Blu-ray playback with libaacs & libbdplus

[candela]

After a long hiatus, discoveries in the past few years on this forum have made Blu-ray playback possible again on free (libre) software such as VLC without proprietary solutions such as DVDFab, MakeMKV or AnyDVD.

Presented here is a new libaacs & libbdplus build for Windows with some improvements made by several different people. Included are Win32/Win64 builds and the actual source patches. It would be nice if someone actually good at C can clean these up and integrate them on the VideoLan source repository.

Improvements:

• Cached BD+ tables support: circumvent the need for the BD+ Virtual Machine (VM) and play BD+ discs of all generations without menus
• UHD support: play 4K Blu-ray discs
• Read Data Key (RDK) caching: play Bus Encrypted Enabled (BEE) discs on Bus Encryption Enabled (BEC) drives after the Host Certificate (HC) is revoked
• Media Key (MK) caching: similar to already existing Volume Unique Key (VUK) and VolumeID (VID) caching. This enables possible scraping in the future by FindVUK
• Incomplete Unit Key (UK) support: allow (partial) playback of discs in case not all unit keys are available in KEYB.cfg and the VUK is not available

How To (Windows):

• Put the 32-bit or 64-bit libaacs/libbdplus DLLs (all 4) in the corresponding VLC directory
• Put the BD+ vm files in the %APPDATA%\bdplus\vm0 directory
• Put the cached BD+ tables (1.5GB) in the %APPDATA%\bdplus\convtab directory
  • updated tables 2020-07-05 (36MB)
  • updated tables 2021-01-06 (31MB)
  • updated tables 2022-06-19 (12MB)
  • updated tables 2023-07-28 (3MB)
• Put FindVUK's KEYDB.cfg in the %APPDATA%\aacs directory
• Edit KEDYB.cfg and add/replace the device keys (DK), processing keys (PK) and host certificates (HC) at the top with the ones from this post (valid up to MKBv81). Older keys can be found in this thread

Builds:

• 2019-10-21_libaacs_libbdplus.7z
  • libaacs 0.9.0 + patches
  • libbdplus 0.1.2 + patches
• 2020-07-26_libaacs_libbdplus.7z
  • libaacs 0.11.0
  • libbdplus 0.1.2 + patches
  • extra Kodi patch from user nst no longer required, use Kodi version > 18.7 because of BD playback bug

Directories:

• base aacs/bdplus directories in above "How To:" are different depending on OS and user-based or system-based (all users) installation
• Windows:
  • aacs (per user): %APPDATA%\aacs
  • aacs (system wide): %ProgramData%\aacs
  • bdplus (per user): %APPDATA%\bdplus
  • bdplus (system wide): %ProgramData%\bdplus
  • dll 32-bit: C:\Program Files (x86)\VideoLAN\VLC
  • dll 64-bit: C:\Program Files\VideoLAN\VLC
• Linux:
  • aacs (per user): ~/.config/aacs
  • aacs (system wide): /etc/xdg/aacs
  • bdplus (per user): ~/.cache/bdplus
  • bdplus (system wide): /etc/xdg/bdplus
• MacOS:
  • aacs (per user): ~/Library/Preferences/aacs
  • aacs (system wide): /Library/Preferences/aacs
  • bdplus (per user): ~/Library/Caches/bdplus
  • bdplus (system wide): /Library/Preferences/bdplus
  • dylib: /usr/local/lib

Decryption keys:

• Simplified, libaacs/libbdplus uses the following flow to remove supported protections
  • if Disc = BEE and Drive = BEC then
    • HC -> RDK -> remove bus encryption
  • if Disc = AACS then
    • DK -> PK -> MK
    • HC -> VID
    • MK + VID -> VUK -> UK -> remove AACS encryption
  • if Disc = BD+ then
    • BD+ VM -> BD+ table -> remove BD+ protection
• When either DK or HC has been revoked, libaacs cannot generate decryption keys anymore. However, any step in the process can be skipped by using cached keys in the local aacs directory or KEYDB.cfg. For example, when VUK is cached DK + HC are no longer needed for AACS decryption. Check the following threads to retrieve all necessary keys without a valid DK and HC
  • FindVUK tool - get VUK of all Blurays supported by DVDfab applications
  • Get Blu-ray VID and RDK from MakeMKV
• The BD+ VM only supports a very limited amount of early titles. In practice cached BD+ tables will be necessary for all your discs

Debugging:

• debug output is possible using environment variables, ref. source util\logging.h and util\logging.c for more information
• e.g. in Windows open CMD window and execute the following:
  • set AACS_DEBUG_MASK=65535
  • set BD_DEBUG_MASK=512
  • set AACS_DEBUG_FILE=c:\temp\debuglog_aacs.txt
  • set BDPLUS_DEBUG_FILE=c:\temp\debuglog_bdplus.txt
  • set BD_DEBUG_FILE=c:\temp\debuglog_libbluray.txt
• start VLC from command line in the same CMD window

About BD+:

• BD+ tables contain the necessary patches to fix the video errors and circumvent the need to emulate the BD+ VM. Since Blu-ray menus interact with the BD+ VM, cached BD+ tables are incompatible with VLC Blu-ray menu support
• To save space, it is assumed that all discs with the same MK also have the same BD+ table. Therefore cached BD+ tables are loaded from the filename MK*.bin. For clarity, provided tables are named MK_VolumeLabel.bin
• At this moment, the last known discs with BD+ protection were released in 2017 (MKBv60). Hence PKs are available in KEYDB.cfg to calculate the necessary MK for all BD+ discs
• BD+ tables can also be used by DumpHD (command line --convtable:table.bin) and BlurayTest&Decrypt (loaded from %APPDATA%\bdplus\convtab\DiscID*.bin)
• There is no way to validate BD+ tables without playing the actual disc and checking if video corruption is fixed. Therefore the tables that are offered come with no guarantees. Fixes for tables reported as bad:
  - 1677D189ECCC2161451A3C0FA4F53CD4_THE_PHANTOM_MENACE.bin
  
• In case the BD+ table included for the MK of your disc does not work, you can try retrieving a working table using Nalor's BlurayTest&Decrypt. The table will be saved in %APPDATA%\bdplus\convtab\DiscID*.bin and will have to be renamed to MK*.bin to use with libbdplus

About RDK:

• Discs that have BEE (all UHD and <10% of BD) and are played on a BEC drive (i.e. all recent drives) require a valid Host Cert to be present in KEYDB.CFG in order to calculate the RDK. Once the current Host Cert is revoked by the drive, the previously cached RDK can still used instead
• The RDK, drive and disc specific, is saved in %APPDATA%\aacs\rdk\[DriveID]\[DiscID]. The [DriveID] is a hash of the Drive Cert which is assumed to be unique
• It seems possible some BEC drive would calculate a different RDK each time the same BEE disc is played. In this case, caching the RDK will obviously not work. No such drives are known at this time
• Updating a drive's firmware may or may not change the RDK

About UHD:

• UHD playback requires a UHD friendly drive, i.e. a non-AACS2.0 drive that supports reading UHD discs and accepts AACS1.0 Host Certs
• It may be possible to convert your non-friendly UHD drive to a friendly one by flashing a different firmware. Read the following topic VERY carefully Ultimate UHD Drives Flashing Guide Updated 2022
• No AACS2.0 PK or DK are currently known. Playback depends on a valid VUK, UK or MK being available in KEYDB.cfg
• AACS2.1 discs are currently not supported. At the moment 5 such discs exist (Fury, The Patriot, Stand By Me, Charlie's Angels, Zombieland)

About Java menus:

• In order to play Blu-rays with Java based menus the Java Runtime Environment (JRE) is required
• Install one of the following:
  • OpenJDK
  • Oracle
  • Note that recent JRE versions appear to crash VLC. The last known working version is 8u322b06
• Make sure the %JAVA_HOME% environment variable is set and points to the installation directory, e.g. "JAVA_HOME=C:\Program Files\Java\jre1.8.0_221". The OpenJDK installer can set this automatically
• In Windows, e.g. Vista, environment variables can be set in Control Panel > System And Maintenance > System > Advanced System Settings > Environment Variables
  

About Region Coding:

• Some Blu-ray discs may be region locked when menus are enabled in VLC. Select the correct region in VLC to circumvent this. Goto Tools > Preferences > Show Settings: All > Input / Codecs > Access Modules > Blu-ray and select the Region Code that matches the disc: A, B or C

Command line tools:

• Using commandline tools like aacs_info or aacskeys allows getting all keys VUK/MK/VID/UK and learning about AACS
• aacs_info is included with libaacs and uses keys in KEYDB.cfg. Debug output as described above is also possible. Example usage: aacs_info F:
• aacskeys and accompanying keyfiles can be downloaded here. Example usage: aacskeys -v F:
• instructions for Mplayer by hnsteyding

To do:

• Playlist obfuscation is a protection where the correct playlist (BDMV\PLAYLIST\*.mpls) for a disc is hidden between hundreds of fake playlists. Although the FindVUK KEYDB.cfg lists the correct playlist for many discs, it's not possible to actually select this playlist in VLC when playing without menus. VLC uses its own title index that has no obvious relation with the actual mpls file. This would need to be changed in libbluray
• Implementation of HD-DVD playback. Although VLC can play files on unprotected HD-DVDs, libaacs has no support for HD-DVD. The source code of aacskeys could be used as an example
• Improvement of BD+ VM libbdplus. Complete implementation will likely be very difficult and require reverse engineering of official players. However, it is plausible that minor improvements to the libbdplus implementation could result in the generation of encrypted BD+ tables. In this case, only (much smaller) decryption keys need to be cached instead of complete tables. This method appears to be used by several non-official players. To study how BD+ tables work load them in ConvTableView and look at the libbdplus source