Finally handling BD+ (?)

[SamNZDat]

Have we looked into...

Another thought or two came to me in the last couple of hours -- just trying to think outside the box here -- how about two or more Daemon Tools mounts of Blu-Ray images, identically timed and of identical (at least as far as humanly readable) content but differently coded, running in parallel, perhaps a way to ferret out watermark? Or running rsynced Blu-Ray images by FTP -- again, to ferret out watermark, watch for decryption clues, or? Or comparing Blu-Ray behavior with the behavior of ray trace programs, for decryption clues or other objects?

[Rupan]

This thread specifically relates to BD+ copy protection, so please keep the discussion on-topic.

There is no need to transmit all 50GB of video data over the internet. It would be trivial to write an application that produces a hash table of small video segments and only send the differing pieces.

[krosswindz]

This might seem to be a stupid question, I just checked out the bdplus from Assembla. I went through the source tree seems like the configure script is missing for libbluray. Are there any instructions on building libbluray?

[Accident]

"autoreconf", or if needed "autoreconf --force --install". Traditionally you don't check in files that are generated when building (like .o files etc).

But perhaps I should put that in the README.txt

[krosswindz]

I did autoreconf but it failed due to missing files. where can I find these files? Tried going through all the 36 pages in this thread, not sure which post may point to it :(.



configure.ac:3: required file `build-aux/install-sh' not found
configure.ac:3: `automake --add-missing' can install `install-sh'
configure.ac:3: required file `build-aux/missing' not found
configure.ac:3: `automake --add-missing' can install `missing'
src/Makefile.am: required file `build-aux/depcomp' not found
src/Makefile.am: `automake --add-missing' can install `depcomp'
autoreconf: automake failed with exit status: 1

[KenD00]

configure.ac:3: `automake --add-missing' can install `install-sh'


Have you tried this?

:rolleyes:

[krosswindz]

Have you tried this?

:rolleyes:

Thanks, I guess I shouldnt try building things when I wake up first thing in the morning :readguid:

[kkloster21]

i don't want this to come off the wrong way, but if anybody needs a tester for the BD+ implementation in dumphd, with respect to the new MKBv9 and MKBv10 discs, i have several of these discs that i've already tried. The MKBv9 discs still produce a conv_tab.bin file that corrects some of the broken video (but not all of it) and the MKBv10 discs produce an error.

again, i have more info if anyone is interested.

[Accident]

Really, you should try the latest tarball, unless you have reason to want to try the latest version in repository, which is this case would be valid since we are working on the new changes... :)

[loo3aem3ON]

which is this case would be valid since we are working on the new changes... :)
I'm regularly checking my private message if you have any questions. Probably i could do this last step (connecting BD-J platform to TRAP_ApplicationLayer) in 1 week so everyone else shouldn't need more than 2 months. :)

[dirio49]

Any news? Just curious?
Progress?
Thanks

[loo3aem3ON]

Any news? Just curious?
Progress?
Thanks
According to Accident the latest revision (203) from April 3rd is supposed to have the connection between BD-J platform and BDVM platform. Accident can't test it though because all the computer he/she has access to are running osx and not linux (i386 compatible).
KenD00 has started working on this as well.
I'm busy at the moment and i doubt i will have much free time in the near future.

[Rupan]

Sorry for the long wait. I've had other things keeping me busy.

I've taken a look at the java BDJ jar that Accident sent me. Of specific interest are two classes:

org.bluray.system.RegisterAccess
com.philips.bluray.system.RegisterAccess

Although they do not reveal anything we do not already know about the player status registers, they do expose some of the binary API in the native libraries. They also confirm the functions of several PSRs.

103 = PSR_APPL_TO_BDPLUS_DATA
104 = PSR_BDPLUS_SHARED_DATA

Some subroutines to target may be:
private static native int nGetGPR(int i);
private static native void nSetGPR(int i, int j);
private static native void nSetPSR(int i, int j);
private static native int nGetPSR(int i);
private static native String nGetPreference(int i);
private static native void nSetPreference(int i, String s);

which are all defined in libbdj.so. I've done a small bit of MIPS assembly, but I'm by no means proficient with it. I'll give them a shot...

One more thing. There is just too much code in the BDJ archive for one person to recreate. Anything other than simple classes requires a significant amount of work to fully recover, and the native functions are going to be a real bear. I need some help from other developers to decide what I should target for reversing; let me reiterate that I simply cannot reverse everything.

Rather than reverse engineer the binary MIPS libraries I suggest that we use them directly. We can write a shim in C and cross-compile it for little-endian MIPS, then run it using qemu-mipsel. IPC can be performed using named pipes or sockets. I realize that this is a completely separate track from the BDJ implementation on Launchpad, but it might be simpler in the short term and it offers the advantage of automatically supporting new versions of the "official" binary-only libbdj copied from player firmware. Comments?

[Accident]

Sorry for the delay, busy here too.

I can reverse engineer MIPS quite well, but small functions only, anything larger is not really realistic.. I'm not a fan of Java, as to me that cuts out too many platforms (I know, it is supposed to be more portable). I've even toyed with the idea of simply recording PSR interactions for each movie, but that's hardly a great idea. IPC is done with Unix sockets on this platform afaik, and they directly use /proc/mem for DiscoveryRAM.

[dirio49]

Hello, Me again

Just curious as to how is it going?
any progress?

thanks

[Wombler]

Funny, I wondered that myself, as it's the first of June now and there hasn't been a post since April in what was previously a very active thread.

Hopefully things are still progressing.


Wombler

[kreet]

im thinking about picking up this project to try and get support for the latest titles. are any of the original devs still around?

[Accident]

I am. Just very busy with many projects. The latest sources has both aacs and bd+ sources, which needs to be merged, or at least have a top level tool that links with both to demonstrate full functionality.

There were still some compatibility issues with latest keys, but not enough to put anyone off working on the project.

[kreet]

Accident:
Ive grabbed the code and will start working on it. do you have the snapshot packages?
I think another big thing is that we dont have working processing keys for > v10 (in aacskeys). we need to get these keys in order to be able to work on newer titles.

arzenami: are you or anyone else working on this?

[KenD00]

The latest sources has both aacs and bd+ sources, which needs to be merged

This has rather low priority, much more important is the fact that the latest BD+ versions interact with the BD-J layer, this should be implemented first before messing up with stuff that works. And there is still much work to do on the BD-J machine itself.


I think another big thing is that we dont have working processing keys for > v10 (in aacskeys). we need to get these keys in order to be able to work on newer titles.

No, i don't think that this is necessary. AFAIK BD+ can use the Volume ID off the disc but nothing more AACS releated stuff (maybe this can change in the future?), for discs we don't have a Processing Key you can still check if the Conversion Table seems to be valid, without actually watching if the movie runs without errors.

:rolleyes:

[880]

I think another big thing is that we dont have working processing keys for > v10 (in aacskeys). we need to get these keys in order to be able to work on newer titles.

Try working on the older (i.e. easier ?) titles first. 28 Days Later, Robocop, Taken, The Happening, etc.

These are all discs we have the keys for, but also have BD+.

[kreet]

ok i think ill focus on getting it to work on some older titles first. need to go out and buy a few :P

[Accident]

Ah yes BD-J. Guess I lost interest when it forces the use of java :) Can we do/fake/get-around BD-J and Java somehow? Re-implementing, or emulating response needed? Although it could potentially send any data to BD-J, which then is entirely open to any implementational cipher or similar, before replying back. This would make things difficult.

Although, it would not be as easy to hide anything too clever in java.

Do we have better understanding of how it is currently used? Just random data, or does it perhaps do "simpler" checks, like if we are to play title 3, it should have title 3 set in the BD-J reply.

[Wombler]

Great to see some activity here again as you guys are the only ones with the skills to be able to attempt this.


Wombler

[kreet]

Accident: i think we need to spend time reversing a working player to get a better understanding of the way the BD-J interaction works.

are you on irc somewhere or do you prefer pms?

[kreet]

is there a list of titles which we know use the BD-J stuff? im about to buy some discs to work with and want to make sure i get the most useful ones

[Revgen]

I believe the Pirates of the Carribean movies do. The latest one released on BD is Pirates of the Carribean: At World's End.

[setarip_old]

These 3 releases contain/utilize BD-J:

Behind Enemy Lines
The League of Extraordinary Gentlemen
Speed

The following is from this link:

http://74.125.95.132/search?q=cache:YRB0Qfh6s7wJ:netblender.com/main/resources/wikipapers/bd-j-for-independent-blu-ray-production/+BluRay%3Dtitles%3DBDJ&cd=7&hl=en&ct=clnk&gl=us

Notably, all Blu-ray titles from Universal Studios have a feature called “U-Control” which is essentially a series of in-move extras that can be activated by the viewer at any time during the movie with their remote control. Commentaries, games, picture-in-picture storyboards and production still, and other such interactive features are accessed via U-Control. U-Control is made possible by BD-J.


All Blu-ray titles from Fox are authored with BD-J pop-up menus, similar in function to how DoStudio creates pop-up menus.


Paramount, Disney, Sony and Warner are all making heavy use of BD-J menus and features (The Dark Knight, anyone?). And any disc that advertises BD-Live or any type of iPhone integration (such as NetBlender’s BD Touch) – that’s BD-J, too. Universal’s Fast & Furious is the first major studio Blu-ray title to make use of the iPhone-Blu-ray interaction.


In fact, any time the trade press takes the time to review an innovative feature on a Blu-ray disc, the feature they are referring to is enabled by BD-J. A quick perusal of Blu-ray Disc Reporter (http://www.blu-ray-disc-reporter.com) reveals numerous such reviews. Here’s one about an interesting feature on Sony’s Nick and Norah:

Comedy Nick & Norah’s Infinite Playlist comes to BD with a special feature that perfectly suits the film’s musical heritage. Nick & Norah’s Interactive Playlist gives viewers background information and trivia on the songs and artists featured in the film, and the option to create custom playlists which can be shared with friends by email.

[KenD00]

Well, i haven't looked further into this, but i would be careful by assuming that every title that uses BD-J uses a BD+ version that interacts with the BD-J layer. Maybe this is true for recent titles but maybe not for older ones.

In any case i know that BD+ on both X-Files movies use the BD-J layer.

:rolleyes:

[kreet]

KenD00: which region are those discs from?

setarip_old: are those title BD+ and are they v10 or lower?

[kreet]

I believe the Pirates of the Carribean movies do. The latest one released on BD is Pirates of the Carribean: At World's End.
these movies are Disney not Fox so no BD+

[Color=Blue]These 3 releases contain/utilize BD-J:

Behind Enemy Lines
The League of Extraordinary Gentlemen
Speed

do you know if any of these cause problems for libbluray/bdvmdbg?

[setarip_old]

@kreet

I merely provided you with information I located on the 'Net in response to your request for titles that have BD-J. I have no personal knowledge regarding them.

[Rupan]

Two titles to try are "The Simpsons Movie" and "Live Free or Die Hard". As I remember, one or both of these movies is broken with libbluray. They both work with BDVMDBG (Java) and used to work with libbluray, but something was changed in libbluray that broke them. I think the break happened after r165. Neither uses the BD-J link though.

As far as reversing the Blu-Ray VM, there is a lot of code. A lot. The MIPS linux shared library I was given was about 350 kilobytes and the JAR is quite large as well. There is far too much code for one person to reverse; if it is to be attempted it will require a team of several experienced MIPS reverse engineers. There are a lot of smart people here on the forum, so it might not be unreasonable to attempt this undertaking. I've done my share of reversing i386 code but am not familiar with the MIPS instruction set.

There is another possibility that I've been thinking about for a while. It should be possible to start a fully virtualized MIPS system using QEMU and run the unmodified binaries in it. I would be extremely hesitant to run that code on bare metal (with qemu-user) since it is trivially easy to write a program that could detect when something isn't right and overwrite every partition table in your system as well as possibly damage hardware. The problem is exacerbated when you consider that the code, if it doesn't already, will probably require root privileges.

If there is interest from others I am willing to help, but I cannot dedicate more than 4 or 5 hours per month to this project (as much as I am interested in it). Let me know what I can do to help you.

[Accident]

Some people asked for the BD+ binary to be shared again, the files I have is about 1.2GB in size. Any free/anonymous uploading places that can take 1.2? Otherwise I will split it into parts.

@rupan: I did not realise I broke diehard in newer, I was under the impression that I fixed it. This I can take a look at immediately.

[kreet]

As far as reversing the Blu-Ray VM, there is a lot of code. A lot. The MIPS linux shared library I was given was about 350 kilobytes and the JAR is quite large as well. There is far too much code for one person to reverse; if it is to be attempted it will require a team of several experienced MIPS reverse engineers. There are a lot of smart people here on the forum, so it might not be unreasonable to attempt this undertaking. I've done my share of reversing i386 code but am not familiar with the MIPS instruction set.

i have quite a bit of experience reversing mips. even still 350k is a hell of a lot. but hopefully we should be able to use some standard vm (like the cvm) and just make changes where things fail. can someone pm me that mips bin and the jar?


There is another possibility that I've been thinking about for a while. It should be possible to start a fully virtualized MIPS system using QEMU and run the unmodified binaries in it. I would be extremely hesitant to run that code on bare metal (with qemu-user) since it is trivially easy to write a program that could detect when something isn't right and overwrite every partition table in your system as well as possibly damage hardware. The problem is exacerbated when you consider that the code, if it doesn't already, will probably require root privileges.

in my experience its relatively easy to tell that you are running on top of qemu. i doubt that macrovision/studios will allow themselves to do actual HARM tho :D id really like to try and get things running without emulating 'stolen' mips code.


If there is interest from others I am willing to help, but I cannot dedicate more than 4 or 5 hours per month to this project (as much as I am interested in it). Let me know what I can do to help you.
i have a bunch of time at the moment. the best thing i can ask for is if you could try and pass me whatever knowledge you have learnt already, and help when ever you can.

[boza111]

hey quick question
so what can be done , and what can not be done so far as far as watching copy protected blu ray movies goes?

I have a set top box that runs on linux and is capable of playing vc1 and blu ray movies that are not copy protected.
The receiver is a dreambox 8000 and the CPU type is MIPS i believe. Is there anything I can use from this forum to be able to play copy protected blurays on my dreambox?

[cRTrn13]

@boza111
I'm working on a patch for mplayer to allow bluray playback (at least those with AACS only atm). If you can get mplayer working on your mips box and decoding h.264 nicely, then it should be able to handle the AACS copy protection when the mplayer patch is released. What do you currently use for vc1 playback? Also what drive do you use?

[boza111]

@cRTrn13

Hey thanks for the quick reply, awesome that you're writing a patch for mplayer to allow the playback for bluray!
as far as i understand the vc1 and h.264 videos are played back directly by hardware by the broadcom 7400 chip. I have also asked in the community what exactly is used to play back vc1 and h.264 content, but I am pretty sure its handled by hardware.
Concerining the drive , right now I don't have a bluray drive in the box since it cant play copy protected movies. I play ripped copies directly from the internal harddisk or over the network. But it is possible to build in any slimline drive.
Are specific drives better for playing blu ray discs in linux?
Is there any chance of getting mplayer to work with the broadcom chip? and if not , is there still hope to play back copy protected bluray discs?

[Guest]

Guys, this is OT. Please open a new thread for this Broadcom/mplayer/VC-1 discussion. This thread is for discussion of BD+.

[XYZ123]

Anyone working on BD+ at the moment?

[cRTrn13]

Anyone working on BD+ at the moment?

Yup. Someone is.

[boza111]

hey cRTrn13 how is your tool coming along :) i found your blog , looks like your making good promising progress :)

[cRTrn13]

hey cRTrn13 how is your tool coming along :) i found your blog , looks like your making good promising progress :)

Lol - haven't updated that a while - maybe i'll post an update. Yes, it's fairly stable for AACS - just working on some little bits and pieces.. :) It's coming along nicely though! :)

[kreet]

im working on reversing some players to understand the whole bd-j thing and grab new keys. theres a lot of work to do. if someone wants to volunteer to implement some of the things i discover, it would be very helpful. pm me.

[kreet]

i think im gonna start a new thread for bd+ reversing and updating libbluray support to current titles. what do you guys think? there is a crapload of work that needs to be done and i could really use a hand, both on implementation and reversing.

if you have leet skillz in x86 asm, java reversing, c/c++ coding and/or java coding pm me here or ping me on irc://irc.efnet.net/#doom9

[GLUBSCH]

Sounds great, kreet! I´ve got leet skillZ in testing stuff. ;)

[kreet]

new thread here: http://forum.doom9.org/showthread.php?p=1332018

let the games begin!

[Accident]

Any readers out there who can run the java Debugger and record snapshots still? I would like to fix more of the small differences in the C version. My old saved snapshots may no longer be current.

Edit: Counting differences I get:

10: 1 times
140: 192 times
420: 33 times
530: 350 times


I completely re-did the DiscoveryRAM, with the proper memory dumps, so it no longer differs. sha(140) differs only in the work area. SlotRead(420) differs since our flash.bin files are different from starting.

As for why Finish (010) differs one time, i do not know. Now it runs much better, and has been committed. I have had reports of old bdplus disks playing, which is encouraging.

Did we ever decide on a name for EVENT_220 ?

Edit:

Thanks Mike Chen.

[Mike Chen]

Did we ever decide on a name for EVENT_220 ?
ComputeSP

[Accident]

I know the current BD+ code we have will not handle Avatar, but for those curious this is what happens:


UDF-fs INFO UDF 0.9.9 (2005/21/07) Mounting volume 'RED_BIRD_2D_F6'
bdplus.c:105: [bdplus] loading BDSVM/00000.svm and flash.bin...
[snip]
bdsvm/trap.c:983: [TRAP] TRAP_ApplicationLayer: WARNING reading from PSR103!
bdsvm/trap.c:983: [TRAP] TRAP_ApplicationLayer: WARNING reading from PSR104!
bdsvm/trap.c:983: [TRAP] TRAP_ApplicationLayer: WARNING writing to PSR104!
bdsvm/trap.c:983: [TRAP] TRAP_ApplicationLayer: WARNING writing to PSR102!
bdsvm/trap.c:983: [TRAP] TRAP_ApplicationLayer: WARNING reading from PSR103!
bdsvm/trap.c:983: [TRAP] TRAP_ApplicationLayer: WARNING reading from PSR104!
bdsvm/trap.c:983: [TRAP] TRAP_ApplicationLayer: WARNING writing to PSR104!
bdsvm/trap.c:983: [TRAP] TRAP_ApplicationLayer: WARNING writing to PSR102!
[snip]
bdsvm/interface.c:128: [interface] trap_ConvertionTable(000F3CCC, *002EFAC8)
bdsvm/trap.c:164: [TRAP] TRAP_FixUpTableSend(998604/3994416)
bdsvm/segment.c:50: [segment] Starting decode of conv_tab.bin: 0x1012efac8 (998604)
bdsvm/segment.c:92: [segment] num tables 193
bdsvm/segment.c:127: [segment] Table 0 ID 00000001, 1 segments
bdsvm/segment.c:206: [segment] Table done. Setting ptr to 00000010
bdsvm/segment.c:127: [segment] Table 1 ID 00000002, 442 segments
bdsvm/segment.c:157: Segment 1 offset 00000702 -> 69 entries
bdsvm/segment.c:157: Segment 2 offset 00000C6A -> 103 entries
bdsvm/segment.c:157: Segment 3 offset 0000147A -> 118 entries
[snip]


Now I would suspect it will fail after this, when it attempts to decode the segment keys, as the (missing) BDJ interface responds incorrectly. But since it was an hiccup for Sly-soft as well, I presume there will be an upcoming road-block that I can not yet see?



Edit:

dirio49: that is fascinating for sure. Nice to have it laid out. I did notice that it requires the VM to run permanently, but don't know anything about mk.enc.