Parental Control Skip

[maksa]

I have backed up Predator I and removed with DVD Stripper all the junk before Main Menu. But if the parental control on my DVD is set below "unlimited" it gets stuck in a black screen, wont even show pasword menu from the standalone. I tried to modify VIDEO_TS.IFO to play meny right away (2Cool's Guide, but doesn't work. ANy ideas how to completely skip parental control.

Regards....

[jeanl]

I'v never done that before but if I were you, I'd open my DVD with Pgcedit and try to find the commands where the player's parental control level is looked up (sprm(13)). Pgcedit has a search field at the bottom of the main window. Then I'd try to modify the commands to act as if the player's parental control was set to unlimited (I believe that would be 15). Check for details here (http://www.dvd-replica.com/DVD/sprm.php) and here (http://dvd.sourceforge.net/dvdinfo/sprm.html).
Also (and maybe simpler), you could actually set the parental control in the player from the first-play PGC by simply adding this as your first line in the precommands:
[00 03 00 00 00 00 0F 02] 1 (SetTmpPML) Set parental level =(mov) 15(none), Goto line 2
but this might require you to enter a passwd upon playback :(

Let us know if you manage to do it, that could help lots more people...

Jean

[r0lZ]

I'm not sure the SetTmpPML will work. This command sets the temporary parental level, ie. SetTmpPML checks the parental level from a specific PGC, but do not change the SPRM 13. However, I'm not sure about that. BTW, is it somebody here able to clarify?

I think the global parental level for the whole DVD is stored in the VMG_PTL_MAIT table, and is not modifiable via commands. IMHO, to get rid of the parental control, you have to delete the whole table. Actually, it is possible to remove this table with a trick in PgcEdit:
1) Load the DVD in PgcEdit.
2) Control-Double-Middle-Click (yes, you must press Control and double click with the middle mouse button!) on the "PGC" selector menubutton. This will open a console, used normally to debug.
3) In the console, type in exactly set ::raw_sectors(0,VMG_PTL_MAIT) ""and press Return.
4) Save the DVD.

Let me know if it works for you. If so, I will add a "Remove parental control" menu in PgcEdit. It's so simple! :)

You should also search for SetTmpPML commands in the PGCs, and replace them with GOTOs.

[jeanl]

I must say I'm confused as to how parental control works (i.e. what are the interactions between the VMG_PTL_MAIT table and SPRM 13.
However I found this (http://www.videohelp.com/forum/archive/t216987.html) interesting thread (look at the bottom), where someone successfully used IFOEdit to remove parental control altogether.
I'm still totally confused! It'd be great if someone could clarify.
Jeanl

[r0lZ]

@jeanl

The thread you mentionned is probably right.
To get rid of the parental control, you have to delete the whole table or reset the parental level to 0 in the table. I think deleting the whole table is still a good solution, because it is obvious that there is no parental control if there is no table.
However, I don't know the behavior of SetTmpPML if the table is missing.

[maksa]

it didn't work. Than I tried to change value for all levels in all VTS to 0 (one guy suggested 32657 - 8000 HEX) and it didn't work. SPRM13 i don't know how to change. I'll try erasing VMG_PTL_MAIT table as r0IZ suggested and report. Thanks for your effort.

[2COOL]

@maksa

Try this in IfoEdit. In your VIDEO_TS.IFO / VMGM_MAT, set this value to 0.

[000000cc] Start offset of VMG_PTL_MAIT 0 [00000000]

[jeanl]

Try this in IfoEdit. In your VIDEO_TS.IFO / VMGM_MAT, set this value to 0.
[000000cc] Start offset of VMG_PTL_MAIT 0 [00000000]
I understand that this indicates that there's no parental control table. But apparently, there are parental control masks for each titles in the TT_SRPT table! Is it going to work if there's no VMG_PTL_MAIT table, but each title still has a mask?
Do you guys know where to find a good description of how parental control actually works? I'm puzzled about a few things:
- How does the VMG_PTL_MAIT work? (is it that the player compares its current control level with the corresponding mask and checks that the title is playable under this level?). Does bit n of the mask indicate that title n is playable? Does this involve SPRM(13) directly (or is it all done "under the hood" with no specific pre/post commands)?
- If so, when is SPRM(13) used? It is to branch to alternate content (or skip) depending on the parental level?
- What are the parental control masks in TT_SRPT and how are they used?

I checked DVD-Replica and and DVDSourceforge.net but couldn't get any useful info...
Jeanl

[2COOL]

@jeanl

Originally posted by jeanl
But apparently, there are parental control masks for each titles in the TT_SRPT table! Is it going to work if there's no VMG_PTL_MAIT table, but each title still has a mask?I'm not the expert on this matter but if there is anything other than a zero, then try zeroing the masks out just in case. I forgot about the masks.

In VIDEO_TS.IFO / VMG_PTT_SRPT

Title_1: Parental ID field 0


In VTS_*_0.IFO / VTS_PGCITI

VTS_PGC_1: Category Parental ID mask 0


Since we don't have any hardcore specs to reference, we just have to trial and error for now. ;)

[jeanl]

Since we don't have any hardcore specs to reference, we just have to trial and error for now.
You know what, I once took a look at the official technical reference and believe me, it's not extremely helpful unless you're willing to invest hours to try to understand it!
Trial and error is our fate, and in fact, reverse-engineering this beast is half of the fun anyway ;)

Jeanl

[2COOL]

There's also the SetTmpPML commands in the PGCs to contend with. Just do a search for "SetTmpPML" in PgcEdit and when you find any, double-click on them to edit and check on [X] none.

BEFORE:

[00 03 00 00 00 00 01 03] 1 (SetTmpPML) Set parental level =(mov) 1, goto line 3

AFTER:

[00 03 00 00 00 00 0F 03] 1 (SetTmpPML) Set parental level =(mov) 15(none), Goto line 3

If the first edit don't work, then convert to GoTo command. Alphabetically > GoTo.

[00 01 00 00 00 00 00 03] 1 Goto line 3

[maksa]

Tried all you guys suggested. Step-by-step, then sequentially, applied first advice, than second, than,3rd & 4th, didn't work. It hangs PowerDVD when set for PG level less than "Unlimited". Tried all of them together, same. Cleared in each VTS__.IFO VMGR_PG_UT value of PARENTAl ID MASK from 128 to 0. Same. Maybe Predator I is authored so every PGC has its own parental lock. It passes Main Menu and when you press Play Film or anything else goes to dummy VTS07 and hangs there.

So, I was pissed, and beware of pissed Serb. Went back to PGCEdit. Removed VMG_PTL_MAIT Table as r0IZ suggested. But that is not enough! On Unofficial DVD Specs site, they say SPRM(13) is parental control. It is given by standalone (or software player) and it is R/W. So, I looked in the structure of the DVD, line by line, and replaced coomands refering to SPRM(13) e.g.

Set gprm(0)=mov sprm(13:parental level) with constant value 8:
Set gprm(0)=mov 8 ".."

Seems logical because sprm(13) is read from hardware and used in conditional jumps in DVD commands. Simply erasing it would disturb further commands. I think this fooled DVD into thinking that Parental level is set to Adult(8). That is not all. SPRM(13) could be changed (R/W), so you have to check any instances of seting that register. I found one in VTS1 (film) setting gprm(13) to SPRM(13). Replaced that too with 8. But, still things to do. Remember Teporary parental Command. You have to change all instances to level 15. Saved the DVD. Tried it on PowerDVD set to G and it worked. Tomorrow I'll try it on DVD-RW and Ronin & Cyberhome that I have.

Word of caution is that sprm13 could be referred anywhere in the DVD. Some DVDs have seamles Parental Control, so they change angle depending on the setting of the player. Some others are simple. This one wasn't so simple, but kill the bastard.

Hope it helps,
thank you all!

[jeanl]

Yepeeee! You conquered the beast!
AH! Good job.
It appears in this case, parental control was done on a "command" basis, probably PGC by PGC. That was my naive assumption (that you'd find commands here and there refering to SPRM(13)), since I didn't know about the VMG_PTL_MAIT Table.
As usual with the DVD specs, it's probably true that there's many different ways of doing parental control (one being the VMG_PTL_MAIT Table, another using SPRM(13) in commands).
I'm puzzled that the code was indeed setting SPRM(13), as I thought that this would pop a menu on your player asking for a passwd (I think I read that on DVD-Replica, or somewhere else).

Let us know how it goes with the other DVDs! Maybe r0lZ can come up with a nifty macro that would kill the beast in all cases ;)

Jeanl

[sweetness]

@maksa
try not to blank the parental control screen in your menu,where your dvd hangs(i think there's something in those button commands that you blanked) if you clear all the tables and leave that screen untouched it shouldn't hang there and it make things alot easier.

[2COOL]

@maksa

I wish I had your DVD to check it out but since I don't, I have to do it virtually. Now, there's something on my mind about your last post ...

Originally posted by maksa
So, I looked in the structure of the DVD, line by line, and replaced coomands refering to SPRM(13) e.g.

Set gprm(0)=mov sprm(13: parental level) with constant value 8:
Set gprm(0)=mov 8 ".."
Why did you use the value of 8? 8 is definitely for Adults.
Reference: http://www.dvd-replica.com/DVD/vmgpml.php

Why not 15? This would make it "none" for parental level.
Reference: http://dvd.sourceforge.net/dvdinfo/sprm.html

I found one in VTS1 (film) setting gprm(13) to SPRM(13). Replaced that too with 8. Again, gprm(13) should've been set to 15 here.

OLD:
[61 00 00 0D 00 8D 00 00] # Set gprm(13) =(mov) sprm(13: parental level)

NEW:
[71 00 00 0D 00 0F 00 00] # Set gprm(13) =(mov) 15 ".."

Remember Teporary parental Command. You have to change all instances to level 15. You did it right in this area.

I hope you can test this with your DVD again with all instances of sprm(13: parental level) holding values of 15 instead.

[jeanl]

the whole thing is definitely puzzling...
Set gprm(0)=mov sprm(13: parental level) with constant value 8:

@2COOL:
doesn't this means you're reading from sprm(13) which (I think) hold the current parental level in the player? So isn't it right to replace it by 8 (adult) as if the player had its parental control level set to adult, so anything will play no matter what its parental control is?

Or am I not understanding the meaning of SPRM(13)...
Jeanl

[maksa]

I have tried setting it to 15. As a matter of fact next command is:

set gprm(0)=&(and)gprm(0),15 (or something like that).

So it compares old value of gprm(0) with 15, so it should work. But it didn't for some reason. 8 worked (I think) because I fooled DVD command sequence into thinking that player is set for adult and Predator is certainly set for that. My guess is that I skipped some command checking it again for PL setting and when you put 15 it doesn't match. When you put 8, result should be "TRUE" for that conditional skip - maybe they put permanent value of 8 on DVD somewhere, but it doesn't make sense. In all honesty, my standalones do not have setting for 15, highest is 8 and there is no option for "unlimited".
Tepm. PAr. Command did work even with 1 once you have removed VTS_PG_MAIT table. Why, I have no clue, but I left it 15 just in case.

WORD OF CAUTION: I have tried RW last night in Ronin 802 & Cyberhome 305 and it works OK. But those players are know to play anything short of the Oreo cookies. Someone should try it on "brand" names DVD players.

Regards everyone....

[maksa]

sprm(13) is given from the standalone and it is Parental level. I have replaced it with 8 (Adult), but it doesn't refer to standalone anymore. Value is given permanently. But in same cases, sprm(13) could be changed in program flow, so that has to be checked and modified for the sake of TepPArCmd.

[jeanl]

But those players are know to play anything short of the Oreo cookies.
that was funny!!!
:p

[maksa]

Hey kids out there! This is NOT to circumvent Parental Control, just to make life easier for us adults (no passwords). I don't beleive in machine controling my kids, I do that myself. Both my DVD players have setting to 8, but my kids (13 & 8) are allowed to warch Predator, Love Actually and the Big Fish, but not allowed to watch Clockwork Orange (UK DVD - no Parental Lock anyways!). And they respect that!

Anyway, same story:
1. Reset VMG_PTML_MAIT table to 0 (console mode).
2. Replaced instances that call sprm(13) to fixed value "8".
3. Replaced SetTmpPML from 8 to 15.
4. Saved DVD.

Bingo, PowerDVD passed it with setting on G, first time!

[jeanl]

Bang! Nailed it on the head!
maksa, it'd be great if you came up with a small guide (not too much detail, assuming people are familiar with pgdedit) for how to do that.
I'm sure you're not the only one who's been trying to defeat parental control and a guide like that could help the rest of us.
Of course, that's a bit of work!

BTW, did you confirm that step 1:
1. Reset VMG_PTML_MAIT table to 0 (console mode).
was indeed necessary?

I'd love to try your recipe, but guess what, I don't have a single DVD with parental control :p

Jeanl

[r0lZ]

@maksa

IMHO, it's even best to do:

1. Reset VMG_PTML_MAIT table to 0 (console mode).
2. Replaced instances that call sprm(13) to fixed value "15".
(because 15 is the default value on a virgin player)
3. Replaced SetTmpPML by Goto (to same line).
(because there is no chance to miss the target!)
4. Saved DVD.



@everybody

I have just played around with the SetTmpPML command and SPRM 13.

SetTmpPML may be used only in the VMGM. This command sets the temporary Parental Managment Level.
SPRM 13 holds the player PML, configured by the user. The SPRM 13 is read only.
Level 15 is "disabled".

Example in pseudo code:

[00 03 00 00 00 00 04 06] 1 (SetTmpPML) Set parental level =(mov) 4, Goto line 6

if ( 4 <= sprm(13) ) {
Goto Line 6
} else {
// On some players, this part is skipped.
Request password
if ( password OK ) {
Goto line 6
}
}
Continue with a "Prohibited" screen, or loop back to the menu, or Exit, or play an "all audiences" version...
...
Line 6: Continue with the restricted contents.

It's funny to realize that this 'Set' command doesn't actually set any register. SPRM 13 is used only for comparison.

[2COOL]

Originally posted by r0lZ
Continue with a "Prohibited" screen...So the disclaimer is "Don't blank or kill playback on your Prohibited screen".

[jeanl]

r0lZ,

2. Replaced instances that call sprm(13) to fixed value "15".

I thought maksa mentioned that setting to 15 didn't work and that 8 was the way to go:
I have tried setting it to 15. As a matter of fact next command is:

set gprm(0)=&(and)gprm(0),15 (or something like that).

So it compares old value of gprm(0) with 15, so it should work. But it didn't for some reason.

I failed to understand your pseudo-code at first! The pseudo code explains what SetTmpPML(4) does! OK, now I understand it. That makes sense. In fact, SetTmpPML is only used to compare to the current value of SPRM(13) and request a passwd if the level isn't high enough, but SPRM(13) is NOT modified at all (not even temporarily).
You have to admit the name of the command was poorly chosen ;)

Thanks for the clarification. Still, it's weird that 15 didn't work in maksa's example...
Jeanl

[2COOL]

Originally posted by jeanl
Still, it's weird that 15 didn't work in maksa's example...I'd say blame it on the DVD player. :(

[jeanl]

I'd say blame it on the DVD player.
I thought maksa used powerDVD... Oh well...

[r0lZ]

I'm pretty sure that a player with PM unset hold 15 in the SPRM 13. Tested with IfoEdit, ZoomPlayer and my Sony standalone.
So, it must work!

[maksa]

I don't know why 15 didn't work, maybe is PowerDVD. It should!

Resetting MAIT TAble is confirmed. Doesn't work otherwise.

I agree with ROIZ, SetTmpPML could be replaced simply with GoTo.

ROIZ, If SPRM(13) is Read Only, you dont have to check for change of that command in the code.

[r0lZ]

ROIZ, If SPRM(13) is Read Only, you dont have to check for change of that command in the code.What do you mean? I must check to see if the SPRM is read, and change it to constant 15, no?

[maksa]

No, I've seen SPRM(13) being R/W. So theoreticaly, it could be changed by DVD program sequence. But you say it is R only, so I guess you don't have to check if it is changed somewhere in the code, e.g:

set sprm(13)=move (sometning, something).

[r0lZ]

You can't set a SPRM with the Set command!
And the only command related to parental control is SetTmpPML, which do not write the SPRM 13. Conclusion: there is no way to change the SPRM 13 (except of course via the player's configuration menu.)
Conclusion: I must check only for commands reading the SPRM 13.

[maksa]

If that is the case, just forget it. I remember seeing some of sprms set in the chain, but not (13). It is logical that sprm is set by hardware only.

[Junior73Italy]

Hi 2Cool Roiz e Maksa,
I'm caming from Italian Doom9 forum and I'm very interested in your discussion.Please sorry for my English.
I want to insert the Parental Lock in a very simple dvd structure that I have created for test :


VMG (VIDEO_TS.IFO)
------------------

VMG / First-Play PGC
********** pre commands:
[30 06 00 01 00 C0 00 00] 1 (JumpSS) Jump to VMGM PGC 1
********** post commands:
********** cell commands:


VMGM / LU 1 (--):

VMGM / LU 1 (--) / 1 (dummy) - Chapters: n/a, Programs: 0, Cells: 0
********** pre commands:
[30 02 00 00 00 01 00 00] 1 (JumpTT) Jump to Title 1
********** post commands:
********** cell commands:



VTS 1 (VTS_01_0.IFO)
--------------------

VTSM 1: no menu.

VTST 1 / TTN 1 (1:00) Title 1 - Chapters: 1, Programs: 1, Cells: 2
********** pre commands:
********** post commands:
[30 08 00 00 01 00 00 00] 1 (CallSS) Call the First Play PGC, resume cell 1
********** cell commands:

I know that the command (SetTmpPML) Set parental level =(mov) X, goto line X can be inserted into VMGM part of a Dvd but I don't know how I can activate the SISTEM PARAMETER 13.I want that the dvd player home (I have Pioneer dv340) show the message of Parental Lock and then throught the introducing the password I can see the part of film
(It's oly one minute..)

I hope that you understand what I mean to say....

Bye

[r0lZ]

You have to do this:

VMGM / LU 1 (--) / 1 (dummy) - Chapters: n/a, Programs: 0, Cells: 0
********** pre commands:
[00 03 00 00 00 00 01 03] 1 (SetTmpPML) Set parental level =(mov) 1, Goto line 3
[30 01 00 00 00 00 00 00] 2 Exit
[30 02 00 00 00 01 00 00] 3 (JumpTT) Jump to Title 1
********** post commands:
********** cell commands:

Of course, you may wish to use another parental level.

Caution: Do a test on a DVD RW to be sure it works. I don't know the exact behavior of the SetTmpPML command when there is no VMG_PTML_MAIT table in VIDEO_TS.IFO.

[Junior73Italy]

Hi Roiz (thank for PGCEDIT I use it from the first realease!!! ),
in the past I tried to insert the command as you told or like this (o similary combinacion of command in a dvd structure more complex) because I'm sure (in te past) that it solusion must function or is the just way to proced.

First case (as you suggested):

VMGM / LU 1 (--) / 1 (dummy) - Chapters: n/a, Programs: 0, Cells: 0
********** pre commands:
[00 03 00 00 00 00 01 03] 1 (SetTmpPML) Set parental level =(mov) 8, Goto line 3
[30 01 00 00 00 00 00 00] 2 Exit
[30 02 00 00 00 01 00 00] 3 (JumpTT) Jump to Title 1
********** post commands:
********** cell commands:



Second Case (inverse combination for inverse test):

VMGM / LU 1 (--):

VMGM / LU 1 (--) / 1 (dummy) - Chapters: n/a, Programs: 0, Cells: 0
********** pre commands:
[00 03 00 00 00 00 08 03] 1 (SetTmpPML) Set parental level =(mov) 8, goto line 3
[30 02 00 00 00 01 00 00] 2 (JumpTT) Jump to Title 1
[30 01 00 00 00 00 00 00] 3 Exit
********** post commands:
********** cell commands:

After setting the Parent Level of the home player to 8 the results is that the player skip the command
(1 (SetTmpPML) Set parental level =(mov) 8, goto line 3 ) and execute the after command in the line 2 of the precommand.
Naturally in the first case the player stopped (exit) and in the second case play the movie.
I think that reason is (as you told) that there no VMG_PTML_MAIT table in VIDEO_TS.IFO.
Have you a dvd structure (from a Film o similar) where there is a Parent Lock ?
Thanks for the reply....I hope that one day you will came on Doom9 Italian forum....!!!!
You are welcome!!!

Bye Junior73....

Ps. I'm looking for a tool call "DVDtray103" that I used in the past for test various dvd structre but the link is "off line".
Where I can download it?

[r0lZ]

You must configure the parental level of the player to a lower level. If you set it to 8, this means that you are accepting almost any rated contents. Try to set it to 1.

The tool you are looking for is probably the Mark's DVD Tray Player Pro. The official download link is closed (for now)...

[Junior73Italy]

You must configure the parental level of the player to a lower level

Sorry but I don't remember to say that the situation is the same if I try to set the parent level to a lower value.I mean that the player home skip the command 1 (SetTmpPML) Set parental level =(mov) 8, Goto line 3 in any case.


The tool you are looking for is probably the Mark's DVD Tray Player Pro.

Yes is just this tool .....

Bye

[maksa]

I think it is not that simple to insert Parental Control. This i a temp command only, probably could be skipped by fooling with remote (menu, title etc.). To get real protection you need serious authoring program,
just my 2c.

[Imjin]

The copy of pgcedit I'm using, version 0.4.5, has an option in the Utilities menu called "Remove Parental Management" that will remove the parental controls. Worked like a charm for me. I first came across the parental control lock on Dawn of the Dead (2003).. everything ripped fine and was re-mastered without a hitch, but when I went to play it, it defaulted instantly to the parental lock with a required password.