"Cinavia"/Verance BluRay audio watermark protection

[pandy]

Are the firmware updates impenetrable?
Or can they be pulled apart and reverse engineered, especially when they go from no-Cinavia to with-Cinavia?

usually encrypted and signed - if you are lucky then security by obscurity

[Ghitulescu]

And one must not forget that nowadays there are several blocks that need to be "upgraded", and only one or two of them are done by FW, the rest being done in factory.

[db1280]

usually encrypted and signed - if you are lucky then security by obscurity

The PS3 has been broken. The private keys to whatever is encrytped for download are thus obtainable.

Let me explain this a bit more...

If you have a PS3 that is pre-Cinavia and have it connected to the Internet via a Linux firewall, then when you do the upgrade, you can use something like wireshark or tshark to capture all of the web session data on the Linux box. Sure, it will be HTTPS'd, but the PS3 has to have the key for that certificate somewhere in its running image/ram available for use to decrypt what it receives. ... heck, you may not even need to do that. If you can dump the PS3 firmware, that would be enough.

The best way to use PS3 firmware would be dump the version without cinavia and the next one with cinavia. If it was 3.50 without and 3.51 with, then the next step is trivial.

The next step is to use a program to compare object files to see what has changed. Even if the image is 100MB of executeable, not all of it will have changed. Quite likely you could use binary image analysis tools to easily identify new object code that has been added as well as that which has changed. Given that this is all based on frequency stuff, all of the data to see Cinavia is likely going to be stored in static tables. Even if they were encoded, again the PS3 needs to access them at run-time so the keys to decode the Cinavia tables are going to be in the PS3 firmware somewhere.

The PS3 is the best attack vector for Cinavia because the PS3 has been root'd. Do any of the Linux-compatible versions of the PS3 support Cinavia?

Away from the PS3, you would need to find a way to attack the firmware of a normal BluRay player. Are there posts or ports inside some players that can be touched and the player switches into a debug mode, unintentionally?

Are there any vulnerabilities in the JVMs used in BluRay players that can be exploited? Consider that a BluRay disc is essentailly one big JAVA program, so are there ways to attack a BluRay player from a custom BluRay disc and get it to provide access to either the data tables for the Cinavia functions or just the Cinavia functions themselves?

Can a PS3 player be made to write a crash dump to disc whilst playing a BluRay or similar and then the disc examined outside of the PS3 and hunt for the Cinava data/functions in the dumped data?

What have Sony forgotten that can be taken advantage of?

[m.rup]

Hi, Panasonic recently released firmware v.2.64 for their BD60 player. Does anybody know if this version is infected with Cinavia?

[milkybar1983]

The PS3 has been broken. The private keys to whatever is encrytped for download are thus obtainable.

Let me explain this a bit more...

If you have a PS3 that is pre-Cinavia and have it connected to the Internet via a Linux firewall, then when you do the upgrade, you can use something like wireshark or tshark to capture all of the web session data on the Linux box. Sure, it will be HTTPS'd, but the PS3 has to have the key for that certificate somewhere in its running image/ram available for use to decrypt what it receives. ... heck, you may not even need to do that. If you can dump the PS3 firmware, that would be enough.

The best way to use PS3 firmware would be dump the version without cinavia and the next one with cinavia. If it was 3.50 without and 3.51 with, then the next step is trivial.

The next step is to use a program to compare object files to see what has changed. Even if the image is 100MB of executeable, not all of it will have changed. Quite likely you could use binary image analysis tools to easily identify new object code that has been added as well as that which has changed. Given that this is all based on frequency stuff, all of the data to see Cinavia is likely going to be stored in static tables. Even if they were encoded, again the PS3 needs to access them at run-time so the keys to decode the Cinavia tables are going to be in the PS3 firmware somewhere.

The PS3 is the best attack vector for Cinavia because the PS3 has been root'd. Do any of the Linux-compatible versions of the PS3 support Cinavia?

Away from the PS3, you would need to find a way to attack the firmware of a normal BluRay player. Are there posts or ports inside some players that can be touched and the player switches into a debug mode, unintentionally?

Are there any vulnerabilities in the JVMs used in BluRay players that can be exploited? Consider that a BluRay disc is essentailly one big JAVA program, so are there ways to attack a BluRay player from a custom BluRay disc and get it to provide access to either the data tables for the Cinavia functions or just the Cinavia functions themselves?

Can a PS3 player be made to write a crash dump to disc whilst playing a BluRay or similar and then the disc examined outside of the PS3 and hunt for the Cinava data/functions in the dumped data?

What have Sony forgotten that can be taken advantage of?

this has already been done, all info is here:

http://www.ps3devwiki.com/wiki/Talk:Playstation_Update_Package_%28PUP%29#Cinavia_DRM

although they have only succeeded in patching out the detection (only for playing files not cinavia disks). Somebody familiar with ps3 binaries needs to reverse engineer the PRX files to see exactly how cinavia works...

[SamuriHL]

http://forum.slysoft.com/showthread.php?t=54079

Just a heads up that there's speculation now that the latest trial copy of PDVD 12 adds Cinavia detection. We knew this day was coming and looks like we've arrived. The purchased version has not yet been updated but if the trial has it, we can be sure that an update to the purchased version is not far behind. Keep an eye on that thread as a SlySoft member is looking at the trial now to verify Cinavia detection is in fact in that build.

[Guest]

Maybe having the binary can ease reverse engineering of the technology.

[SamuriHL]

Let's hope so. It has now been confirmed that the trial does in fact contain Cinavia detection which means it's only a matter of time before the retail version is updated. My advise to everyone...make a backup of your current PDVD 12 install. You may want to revert back to it from time to time.

[rek1978]

Please read my post in audio encoding.I have found something...

http://forums.afterdawn.com/t.cfm/f-153/cinavia_fix_--_no_need_to_mod_or_hack-928172/

Guys read at the end....i have done somrthing similar but only with DTS sound and i bypassed cinavia in my LG blu ray player (believe it or not) may my english are not very good to explain to you.
Sorry for mentioning other forum.
I reckon doom9 is one of the best around

[Andy o]

Which post is yours? The first poster reeks of BS, but StevenNewcastle posted (http://forums.afterdawn.com/t.cfm/f-153/cinavia_fix_--_no_need_to_mod_or_hack-928172/#5718918") a clever workaround that might just work. (Short Steven: use a DTS WAV track so the player's decoder thinks it's just noise, but the receiver/decoder over SPDIF will still decode it as 5.1 DTS.)

[Andy o]

BTW, download the .exe file referenced in that first post at your own risk (https://www.virustotal.com/file/22acd070cfb6e067e7ae8ac85096bce630836e992786bead25db05bbf20907ca/analysis/1346443828/).

[Ghitulescu]

Which post is yours? The first poster reeks of BS, but StevenNewcastle posted (http://forums.afterdawn.com/t.cfm/f-153/cinavia_fix_--_no_need_to_mod_or_hack-928172/#5718918") a clever workaround that might just work. (Short Steven: use a DTS WAV track so the player's decoder thinks it's just noise, but the receiver/decoder over SPDIF will still decode it as 5.1 DTS.)

Even so, where's the hack? S/P-DIF cannot accommodate HD audio formats, so big deal :). Most methods simply concern the playback of downloaded movies on PCs and/or mediaplayers. The latter are not affected yet by cinavia.

[sexconker]

I rip my BluRays and store them on a network drive.
I currently play them through my PC hooked up to my TV via HDMI and an old HTIB via optical.

I'm currently looking at buying a new HTIB ( http://amzn.com/B0076R7K26 ) and was wondering if I'd be screwed over by Cinavia. Since the HTIB is a BluRay player, it has (or will soon have) Cinavia detection. The issue is whether or not that detection triggers on the other inputs.

If I play the file on my PC and pass the audio and video over HDMI to the HTIB (audio either as DTS/DTS-HD MA/AC3 passthrough or LPCM), would it listen in on that audio stream and throw a fit? Or would I be safe?

I could also pass 5.1 AC3 over optical and have the video go straight to the TV via HDMI.

I'm thinking I would be safe since the HTIB isn't the one decoding the source file and wouldn't know if there was a key or not. Cinavia detection only trips if the Cinavia-infected hardware has access to the source file. If it's just audio (or audio/video) decoded from an external device, it has no way of knowing whether or not it's an original.

Right?

[SamuriHL]

Correct. The Cinavia detection can only work on discs that it's playing. It can't reliably detect whether another source is properly licensed or not. Of course, that doesn't mean stupid companies won't try. What I mean is they could detect a Cinavia signal in another source and refuse to play it whether it's legitimate or not. That'd be stupid and get them sued most likely, but, it's at least possible.

[sexconker]

Thanks, that's what I figured.
If I play a file on my external device and feed audio/video to my HTIB, the HTIB can detect Cinavia in the watermark but can't do squat because it only has access to audio and video from the device, and can't verify whether or not it's an original. If I played a copied BluRay disc or a rip via a USB drive / network share, then it would have access to the file itself and would be able to know that I'm playing a rip and not an original.

I should be good to go then.

[SamuriHL]

In theory, yea. I never count out the stupidity of these companies, but, I can't see them blocking Cinavia content played outside their own blu-ray player. The detection is built into their blu-ray player and not the receiver part anyway.

[diogen]

I currently play them through my PC hooked up to my TV via HDMI and an old HTIB via optical.
I'm currently looking at buying a new HTIB...Why do you need an HTIB if you play ripped movies on your PC?

Get a decent AVR. At the moment those don't have Cinavia smarts even in theory...

Diogen.

[diogen]

...Steven: use a DTS WAV track so the player's decoder thinks it's just noise,
but the receiver/decoder over SPDIF will still decode it as 5.1 DTS.)If this does work and the PS3 can be that easily tricked
into believing the audio file's header (instead of content),
it most likely will be fixed during next firmware update.

The fix can be dead easy: reduce the volume by 0.1%.
That would be enough to turn the soundtrack into real white noise...

Diogen.

[Andy o]

Reduce the volume of what? Sony would have to actually add a feature, which I'm sure some people would be happy about (I've seen a few request or ask about it at the foobar2000 forum), which is DTS wav detection and decoding. So if Sony did that, how would you "reduce the volume" so that the decoder detects it as noise?

[sexconker]

Why do you need an HTIB if you play ripped movies on your PC?

Get a decent AVR. At the moment those don't have Cinavia smarts even in theory...

Diogen.

Because the PC is hooked up to the TV for video, and the HTIB for surround sound?

An HTIB is smaller, cheaper, cleaner, etc. than a full receiver.
I realize a receiver wouldn't have any possibility of Cinavia infection, but I don't want to shell out the extra cash for a receiver + speakers + a BluRay player.
My current Samsung HTIB has been great for 10+ years, and I'm only upgrading it because I'll have future devices that don't have optical out (Wii U, for example).

For my purposes, http://amzn.com/B0076R7K26 looks like the best option (it was $25 cheaper yesterday, damn it). That and an HDMI switcher. I don't need or want 7.1, giant or expensive speakers, etc.

[setarip_old]

Re: Evanescent software

http://forum.doom9.org/showthread.php?p=1592303&postcount=1

Right now the software is still in development and the authors report a success rate of 55% on the tested Blu-Ray discs and DVDs. The release of DVD Ranger 5 is scheduled for October 31st and will cost $89.99 plus $39.99 for the Cinavia module. Pre-order price is $69.99 – including the Cinavia module. Seeking advance payments for vaporware - Cute...

[Kerry56]

Someone claiming to be a rep for Pixbyte/IFoerster showed up over at MyCE, in this thread (http://club.myce.com/f94/cinavia-broken-pixbyte-329333/#.UF8nG6Ma5G4).

No way of verifying anything at the moment, but it does seem the software will have a 7 day trial to test its capabilities.

[Ch3vr0n]

and and every guy i know that tried to install that trial had it expire the second they clicked the "get trial key" button. Gone from 7d trail to expire by 1 button press

[Ghitulescu]

and and every guy i know that tried to install that trial had it expire the second they clicked the "get trial key" button. Gone from 7d trail to expire by 1 button press

That looks like scam to me http://www.tapeheads.net/images/smilies/scratch2.gif.

[Big Vern]

and and every guy i know that tried to install that trial had it expire the second they clicked the "get trial key" button. Gone from 7d trail to expire by 1 button press

Yep, same here! I even emailed them about it, and have not yet had a reply.
Make your own minds up ;)

[mike20021969]

and and every guy i know that tried to install that trial had it expire the second they clicked the "get trial key" button. Gone from 7d trail to expire by 1 button press

Yep, same here!

There's a possible scenario for that happening here:
http://forum.slysoft.com/showpost.php?p=353781&postcount=39

[setarip_old]

Curiouser and curiouser:

1) If a 7 day pre-release trial is truly available now, the developers would appear to be giving the folks over at Verance an unnecessary heads up to defeat this software, prior to the stated 10/31 release date

2) Posts indicate thusfar the authors report a success rate of 55% on the tested Blu-Ray discs and DVDs...It will be also tested on PS3, various Blu-ray players and PowerDVD.

A) One would expect, based on the nature of Verance/"Cinavia" protection, methodology would be either 100% successful or 0% successful

B) Not yet tested on PS3 (The world's largest implementation of Verance/"Cinavia"), various Blu-ray players, PowerDVD - Doesn't leave too much of the real world that it could have been tested on

In light of the fact that informational posts are supposedly coming from Spain, perhaps something is being lost in the translation. I say this because, if not due to translation, my interpretation of these informational posts is that they appear to clearly indicate (almost in an "in your face" way) that the community is being tested and/or taunted...

[bryguy12]

The 55% is just poor reporting. Their original 'press release' stated "Approx. 55% of all reported Blu-ray Region A/B disks and DVDs have been successfully tested so far". That doesn't mean 45% failed, just (maybe) that they've only had access to 55% of the known discs with Cinavia.
And my tea-leaf and chicken bone readings feeling? -- this transcoder is vaporware.

[setarip_old]

A bit of information from my (ever-aging) memory banks - The following is part of a post at the Myce Forum, purportedly a "team member" working on this program-in-progress: 2005, The DVD-Ranger team released as first company in the whole world a free and opensource software "ShrinkTo5".

1) It was never truly free - To attempt to be legitimate, you had to trackdown and purchase the core "machinist.dll". You could then choose to either use a "no cost" version laden with adware (and, likely, spyware) or, as I recall, pay $15 to $20 for the "Shrinkto5" skeleton (did not include "machinist.dll).

2) DVD Shrink was ALWAYS 100% free and NEVER contained any adware or spyware.

3) DVD Shrink was around for several years before Shrinkto5 and its constantly problematic "heuristic" programming appeared.

4) If anyone can locate the Shrinkto5 Forum (archives or otherwise, I couldn't find it), among other things, you'd get the overall flavor/sense that the Shrinkto5 folks were constantly trying to catch up with DVD Shrink - and, IIRC (Don't hold me to this), later with RipIt4Me. This same forum contained MANY posts of "Where's my refund?" and "Where do I find the newest Machinist.dll?"

At the risk of being repetitive, I strongly suggest you keep your money in your wallet for the time being.

Perhaps these folks would consider providing test versions of their Verance/"Cinavia"disruption module to the moderating staff of Doom9 for independent testing and evaluation?

[Chetwood]

I deleted ShrinkTo5 after my first test run, LOL. But you know, there's a sucker born every minute. Just think of the jackasses that release a "new" DVD Shrink every year, ripping of uninformed customers.

[setarip_old]

If I understand correctly, the information at the following link might very well make "Verance/"Cinavia" disappear as a concern for PS3 users:

http://forum.digital-digest.com/f145/new-ps3-hack-may-irreversible-96025.html

[SamuriHL]

It should be noted that tmt5 now has Cinavia detection. All those who doubted that software players would see cinavia can become true believers. I had no doubt. ;)

Sent from my Xoom using Tapatalk 2

[setarip_old]

It should be noted that tmt5 now has Cinavia detectionWon't that possibly leave things open for (easier) reverse engineering?

[SamuriHL]

Won't that possibly leave things open for (easier) reverse engineering?

Not with the way ArcSoft implemented it. Possibly with Cyberlink's implementation. However, that remains to be seen at this point. ArcSoft's implementation is nasty.

[billqs]

I know we have "no one on the inside", but since I use both PowerDVD 11 and Arcsoft TMT 3 with 3D plugin, do we imagine they will add the Cinavia "feature" to these already released products as well?

[SamuriHL]

Since neither product is currently sold anymore, I seriously doubt Cinavia will be retrofitted into those legacy products.

[billqs]

I went to the linked list on Discs and players that have been "Cinaviad". The player list looks pretty sparse. I may be picking up a more recent 3D BD player for my Home Theater and wondered which one might be safe. I know to avoid players made after February of this year.

[Big Vern]

Well, Halloween has come and gone, and this DVD ranger "cinavia buster" is still on pre-order.

[[SLiM]D12]

Well, Halloween has come and gone, and this DVD ranger "cinavia buster" is still on pre-order.

Yep -- it aint coming. Poor people that pre-ordered and got nothing out of it.

[Ch3vr0n]

Oh and here's what they do when you ask for a refund with PayPal for failure to deliver. Check the note on the refund. They say they don't blacklist. Proof sais otherwise.

Posted by brcs over at the slysoft forums.

-----------

Oh and this is what you get if you request file a dispute with them from paypal for non delivery of dvdrangers product.

Total amount:
$19.99 USD
Fee amount:
$0.00 USD
Net amount:
$19.99 USD
Refund:
$19.99 USD to PayPal balance

Date:
Nov 1, 2012
Time:
00:11:11 PDT
Status:
Completed

Subject:

IFoerster Development
Note:

Blacklisted for any additional purchases.


http://forum.slysoft.com/showpost.php?p=356696&postcount=136

-----------

Verstuurd van mijn HTC Sensation XE with Beats Audio Z715e met Tapatalk

[SamuriHL]

You mean you won't be able to able to purchase it when they release their amazing Cinavia killing product? Darn.

[setarip_old]

As I said on September 23rd regarding the purported "DVD Ranger" Cinavia removal program: Seeking advance payments for vaporware - Cute...

[Xplic1T]

Obviously this is a bust ... it was nothing more than screwing people out of money. Cinavia's echoing algorithm is built into movie/dvd/br presses of the media and is only going to become more prevalent with future releases. I dont believe we can just filter it out because it's built into the core audio itself ... we just dont notice it because the echoing is constant and in miliseconds ... so what can we do ? Screw Cinavia and buy a HTPC or some blu-ray player that doesn't detect cinavia. End of story ... oh and who cares if Cyberlink or Arcsoft now support it ? Get yourself VLC and stop worrying.

Either way id rather spend 70 bucks towards a G-box than 20 bucks on some pipe dream that hasn't been verified by anybody.

[SamuriHL]

I personally use J River MC18 with LAV Filters, madVR, and rip my blu-rays to MKV with MakeMKV and AnyDVD. What's a "cinavia" again? Oh, right, that thing that doesn't impact me. :D MC18 can also play blu-ray discs which is great for when I rent stuff from Netflix and just want to watch it. No menus, no previews, no nonsense...just a high quality movie. I'm a huge advocate of the HTPC approach. :)

[Ch3vr0n]

So they're 3 days overdue now with the release. No official public statement, still the possibility to "pre-order" their "cinavia module". I wonder what's going on on the forums. Must be alot of pissed of customers by now cause they failed to live up to the promise. I'm curious but i refuse to register just to get a peek. Anyone with an account over there that could shed some light ? ^^

[Big Vern]

So they're 3 days overdue now with the release. No official public statement, still the possibility to "pre-order" their "cinavia module". I wonder what's going on on the forums. Must be alot of pissed of customers by now cause they failed to live up to the promise. I'm curious but i refuse to register just to get a peek. Anyone with an account over there that could shed some light ? ^^

Tried to create an account!

They have a security question, "what is the name of our software". I typed in DVD Ranger, and that is wrong, according to them. I tried many variants of DVD ranger as well, lower case, upper case, none worked. Seems like you can't even register an account.

[mike20021969]

I wonder what's going on on the forums. Must be alot of pissed of customers by now cause they failed to live up to the promise. I'm curious but i refuse to register just to get a peek. Anyone with an account over there that could shed some light ?

Wonder no more... their forum is as dead as a dodo.
There's currently more life on Mars :D

The vast majority of posts are by an administrator who goes by the username ReadMeToo®

[Ch3vr0n]

Lol no surprise there then. That's what you get for making such huge claims and not live upto them. That's what i love about slysoft, they neither make such claims nor do release dates. Stuff will be ready when its ready, no eta = you can't disappointed ppl except maybe a little for keeping them waiting.

Verstuurd van mijn HTC Sensation XE with Beats Audio Z715e met Tapatalk

[mike20021969]

Lol no surprise there then.

Forum screenshot download (jpg image requires lots of scrolling):

http://www24.zippyshare.com/v/74298668/file.html

[cynthia_old]

Stuff will be ready when its ready, no eta = you can't disappointed ppl except maybe a little for keeping them waiting.

The admin of the support forum posted this some hours ago.

I know they are working on a few bugs but I like you have no idea when it will be ready and waiting as well

There is no scam Trust me on this one it will be released when its ready

http://www.dvdrangersupportforum.info/index.php?topic=3172.0