".

[Wilbert]

Sorry to bump in again :)
Try WinDVD Platinum 7.0.27.66. Even in trial mode it plays DVD-A. Google "WinDVD.v.7.0.27.66".
I'm using 7.0 B27.172. If i select the "i" of Info i see it's playing the mpeg2/ac3 stream. I've enabled "DVD-Audio navigation" in the Preferences tab. I've also enabled "96KHz/24bit decoding" in the Audio tab.

How can i select the MLP stream that evdberg is talking about? I don't see an audio menu. I see something called "Audio center", but i can't see/select any tracks in there.

edit: is it possible that there is no MLP stream on my disc?

[evdberg]

How can i select the MLP stream that evdberg is talking about? I don't see an audio menu.
I mean the menu on the DVD itself. As arnezami says, PowerDVD plays the dvd-video and -audio combined. I have "Queen - Night at the Opera". At start of the disk, you get a menu just like regular DVDs. Now you can enter the Audio selection menu, again just like regular DVDs have. In this menu you see 3 audio options: 2 for dvd-video (PCM and DTS) and 1 or dvd-audio (MLP 96/24 lossless 5.1). This last option only works when I play it in PowerDVD. In all other players (like the Apple DVD player) only the 1st 2 work.

[CZroe]

I backed up the LPCM tracks from my DVD-Audio of The Crystal Method - Legion of Boom album with DVD Decrypter. I never had any idea that there was some special kind of protection for DVD-A, just that PC software wasn't allowed to play it back without downsampling at one time. Is mine not protected like that or something? I just demuxed the streams and ran the output (WAV) through WMEncoder9 to Lossless WMA. Even the album information with bonus tracks + DVD-Audio cover art was avalable through WMP.

[mommyman]

Both keysets (CPPM/CPRM) have already been extracted from software and firmware. A long time ago... So, there is no reason to "just hack" them again:)

[arnezami]

Both keysets (CPPM/CPRM) have already been extracted from software and firmware. A long time ago... So, there is no reason to "just hack" them again:)

Can you give us a link or more info?

[mommyman]

As I know there are no available links today. Do you think that this would be a good idea to make these keys public? By now DVD-Audiio is a dying thing, seems that no one will be interested to incorporate this kind of "support" in software. And DMCA is not the last issue...

[evdberg]

Both keysets (CPPM/CPRM) have already been extracted from software and firmware. A long time ago... So, there is no reason to "just hack" them again:)

Hmmm ... I've been following this kind of stuff for years and the only 'hack' for dvd-audio I have ever seen is the one that uses WinDVD to capture the decoded audio from the soundcard output. And if you can not provide the previous hack, there is no other solution then to hack it again.

[mommyman]

Hmmm ... I've been following this kind of stuff for years and the only 'hack' for dvd-audio I have ever seen is the one that uses WinDVD to capture the decoded audio from the soundcard output. And if you can not provide the previous hack, there is no other solution then to hack it again.

If it is going to happen this way... http://www.sendspace.com/file/atzn56

[HyperHacker]

Not at all. Actualy I can find 0xDEADBEEF it in memdump taken with fresh WinDVD without any disc. The values around it stay the same if there is a disc or not as well.

0xDEADBEEF is commonly used to fill uninitialized memory, so that it stands out when debugging. IOW, you're probably looking at variables that haven't been used yet.

[evdberg]

@mommyman: that's some pretty solid proof ... stange I missed it back then ... thanks for sharing! Looks like this thread can be closed ...

[ron spencer]

it was not a hack/patch per se....you used WinDVD as it was....output was redirected to hard disk (not sound card). the tools were removed:

http://www.cdfreaks.com/news/DVD-Audios-CPPM-can-be-got-around-with-a-WinDVD-patch.html


The programs never got rid of the Verance watermarking (if used), so if you re-burned the content and your player saw the watermarking but no CPRM it would stop.

[Wilbert]

If it is going to happen this way... http://www.sendspace.com/file/atzn56
I tried to compile it, but got dozens of errors. Did someone else succeed?

[ron spencer]

what is it supposed to do this proof??

[evdberg]

I tried to compile it, but got dozens of errors. Did someone else succeed?

Which compiler did you use? From what I saw it looks like Visual C to me. To compile it with another compiler you need at least to change the pragma statements. And I am not sure, but maybe you also need some header files from the Platform SDK or DDK.

[evdberg]

what is it supposed to do this proof??

That CPPM/CPRM was already cracked/hacked in the past and we are wasting our time to try to do it again ...

[jesperl]

I tried to compile it, but got dozens of errors. Did someone else succeed?

I can compile it with Visual C++ 2005 Express and the Microsoft Platform SDK. You need to disable UNICODE support (in compiler options) or change two instances of CreateFile to CreateFileA in dvd_device.c.

I also tried gcc, but the MinGW Platform SDK replacement (w32api, v3.6) is missing some declarations, so it doesn't compile.

[moshmothma]

That CPPM/CPRM was already cracked/hacked in the past and we are wasting our time to try to do it again ...

Yeah, but it would sure be nice not to have to use a hacked version of Windvd to rip content.
And what about the watermark? Anyone thought of doing away with that?

Thanks

[ron spencer]

not all DVD-As have the watermark....few do from what I understand....the spec says if watermark is present then CPRM MUST be there....if your player sees that CPRM is not there it assumes your disc is ripped and stops playing after 30 sec. There is no way to get rid of the watermark...none. Really to stop ripping all you need are the rules I mentioned...and the studios would not need CPRM, ACSS, etc. It would be a hardware protection via audio watermarking - to get around this you would need to open your player up and hack the hardware/firmware. That really would mark the end of copying forever. However if you peruse audio forums the watermark seems to be audible in many instances...wouldn't want to hear that in a silent scene from Lord of the Rings or anything right? Hence it is rarely used. But if it is there you cannot get rid of it.

Again it was NOT a hacked version of WinDVD...those programs were just able to read the encryption keys...they patched nothing really...they just "intercepted" the audio. In any case I am sure that version of WinDVD was revoked long since then anyway. DVD-As from this year likely would not be played with those versions of WinDVD....all the old stuff would.

[Balwyn]

not all DVD-As have the watermark....few do from what I understand....

I have about 20 DVD-A's and about 70% are watermarked.
One however (Gary Moore Blues) isn't watermarked OR encrypted and the digital outputs of my Audigy 2 sound card are still enabled !

I ripped The Coors in Blue disk to wav files using the WinDVD and dvdaripper, then reauthored a new disk with Diskwelder. PPCMripper confirmed the presence of watermarks in each track. Sure enough, the player stops between 14 and 30 secs after each track begins.

Those with DSP experience should gain insight into a Edward Felten's successful Verance Watermark removals by looking here : http://www.usenix.org/events/sec01/craver.pdf

[tjf]

Why is watermark a problem? Once you rip the audio into uncompressed format, you can play it in any player that does not check the presence of watermark (Foobar, iPOD, ...). It is a problem only if you want to burn it to DVD-A disc and play with the DVD-A player, but why would you want to do that if you have the original disc?

[ron spencer]

even with that paper on watermarl removing there is no tool to do so.

yep they will play on pc


you can also author the audio into the DVD-Video zone with nice menus, etc....that will work perfectly as well. Since in DVD-Video zone DVD-A players will not care about watermark

[lightshadow]

you can also author the audio into the DVD-Video zone with nice menus, etc....that will work perfectly as well. Since in DVD-Video zone DVD-A players will not care about watermark
I agree.

Watermarking is a fair protection, that let's you backup your purchased media. Some are blaming Apple for storing personal info in their DRM free downloaded music, but only people with intention to illegally share the music are harmed by this.

I'll say watermarks OK, DRM not.

So if you ask me, don't waist your life and time on this, focus on DRM instead. =)

I store all my music in FLAC (http://en.wikipedia.org/wiki/Free_Lossless_Audio_Codec), and I have never looked back, and I think you would find that it would satisfy your needs too.

[ron spencer]

I disagree about watermarking....there is enough evidence (see hydrogen audio) to show that if not done properly the watermarking will degrade the audio...this may not be a great consquence for a movie, but for music this is not good.

DRM in general is falling away slowly in the music milieu....lots of legal drm free music now

[lightshadow]

I disagree about watermarking....there is enough evidence (see hydrogen audio) to show that if not done properly the watermarking will degrade the audio...this may not be a great consquence for a movie, but for music this is not good.

Removing the watermark decreases the quality even further.