Finally handling BD+ (?)

[Accident]

I took a glance at their implementation of RunNative, and most of which we already know.


uint32_t trap_RunNative(uint8_t *signature, uint32_t sigLen, uint8_t *code,
uint32_t codeLen)


Test of "signature" and "code" follow the regular "valid_ptr" tests, segLen should be 0x28 in length. codeLen fails if < 1. It then calls SHA on "code" (?) followed by ecdsa_verify, if that is ok it finally calls RunNative. What is peculiar is that there is a code-path that skips SHA and ecdsa_verify calls and directly calls RunNative.

RunNative itself is fairly boring, calls mkstemp("/tmp/run_native.XXXXXX"); write( , code, codeLen); chmod 0700; fork; execv / waitpid. The exit-code of the child process is eventually returned. RunNative itself blocks until script completes, although technically, scripts could easily put themselves in the background if so wanted. Scripts are run as player user, in this case root.

[Kraise]

Wow, I think that would work

[loo3aem3ON]

The Handshake between BD-J and BD+ involves AES but i haven't studied this in detail yet.

I found a stack trace:
at sun.security.util.DerValue.init(Unknown Source)
at sun.security.util.DerValue.<init>(Unknown Source)
at com.cl.bdj.jar.BDJSecurityUtil.getPermRootCertDigest(Unknown Source)
at com.cl.bdj.appmanager.BDJAppProxy.loadResources(Unknown Source)
at com.cl.bdj.appmanager.BDJAppProxy.startBDJApp(Unknown Source)
at com.cl.bdj.appmanager.BDJAppManager.runAutoStartApps(Unknown Source)
at com.cl.bdj.appmanager.BDJAppManager.startTitle(Unknown Source)
at com.cl.bdj.appmanager.BDJAppManager.initTitle(Unknown Source)
at com.cl.bdj.main.BDJCFacade.initTitle(Unknown Source)
According to this execution starts in the com.cl.bdj.main.BDJCFacade class which then calls the application manager which then starts the BD-J Application Proxy which finally starts the application (which is marked as "Autostart").

All the code is inside the BDJ.jar you can download here (http://uploaded.to/?id=51tw3r)

[loo3aem3ON]

It's my current understanding that the BD-J implementation consists of at least 3 major parts:

1. BD-J core implemented in java (vendor specific)
2. BD-J player interface (vendor specific) implemented in native code
3. common libraries implemented in java: javatv, GEM/MHP, ... (overview (http://java.sun.com/developer/technicalArticles/javame/bluray/#3))

If we use all the jar packages from one vendor we would only have to implement the native interface. The interface is probably vendor specific too.

The source code of the virtual machine interpreter (Personal Basis Profile of the Connected Device Configuration) is available from the phoneme (https://phoneme.dev.java.net/downloads_page.html#advanced) download page.

The undefined opcodes (eg. 0xDA) i saw during execution are generated by the interpreter during runtime. In other words the java bytecode is transformed during execution which is really confusing.

[OwenRW]

If anyone finds a description for some of the remaining unknown registers please post it here.

According to these...
http://www.wipo.int/pctdb/en/wo.jsp?wo=2006078111&IA=WO2006078111&DISPLAY=DESC
http://www.wipo.int/pctdb/en/wo.jsp?IA=KR2006003273&wo=2007024075&DISPLAY=DESC
http://www.freepatentsonline.com/y2007/0092223.html

Here are a couple more PSRs:

PSR30 Player Capability for Text Subtitle
PSR31 Player Version information
PSR32 Network Configuration
PSR33 Local Storage Size
PSR34 Streaming Media Capability

Hope that's useful for completing the list, if nothing else.

[loo3aem3ON]

Hope that's useful for completing the list, if nothing else.
Thank you. I've updated the description. :thanks:

[loo3aem3ON]

That's a build snapshot of the upcoming BD-J implementation: http://uploaded.to/?id=14h79o

The current debug log: [BDRootScene.getRootScene()] BDRootScene.notifyDirty
[HGraphicsHelper.init()] m_image.getWidth 1920
[HGraphicsHelper.init()] m_image.getHeight 1080
[HGraphicsHelper.init()] m_image.type 1
JMFProperties: readProperties
[AppsDatabaseHelper.getInitHAVIResolution()] [ERROR!]unknown initial HAVI config id, set as 1920x1080
[BDRootScene.getRootScene()] BDJPluginImp.toolkitSync
[BDRootScene.getRootScene()] BDRootScene.notifyDirty
[BDRootScene.getRootScene()] BDJPluginImp.toolkitSync
[BDJCFacade.executeCommand()] Start init Title
java.lang.NoSuchMethodException: java.util.jar.JarFile.extractJar(java.security.cert.X509Certificate, java.lang.String, [Z)
at java.lang.Class.getDeclaredMethod(Class.java:1937)
at com.cl.bdj.jar.JarAuthenication.initialReflections(Unknown Source)
at com.cl.bdj.jar.JarAuthenication.<clinit>(Unknown Source)
at com.cl.bdj.appmanager.BDJAppManager.checkRootCerts(Unknown Source)
at com.cl.bdj.appmanager.BDJAppManager.initTitle(Unknown Source)
at com.cl.bdj.main.BDJCFacade.initTitle(Unknown Source)
at com.cl.bdj.main.BDJCFacade.executeCommand(Unknown Source)
[BDJPlaneControlHelper.setScreenKeepResolution()] KeepResolution(false)
[BDJCFacade.executeCommand()] End init Title

Edit: error fixes. updated console output. It creates a graphic window on my screen now.

Edit: further bugfixes. Initialization succeeds. Problems after "init title" command (loading the application jar files from the disc).

Edit: updated debug log; new build snapshot

[loo3aem3ON]

The reference debug log from the player is:created one file output stream : javaLog.txt


ä¸*æ–‡Log started: Fri Jan 30 11:22:50 GMT-08:00 2009
[BDRootScene.getRootScene()] BDRootScene.notifyDirty
[HGraphicsHelper.init()] m_image.getWidth 1920
[HGraphicsHelper.init()] m_image.getHeight 1080
[HGraphicsHelper.init()] m_image.type 2
JMFProperties: readProperties
[AppsDatabaseHelper.getInitHAVIResolution()] [ERROR!]unknown initial HAVI config id, set as 1920x1080
[BDRootScene.getRootScene()] BDJPluginImp.toolkitSync
[BDRootScene.getRootScene()] BDRootScene.notifyDirty
[BDRootScene.getRootScene()] BDJPluginImp.toolkitSync
[BDRootScene.checkGraphicsPlaneSize()] [ERROR!][resolution] screen size unknown
[BDJCFacade.executeCommand()] Start init Title
[BDJPlaneControlHelper.setScreenKeepResolution()] KeepResolution(false)
[BDJPlaneControlHelper.setScreenKeepResolution()] KeepResolution(false)
[BDJPrimitiveCommand.doLoadXlet()] load BD-J app : com.macrovision.bdplus.Handshake
[BDJCFacade.executeCommand()] End init Title
[BDJPrimitiveCommand.doLoadXlet()] load BD-J app ended : com.macrovision.bdplus.Handshake
[BDJPrimitiveCommand.doInitXlet()] init BD-J app : com.macrovision.bdplus.Handshake
[BDJPrimitiveCommand.doInitXlet()] init BD-J app ended: com.macrovision.bdplus.Handshake
[BDJPrimitiveCommand.doStartXlet()] start BD-J app : com.macrovision.bdplus.Handshake
[BDJPrimitiveCommand.doStartXlet()] start BD-J app ended: com.macrovision.bdplus.Handshake
[BDJPrimitiveCommand.doLoadXlet()] load BD-J app : com.bydeluxe.fox.FirstPlayXlet
[BDJPrimitiveCommand.doLoadXlet()] load BD-J app ended : com.bydeluxe.fox.FirstPlayXlet
[BDJPrimitiveCommand.doInitXlet()] init BD-J app : com.bydeluxe.fox.FirstPlayXlet
[BDJPrimitiveCommand.doInitXlet()] init BD-J app ended: com.bydeluxe.fox.FirstPlayXlet
[BDJPrimitiveCommand.doStartXlet()] start BD-J app : com.bydeluxe.fox.FirstPlayXlet
com.cl.bdj.appmanager.BDJThreadGroup[name=BDJThreadGroup-com.macrovision.bdplus.Handshake,maxpri=5]
[RegisterAccess.setGPR()] setGPR(1009)=0
[RegisterAccess.setGPR()] setGPR(1008)=0
[RegisterAccess.setGPR()] setGPR(1007)=0
[RegisterAccess.setGPR()] setGPR(1006)=0
[RegisterAccess.setGPR()] setGPR(1005)=0
[RegisterAccess.setGPR()] setGPR(1004)=0
[RegisterAccess.setGPR()] setGPR(1003)=0
[RegisterAccess.setGPR()] setGPR(1002)=0
[RegisterAccess.setGPR()] setGPR(1001)=0
[RegisterAccess.setGPR()] setGPR(1000)=0
[RegisterAccess.setGPR()] setGPR(1030)=0
[RegisterAccess.setGPR()] setGPR(1029)=0
[RegisterAccess.setGPR()] setGPR(1028)=0
[RegisterAccess.setGPR()] setGPR(1027)=0
[RegisterAccess.setGPR()] setGPR(1026)=0
[RegisterAccess.setGPR()] setGPR(1025)=0
[RegisterAccess.setGPR()] setGPR(1024)=0
[RegisterAccess.setGPR()] setGPR(1023)=0
[RegisterAccess.setGPR()] setGPR(1022)=0
[RegisterAccess.setGPR()] setGPR(1021)=0
[RegisterAccess.setGPR()] setGPR(1020)=0
[RegisterAccess.setGPR()] setGPR(1019)=0
[RegisterAccess.setGPR()] setGPR(1018)=0
[RegisterAccess.setGPR()] setGPR(1017)=0
[RegisterAccess.setGPR()] setGPR(1016)=0
[RegisterAccess.setGPR()] setGPR(1015)=0
[RegisterAccess.setGPR()] setGPR(1014)=0
[RegisterAccess.setGPR()] setGPR(1013)=0
[RegisterAccess.setGPR()] setGPR(1012)=0
[RegisterAccess.setGPR()] setGPR(1011)=0
[RegisterAccess.setGPR()] setGPR(1010)=0
[RegisterAccess.getPSR()] getPSR(20)=2
[RegisterAccess.getPSR()] getPSR(13)=255
[RegisterAccess.getPSR()] getPSR(31)=197120
[BDJSelectTitleEvent.callEvent()] [Begin] select title: 2
[BDJEventTicket.waitForEventStart()] [Start] process event com.cl.bdj.event.BDJEventTicket@478783
[BDJAppProxy.destroyBDJApp()] destroyBDJApp -- the app is not loaded
[BDJPrimitiveCommand.doStartXlet()] start BD-J app ended: com.bydeluxe.fox.FirstPlayXlet
[BDJPrimitiveCommand.doDestroyXlet()] destroy BD-J app : com.bydeluxe.fox.FirstPlayXlet
[BDJPrimitiveCommand.doDestroyXlet()] destroy BD-J app ended: com.bydeluxe.fox.FirstPlayXlet
[BDJCommandRunner.forceExit()] the runner: BDJCommandRunner:Name<PaintRunner>,Owner<com.cl.bdj.appmanager.MainXletContext@52bc4e( BDJAppProxy (2147443820, 16384, com.bydeluxe.fox.FirstPlayXlet) )> was not stopped
com.cl.bdj.appmanager.BDJThreadGroup[name=BDJThreadGroup-com.bydeluxe.fox.FirstPlayXlet,maxpri=5]
Thread[AWTEventQueueThread-com.bydeluxe.fox.FirstPlayXlet,5,BDJThreadGroup-com.bydeluxe.fox.FirstPlayXlet]
Thread[BDJPaintRunnerThread-com.bydeluxe.fox.FirstPlayXlet,5,BDJThreadGroup-com.bydeluxe.fox.FirstPlayXlet]
[BDJCFacade.executeCommand()] Start init Title
[BDJAppProxy.destroyBDJApp()] destroyBDJApp -- the app is not loaded
[AppsDatabase.getAppProxy()] Input AppID:(1)getOID()=2147443820,(2)getAID()=30583
[BDJAppProxy.sendStateChangeEvent()] App-orgID: 2147443820, App-appID: 30583 => getAppProxy(appID) returns null
[BDJPlaneControlHelper.setScreenKeepResolution()] KeepResolution(false)
[BDJPlaneControlHelper.setScreenKeepResolution()] KeepResolution(false)
[BDJCFacade.executeCommand()] End init Title
[BDJPrimitiveCommand.doLoadXlet()] load BD-J app : com.bydeluxe.fox.BDLiveReadyXlet
[BDJPrimitiveCommand.doLoadXlet()] load BD-J app ended : com.bydeluxe.fox.BDLiveReadyXlet
[BDJPrimitiveCommand.doInitXlet()] init BD-J app : com.bydeluxe.fox.BDLiveReadyXlet
[BDJSelectTitleEvent.callEvent()] [End] select title: 2
[BDJPrimitiveCommand.doInitXlet()] init BD-J app ended: com.bydeluxe.fox.BDLiveReadyXlet
[BDJPrimitiveCommand.doStartXlet()] start BD-J app : com.bydeluxe.fox.BDLiveReadyXlet
[BDJPrimitiveCommand.doStartXlet()] start BD-J app ended: com.bydeluxe.fox.BDLiveReadyXlet
[DiscFontManager.getFontIndexData()] fontindexDataBuffer is null
[HScene.reloadDefaultFont()] SetDefaultFont: style(0) Size(26)
Creating buffer: 1920 x 1080
, 8294400 bytes
1 images. 8294400bytes
https://0000-0000-1D6F-0000-5-0000-0003-G.foxbd-live.com/BDLiveServices/Service.asmx/BootLoader
VolumeID: 6C2C3851-D4BF-39AC-E53B-8EA78E866E45
[RegisterAccess.getPSR()] getPSR(18)=6647399
class java.lang.SecurityException Doesn't contain valid SocketPermission
java.lang.SecurityException: Doesn't contain valid SocketPermission
at com.cl.bdj.jar.BDJSecurityManager.checkPermissionImp(Unknown Source)
at com.cl.bdj.jar.BDJSecurityManager.access$000(Compiled Method)(Unknown Source)
at com.cl.bdj.jar.BDJSecurityManager$1.run(Unknown Source)
at java.security.AccessController.doPrivileged(Unknown Source)
at com.cl.bdj.jar.BDJSecurityManager.checkPermission(Unknown Source)
at java.lang.SecurityManager.checkConnect(Unknown Source)
at java.net.InetAddress.getAllByName0(Unknown Source)
at java.net.InetAddress.getAllByName0(Unknown Source)
at java.net.InetAddress.getAllByName(Unknown Source)
at java.net.InetAddress.getByName(Unknown Source)
at sun.net.www.protocol.https.HttpsClient.<init>(Unknown Source)
at sun.net.www.protocol.https.HttpsClient.a(Unknown Source)
at sun.net.www.protocol.https.HttpsClient.a(Unknown Source)
at sun.net.www.protocol.https.HttpsClient.a(Unknown Source)
at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.plainConnect(Unknown Source)
at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(Unknown Source)
at sun.net.www.protocol.http.HttpURLConnection.getInputStream(Unknown Source)
at sun.net.www.protocol.http.HttpURLConnection.getHeaderFieldKey(Unknown Source)
at sun.net.www.protocol.https.HttpsURLConnectionImpl.getHeaderFieldKey(Unknown Source)
at ae.a(Unknown Source)
at w.k(Unknown Source)
at w.run(Unknown Source)
at java.lang.Thread.startup(Unknown Source)
java.lang.SecurityException: Doesn't contain valid SocketPermission
at com.cl.bdj.jar.BDJSecurityManager.checkPermissionImp(Unknown Source)
at com.cl.bdj.jar.BDJSecurityManager.access$000(Compiled Method)(Unknown Source)
at com.cl.bdj.jar.BDJSecurityManager$1.run(Unknown Source)
at java.security.AccessController.doPrivileged(Unknown Source)
at com.cl.bdj.jar.BDJSecurityManager.checkPermission(Unknown Source)
at java.lang.SecurityManager.checkConnect(Unknown Source)
at java.net.InetAddress.getAllByName0(Unknown Source)
at java.net.InetAddress.getAllByName0(Unknown Source)
at java.net.InetAddress.getAllByName(Unknown Source)
at java.net.InetAddress.getByName(Unknown Source)
at sun.net.www.protocol.https.HttpsClient.<init>(Unknown Source)
at sun.net.www.protocol.https.HttpsClient.a(Unknown Source)
at sun.net.www.protocol.https.HttpsClient.a(Unknown Source)
at sun.net.www.protocol.https.HttpsClient.a(Unknown Source)
at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.plainConnect(Unknown Source)
at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(Unknown Source)
at sun.net.www.protocol.http.HttpURLConnection.getInputStream(Unknown Source)
at sun.net.www.protocol.http.HttpURLConnection.getHeaderFieldKey(Unknown Source)
at sun.net.www.protocol.https.HttpsURLConnectionImpl.getHeaderFieldKey(Unknown Source)
at ae.a(Unknown Source)
at w.k(Unknown Source)
at w.run(Unknown Source)
at java.lang.Thread.startup(Unknown Source)
Continue Normal Disc Execution
Removing 8294400 bytes.
0 images. 0bytes
4
[BDJEventTicket.waitForEventStart()] [Start] process event com.cl.bdj.event.BDJEventTicket@22a11b
[BDJSelectTitleEvent.callEvent()] [Begin] select title: 4
[BDJPrimitiveCommand.doDestroyXlet()] destroy BD-J app : com.bydeluxe.fox.BDLiveReadyXlet
[BDJPrimitiveCommand.doDestroyXlet()] destroy BD-J app ended: com.bydeluxe.fox.BDLiveReadyXlet
com.cl.bdj.appmanager.BDJThreadGroup[name=BDJThreadGroup-com.bydeluxe.fox.BDLiveReadyXlet,maxpri=5]
[BDJCFacade.executeCommand()] Start init Title
[BDJPlaneControlHelper.setScreenKeepResolution()] KeepResolution(false)
[BDJPlaneControlHelper.setScreenKeepResolution()] KeepResolution(false)
[BDJCFacade.executeCommand()] End init Title
[BDJPrimitiveCommand.doLoadXlet()] load BD-J app : com.bydeluxe.fox.OpeningSequenceXlet
[BDJSelectTitleEvent.callEvent()] [End] select title: 4
[BDJPrimitiveCommand.doLoadXlet()] load BD-J app ended : com.bydeluxe.fox.OpeningSequenceXlet
[BDJPrimitiveCommand.doInitXlet()] init BD-J app : com.bydeluxe.fox.OpeningSequenceXlet
[RegisterAccess.getPSR()] getPSR(18)=6647399
[RegisterAccess.getPSR()] getPSR(20)=2
[BDJPrimitiveCommand.doInitXlet()] init BD-J app ended: com.bydeluxe.fox.OpeningSequenceXlet
[BDJPrimitiveCommand.doStartXlet()] start BD-J app : com.bydeluxe.fox.OpeningSequenceXlet
Reading /VFS//BDMV/JAR/99801/opening.properties
[RegisterAccess.getPSR()] getPSR(16)=6647399
getPlaylistId interpol.eng.eng.B = null
getPlaylistId interpol.eng = -1
[RegisterAccess.getPSR()] getPSR(17)=6647399
getPlaylistId disclaimer.eng.eng.B = null
getPlaylistId disclaimer.eng = -1
getPlaylistId mpaa.eng.B = null
getPlaylistId mpaa = -1
getPlaylistId playlist1.eng.B = null
getPlaylistId playlist1 = 5
[RegisterAccess.getPSR()] getPSR(1)=1
[RegisterAccess.getPSR()] getPSR(2)=268374015
[BDJPrimitiveCommand.doStartXlet()] start BD-J app ended: com.bydeluxe.fox.OpeningSequenceXlet
[BDJCFacade.executeCommand()] ====== start do suspend ======
[BDJCFacade.executeCommand()] ====== end do suspend ======
[BDJPrimitiveCommand.doDestroyXlet()] destroy BD-J app : com.bydeluxe.fox.OpeningSequenceXlet
[BDJPlaneControlHelper.getAWTVideoSize()] [ERROR!]getPlaneControl return null
java.lang.Exception
at com.cl.bdj.helper.BDJPlaneControlHelper.getAWTVideoSize(Unknown Source)
at com.cl.bdj.media.control.AWTVideoSizeControlImpl.getSize(Unknown Source)
at com.cl.bdj.media.control.BDJPlaylistAWTVideoSizeControl.getSize(Unknown Source)
at com.cl.bdj.media.BDJPlayListPlayer.hookStop(Unknown Source)
at com.cl.bdj.media.BDJJMFPlayerImpl.stop(Unknown Source)
at c.j(Unknown Source)
at c.a(Unknown Source)
at com.bydeluxe.fox.OpeningSequenceXlet.destroyXlet(Unknown Source)
at com.cl.bdj.appmanager.BDJPrimitiveCommand.doDestroyXlet(Unknown Source)
at com.cl.bdj.appmanager.DestroyXletCommand.execute(Unknown Source)
at com.cl.bdj.event.BDJCommandRunner.run(Unknown Source)
at java.lang.Thread.run(Unknown Source)
at java.lang.Thread.startup(Unknown Source)
[BDJPrimitiveCommand.doDestroyXlet()] destroy BD-J app ended: com.bydeluxe.fox.OpeningSequenceXlet
[BDJCommandRunner.forceExit()] the runner: BDJCommandRunner:Name<AppRunner>,Owner<XletRunnerContext<null>> was not stopped
com.cl.bdj.appmanager.BDJThreadGroup[name=BDJThreadGroup-com.bydeluxe.fox.OpeningSequenceXlet,maxpri=5]
[BDJCFacade.exitAll()] end exitAll(), clear Image Cache
[BDJCFacade.exitAll()] Clear Image Cache
[BDJCFacade.clearImageCache()] Finish clear image cache
[BDJCFacade.flushAllImageData()] Finish flush image psd
CBDJMediaProcessor has been stopped or finalized!
CBDJMediaProcessor has been stopped or finalized!
CBDJMediaProcessor has been stopped or finalized!

[loo3aem3ON]

I've uploaded a new binary snapshot (see posting #657 (https://forum.doom9.org/showpost.php?p=1244334&postcount=657)). The developers should try to get it running so we can quickly proceed when it executes the 77770.jar (BD+ handshake). I expect this to happen in the next view days.

To execute: (example)
export LD_LIBRARY_PATH=${HOME}/bdj/jdk1.6.0_11/jre/lib/i386/:${HOME}/bdj/jdk1.6.0_11/jre/lib/i386/server
./bdj /absolute_path/jni/libbdjinterface.so
Look for a logfile: ${HOME}/javaLog.txt

to compile the bdj.c: (example; optional)
gcc -m32 -L/${HOME}/bdj/jdk1.6.0_11/jre/lib/i386/server -ljvm -I/${HOME}/bdj/jdk1.6.0_11/include/ -o bdj bdj.c

to compile the interface (jni): (optional)
cd jni
make

[KenD00]

I am very low on free time currently so i couldn't test this one earlier. After adjusting the paths to fit my installation and installing libqt3-mt i still can't get it running. The problem is the following

Exception in thread "main" [W] java.lang.UnsatisfiedLinkError: no qtawt in java.library.path

I can't convince java to find that damn shared library. I tried moving it around, added a java.library.path definition to the vmargs inside bdj.c but it still won't find that damn library :confused:. In the beginning i had that problem with DumpHD too but it was fixed adjusting java.library.path but this doesn't help right now. I will experiment around a little more but maybe someone else had the same problem and knows a solution.

:rolleyes:

[loo3aem3ON]

Exception in thread "main" [W] java.lang.UnsatisfiedLinkError: no qtawt in java.library.path

I can't convince java to find that damn shared library. I tried moving it around, added a java.library.path definition to the vmargs inside bdj.c but it still won't find that damn library :confused:.
Maybe your libqt3-mt.so.3 is not 32bit or some other dependencies of libqtawt.so are not met. I had to install the 32bit version of libqt3-mt.so.3 manually because i work on an amd64 system. From my notes:
http://www.boundlesssupremacy.com/Cappy/getlibs/getlibs-all.deb
getlibs -w http://ftp.de.debian.org/debian/pool/main/q/qt-x11-free/libqt3-mt_3.3.8b-5+b1_i386.deb
I can't compile the libqtawt.so (closed source?) and only the 32-bit version is available.

Anyway i recently switched from Java SE to ME and compiled the compact virtual machine (cvm) with debug flag so it's pretty verbose if something goes wrong. You can grab my binary snapshot from here (http://uploaded.to/?id=a91uz7). Run it with (adjust the paths):
./bin/cvm ${HOME}/bdplus/trunk/bdj/jni/libbdjinterface.so
The snapshot contains a standalone Java (microedition) installation so it shouldn't use any foreign jar files or stuff from other java installations. My player uses the cvm too and it's part of the BD-J standard.

If you want to compile it you will need the phoneme advanced mr2 snapshot. I had to merge the bdj.c with the phoneme source before compiling the cvm. Let me know if you need to know more details.

[KenD00]

I'm running this on a 32 bit Ubuntu, ldd reports no missing libs. I've written a small java app which just loads the qtawt library and this works, don't know why it doesn't work from bdj.

Anyway, i've tried your cvm snapshot and had more success, qtawt is now loaded and i get a black window. During startup i got this error

"/home/<scrubbed>/bdj-cvm/lib/basis.jar" is not a valid classpath zip file or directory.

which i fixed by renaming basis_security.jar.

The cvm runs but fails to load any BD-J applet from the disc. The path to my drive matches the hardcoded path so this isn't the problem. I can't remember you ever mentioned which disc you are using, i assume we are talking about X-Files here because your posted 77770.jar matches almost the one from my disc (but there are differences, i think because i don't have your version of the movie and i remember Anydvd was updated to support a different version of X-Files), but i don't have 99900.jar (and no directory with that name) on my disc.

These are the error messages from loading the 99900.jar file, loading the 77770.jar produces the same ones:

[W] [BDJAppManager.startTitle()] startTitle(65535)
[W]

[W] [BDJAppManager.setTitleSelectState()] set current title context state: 3, previos state: 1
[W]

called Java.com.cl.bdj.helper.AppsDatabaseHelper.pGetAppControlCode
[W] java.util.zip.ZipException: No such file or directory
[W]

[W] at java.util.zip.ZipFile.open(Ljava/lang/String;IJ)J(Native Method)
[W]

[W] at java.util.zip.ZipFile.<init>(Ljava/io/File;I)V(ZipFile.java:146)
[W]

[W] at java.util.jar.JarFile.<init>(Ljava/io/File;ZI)V(JarFile.java:138)
[W]

[W] at java.util.jar.JarFile.<init>(Ljava/lang/String;Z)V(JarFile.java:90)
[W]

[W] at com.cl.bdj.jar.JarAuthenication.extractJar(Ljava/lang/String;Ljava/lang/String;Z)V(Unknown Source)
[W]

[W] at com.cl.bdj.appmanager.BDJAppProxy.securityCheckProcess(Ljava/lang/String;Ljava/lang/String;)V(Unknown Source)
[W]

[W] at com.cl.bdj.appmanager.BDJAppProxy.loadResources()V(Unknown Source)
[W]

[W] at com.cl.bdj.appmanager.BDJAppProxy.startBDJApp([Ljava/lang/String;)V(Unknown Source)
[W]

[W] at com.cl.bdj.appmanager.BDJAppManager.runAutoStartApps()V(Unknown Source)
[W]

[W] at com.cl.bdj.appmanager.BDJAppManager.startTitle(I)V(Unknown Source)
[W]

[W] at com.cl.bdj.appmanager.BDJAppManager.initTitle(Z)V(Unknown Source)
[W]

[W] at com.cl.bdj.main.BDJCFacade.initTitle(I)V(Unknown Source)
[W]

[W] at com.cl.bdj.main.BDJCFacade.executeCommand(I[Ljava/lang/Object;)I(Unknown Source)
[W]

[W] [BDJAppProxy.loadResources()] Start printing class path for application:OID(2147443820), AID(16384)
[W]

[W] [BDJAppProxy.loadResources()] ClassPath<0>:file:///DOCR/signed/99900/
[W]

called Java.com.cl.bdj.helper.AppsDatabaseHelper.pGetAppBaseDirectory -> OrgID = 7FFF646C, AppID = 4000
called Java.com.cl.bdj.helper.AppsDatabaseHelper.pGetAppClasspathExt -> OrgID = 7FFF646C, AppID = 4000
[W] [BDJAppUtil.getAppClasspath()] /DOCR/signed/
[W]

[W] [BDJAppUtil.getAppClasspath()] 99900
[W]

[W] [BDJAppUtil.getAppClasspath()]
[W]

[W] [BDJPrimitiveCommand.doLoadXlet()] load BD-J app : com.bydeluxe.fox.FirstPlayXlet
[W]

called com.cl.bdj.helper.BDJTitleInfoHelper.pGetCurrentDiscIdFromC
called Java.com.cl.bdj.helper.CUtil.pSetJITOffSwitch -> NOT IMPLEMENTED!
[W] [BDJClassLoader.findClass()] Can't find class:com.bydeluxe.fox.FirstPlayXlet, start printing class path ...
[W]

[W] [BDJClassLoader.findClass()] ClassPath<0>:file:/DOCR/signed/99900/
[W]

[W] [BDJAppUtil.createXletInstance()] [ERROR!]in createXletInstance(), caught exception ClassNotFoundException
[W]

[W] java.lang.ClassNotFoundException: com.bydeluxe.fox.FirstPlayXlet
[W]

[W] at java.net.URLClassLoader.findClass(Ljava/lang/String;)Ljava/lang/Class;(URLClassLoader.java:234)
[W]

[W] at com.cl.bdj.appmanager.BDJClassLoader.findClass(Ljava/lang/String;)Ljava/lang/Class;(Unknown Source)
[W]

[W] at java.lang.ClassLoader.loadClass(Ljava/lang/String;Z)Ljava/lang/Class;(ClassLoader.java:349)
[W]

[W] at java.lang.ClassLoader.loadClass(Ljava/lang/String;)Ljava/lang/Class;(ClassLoader.java:291)
[W]

[W] at com.cl.bdj.appmanager.BDJAppUtil.createXletInstance(Ljava/lang/ClassLoader;Ljava/lang/String;)Ljava/lang/Object;(Unknown Source)
[W]

[W] at com.cl.bdj.appmanager.BDJPrimitiveCommand.doLoadXlet(Lcom/cl/bdj/appmanager/XletRunnerContext;)Z(Unknown Source)
[W]

[W] at com.cl.bdj.appmanager.StartXletCommand.execute()V(Unknown Source)
[W]

[W] at com.cl.bdj.event.BDJCommandRunner.run()V(Unknown Source)
[W]

[W] at java.lang.Thread.run()V(Thread.java:712)
[W]

[W] at java.lang.Thread.startup(Z)V(Thread.java:782)
[W]

[W] [BDJPrimitiveCommand.doLoadXlet()] load BD-J app ended : com.bydeluxe.fox.FirstPlayXlet
[W]

[W] [BDJAppProxy.stateTransition()] state change failed : BDJAppProxy (2147443820, 16384, com.bydeluxe.fox.FirstPlayXlet), 2 -> 0
[W]

[loo3aem3ON]

The cvm runs but fails to load any BD-J applet from the disc.
It doesn't load the jar files from the disc. Instead you have to copy them to "/tmp/BDJRoot/" (both the 77770.jar and 99900.jar). That directory is the local application cache which can change over time when using BD-Live. It will extract a part of the jar archives inside the "DOCR/signed/" subdirectory. I don't fully understand this yet.

I can't remember you ever mentioned which disc you are using, i assume we are talking about X-Files here because your posted 77770.jar matches almost the one from my disc (but there are differences, i think because i don't have your version of the movie and i remember Anydvd was updated to support a different version of X-Files), but i don't have 99900.jar (and no directory with that name) on my disc.
It's "The Day The Earth Stood Still" and you can download the content of the JAR directory from posting #645 (https://forum.doom9.org/showpost.php?p=1241632&postcount=645).

These are the error messages from loading the 99900.jar file, loading the 77770.jar produces the same ones:
I'm glad to see you made it this far. You should get a bit further with both jar files in the /tmp/BDJRoot/ directory but there will be null pointer exception (certificate == null?) soon afterwards.

A good way to proceed is to edit the com.cl.bdj.helper.* classes (inside the bdj.jar) to make them print out a console message of the actual value/string they got from the native methods they called. For example:
invokestatic com/cl/bdj/util/BDJTrace/info(Ljava/lang/String;)V
will print the string you pass as parameter plus the class and method name from which it is called.
The additional debug output i get when using the modified bdj.jar helps me to correct the bugs in the native interface. My source code C files are named after the helper classes as you might have noticed.

[loo3aem3ON]

The classes in the "btclasses.zip" archive have been merged into the cvm binary (ROMization) to boost performance. That causes some problems because some of these classes have been customized by the vendor of my player. For example a "extractJar" method has been added to the java.util.jar.JarFile which is therefor missing in the cvm i compiled. I have several options in this case and will try them all.
I also managed to patch all methods which call native code and return boolean, int or string. I also succeeded in attaching a debugger (jdb) to the cvm to monitor the BD-J implementation. It's quite complex.

Progress is slow because i'm working alone on this. So be patient.

[loo3aem3ON]

I finally got the BD+ handshake application loaded and running:
[BDJPrimitiveCommand.doLoadXlet()] load BD-J app : com.macrovision.bdplus.Handshake
[...]
[BDJPrimitiveCommand.doLoadXlet()] load BD-J app ended : com.macrovision.bdplus.Handshake
[BDJPrimitiveCommand.doInitXlet()] init BD-J app : com.macrovision.bdplus.Handshake
[BDJPrimitiveCommand.doInitXlet()] init BD-J app ended: com.macrovision.bdplus.Handshake
[BDJPrimitiveCommand.doStartXlet()] start BD-J app : com.macrovision.bdplus.Handshake
[...]
[BDJPrimitiveCommand.doStartXlet()] start BD-J app ended: com.macrovision.bdplus.Handshake
[BDJAppProxy.stateTransition()] state change succeeded : BDJAppProxy (2147443820, 30583, com.macrovision.bdplus.Handshake), 2 -> 0
[...]
called Java.com.cl.bdj.helper.BDJVFSHelper.RegisterAccessHelper.pSetPSR(104, 0) -> NOT IMPLEMENTED!
called Java.com.cl.bdj.helper.BDJVFSHelper.RegisterAccessHelper.pSetPSR(103, F1000000) -> NOT IMPLEMENTED!
called Java.com.cl.bdj.helper.BDJVFSHelper.RegisterAccessHelper.pTriggerPSR103change -> NOT IMPLEMENTED!
The application (com.macrovision.bdplus.Handshake) sets PSR103 to 0xF1000000 and PSR104 to 0 as expected (see first lines of posting #642 (https://forum.doom9.org/showpost.php?p=1241353&postcount=642)). The following call "pTriggerPSR103change" probably places a trigger on PSR103 so the thread resumes once the content code is done with its changes. I don't know the exact mechanism yet.

You can download the binary snapshot here (http://uploaded.to/?id=q83orr).

Steps to reproduce:
1. mount the disc at "/media/cdrom/" (certificate will be verified)
1. place the 77770.jar and the 99900.jar in the directory "/tmp/BDJRoot/" (see posting #645 (https://forum.doom9.org/showpost.php?p=1241632&postcount=645))
2. create a directory "/DOCR/" (root directory -> i couldn't move it into the "/tmp/" folder)
3. make sure both directories have user write permission (stuff will be written into both directories by the java code)
4. run: "./bin/cvm ${HOME}/bdplus/trunk/bdj/jni/libbdjinterface.so" <-- adapt to your directory structure

Edit: the "bdj.c" in the archive is slightly different from the version i used to create the cvm (debugging with jdb is currently disabled).

[loo3aem3ON]

After the content code wrote PSR102 the player executes command 8 (native code calls java method "executeCommand") which creates a BDPlusStatusEvent object. The constructor gets the contents of PSR102 as parameter. The status event object is then passed to the application. The "pTriggerPSR103change" call might cause BD+ event#0210.

I'll run some tests to see if the handshake works properly. If successful i can start merging this into libbluray. :)

[loo3aem3ON]

It seems to be working. Below are the relevant sections of the console output. You should compare this with posting #642 (https://forum.doom9.org/showpost.php?p=1241353&postcount=642) (look for the correct return "BC79595F 97F05643 07A0ABF2 CC10F7C5")
called Java.com.cl.bdj.helper.BDJVFSHelper.RegisterAccessHelper.pSetPSR(104, 0x0)
called Java.com.cl.bdj.helper.BDJVFSHelper.RegisterAccessHelper.pSetPSR(103, 0xF1000000)
called Java.com.cl.bdj.helper.BDJVFSHelper.RegisterAccessHelper.pTriggerPSR103change
[...]
called Java.com.cl.bdj.helper.BDJVFSHelper.RegisterAccessHelper.pGetPSR(104) -> FFFFFFFE!
called Java.com.cl.bdj.helper.BDJVFSHelper.RegisterAccessHelper.pSetPSR(103, 0x4000)
called Java.com.cl.bdj.helper.BDJVFSHelper.RegisterAccessHelper.pTriggerPSR103change
[...]
called Java.com.cl.bdj.helper.BDJVFSHelper.RegisterAccessHelper.pGetPSR(104) -> 3EA9DAFF!
called Java.com.cl.bdj.helper.BDJVFSHelper.RegisterAccessHelper.pSetPSR(103, 0x8000)
called Java.com.cl.bdj.helper.BDJVFSHelper.RegisterAccessHelper.pTriggerPSR103change
[...]
called Java.com.cl.bdj.helper.BDJVFSHelper.RegisterAccessHelper.pGetPSR(104) -> B23259D5!
called Java.com.cl.bdj.helper.BDJVFSHelper.RegisterAccessHelper.pSetPSR(103, 0xC000)
called Java.com.cl.bdj.helper.BDJVFSHelper.RegisterAccessHelper.pTriggerPSR103change
[...]
called Java.com.cl.bdj.helper.BDJVFSHelper.RegisterAccessHelper.pGetPSR(104) -> 53B07B58!
called Java.com.cl.bdj.helper.BDJVFSHelper.RegisterAccessHelper.pSetPSR(103, 0x10000)
called Java.com.cl.bdj.helper.BDJVFSHelper.RegisterAccessHelper.pTriggerPSR103change
[...]
called Java.com.cl.bdj.helper.BDJVFSHelper.RegisterAccessHelper.pGetPSR(104) -> 60FBC4BB!
called Java.com.cl.bdj.helper.BDJVFSHelper.RegisterAccessHelper.pSetPSR(103, 0x14000)
called Java.com.cl.bdj.helper.BDJVFSHelper.RegisterAccessHelper.pTriggerPSR103change
[...]
called Java.com.cl.bdj.helper.BDJVFSHelper.RegisterAccessHelper.pGetPSR(104) -> 60FBC4BC!
called Java.com.cl.bdj.helper.BDJVFSHelper.RegisterAccessHelper.pSetPSR(104, 0x60FBC4BD)
[...]
called Java.com.cl.bdj.helper.BDJVFSHelper.RegisterAccessHelper.pSetPSR(104, 0xBC79595F)
called Java.com.cl.bdj.helper.BDJVFSHelper.RegisterAccessHelper.pSetPSR(103, 0x4014004)
called Java.com.cl.bdj.helper.BDJVFSHelper.RegisterAccessHelper.pTriggerPSR103change
[...]
called Java.com.cl.bdj.helper.BDJVFSHelper.RegisterAccessHelper.pSetPSR(104, 0x97F05643)
called Java.com.cl.bdj.helper.BDJVFSHelper.RegisterAccessHelper.pSetPSR(103, 0x4014008)
called Java.com.cl.bdj.helper.BDJVFSHelper.RegisterAccessHelper.pTriggerPSR103change
[...]
called Java.com.cl.bdj.helper.BDJVFSHelper.RegisterAccessHelper.pSetPSR(104, 0x7A0ABF2)
called Java.com.cl.bdj.helper.BDJVFSHelper.RegisterAccessHelper.pSetPSR(103, 0x401400C)
called Java.com.cl.bdj.helper.BDJVFSHelper.RegisterAccessHelper.pTriggerPSR103change
[...]
called Java.com.cl.bdj.helper.BDJVFSHelper.RegisterAccessHelper.pSetPSR(104, 0xCC10F7C5)
called Java.com.cl.bdj.helper.BDJVFSHelper.RegisterAccessHelper.pSetPSR(103, 0x4014010)
called Java.com.cl.bdj.helper.BDJVFSHelper.RegisterAccessHelper.pTriggerPSR103change
[...]
called Java.com.cl.bdj.helper.BDJVFSHelper.RegisterAccessHelper.pGetPSR(104) -> 10000000!
called Java.com.cl.bdj.helper.BDJVFSHelper.RegisterAccessHelper.pSetPSR(103, 0x18010)
called Java.com.cl.bdj.helper.BDJVFSHelper.RegisterAccessHelper.pTriggerPSR103change
[...]
called Java.com.cl.bdj.helper.BDJVFSHelper.RegisterAccessHelper.pGetPSR(104) -> 00000000!
called Java.com.cl.bdj.helper.BDJVFSHelper.RegisterAccessHelper.pSetPSR(103, 0x1A010)
called Java.com.cl.bdj.helper.BDJVFSHelper.RegisterAccessHelper.pTriggerPSR103change
[...]
called Java.com.cl.bdj.helper.BDJVFSHelper.RegisterAccessHelper.pGetPSR(104) -> 00000001!
called Java.com.cl.bdj.helper.BDJVFSHelper.RegisterAccessHelper.pSetPSR(104, 0x2)
So we should probably start creating a libbdj which can be used in conjunction with libbluray to repair the latest batch of BD+ corrupted discs.

Btw the handshake application needs additional jar files but these are fetched automatically from the disc after i changed the VFS root to /media/cdrom. :)

[br0kenpipe]

You're doing an excellent job loo3aem3ON! And I would gladly help. But I'm afraid I don't know much about Java, and pretty much anything else discussed in this thread. ;)

Just wanted to give you an encouraging word, and keep up the excellent work!

[loo3aem3ON]

Thanks. You can help by grabbing the latest binary snapshot and playing around with it. Then report the problems you encounter.

About 80% of BD-J is implemented in java and this part can be copied from any Blu-Ray player without modifications. The rest are native functions which have to be implemented in C/C++ or whatever. Of particular interest are the functions which are used to indirectly talk with the BD+ content code via the player status registers (PSR) 102-104.

I don't know how difficult it is to get the menus working. A black window pops up in the top left corner of the screen but it isn't filled with contents because that's being done by the second application which i haven't yet tried to start. The primary goal was to get the first application (BD+ handshake) running.

[slicemaster102]

Thanks. You can help by grabbing the latest binary snapshot and playing around with it. Then report the problems you encounter.

About 80% of BD-J is implemented in java and this part can be copied from any Blu-Ray player without modifications. The rest are native functions which have to be implemented in C/C++ or whatever. Of particular interest are the functions which are used to indirectly talk with the BD+ content code via the player status registers (PSR) 102-104.

I don't know how difficult it is to get the menus working. A black window pops up in the top left corner of the screen but it isn't filled with contents because that's being done by the second application which i haven't yet tried to start. The primary goal was to get the first application (BD+ handshake) running.

This is great news, the progress you and the others working on this project have made in the last few weeks is more then the entire Linux community efforts combined for the last…o 6 moths or so. The guys here on the doom9 forums have almost successfully reverse-engineered the VM completely and now you are braking down the walls for BD-J in order to completely bypass BD+. An amazing feat if you ask me considering the relatively short amount of time you guys have been working on this. As to your comments regarding getting a full BD-J library in development, I feel this is the next logical step as it will be needed to get BD+ is fully handled. This is not to mention the fact that once we have an operational BD-J library, we would more or less have fully functional menu support under Linux with relatively little effort compared to what has already been done.

Keep up the good work guys!

Slice

P.S. something that might be nice to get more people testing this stuff is to make it easily and openly available, maybe precompiled and available for download from a repository for Linux. Also, basic step by step instructions on how to use these tools is not readily available so that might be something to consider.

P.P.S. I have not followed the progress of AACS very closely, has it been completely broken yet or are we still stuck only being able to decrypt titles that feature MKBv7 or earlier?

[kkloster21]

@ Slice:

as of now we (Linux users) are only able to decrypt titles that are MKBv8 and earlier. We don't have processing keys for MKBv's beyond that. Although Mike Chen of the MakeMKV project claims that they have keys that may be able to go as far as MKBv11:

http://forum.doom9.org/showthread.php?p=1242679#post1242679

but he hasn't yet responded to a request to share these keys with KenD00 (for DumpHD).

[edit: make that MKBv12: http://forum.doom9.org/showthread.php?p=1248998#post1248998]

[KenD00]

P.P.S. I have not followed the progress of AACS very closely, has it been completely broken yet

AACS most probably will never be broken and there will be always the hunt for new keys.

:rolleyes:

[880]

Can I donate money or blu-ray discs to you? I am not very technical but I want to help out.

[Raybuntu]

Hi,
where I can find the source code of this project. Maybe you could host this project on https://launchpad.net/ ? There you can make an bazaar repo so others could hack on the code too!? I could help you to register and host this project on Launchpad. I can also provide you help for Debian/Ubuntu packaging. I would be glad to helping this project :)

[loo3aem3ON]

in order to completely bypass BD+.
I don't think "bypassing" BD+ is possible. We are doing exactly what all the licensed Blu-Ray players are doing.

This is not to mention the fact that once we have an operational BD-J library, we would more or less have fully functional menu support under Linux with relatively little effort compared to what has already been done.
Hopefully :)

P.S. something that might be nice to get more people testing this stuff is to make it easily and openly available, maybe precompiled and available for download from a repository for Linux.
You can find full build/binary snapshots in my previous postings.

Also, basic step by step instructions on how to use these tools is not readily available so that might be something to consider.
Will do.

AACS most probably will never be broken and there will be always the hunt for new keys.
I would be a careful with such statements. Even if no weakness can be found (which i think is unlikely) the underlying AES cipher is losing 1 bit of its security every 18 months (Moore's law).
Well maybe by the time AES becomes insecure we will all have DRM modules implanted in our brains. :rolleyes:

Can I donate money or blu-ray discs to you? I am not very technical but I want to help out.
No thank you.

where I can find the source code of this project.
It's currently hosted at assembla: https://trac.assembla.com/bdplus/

Maybe you could host this project on https://launchpad.net/ ?
I'm currently quite happy with assembla but it might be a good idea to move the BD-J part (trunk/bdj) to a different repository.

I would be glad to helping this project :)
AACS needs to added to libbluray (currently BD+ only). The maintainer (Accident) is busy at the moment. You could help by finding volunteers to help with the project.
I need to explain and simplify the environment for BD-J so more people are willing to experiment. The directory structure needs to be explained (eg. BUDA = "Binding Unit Data Area" etc). Furthermore some of the native functions return data specific to the movie "The Day The Earth Stood Still".

[loo3aem3ON]

The BD-J platform development project is now hosted at https://launchpad.net/bdj.

The method "readBDJO" (trunk/src/bdjo/BDJOReader.cpp) and its dependencies need to be ported from java to C++. I've already renamed all the file extensions. The conversion from and to XML is irrelevant. Have a look at the method names in "AppsDatabaseHelper.c" and you will see why.

The native code first needs to parse the index.bdmv to obtain the FirstPlaybackmobjidref (name of a BD-J object in the BDJO/ directory) and then parse the identified *.bdjo file.
At the moment the data from the 07777.bdjo is hardcoded in the methods of "AppsDatabaseHelper.c" so other applications from other Blu-Rays won't work. Furthermore the AppCacheInfo section of this BD-J object contains a list files which have to be loaded into the local cache (which i called "/tmp/BDJRoot/") for fast access. Currently these files have to be copied manually. So you see how important it is to read these BD-J objects properly.
Reading the index.bdmv is not a problem.

[Accident]

AACS needs to added to libbluray (currently BD+ only). The maintainer (Accident) is busy at the moment. You could help by finding volunteers to help with the project.


I want to apologise not being of much help lately. Large equipment failure that I got the honour to fix. But I can do code just fine when we have new things to solve, but no time to help with the in-depth research. On related news, I actually ended up with a BD player and a couple of disks, so it will be fun to be able to some experience actually playing a disk.

Related to libaacs, and libbluray, I was thinking of keeping the libraries separated, but write some example sources that uses both libraries, and massage them to play together nicely. I may end up checking in libaacs since its maintainer appears to be MIA. I have version 0.05.

[loo3aem3ON]

That's the latest binary/build snapshot containing the libraries missing from the launchpad repository: Download (http://uploaded.to/?id=qkqdrm).
Start it simply with "sh run.sh". The disc has to be mounted at "/media/cdrom". It probably won't run far so don't be disappointed (see my previous posting for an explanation). I'm working on it.

@Accident:
Focus on libaacs then and maybe rename libbluray to libbdplus.

[lbalan79]

Is there any way to help test this code without the actual use of an blu-ray phisical reader? I do not have an blu-ray unit but I would gladly help in case there is any test work that needs to be done.

[loo3aem3ON]

Is there any way to help test this code without the actual use of an blu-ray phisical reader?
It doesn't require the physical disc. You can copy these files/directories to /media/cdrom/ (path is currently hardcoded as well) :
CERTIFICATE/app.discroot.crt
CERTIFICATE/bu.discroot.crt
BDMV/index.bdmv
BDMV/BDJO/*
BDMV/JAR/*
None of these files are encrypted. At least one *.jar file has to be present in BDMV/JAR/ otherwise there is no application to execute.

See if you can find these files somewhere. Otherwise i could send you those from my disc.

[880]

In the readme for BDVMDebug 0.1.5 it says to post the conversion table on the forum. Should I post conv_tab.bin here? Should I post console output?

[loo3aem3ON]

In the readme for BDVMDebug 0.1.5 it says to post the conversion table on the forum. Should I post conv_tab.bin here? Should I post console output?
The readme is outdated but you still can upload the conversion table somewhere if you want to. Have you tried to view the table with ConvTableView? Are there any console messages?

[loo3aem3ON]

I've started a new thread for BD-J related discussions: link (https://forum.doom9.org/showthread.php?t=145249)
Rupan has imported Brian Gladman's AES implementation into libbluray which needs testing. I'll remove the BD-J stuff from the assembla repository soon. It's now available on launchpad (link (https://launchpad.net/bdj)).

[loo3aem3ON]

Is someone willing to connect libbdjinterface and libbluray or do i have to do this myself too? Both libraries access the same PSR and GPR.

Remember:
PSR102 = BD+ to BD-J pipe
PSR103 = BD-J to BD+ pipe
PSR104 = BD-J/BD+ shared register
The call of pTriggerPSR103change means that the BD-J program has sent a message (PSR103) to the content code. The content code needs to handle this as EVENT#0210 next.
If in turn the content code writes PSR102 then EVENT#008 is passed to the BD-J code (see last view lines of bdj.c for an example).

[Accident]

I can probably squeeze that in over the weekend, at least I can make an effort to.

[loo3aem3ON]

@Rupan: Could you please explain your changes to TRAP_Aes and TRAP_SHA? What are the advantages of Brian Gladman's AES and SHA-1 implementations?

[Rupan]

I didn't end up using BRG's SHA-1 code. There wasn't any point, really. BRG's AES code, however, is very fast (it is used in WinZip for their ZIP encryption).

I ended up using OpenSSL's SHA in trap_Sha. trap_helper has code to look up SHA contexts keyed on the destination address, so I believe it now should handle interleaved calls.

You can revert my changes to trap_Aes by commenting USE_GLADMAN_AES at the top of trap.c. trap_Sha has been modified to make use of trap_helper, in changesets 197 and 198.

**EDIT** Part of the reason I was looking at BRG's SHA-1 code was so that I could remove the dependency on OpenSSL. However, I wasn't able to find a suitable replacement for its ECDSA implementation so I didn't bother using BRG's SHA-1 code.

I've been reading over the traps and am trying to improve them where the comments say they need improvement.

[Rupan]

Today I was attempting to validate the current changeset with libbluray. I wanted to make sure that my changes to the source code weren't causing breakage. However, it appears that libbluray has been broken for sime time before I started working on it.

I'm testing with a region A release of "Live Free or Die Hard". I specifically remember this working a while back, so I was surprised when libbluray failed with it today. I went back through the svn revisions, bisecting from revision 168 (which I remember it working with). It turns out that svn revision 170 was what broke it.

With svn rev 169 it works fine, creating a conv_tab.bin as expected. However, with svn revision 170 it no longer works:

./convtab -d /mnt/cdrom -I <VID> -s conv_tab.bin
[dlx] BREAK! PC=000010B4. WD=FFFFFFFF (old R28 00001000, event 1)
[dlx] BREAK! PC=000010B4. WD=00000000 (old R28 000010B4, event 1)
[dlx] BREAK! PC=000010B4. WD=00000000 (old R28 000010B4, event 1)
[dlx] BREAK! PC=000010B4. WD=FFFFFFFF (old R28 000010B4, event 1)
^C

svn info claims that the last revision to libbluray prior to 169 was by Accident, in revision 165. Revision 170 was also committed by Accident, so he/she might be the right person to debug this.

[loo3aem3ON]

I'm having problems building libbluray:
$ automake
configure.ac:208: required file `win32/Makefile.in' not found
configure.ac:208: required file `win32/libbluray/Makefile.in' not found
configure.ac:208: required file `win32/libbluray/libbluray/Makefile.in' not found
configure.ac:208: required file `win32/libbluray/convtab/Makefile.in' not found
Please advise. There is still no "autogen.sh".

[Rupan]

run this to rebuild all of the autotools cruft in one shot:

# autoreconf -sfi

The win32 stuff was apparently added by someone with the intent of making libbluray work with Windows. It has been there since before I first saw the source code, so I'm assuming that the effort is abandoned. Personally I am not willing to touch the Windows application layer; the idea of writing source code for Windows is distasteful to me in the extreme.

If you're okay with it, just remove all references to win32 from Makefile.am and configure.ac then commit the changes. Otherwise just modify them locally before running autoreconf.

**EDIT** I do believe that I've forgotten to add the trap_helper source files to Makefile.am. You can add them in if you get to it first; I'll fix it later tonight when I get home.

I'm having problems building libbluray:
$ automake
configure.ac:208: required file `win32/Makefile.in' not found
configure.ac:208: required file `win32/libbluray/Makefile.in' not found
configure.ac:208: required file `win32/libbluray/libbluray/Makefile.in' not found
configure.ac:208: required file `win32/libbluray/convtab/Makefile.in' not found
Please advise. There is still no "autogen.sh".

[loo3aem3ON]

@Rupan: I still can't compile libbluray because of missing symbols so i'll revert your changes. You may commit a complete patch later.

@Accident: Could you please send me the AACS source code you have?

[Rupan]

I've committed a fixed patch in revision 201.

**EDIT**

@Accident: can you take a look at what happened between rev 165 and 170 to libbluray? I just confirmed, convtab fails for both "The Simpsons Movie" and "Live Free or Die Hard" for svn >= 170 (165 works fine).

@loo3aem3ON: svn rev 201 compilable for you?

[Accident]

Apologies for my tardiness. I was ready to start coding, when things at work went belly-up, only caught up on sleep now. I will try to catch up:

@Rupan: I wrote my code to be portable, so I did the Windows massaging (with a patch from a contributor to remove warnings). The Makefile.am for Windows are just stubs to tell autoconf to include required files when you do "make dist-gzip". Both Unix and Windows is just untar, and make.

When you check it out of svn, you should run "autoreconf", sometimes if the .ac files have changed, you may need "autoreconf --install --force".

@loo3aem3ON: The best I have found (sent to me by contributors) are:
101603 Dec 23 21:42 libaacs_v0.5.tar.bz2

All my attempts to reach the original author has failed. We might as well consider checking it into our repository, and start working on API to use both libraries.

Edit:
It appears that I changed segment_NextSegment() to instead of returning the "table index" to return the "table ID" of the table index. (Which I think is more correct... anyone?) but segment_SetSegment() still took "table index". So, I returned table = 60 as the next one to decrypt, and posted events for key 60,1. But when I went to decrypt it, "60 > numTables of 43". Can I get it confirmed that the BD+ code deals with TableID when you post the playback event to retrieve the keys, or should it be pure conv_tab index?

Edit2:

loo3aem3ON: In previous testing of older disks, the table index (subtable number) in conv_tab, and TableID were always the same. 0 to numSubTables in conv_tab. But in testing LiveAndLetDie, table index 34 (the first we need to decrypt) has table ID 60. We then post events to get the key, do we send 34, or 60. Looking at debugger, it appears that it uses
segmentID[0] = subtables[i].subtable_id; //(conv_tab_main.java:79)
which would confirm it uses only tableIDs when communicating with content code, whereas libbluray previously never used tableID at all. It would make sense to me that content-code uses tableID, and I should convert to subtable index internally, but it would be nice to be confident about this change :)

Rupan: So you say you can't test rev 202, but it is still broken.... what?

[Rupan]

I'm not in any state at the moment to analyze rev 202 (seeing as it is 2 am), but I'm still getting the same results:

$ ./convtab -I <VID> -s conv_tab.bin -d /mnt/cdrom
[dlx] BREAK! PC=000010B4. WD=FFFFFFFF (old R28 00001000, event 1)
[dlx] BREAK! PC=000010B4. WD=00000000 (old R28 000010B4, event 1)
[dlx] BREAK! PC=000010B4. WD=00000000 (old R28 000010B4, event 1)
[dlx] BREAK! PC=000010B4. WD=FFFFFFFF (old R28 000010B4, event 1)
[dlx] BREAK! PC=000010B4. WD=FFFFFFFF (old R28 000010B4, event 1)
[dlx] BREAK! PC=000010B4. WD=FFFFFFFF (old R28 000010B4, event 1)

And yeah, might as well commit libaacs..

[loo3aem3ON]

I suggest to merge the code from libbluray into libaacs and call the resulting library libbluray. The current libbluray code needs to be restructured a bit. For example the dlx.c is overloaded with functions which have nothing to to with the DLX processor (eg. traces/snapshots, slots, conversion table, events, trap calls,...). It should be better to split the code into modules (e.g. DLX, trap_interface, trap_implementation, events, conversion_table, debugging_helpers).
Furthermore I would like if you could use the parameter checks without modifications from the documentation.

It appears that I changed segment_NextSegment() to instead of returning the "table index" to return the "table ID" of the table index. (Which I think is more correct... anyone?) but segment_SetSegment() still took "table index".
By "table" you mean the subtable associated with a specific *.m2ts file?

So, I returned table = 60 as the next one to decrypt, and posted events for key 60,1. But when I went to decrypt it, "60 > numTables of 43". Can I get it confirmed that the BD+ code deals with TableID when you post the playback event to retrieve the keys, or should it be pure conv_tab index?
I don't fully understand what you mean. The subtable ID can be higher than the total number of subtables. I don't know which part of the player generates the events 0x0110 and 0x0220. It's still unknown what exactly the second parameter of EVENT_#0110 means. Somehow it's related to the number of the m2ts file. The second parameter of EVENT_#0220 seems to be the subtable ID == number of m2ts file.

Edit: It's known that EVENT#0210 is related to BD-J and since EVENT#0220 is in the same group it's probably related as well.

[Accident]

This is the latest version that people managed to find me me. :thanks:
libaacs_v0.5.tar.bz2 (http://uploaded.to/?id=nndy0g)

I was initially just going to check it into libbluray as a sub-directory, but it does have the two keys embedded so I thought I should wait an see first. We should probably take those keys from command-line arguments, or env vars. Or at the very least obfuscate them so the repositories do not need to worry.

Switching to bazaar has been a hassle so far, but I should have what I need in a bit..

[loo3aem3ON]

Have you made any progress "connecting" the BD-J platform to libbluray? Do you need help?

[bumbo]

This is the latest version that people managed to find me me. :thanks:
libaacs_v0.5.tar.bz2 (http://uploaded.to/?id=nndy0g)

It seems I have a more recent version of libaacs, checked out from decrypthd svn repository quite some time ago...

libaacs-svn-r51.tar.bz2 (http://uploaded.to/?id=vuu6ka)

It does not compile here because of some missing include directives. I've attached a patch to solve that.
It also requires CMake.

[loo3aem3ON]

Thanks for the AACS source.

I'd like to make a suggestion regarding the connection between libbluray and the experimental bd-j platform i proposed. As i understand there has been little progress and it seems to be quite a difficult task. How about running both libbluray and bdj in two different processes and let them communicate via network or some other form of inter process communication? This would probably be easier and require fewer changes to both programs.

:helpful:

[SamNZDat]

Have we looked into comparing the signals sent to CRT monitor(s) with signals sent to LCD or plasma monitors, or into comparing signals sent by optic fiber(s) to signals sent by TV transmitter, satellite, cable, or DSL? Is there another way to back-engineer the technology? I have a fiber optics installer's field guide, if it can be of use to anyone.