candela
13th September 2022, 20:41
The last known public Host Certificate (HC) needed for Blu-ray playback has been revoked in MKBv82. As the amount of discs with a newer MKB version increases, more and more people will find themselves in the situation where their drives have permanently revoked this HC. When relying on libaacs for playback (e.g. VLC), this causes problems for new and old (!) discs as the HC is needed to retrieve the VID (aacs decryption) and the RDK (bus encryption) unless keys are cached or available in KEYDB.cfg.
Even though VID is always needed in theory to retrieve VUK/UK, in practice this is not a problem because these keys can be found using FindVUK (https://forum.doom9.org/showthread.php?t=172472) or by downloading FindVUK's KEYDB.cfg containing a large database of keys. However RDK is unique for every drive and cannot be shared in the same way. The RDK affects a minority of BD discs but 100% of UHD discs. libaacs 0.11.0 (https://forum.doom9.org/showthread.php?t=176924) supports cached RDK keys allowing playback of bus encrypted discs without a valid HC. However, to have this RDK in the libaacs cache, the disc had to be played before the certificate was revoked.
Just like FindVUK can get VUK/UK from DVDFab, it's possible to get VID/RDK from other players or rippers that contain an unrevoked HC. This guide shows you how to get these keys from MakeMKV. This is based purely on public information released by MakeMKV but it is nonobvious. Please support MakeMKV for the work that they do.
Update: Following programs automate the steps below
Windows: RDKfromMMKV by Nalor
RDKfromMMKV 0.1 (https://forum.doom9.org/showthread.php?p=1975204#post1975204)
RDKfromMMKV 0.2 (https://forum.doom9.org/showthread.php?p=1975360#post1975360)
RDKfromMMKV 0.4 (https://forum.doom9.org/showthread.php?p=1976672#post1976672)
RDKfromMMKV 0.5 (https://forum.doom9.org/showthread.php?p=1981775#post1981775)
Linux: gen-rdk.sh by Nitro322
gen-rdk.sh (https://forum.doom9.org/showthread.php?p=1979303#post1979303)
The following steps are performed on Windows but they are similar for Linux & Mac
Step 1. Install MakeMKV
Choose a version that has an unrevoked HC. As of this moment, this is v1.15.1 or later
http://makemkv.com/download/
MakeMKV v1.15.1 (15.4.2020 )
- Added support for AACS v76 (for those poor souls without LibreDrive)
If needed, register using the Beta key (https://forum.makemkv.com/forum/viewtopic.php?f=5&t=1053)
Step 2. Get a list of drives
Open a command window and run
"C:\Program Files (x86)\MakeMKV\makemkvcon.exe" f --list
Example output
Found 2 drives(s)
00: \Device\CdRom0, \Device\CdRom0, F:
HL-DT-ST_BDDVDRW_GGC-H20L_1.03_20080515123456_XXXX
01: \Device\CdRom1, \Device\CdRom1, G:
ASUS_BW-16D1HT_3.00_211511031110_YYYY
Write down the drivenumber/name for the selected driveletter
Step 3. Disable LibreDrive
On supported drives, LibreDrive disables bus encryption and prevents MakeMKV from revealing the RDK. Luckily, it can be disabled
Disable LibreDrive (https://forum.makemkv.com/forum/viewtopic.php?p=75476#p75476)
There are 2 ways to pass this setting to MakeMKV:
1. Using MakeMKV config file, the setting name is sdf_Stop . On Linux / Mac that would be the following line in config:
sdf_Stop = "yourdriveid1 yourdriveid2"
On Windows this would be the registry variable under MakeMKV settings.
2. Or you can set environment variable SDF_STOP with the same syntax.
In the command window set the environment variable to the drivename from step 2.
set SDF_STOP=ASUS_BW-16D1HT_3.00_211511031110_YYYY
Step 4. Create an encrypted backup
In the command window (same one where step 3. is performed) run
"C:\Program Files (x86)\MakeMKV\makemkvcon" backup disc:1 "c:\temp\getrdk"
note:
- disc:1 is the drivenumber from step 2
- "c:\temp\getrdk" is a directory of your choice
Example output
MakeMKV v1.15.1 win(x86-release) started
Debug logging enabled, log will be saved as C:\Users\*/MakeMKV_log.txt
The new version 1.17.1 is available for download at http://www.makemkv.com/download/
Backing up disc into folder "c:\temp\getrdk"
Loaded content hash table, will verify integrity of M2TS files.
Once the file c:\temp\getrdk\discatt.dat is created press CTRL-C to interrupt the backup process
Step 5. Extract Drive Certificate (DC), VID and RDK
The DC, VID and RDK are present in discatt.dat. The file format is described in the MakeMKV source code that is (partially) publicly available
MakeMKV linux build & source (https://forum.makemkv.com/forum/viewtopic.php?f=3&t=224)
file makemkv-oss-1.17.1\libdriveio\inc\driveio\driveio.h states
- dicat_DriveStandard=1,
- dicat_DiscSpecific=4,
- diid_DriveCert=(dicat_DriveStandard<<24)+(3<<16)+0x38,
- diid_Aacs_VID=(dicat_DiscSpecific<<24)+(0<<16)+0x80,
- diid_Aacs_DataKeys=(dicat_DiscSpecific<<24)+(0<<16)+0x84,
i.e. the following byte sequences should be present in discatt.dat
- 01 03 00 38 00 00 00 5C [92 bytes = DC]
- 04 00 00 80 00 00 00 10 [16 bytes = VID]
- 04 00 00 84 00 00 00 20 [16 bytes = RDK]
The required bytes can be manually extracted using any hexeditor (https://alternativeto.net/feature/hex-editor/?license=opensource). A tool like Swiss File Knife (http://www.stahlworks.com/dev/swiss-file-knife.html) can immediately save the values in the correct format for later use
sfk hexdump -raw c:\temp\getrdk\discatt.dat +xex "/010300380000005C[184 bytes]/[part2]/" +hextobin c:\temp\getrdk\dc.bin
sfk hexdump -raw c:\temp\getrdk\discatt.dat +xex "/0400008000000010[32 bytes]/[part2]/" -tofile c:\temp\getrdk\vid.txt
sfk hexdump -raw c:\temp\getrdk\discatt.dat +xex "/0400008400000020[32 bytes]/[part2]/" -tofile c:\temp\getrdk\rdk.txt
To display the saved values
sfk hexdump -raw c:\temp\getrdk\dc.bin
type c:\temp\getrdk\vid.txt
type c:\temp\getrdk\rdk.txt
Example output
DC = 0101005C...
VID = 65869168F2AF4D69EDB79754B515A8AC
RDK = 96175870A5A27DEE528975C3BF6756F9
Note:
- RDK is only available if the drive supports bus encryption
- if the drive supports bus encryption, RDK is also present for discs without bus encryption even though RDK is not needed for playback
- do not post your DC on the forum. Theoretically (but unlikely) it can be revoked
Step 6. Save VID and RDK in libaacs cache
The cache files are located in a subdir of the aacs dir with the KEYDB.cfg file
- RDK: ..\aacs\rdk\[driveid]\[discid]
- VID: ..\aacs\vid\[discid]
where
- driveid = SHA1 hash of DC which is different for all your drives
- discid = SHA1 hash of the file AACS\Unit_Key_RO.inf on your Blu-ray disc
Use a tool like 7-Zip (https://www.7-zip.org) to calculate these hashes
driveid:
"C:\Program Files\7-Zip\7z" h -scrcSHA1 c:\temp\getrdk\dc.bin
discid:
"C:\Program Files\7-Zip\7z" h -scrcSHA1 G:\AACS\Unit_Key_RO.inf
note:
- G: is driveletter from step 2
Example output
driveid:
SHA1 for data: F4530616E23597A2368757EAFCFC8685C1EC38D1
discid:
SHA1 for data: B01C8C10CEA251CE65508498993E36D3FD1A7B72
Copy the VID and RDK files to the correct location, rename to discid and remove the .txt file extension
Note that you can also find these hashes by creating a libaacs log using VLC or aacs_info.exe included with libaacs
set AACS_DEBUG_MASK=65535
set AACS_DEBUG_FILE=debuglog.txt
aacs_info G:
Example debuglog.txt file (search for "\rdk")
src/file/file_win32.c:131: Opened WIN32 file
C:\Users\*\AppData\Roaming\aacs\rdk\f4530616e23597a2368757eafcfc8685c1ec38d1\b01c8c10cea251ce65508498993e36d3fd1a7b72
(00000000008b7cc0)
aacs_info.exe output will also show if the drive (device) and disc (media) have bus encryption
Bus encryption:
Device support: yes
Enabled in media: yes
Step 7. Repeat for other drives
The RDK for the disc is unique for every drive so repeat the steps for all your drives that support bus encryption
Warning: in case the firmware of a drive is updated, the RDK for all discs possible changes
FAQ
- VID can also be put in the KEYDB.cfg file instead of the local cache
- VID in combination with MK can be used to calculate VUK/UK. Device Keys for MK retrieval are public for up to MKBv82. Besides libaacs also aacskeys supports input of VID instead of using a HC
- it seems libaacs has some bugs in aacs keys calculation flow. Put both VID and MK in keydb.cfg to get the VUK in the ..\aacs\vuk\[discid] file
- RDK unlike the other keys are disc+drive specific. There is NO POINT in sharing these keys as they will not work for anyone else
- If MakeMKV is allowed to enable LibreDrive a power off is need to reset your drive and allow VLC to play bus encrypted discs
- MakeMKV used to include the tool cddump.exe (https://forum.doom9.org/showthread.php?p=1262464#post1262464) to generate the discatt.dat but it has been removed. It's unknown if there is a similar makemkvcon command to generate the file without starting a disc backup
Even though VID is always needed in theory to retrieve VUK/UK, in practice this is not a problem because these keys can be found using FindVUK (https://forum.doom9.org/showthread.php?t=172472) or by downloading FindVUK's KEYDB.cfg containing a large database of keys. However RDK is unique for every drive and cannot be shared in the same way. The RDK affects a minority of BD discs but 100% of UHD discs. libaacs 0.11.0 (https://forum.doom9.org/showthread.php?t=176924) supports cached RDK keys allowing playback of bus encrypted discs without a valid HC. However, to have this RDK in the libaacs cache, the disc had to be played before the certificate was revoked.
Just like FindVUK can get VUK/UK from DVDFab, it's possible to get VID/RDK from other players or rippers that contain an unrevoked HC. This guide shows you how to get these keys from MakeMKV. This is based purely on public information released by MakeMKV but it is nonobvious. Please support MakeMKV for the work that they do.
Update: Following programs automate the steps below
Windows: RDKfromMMKV by Nalor
RDKfromMMKV 0.1 (https://forum.doom9.org/showthread.php?p=1975204#post1975204)
RDKfromMMKV 0.2 (https://forum.doom9.org/showthread.php?p=1975360#post1975360)
RDKfromMMKV 0.4 (https://forum.doom9.org/showthread.php?p=1976672#post1976672)
RDKfromMMKV 0.5 (https://forum.doom9.org/showthread.php?p=1981775#post1981775)
Linux: gen-rdk.sh by Nitro322
gen-rdk.sh (https://forum.doom9.org/showthread.php?p=1979303#post1979303)
The following steps are performed on Windows but they are similar for Linux & Mac
Step 1. Install MakeMKV
Choose a version that has an unrevoked HC. As of this moment, this is v1.15.1 or later
http://makemkv.com/download/
MakeMKV v1.15.1 (15.4.2020 )
- Added support for AACS v76 (for those poor souls without LibreDrive)
If needed, register using the Beta key (https://forum.makemkv.com/forum/viewtopic.php?f=5&t=1053)
Step 2. Get a list of drives
Open a command window and run
"C:\Program Files (x86)\MakeMKV\makemkvcon.exe" f --list
Example output
Found 2 drives(s)
00: \Device\CdRom0, \Device\CdRom0, F:
HL-DT-ST_BDDVDRW_GGC-H20L_1.03_20080515123456_XXXX
01: \Device\CdRom1, \Device\CdRom1, G:
ASUS_BW-16D1HT_3.00_211511031110_YYYY
Write down the drivenumber/name for the selected driveletter
Step 3. Disable LibreDrive
On supported drives, LibreDrive disables bus encryption and prevents MakeMKV from revealing the RDK. Luckily, it can be disabled
Disable LibreDrive (https://forum.makemkv.com/forum/viewtopic.php?p=75476#p75476)
There are 2 ways to pass this setting to MakeMKV:
1. Using MakeMKV config file, the setting name is sdf_Stop . On Linux / Mac that would be the following line in config:
sdf_Stop = "yourdriveid1 yourdriveid2"
On Windows this would be the registry variable under MakeMKV settings.
2. Or you can set environment variable SDF_STOP with the same syntax.
In the command window set the environment variable to the drivename from step 2.
set SDF_STOP=ASUS_BW-16D1HT_3.00_211511031110_YYYY
Step 4. Create an encrypted backup
In the command window (same one where step 3. is performed) run
"C:\Program Files (x86)\MakeMKV\makemkvcon" backup disc:1 "c:\temp\getrdk"
note:
- disc:1 is the drivenumber from step 2
- "c:\temp\getrdk" is a directory of your choice
Example output
MakeMKV v1.15.1 win(x86-release) started
Debug logging enabled, log will be saved as C:\Users\*/MakeMKV_log.txt
The new version 1.17.1 is available for download at http://www.makemkv.com/download/
Backing up disc into folder "c:\temp\getrdk"
Loaded content hash table, will verify integrity of M2TS files.
Once the file c:\temp\getrdk\discatt.dat is created press CTRL-C to interrupt the backup process
Step 5. Extract Drive Certificate (DC), VID and RDK
The DC, VID and RDK are present in discatt.dat. The file format is described in the MakeMKV source code that is (partially) publicly available
MakeMKV linux build & source (https://forum.makemkv.com/forum/viewtopic.php?f=3&t=224)
file makemkv-oss-1.17.1\libdriveio\inc\driveio\driveio.h states
- dicat_DriveStandard=1,
- dicat_DiscSpecific=4,
- diid_DriveCert=(dicat_DriveStandard<<24)+(3<<16)+0x38,
- diid_Aacs_VID=(dicat_DiscSpecific<<24)+(0<<16)+0x80,
- diid_Aacs_DataKeys=(dicat_DiscSpecific<<24)+(0<<16)+0x84,
i.e. the following byte sequences should be present in discatt.dat
- 01 03 00 38 00 00 00 5C [92 bytes = DC]
- 04 00 00 80 00 00 00 10 [16 bytes = VID]
- 04 00 00 84 00 00 00 20 [16 bytes = RDK]
The required bytes can be manually extracted using any hexeditor (https://alternativeto.net/feature/hex-editor/?license=opensource). A tool like Swiss File Knife (http://www.stahlworks.com/dev/swiss-file-knife.html) can immediately save the values in the correct format for later use
sfk hexdump -raw c:\temp\getrdk\discatt.dat +xex "/010300380000005C[184 bytes]/[part2]/" +hextobin c:\temp\getrdk\dc.bin
sfk hexdump -raw c:\temp\getrdk\discatt.dat +xex "/0400008000000010[32 bytes]/[part2]/" -tofile c:\temp\getrdk\vid.txt
sfk hexdump -raw c:\temp\getrdk\discatt.dat +xex "/0400008400000020[32 bytes]/[part2]/" -tofile c:\temp\getrdk\rdk.txt
To display the saved values
sfk hexdump -raw c:\temp\getrdk\dc.bin
type c:\temp\getrdk\vid.txt
type c:\temp\getrdk\rdk.txt
Example output
DC = 0101005C...
VID = 65869168F2AF4D69EDB79754B515A8AC
RDK = 96175870A5A27DEE528975C3BF6756F9
Note:
- RDK is only available if the drive supports bus encryption
- if the drive supports bus encryption, RDK is also present for discs without bus encryption even though RDK is not needed for playback
- do not post your DC on the forum. Theoretically (but unlikely) it can be revoked
Step 6. Save VID and RDK in libaacs cache
The cache files are located in a subdir of the aacs dir with the KEYDB.cfg file
- RDK: ..\aacs\rdk\[driveid]\[discid]
- VID: ..\aacs\vid\[discid]
where
- driveid = SHA1 hash of DC which is different for all your drives
- discid = SHA1 hash of the file AACS\Unit_Key_RO.inf on your Blu-ray disc
Use a tool like 7-Zip (https://www.7-zip.org) to calculate these hashes
driveid:
"C:\Program Files\7-Zip\7z" h -scrcSHA1 c:\temp\getrdk\dc.bin
discid:
"C:\Program Files\7-Zip\7z" h -scrcSHA1 G:\AACS\Unit_Key_RO.inf
note:
- G: is driveletter from step 2
Example output
driveid:
SHA1 for data: F4530616E23597A2368757EAFCFC8685C1EC38D1
discid:
SHA1 for data: B01C8C10CEA251CE65508498993E36D3FD1A7B72
Copy the VID and RDK files to the correct location, rename to discid and remove the .txt file extension
Note that you can also find these hashes by creating a libaacs log using VLC or aacs_info.exe included with libaacs
set AACS_DEBUG_MASK=65535
set AACS_DEBUG_FILE=debuglog.txt
aacs_info G:
Example debuglog.txt file (search for "\rdk")
src/file/file_win32.c:131: Opened WIN32 file
C:\Users\*\AppData\Roaming\aacs\rdk\f4530616e23597a2368757eafcfc8685c1ec38d1\b01c8c10cea251ce65508498993e36d3fd1a7b72
(00000000008b7cc0)
aacs_info.exe output will also show if the drive (device) and disc (media) have bus encryption
Bus encryption:
Device support: yes
Enabled in media: yes
Step 7. Repeat for other drives
The RDK for the disc is unique for every drive so repeat the steps for all your drives that support bus encryption
Warning: in case the firmware of a drive is updated, the RDK for all discs possible changes
FAQ
- VID can also be put in the KEYDB.cfg file instead of the local cache
- VID in combination with MK can be used to calculate VUK/UK. Device Keys for MK retrieval are public for up to MKBv82. Besides libaacs also aacskeys supports input of VID instead of using a HC
- it seems libaacs has some bugs in aacs keys calculation flow. Put both VID and MK in keydb.cfg to get the VUK in the ..\aacs\vuk\[discid] file
- RDK unlike the other keys are disc+drive specific. There is NO POINT in sharing these keys as they will not work for anyone else
- If MakeMKV is allowed to enable LibreDrive a power off is need to reset your drive and allow VLC to play bus encrypted discs
- MakeMKV used to include the tool cddump.exe (https://forum.doom9.org/showthread.php?p=1262464#post1262464) to generate the discatt.dat but it has been removed. It's unknown if there is a similar makemkvcon command to generate the file without starting a disc backup