Blu-ray playback with libaacs & libbdplus

[Mahna]

would this also work with the current version of libre elec on an Intel PC?

[Grimsdyke]

Originally Posted by Roof Tile

So recently I noticed that libbdplus and libaacs had been updated for some time (which was especially exciting since libbdplus hasn't gotten a proper new version since 2015!). I figured I'd go to the main post and download them like before, but it appears that both sets of files haven't been updated yet. So, I decided to try and figure out how to do it myself, ...

@ Roof Tile. Have you tested your new files with BD+ titles ?? I am asking because they did not work on my system so I had to go back to the originals. Kind reagrds

[Mahna]

Ok mein englisch ist unterirdisch daher versuche ich es auf deutsch. Ich habe einen Asus Vivo Mini PC PN40. Darauf habe ich Libre Elec gespielt. Per USB ist ein 4k Friendly Laufwerk angeschlossen. Bisher habe ich ohne Probleme alle DVD´s und Bluray abspielen können. Nun habe ich aber eine Bluray und eine 4K Disk bekommen. Diese wollen nicht laufen obwohl sie in der KeyDB.cfg aufgeführt sind. Von Libre Elec bekomme ich die Meldung das sie verschlüsselt seien. Kann mir dazu jemand hier helfen?
Vielen Dank schonmal im Vorraus.

[Roof Tile]

Originally Posted by Grimsdyke

@ Roof Tile. Have you tested your new files with BD+ titles ?? I am asking because they did not work on my system so I had to go back to the originals. Kind reagrds

I don't think I have any BD+ titles currently, so I don't know how well they work with them. I figured that they would work just fine but it's totally possible my ignorance caused issues. My only thought would be to make sure that the cached BD+ tables in the main post are in the right place and that you did one after the other (along with the one Phantom Menace bin below the collections after the very first set). Again though, I wouldn't know since I don't believe I have any BD+ titles to test. Sorry I can't be that big of a help to your issue. Maybe at some point candela or someone else with more experience will upload their own versions that don't have that problem, if that's where the kerfuffle is coming from anyway.

[candela]

Originally Posted by Grimsdyke

@ Roof Tile. Have you tested your new files with BD+ titles ?? I am asking because they did not work on my system so I had to go back to the originals. Kind reagrds

Seems like recent libddplus code is broken. It loads the cached convtab if you play with menus but not without menus.

If the disc is an older BD+ gen it will show a "update player firmware" screen which has a "continue" button. In this case you can still play the disc and stream is fine (I tested Romancing the Stone). But newer BD+ gen (I tested Epic) will be stuck on the "update player firmware" screen with no way to continue.

[Cyber Akuma]

Is the "Edit the KEDYB.cfg and put the keys and certs from this post on top" step still relevant today, or is that outdated information now? I noticed that the linked post is from 2019, and the last post made in that thread was in 2020. But the KEYB.cfg file that's in the download link was last updated 8/24/2022, just today. Wouldn't all the information from that post in 2019 be in the current versions of the KEYDB.cfg file today?

[DanTheMann15]

@Cyber Akuma

Not many host certs were revoked since MKBv72, and consequently nobody is willing to share any cert that's not currently revoked.

This KEYDB.cfg will decrypt everything (MKBv71) and older, these are the best keys publicly available.

; KEYDB.cfg

; Processing Keys

; Device Keys
| DK | DEVICE_KEY 0x5FB86EF127C19C171E799F61C27BDC2A | DEVICE_NODE 0x0A00 | KEY_UV 0x00000400 | KEY_U_MASK_SHIFT 0x17 ; MKBv01-MKBv48
| DK | DEVICE_KEY 0x38841673E2B4E05191659899606CFFB8 | DEVICE_NODE 0x0C00 | KEY_UV 0x00000A00 | KEY_U_MASK_SHIFT 0x0B ; MKBv49-MKBv71

; Host Certificate
| HC | HOST_PRIV_KEY 0x909250D0C7FC2EE0F0383409D896993B723FA965 | HOST_CERT 0x0203005CFFFF800001C100003A5907E685E4CBA2A8CD5616665DFAA74421A14F6020D4CFC9847C23107697C39F9D109C8B2D5B93280499661AAE588AD3BF887C48DE144D48226ABC2C7ADAD0030893D1F3F1832B61B8D82D1FAFFF81 ; MKBv71

; Bluray Disc VUK Keys ;

if you try to play anything with v72 or up it'll revoke this host cert in your drive, and that's where the FindVUK database comes in because
it'll give you the database of all known VUK decryption keys, so you'll still be able to play your blurays (even ones above MKBv71).

but you won't be able to play BusEncrypted discs without a valid host cert, Unless your BD Drive is an old one that doesn't support BusEncryption.

It'll be awhile for those needing a new cert, but one will come eventually.

[Cyber Akuma]

Sorry, still trying to understand all this. Are you saying those few lines are all I need in my entire KEYDB.cfg? Or that I should add those on top of what is in the existing latest KEYDB.cfg?

I was trying to test this out, and I had zero issues playing 1080p Blu-Rays (after I downgraded Java because the latest version crashes VLC if you enable menues) but any 4K disk I try gives me "AACS Host certificate revoked".

I admit, I wasn't aware of this key revoking thing, because the first 4K Blu-Ray I tried was a movie that JUST came out on disk, Sonic 2. Then I tried a random movie I had from 2018, the first Avengers movie, and that one still gives me the error. Did I permanently cripple my drive or something by attempting to play a newer movie and now it's been disabled/revoked? It's not clear to me if revoked means it just simply won't play newer disks that use a newer cert, or if the entire ability for my drive/PC to play 4K Blu-Rays has been revoked now. Since it won't even play that 2018 movie I worry it's just completely revoked the UHD ability of my system. I would have assumed that the MakeMKV firmware/VLC would at least not honor disabling itself like that for older disks that it has/had the certs for.

And if a new cert comes out, would attempting to play a movie with a newer cert revoke it again and then no 4K movies will again be playable until another new one comes out? Is that how it works? Or can I never even add a new cert again and have it work now that it's been revoked?

[richy]

@Cyber Akuma...

Those few lines are the highest publicly known processing keys and are all you need..... provided you don't play a disc that's MKBv72 or above, which is what you appear to have done.

Once you've done that and revoked your drive then it won't be able to generate valid keys for you any more until a newer set is made public. Depending on your setup, what would normally happen is that the decryption key for your disc would be found and then cached for future usage. Without a working host certificate etc this can't happen but any keys you've got cached already or in your keydb.cfg will still allow you to play those specific titles.

If you get hold of the most recent keydb.cfg file with the 100k+ entries in it then you should be fine as it contains all the decryption keys that people have already found and submitted. Unless you have some really obscure titles in your collection then it's highly likely the keys you'll need to play them will be in there already. If not, then you may just have to wait for someone to submit the decryption keys in a future update. The file is updated pretty much constantly.

I hope that all makes sense... and apologies to the more technical types on here if my explanation has any howlers in it! ;-)

[Cyber Akuma]

@richy

Thanks, let me make sure that I understood this right:

So those three lines that DanTheMann15 posted are all I would need to decrypt any 4K Blu-Ray that's MKBv71 or earlier (I am not sure what MKB even is), but every disk that I do, it gets cached so that a key to decrypt just that disk is stored?

And if I put in a disk that is MKBv72 or later (how does one even check that?) it will somehow disable any UHD Blu-Ray decrypting on that drive until a new host key is released somehow?

One thing I don't understand is why the whole revoking keys thing still happens even if you have custom firmware. Does the custom MakeMKV firmware not disable this? Or is it something very hard-coded and not possible to disable? I don't really understand how if you have access to the files on the system itself (A PC in this case) and the drive's firmware that you can still somehow have your keys get permanently revoked. And how come MakeMKV is still able to decrypt disks despite this revocation.

Also, if the reason the KEYDB.cfg file is so massive is because it contains a huge list of known cached UHD keys, then why was neither Sonic 2 nor Avengers playing? I noticed that there are multiple entries for both of those movies in the latest KEDYB.cfg, so if those are cached keys then shouldn't those disks still play even with the host key revoked?

[DanTheMann15]

Originally Posted by cyber akuma

@richy

i am not sure what mkb even is

MKB is short for "Media Key Block" you can find more information here on Wikipedia.

another thing is that all UHD Blurays use Bus Encryption, so without a valid host certificate you cannot play those movies even if you have cached vuk keys, except if your keys are cached by VLC before you revoked your cert which would have an RDK.

more info on that including for AACS 2.1 in the first post here.

also, there may be several keys for the same title so your discs of Sonic 2 or Avengers may not have been put up on the key database yet, but still bus encryption stands in your way even if you do have keys for your discs.

[richy]

@Cyber Akuma...

The keydb.cfg file isn't just UHD keys, it contains mostly "regular" blu-ray disc titles just because there are way more of those in existence than 4K ones.

I don't have a UHD-compatible drive myself (yet) so I can't really help regarding 4K discs - apologies if that was essentially what you were asking about!

You've mentioned custom MakeMKV firmware so I'm guessing you're talking about LibeDrive. I've looked into it a little myself because I want to get a new drive but you may be better off asking at the MakeMKV forum because it's more their "thing".

In what may be an internet first, I'm going to shuttup now because I'd rather not confuse the situation any further by posting any more drivel about a subject I don't know enough about! ;-)

[Cyber Akuma]

Originally Posted by DanTheMann15

another thing is that all UHD Blurays use Bus Encryption, so without a valid host certificate you cannot play those movies even if you have cached vuk keys, except if your keys are cached by VLC before you revoked your cert which would have an RDK.

I see, so if VLC itself didn't cache my disks when the key is revoked not even the keydb.cfg will help me. I am assuming that the keys VLC caches are different from the keydb.cfg and that I can't somehow use those in VLC?

To be honest though, I still don't understand how using my own open software (VLC/libaccs/libbdplus) and a custom firmware on my optical drive would allow a key to be revoked permanently even for disks that are MKBv71 and older, and how MakeMKV apparently still gets around this somehow.

Originally Posted by richy

@Cyber Akuma...
I don't have a UHD-compatible drive myself (yet) so I can't really help regarding 4K discs - apologies if that was essentially what you were asking about!

Yeah, I specifically meant UHDs. I have had no issues playing 1080p Blu-Rays. Even the 1080p Blu-Ray of Sonic 2 played just fine from the same Steelbook the UHD disk came from.

You've mentioned custom MakeMKV firmware so I'm guessing you're talking about LibeDrive. I've looked into it a little myself because I want to get a new drive but you may be better off asking at the MakeMKV forum because it's more their "thing".

I tried the VLC forums, and a mod just linked me to this thread.

[candela]

Originally Posted by Cyber Akuma

I see, so if VLC itself didn't cache my disks when the key is revoked not even the keydb.cfg will help me. I am assuming that the keys VLC caches are different from the keydb.cfg and that I can't somehow use those in VLC?

To be honest though, I still don't understand how using my own open software (VLC/libaccs/libbdplus) and a custom firmware on my optical drive would allow a key to be revoked permanently even for disks that are MKBv71 and older, and how MakeMKV apparently still gets around this somehow.

Yeah, I specifically meant UHDs. I have had no issues playing 1080p Blu-Rays. Even the 1080p Blu-Ray of Sonic 2 played just fine from the same Steelbook the UHD disk came from.

I tried the VLC forums, and a mod just linked me to this thread.

I haven't looked at Libredrive in a while but from what I remember it doesn't disable host certificate revocation. It creates custom commands to retrieve the VID and to disable the bus encryption on the drive so the host certificate is not needed.

VLC doesn't know about Libredrive. It doesn't know the custom commands to get the VID and to disable the bus encryption (and the drive certificate will still say the drive supports bus encryption). So VLC tries to retrieve the VID and RDK (for bus encryption) using the host certificate and fails because it's been revoked by the drive.

If you managed to play those UHD before, VLC should have cached the RDK and you should still be able to play the disc on that specific drive you played it before (if you flashed the firmware the RDk may have changed, I'm not sure about that)

[Cyber Akuma]

Originally Posted by candela

I haven't looked at Libredrive in a while but from what I remember it doesn't disable host certificate revocation. It creates custom commands to retrieve the VID and to disable the bus encryption on the drive so the host certificate is not needed.

VLC doesn't know about Libredrive. It doesn't know the custom commands to get the VID and to disable the bus encryption (and the drive certificate will still say the drive supports bus encryption). So VLC tries to retrieve the VID and RDK (for bus encryption) using the host certificate and fails because it's been revoked by the drive.

I see, so unless the VLC team adds support for that Libredrive work-around then it doesn't help whatsoever to have Libredrive bypass all of this when trying to play them in VLC. I recall reading there is a way to make VLC use MakeMKV itself to decrypt and play the disk, but IIRC that requires having MakeMKV running and that program isn't free.

If you managed to play those UHD before, VLC should have cached the RDK and you should still be able to play the disc on that specific drive you played it before (if you flashed the firmware the RDk may have changed, I'm not sure about that)

I didn't unfortunately, Sonic 2 was the first UHD I attempted, I was testing if the latest UHDs could play and was not aware that the disks could revoke licenses like that.

I don't suppose that the cached keys in the keydb.cfg file are in any way the same format as in VLC and that I could somehow import them or insert them into whatever file VLC uses to cache UHDs?

[candela]

Originally Posted by Cyber Akuma

I see, so unless the VLC team adds support for that Libredrive work-around then it doesn't help whatsoever to have Libredrive bypass all of this when trying to play them in VLC.

correct

Originally Posted by Cyber Akuma

I recall reading there is a way to make VLC use MakeMKV itself to decrypt and play the disk, but IIRC that requires having MakeMKV running and that program isn't free.

well it's free (they keep publishing new beta keys for free as far as I know) but it hides the disc keys. A lot BD decryption info comes from MakeMKV directly or indirectly so they do deserve support. But we want to be able to backup keys for playback.

Originally Posted by Cyber Akuma

I don't suppose that the cached keys in the keydb.cfg file are in any way the same format as in VLC and that I could somehow import them or insert them into whatever file VLC uses to cache UHDs?

No. The keys you need for UHD are RDK which are not in keydb.cfg since they are disc+drive specific. No one has the same keys as you.

In theory it's possible to extract the RDK from a different player and put in the appropriate folder for VLC to use. I don't know for sure but I'm guessing DVDFab will have it unencrypted in memory somewhere (in the past even some official BD players had them unecrypted in memory). So someone would have to make FindRDK, a FindVUK for RDK

[BalooDP]

Previously there was a post in this thread with instructions on how to get BD+ disc playback working on the fly decryption on Debian based Linux distros. The post contained instructions on how to build the libbdplus library because the one in the repo wasnt sufficient. It also contained a pre built version which I used with success on my Pop OS distro for a little while, but it has stopped working. Has anyone had success in using libbdplus in the Ubuntu/Debian repos or their own build to decrypt and playback libbdplus discs on the fly again in Ubuntu 22.10 and higher distros?

[Cyber Akuma]

Originally Posted by candela

No. The keys you need for UHD are RDK which are not in keydb.cfg since they are disc+drive specific. No one has the same keys as you.

In theory it's possible to extract the RDK from a different player and put in the appropriate folder for VLC to use. I don't know for sure but I'm guessing DVDFab will have it unencrypted in memory somewhere (in the past even some official BD players had them unecrypted in memory). So someone would have to make FindRDK, a FindVUK for RDK

I see. So basically once my key is revoked I can never play a UHD movie on that drive with VLC again unless I make use of the MakeMKV work-around or hope that someday a new database comes out... and then be careful not to get it revoked again.

That or if someone does that whole key extraction thing you mentioned which I doubt is going to happen.

Is there any way to know what version a disk is so I can avoid using one that will revoke the keys in the future?

[candela]

Originally Posted by Cyber Akuma

That or if someone does that whole key extraction thing you mentioned which I doubt is going to happen.

It already happened , please check the topic Get Blu-ray VID and RDK from MakeMKV

[demomode]

How do I extract BD+ tables? I tried BlurayTest&Decrypt but isn't working.