Advice on Bus Encrypted Blu-Rays

[HaloSlayer255]

Hello all,

I thought I'd try to get the key for Night at the Museum: Secret of the Tomb

The FindVUK program reports this

0x9E4313865AA282ED0722688FE2B2C836056FAD1A = Night at the Museum 3 (Night at the Museum: Secret of the Tomb
) | V | 0x13F583B9948971DF822A611BC69A5E5E ; MKBv47/BD+/BEE/VUKNOTVAL!/FindVUK 0.83


When I try to launch bd_info /dev/sr0 it outputs this:

syntax error: line 10412
bad entry at or around line 10411
syntax error: line 10412
bad entry at or around line 10412
aacs.c:470: Error calculating media key. Missing right processing key ?
dec.c:208: aacs_open() failed!
aacs.c:295: get_aacs_data(MEDIA_VID): libaacs not initialized!
aacs.c:295: get_aacs_data(MEDIA_KEY): libaacs not initialized!
dec.c:237: BD+ initialization failed (no AACS ?)
Volume Identifier : Night at the Museum 3
BluRay detected : yes
First Play supported: yes
Top menu supported : yes
HDMV titles : 5
BD-J titles : 86
UNSUPPORTED titles : 0

BD-J detected : yes
BD-J supported : yes
Java VM found : yes
BD-J handled : yes
BD-J organization ID: 7fff646c
BD-J disc ID : 0000000000000000000000000000047a

AACS detected : yes
libaacs detected : yes
Disc ID : 9E4313865AA282ED0722688FE2B2C836056FAD1A
AACS MKB version : 47
AACS handled : no
(no matching processing key)

BD+ detected : yes
libbdplus detected : yes
BD+ handled : no

Application info:
initial mode preference : 2D
3D content exists : No
video format : 1080p (0x6)
frame rate : 23.976 Hz (0x1)
provider data : ' Provider Name'

Disc library metadata:
Metadata file : bdmt_eng.xml
Language : eng
Disc name : Night at the Museum: Secret of the Tomb

Alternative : <undefined>
Disc # : 1/1
TOC count : 1
Title 1: Night at the Museum: Secret of the Tomb

Thumbnail count : 2
natm3_jacketpic_large_sml.jpg
natm3_jacketpic_large.jpg


Any advice is greatly appreciated. Just to my note the folder structure in Linux goes like this, correct?

/home/username/.config/aacs
/home/username/.config/aacs/device_binding_id
/home/username/.config/aacs/KEYDB.cfg
/home/username/.config/bdplus/vm0
/home/username/.config/bdplus/vm0/aes_keys.bin
/home/username/.config/bdplus/vm0/device_discovery_1.bin
/home/username/.config/bdplus/vm0/device_discovery_2.bin
/home/username/.config/bdplus/vm0/device_discovery_3.bin
/home/username/.config/bdplus/vm0/device_discovery_4.bin
/home/username/.config/bdplus/vm0/device_discovery_5.bin
/home/username/.config/bdplus/vm0/ecds_keys.txt
/home/username/.config/bdplus/vm0/mem_area_02.bin
/home/username/.config/bdplus/vm0/mem_area_03.bin
/home/username/.config/bdplus/vm0/mem_area_04.bin
/home/username/.config/bdplus/vm0/mem_area_05.bin
/home/username/.config/bdplus/vm0/mem_area_06.bin
/home/username/.config/bdplus/vm0/mem_area_07.bin
/home/username/.config/bdplus/vm0/mem_free.bin
/home/username/.config/bdplus/vm0/memory.map
/home/username/.config/bdplus/vm0/mem_player_executable.bin
/home/username/.config/bdplus/vm0/mem_player_name.bin
/home/username/.config/bdplus/vm0/mem_player_version.bin
/home/username/.cache/aacs/vuk
/home/username/.cache/aacs/vuk/vuk (KEYDB.cfg renamed to just vuk)


Thanks in advance for any advice/help,
HaloSlayer255

[nalor]

Just a small note from my side: BEE is only enabled in case the disc requests it and the drive supports it - so in case the drive doesn't support it you will never have troubles with it.
I have 3 bluray drives and only 1 of them is capable of bus encryption..
I've also read somewhere that this feature is firmware dependent - so eventually you'll find a different firmware for your drive without the bus encryption support... (I think it was this thread here: slysoft forum (https://forum.slysoft.com/threads/drives-with-without-bus-encryption.52462/) )

[HaloSlayer255]

Thank you for the info nalor,

The drive I use is a Pioneer BDR-2209 capable of writing BDXL media, I forget which product revision it is, but got it from http://www.newegg.com/Product/Product.aspx?Item=9SIA85V3F50324&cm_re=BDR-2209-_-27-129-076-_-Product from newegg not the other outletpc seller.

Is there a way I can see if the drive utilizes BEE?
Also what sites have modified firmware, if those would be possible? I was able to find this firmware page: http://pioneer.jp/device_e/product-e/ibs/device_e/dev00002r_e.html#BDR-209EBK and also http://www.firmwarehq.com/Pioneer/BDR-209M/files.html

---Edit---
Found some interesting lines in FindVUK, uploaded to post.
As a quick question, could I create a .iso file then use this to verify the VUK? Speaking of which, how do I verify the key manually?
---End Edit---

Thanks in advance,
HaloSlayer255

[nalor]

I think the idea with the iso file is a great one :goodpost:

you need to create an iso with the DRM unmodified (e.g. in Passkey this is the option 'Keep protection') and when you mount this iso in a virtual drive you can also use findvuk again to get the VUK and I think the validation should be possible in this case also :)

I'm pretty sure that no virtual drive will support bus encryption - so this way it should always be possible to validate the vuk :)

Another option to validate the vuk yourself would be to simply use a bluray player that uses the keydb.cfg file and takes care of the bus encryption.
Basically libaacs is capable of handling the bus encryption - but it always failed for me - eventually it needs a valid processing key for the encryption? So I think it's not possible to handle the bus encryption with only the VUK and this is the reason why there's no support for it in FindVUK...

But I've found something interesting in your logfile: the meta-title for 'Night at the museum 3' ends with a linebreak... strange thing ;)
Eventually this line break is now also present in the keydb.cfg and might render this particular entry unuseable... (this might be the reason for your problems in linux?) - in case there's a linebreak in this line please remove it - I will improve the findvuk code for meta-title handling so that linebreaks are removed automatically...
And I think it would be a good thing to write the model of the drive also to the logfile...shouldn't be that hard to get this detail..

[HaloSlayer255]

Hello again nalor,

Turns out the linebreak issue must have been the cause, removing it and making it one line results in vlc playing the disk. Will add the entry to the database soon.

Kinda funny, I would probably never have stumbled upon this info if not for switching to Arch linux. I mainly use windows for the FindVUK program and a android program bluestacks.

Still will probably create the iso just to be safe.

Thanks for the info and help,
HaloSlayer255

[nalor]

released FindVUK 0.84 - it corrects the problem with the linebreak in the metatitle.

[HaloSlayer255]

Many thanks nalor,

The program keeps getting better and better, never believed I'd help out with debugging some of it.
Looks like this thread has served its purpose, I guess just let it lock itself after some time.

HaloSlayer255

[dizzier]

You can read quite detailed description of bus encryption in libaacs commit log: http://git.videolan.org/?p=libaacs.git;a=commit;h=583df16fa867ccda948a6c760ee8912684fb7b9d
In short, it will work with libaacs, but you need a working host certificate. The processing key has nothing to do with it (if you have a valid VUK you don't need that, as always).

[nalor]

That's an interesting commit you've linked here - but in the end it says: bus encryption is more or less unreachable for us because I'm not not aware of any working host certificate that can be used. :(

So the only way is to use drives that aren't BusEncryptionCapable and with them it's possible to play blurays as long as you know the VUK (and the disc isn't BD+ protected)...

[dizzier]

That's an interesting commit you've linked here - but in the end it says: bus encryption is more or less unreachable for us because I'm not not aware of any working host certificate that can be used. :(

Try this one:
| HC | HOST_PRIV_KEY 0x27263F402E2D6DB56B1FB7BB4524C6CD5C9F2EF4 \
| HOST_CERT 0x0201005CFFFF800001460000952D611B06911B0E \
0xAEE577D3715D1FA0E405914068752559DFBD845C \
0xB80F4FEE04A40B8FED842ACB78F9F898AEC39540 \
0x9E929C55A20A7EE853509BB84D8FB0DC99E5CAC5 \
0xF239F0CD79B38C0678702B1C

[nalor]

Great - this one is working for me! :)

So I'll try to include BEE support into FindVUK during the weekend.. :)

[HaloSlayer255]

Great - this one is working for me! :)

So I'll try to include BEE support into FindVUK during the weekend.. :)

I'll store the .iso file to test functionality later :cool:

[nalor]

Hmm.. I don't think this will work - to test BEE support you need a real disc that requires BEE in real drive that is BEC - so I don't think the iso will be of much use.. :(

[HaloSlayer255]

Hello nalor,

I can still test using Divergent.

[libredr]

Try this one:
| HC | HOST_PRIV_KEY 0x27263F402E2D6DB56B1FB7BB4524C6CD5C9F2EF4 \
| HOST_CERT 0x0201005CFFFF800001460000952D611B06911B0E \
0xAEE577D3715D1FA0E405914068752559DFBD845C \
0xB80F4FEE04A40B8FED842ACB78F9F898AEC39540 \
0x9E929C55A20A7EE853509BB84D8FB0DC99E5CAC5 \
0xF239F0CD79B38C0678702B1C

Hi dizzier. Thanks for posting this. Up to which MKB version does it work?

[dizzier]

Hi dizzier. Thanks for posting this. Up to which MKB version does it work?

The latest MKB I've seen is 57 and it is not revoked there. I don't know how about later versions.

[libredr]

The latest MKB I've seen is 57 and it is not revoked there. I don't know how about later versions.

Thanks a lot. Just used it with my drive "updated" to MKBv50 and indeed it was working using aacskeys on Linux.

However, we cruelly miss PK for MKB over v28. I cannot decrypt discs over v28 directly for this reason (I can use the LG firmware hack though to bypass AACS checking). Do you know if there is any new PK around?

[dizzier]

Do you know if there is any new PK around?

I have no idea.

[candela]

Try this one:
| HC | HOST_PRIV_KEY 0x27263F402E2D6DB56B1FB7BB4524C6CD5C9F2EF4 \
| HOST_CERT 0x0201005CFFFF800001460000952D611B06911B0E \
0xAEE577D3715D1FA0E405914068752559DFBD845C \
0xB80F4FEE04A40B8FED842ACB78F9F898AEC39540 \
0x9E929C55A20A7EE853509BB84D8FB0DC99E5CAC5 \
0xF239F0CD79B38C0678702B1C

It seems the certificate has now been revoked by my drive. It must be revoked somewhere between MKBv57 and MKBv61

[dizzier]

It seems the certificate has now been revoked by my drive. It must be revoked somewhere between MKBv57 and MKBv61

That's a pity ;( Try this one ;)
| HC | HOST_PRIV_KEY 0x5F291AE7CF68D67F58689A4CBFE2953064539FAA \
| HOST_CERT 0x0203005CFFFF8000018900003E7C4B0931C0045D \
0xFB017F24B1557F5BD0AF5B961FBC1B43519F9023 \
0xA1E84A3E8C06967B76469CC86527AA3807258C58 \
0xE00F73971F9BC8353165476454911E3A9D07D742 \
0x980598BFF9B3DF5EA18E0C7F

[candela]

That's a pity ;( Try this one ;)
| HC | HOST_PRIV_KEY 0x5F291AE7CF68D67F58689A4CBFE2953064539FAA \
| HOST_CERT 0x0203005CFFFF8000018900003E7C4B0931C0045D \
0xFB017F24B1557F5BD0AF5B961FBC1B43519F9023 \
0xA1E84A3E8C06967B76469CC86527AA3807258C58 \
0xE00F73971F9BC8353165476454911E3A9D07D742 \
0x980598BFF9B3DF5EA18E0C7F

Thanks it works with VLC (it generated VUK for MKBv4 disc) but with aacskeys-0.4.0e I get an error


Problem with verifying the host signature.

ERROR: AACSVERYIFHOST, errnr: -1



Any idea why that is? It always worked with your previous certificates. Copied like this in HostKeyCertificate.txt

5F291AE7CF68D67F58689A4CBFE2953064539FAA
0203005CFFFF8000018900003E7C4B0931C0045DFB017F24B1557F5BD0AF5B961FBC1B43519F9023A1E84A3E8C06967B76469CC86527AA3807258C58E00F73971F9BC8353165476454911E3A9D07D742980598BFF9B3DF5EA18E0C7F

[dizzier]

Because there is additional bit set in the certificate. This has nothing to do with disc playback (the additional bit is related to disc writing), but aacskeys stubbornly refuses to load such certificate. You must modify the condition in aacs_set_cert() function in aacs_ecdsa.cpp to get it working.