FindVUK tool - get VUK of all Blurays supported by DVDfab applications

[nalor]

A few words of introduction:

As we all know there's no chance to free the Bluray format as it happened with the DVD.
There are no working processing keys available anymore and even if it would, they would get revoked within a short period of time.

The only thing that is forever (at least for AACS) is the VUK (Volume Unique Key).

About february 2014 I got my first raspberry pi, connected a usb-bluray drive and tried to play a few blurays but simply got disappointed: apart from the problem that the first pi was simply not fast enough to handle the usb-bluray and the decoding I also ran into the problem that the necessary library 'libaacs' needs a VUK for each Bluray to decode it properly - but those keys are only available for older Blurays as the newer ones cannot be decrypted any longer because of the missing processing keys....
Usually 'MakeMKV' is a quite good replacement for libaacs under linux - but at the time where the FindVUK started it has not been available for ARM devices (I think now it is: MakeMKV on Raspberry PI (ARM)).

In August 2015 I stumbled across this post here http://forum.kodi.tv/showthread.php?tid=230493 and started thinking about the VUK problem again.

I already asked the MakeMKV developer in the past to output the VUK so it can be used on arm devices - but he replied that it's too complicated to get the vuk from his tool.

But than I got hands on another tool called 'DVDfab Passkey' and noticed an interesting line in it's logfile:

0m 58.68s: got vuk

So I posted a feature request in their forum to write the VUK into the logfile - but until now I've got no reply to it.

But I discovered another way to get the VUK from Passkey: create a memory dump after decrypting and read it from the dump

How you can 'find the VUK' manually (without FindVUK):

Basically the steps are quite easy:

• start a DVDfab application (Passkey, MediaPlayer or DVDfab9)
• insert a bluray
• in case you're using MediaPlayer start the playback
• in case of Passkey or DVDfab9: wait until the analyzing finishes
• create a memory dump with e.g. the windows task manager
• open the dump with a hex editor and search for the discid (it can be found in the logfile of passkey)
• and a few bytes later you'll find the vuk in the file (for newer releases only the unit keys are present in the dump)

What FindVUK does:
Originally FindVUK was only a proof-of-concept to get the VUK from a dvdfab memory dump, but it evolved and also received a few more features:

• Main feature: monitor the logfile of different DVDfab applications, dump the memory when the relevant data is available, extract vuk or unit keys from the dump and validate the data against the disc in the drive. finally the result is uploaded to a central bluray-database
• Synchronize mode: synchronizes the 'keydb.cfg' file with the online database
• AACSkeys mode: calls the well known aacskeys utility to read MediaKey, VolumeId and VUK, validates the data against the current disc and finally the result is uploaded to a central bluray-database
• ValidateVUK mode: simple test to check if a VUK matches the disc in a drive - no upload to the database is performed
• ValidateDisc mode: monitors a defined drive and checks for each inserted disc if there's a matching entry in the keydb.cfg file and if this entry is valid and finally the result is uploaded to a central bluray-database
• ShowDriveDetails mode: just displays technical details of either all drives or a specific drive
• GetMetaInfoFromDisc mode: reads meta-data from the disc in the specified drive and uploads it to the central bluray-database
• KeyDB_ListDuplicates mode: checks the keydb-file for duplicate entries

The KEYDB.cfg file is used by the libaacs library (that can be used to play blurays for example in VLC).

FindVUK is windows only - in case you're a linux user take a look at VukExtract from @m4tthi4s

Getting started:

1. Select your DVDfab tool of choice (personally I bought a DVDfab Passkey license), download and install it http://www.dvdfab.cn
2. Download and extract FindVUK into a new directory
3. Execute FindVUK (during the first start it will download the dump-tool from the sysinternals website and start it so you can accept the license)
   • Alternatively download 'procdump.exe' (x86 version) manually and copy it into a subdirectory called 'tool'
4. Insert a Blu-ray into your drive
5. You're using Passkey or DVDfabXX: it automatically start to decrypt the disc - FindVUK will watch the logfile, create a memory dump when Passkey/DVDfabXX got the VUK/UnitKeys, stop the Passkey/DVDfabXX decrypting process and analyze the memory dump to get the VUK/UnitKeys. Finally it will validate it against the disc and in case it's valid add it to the end of the local KEYDB.cfg
6. You're using MediaPlayer: Please start the playback of the disc manually - FindVUK will watch the logfile, create a memory dump when Mediaplayer got the VUK/UnitKeys, close MediaPlayer and analyze the memory dump to get the VUK/UnitKeys. Finally it will validate it against the disc and in case it's valid add it to the end of the local KEYDB.cfg (and restart's MediaPlayer for the next analysis cycle)
7. Repeat the previous 2 steps until you got the VUK for all your Blurays
8. At the end of each cycle FindVUK uploads the complete data-set to the online-database

Whenever DVDfab releases a new version of either DVDfab, MediaPlayer or Passkey I'll test if FindVuk is still compatible and include it into an internal 'known to be good' list and will release a new version that includes this result. But even in case I'm not fast enough - FindVUK will simply report that the used DVDfab application is untested.

I hope the company behind the application don't close this way of retrieving the VUK or at least the unit keys.

In case you have problems with the tool please post your experience here and I'll try to help as good as I can

History of the tool:

(had to clean the details of the first releases because I hit the size limit of this post
-> the full changelog of all releases is included in the zip-file of the download

20150812 .. 0.51 - initial release
(...)

20200629 .. Download FindVUK 1.35

• FIX: do not report an error in case the hash-file is not present at all
• FEATURE: auto-update integrated - can be disabled in ini-file

20201013 .. Download FindVUK 1.37

• FIX: support for DVDfab 12

20201016 .. Download FindVUK 1.38

• FIX: make sync debug log configurable with ini parameter and disable by default
• CHANGE: more details in sync-debug-log
• CHANGE: more output during update

20210721 .. Download FindVUK 1.42

• CHANGE: also sync DateDiscId to online database
• CHANGE: new logpath for dvdfab passkey 9.4.0.9
• FIX: properly strip forbidden characters from filenames used for backup
• CHANGE: adjust loglevel for various output
• FIX: properly strip forbidden characters from filenames used for backup (of meta files)
• FEATURE: new ini parameter ExitAfterProcessing to exit FindVUK instead of starting over to scan the next disc

20211111 .. Download FindVUK 1.53

• CHANGE: replaced Drive_GetVolumeName call with DRVMS_GetVolumeName
• FEATURE: now possible to use only a driveletter as parameter to get metainfo from disc
• CHANGE: only ask for keypress at the end in case it's not started from command line
• CHANGE: lot's of refactoring
• CHANGE: GetMetaInfoFromDisc mode now also uploads UnitKeysENC and DiscType to enrich existing legacy disc entries
• FEATURE: new mode AACSkeys to get mediakey, volumeid and vuk by using AACSkeys tool
• FEATURE: synchronisation of DeviceKey, ProcessingKey and HostCertificates with OnlineDB
• FEATURE: entries uploaded to OnlineDB are now always directly processed and written to OnlineDB
• FIX: a few bugfixes
• FIX: update process now correctly works in case parameters are set
• FIX: update process now is able to handle subdirectories in the update file

20211113 .. Download FindVUK 1.54

• CHANGE: upload of devicekeys, processingkeys and hostcertificates disabled by default and can be enabled with ini parameter

20220501 .. Download FindVUK 1.55

• FIX: \ and / in Volumenames do not cause a problem any longer

20220515 .. Download FindVUK 1.57

• FIX: 2nd try - \ and / in Volumenames do not cause a problem any longer
• FIX: BD+ not detected in aacskeys mode
• FIX: copy protection check broken in 1.56

20230122 .. Download FindVUK 1.58

• FIX: add support for Passkey 9.4.5.1
• CHANGE: add support for MS Windows 10 virtual drive
• FIX: repair support for virtual drives
• CHANGE: report success if all unit-keys are validated (should fix handling of disc >WINX-IL MISTERO DEGLI ABISSI<)

20230203 .. Download FindVUK 1.59

• FEATURE: add support for Passkey 9.4.5.2

20230425 .. Download FindVUK 1.63

• CHANGE: better logoutput in case online-upload is disabled
• FEATURE: support to get ReadDataKey (RDK) from Passkey Dump (in case BusEncryption is active)
• FEATURE: validation of Unitkeys is using RDK (in case of BusEncryption)
• CHANGE: speedup during validation - first collect all M2TS files and check if it's encrypted only if required (usually not all files are necessary to validate all unit keys)
• BAD NEWS: Passkey 9.4.5.3 does not provide the UnitKeys any longer in the memory dump - so it's flagged as "not working"
• FEATURE: introduce support for FabPlayer 7 (tested with 7.0.3.6 and it's working)
• FIX: problem with Unitkey Validation

20230626 .. Download FindVUK 1.64

• FIX: do not write an error if a local processing_key, device_key or host_certificate is not available
• FIX: support DVDfab up to 12.1.0.9

20230919 .. Download FindVUK 1.66

• FIX/IMPROVE: support DVDfab up to 12.1.1.5

20230920 .. Download FindVUK 1.67

• FIX: correctly update hash file after keydb sync

20231208 .. Download FindVUK 1.72

• CHANGE: treat unitkeys with lots of 0es with lower priority as local entries so those get uploaded to fvonlinedb during sync
• FEATURE: added basic AACS2 support
• FEATURE: added MakeMKV Libredrive support to disable BusEncryption for validation of UHD discs (see https://forum.makemkv.com/forum/viewtopic.php?t=19029 )
• FEATURE: support for DVDfab 13 (tested with 13.0.0.7)
• FIX: assume logfile for DVDfab 13 is always enabled
• FEATURE: new INI switch "MakeMKV_Libredrive_Enabled" to enable Libredrive support if desired/required - but it's disabled by default

20240504 .. Download FindVUK 1.74

• FEATURE: new mode "validateDisc" that monitors a drive, validates each disc that get inserted and upload the result
• FEATURE: option to integrate external tools to either disable BusEncryption and/or provide a RDK file

20240508 .. Download FindVUK 1.75

• FIX: correctly calculate DriveId for AACS2 drives
• CHANGE: use internal UDF parser to get creation date of "\AACS\Unit_Key_RO.inf" for DateDiscId (fixes problem with Linux/Wine to return the modification timestamp as creation timestamp)
• CHANGE: use new procedure BRAACS_getVolumeName to read volumename, includes a fallback to read directly from udf filesystem in case operating system returns an empty string
• CHANGE: prevent to upload meta-entries with empty: discid, datediscid, volumename, disctype

20240804 .. Download FindVUK 1.77

• FIX: correctly read udf volumename (possible additional weird character at the end)
• FIX: in case first unitkey-location is not the correct one keep searching until the end of the file

20240904 .. Download FindVUK 1.79

• FIX: do not write error for backup/restore of window position when used with Windows Terminal (simply do nothing instead as this is not yet supported)
• FEATURE: support DVDfab 13.0.2.5/13.0.2.6

[nalor]

Released 0.54 - details see first post (not that hard to find

[mpfour]

Source?

Also, a version with options to disable anything that uses a network connection in your program would be good.

[candela]

Holy crap. It works! Amazing find.

Unfortunately DVDFabPasskey doesn't appear to work without internet connection so they can, and probably will, make the current versions stop working and block your program But let's hope and get as many keys as possible in the meantime

[nalor]

@mpfour:

It's written in Purebasic and at the moment I don't want to release the source - but maybe this will change in the future...

And basically there's nothing in the software that uses an online connection with one small exception - in case the 'procdump.exe' in the 'tool' subdirectory is not available the tool tries to download it automatically from the location that is specified in the ini file with 'ProcDumpUrl'.
Until now I never thought someone could have problems with this download - but I've changed the error message in case the URL is empty to something more readable

So in case you want to run it right from the start without any network activities simply create the FindVUK.ini file in the 'config' subdirectory manually and delete the procdumpurl from the ini file - for example this here should do the trick:

[Passkey]
LogFolder = %userprofile%\Documents\DVDFab Passkey\Log
MainFile =
[FindVUK]
KEYDB_Path = %userprofile%\AppData\Roaming\aacs
ProcDumpUrl =
CustomOffset_Folder2DiscId =
CustomOffset_DiscId2Vuk =

So Release 0.55 only includes the change of the error message in case of an empty download url:

Old Message:

ProcDump is not available right now at >C:\FindVUK\tool\procdump.exe< - download a fresh copy now from ><
ERROR! receiving ><
ERROR! getting procdump - end now

New Message:

Error - ProcDump is not available here >C:\FindVUK\tool\procdump.exe< and no download URL is specified!
Please download it manually from the SysInternals website

[nalor]

@candela:

Thanks for your positive post!

I also thought a lot if DVDfab will change their software to prevent that the VUK can be extracted from a memory dump - but personally I think that the VUK is only usefull for playback of blurays and although it can also be used to decrypt blurays I'm not aware of a convenient tool to do this.

So finally I don't think that somebody stops buying software from them because they don't sell bluray playback software

On the other hand it might be a reason to buy software from them to get the possibility to detect the VUK for certain blurays that couldn't be watched on a linux device otherwise...

But as I can't change it anyway I'm with you: get as many keys as possible as long as it works

[nalor]

Uploaded latest version 0.55 also to file-upload.net and added the link in the first post.

[candela]

I only have Passkey and Media Player installed and then FindVUK refuses to start unless I put a valid (fake) DVDFab path in the ini

Log file says:
DVDFab "Warning! DVDfab MainApp is not valid! >< - please check if it is installed properly!"

[nalor]

Thanks for the bug report! - already corrected the error... stupid mistake, don't know why I've treated the 'Warning' messages as errors...

Please try 0.62 now - it should work as expected (only exit in case not a single supported application can be found)

[candela]

Thanks 0.62 works. The Media Player is indeed a much better option than Passkey which always locks my drive and often crashes when I try to close it. No such problems with Media Player so far

[shadowofdarkness]

I'm trying to get this to run but it keeps giving a error and I don't know what to do. I only have temporary access to a Windows machine (I only run Linux) so I need to figure this out fast.
I already added added about 140 vuk's to the KeyDB that I could from a Linux machine now I want to get the rest of my v31+ discs done will I can so they well play under Linux after a KeyDB update.

Output

-----------------------------------------------------------
2013.11.20 06:32:18 -  ------------ FindVUK 0.62 ------------
-----------------------------------------------------------
2013.11.20 06:32:18 - SettingsFile: >C:\Users\username\Desktop\FindVUK\con
fig\FindVUK.ini<

2013.11.20 06:32:18 - Passkey is preferred and available!
2013.11.20 06:32:18 - Passkey-MainFile:>C:\Program Files\DVDFab Passkey\DVDFabPa
sskey.exe
2013.11.20 06:32:18 - Passkey-LogFile: >C:\Users\username\Documents\DVDFab
 Passkey\Log\passkey_internal.log
2013.11.20 06:32:18 - KEYDB-Path:      >C:\Users\username\AppData\Roaming\
aacs

2013.11.20 06:32:18 - ProcDumpFile:    >C:\Users\username\Desktop\FindVUK\
tool\procdump.exe

###############################################################################
 --- PART 1 --- GET VUK ---
-------------------------------------------------------------------------------
2013.11.20 06:32:18 - Please make sure Passkey is enabled!
-------------------------------------------------------------------------------
2013.11.20 06:32:18 - Tested Passkey Version >8.2.4.8< found
2013.11.20 06:32:18 -  >>> everything should work as expected!
2013.11.20 06:32:18 - Offset Folder2DiscId >0x114< - DiscId2Vuk >0x5F<
2013.11.20 06:32:31 - Drive opened
2013.11.20 06:32:34 - DiscType detected >Blu-ray BDMV<
2013.11.20 06:32:34 - Volume Label detected >GAME_OF_THRONES_S2_EPISODE_ONE▼<
2013.11.20 06:32:34 - DriveLetter detected >D<
2013.11.20 06:32:34 - Detected CopyProtections AACS >1< BD+ >0<
2013.11.20 06:32:35 - DiscID found >AB6DAF1F77EEB06782525D440B84CF4F52D96452<
2013.11.20 06:32:36 - Passkey got VUK! Cancel decryption and create MemDump now!

2013.11.20 06:32:37 - Dump successful! >0<
2013.11.20 06:32:37 - MemDump successfully finished!
2013.11.20 06:32:37 - Start to analyze MemDump now!
2013.11.20 06:32:37 - Error! DVDfab_GetVukFromDump - Couldn't find Vid in File!!
!
2013.11.20 06:32:37 - Error during analyzing memory dump - please report in the
doom9 forum!
2013.11.20 06:32:37 - ERROR! while analyzing the memory dump! Exit application!
Waiting 3 secs before quit...

Edit: It turns out it is only that one disc when I tried others they worked. I just have to figure out that one now.
Although I found 10 discs in the end that FindVUK said were invalid but when I manually added them from the terminal output into the keydb on my Linux system (no other decryption software running just libaacs) and manually tested they worked great. They were Game of Thrones seasons 3 and 4 plus the 3D disc for Jurassic Park

Another strange thing when I went to add those last ones with the updater it only added 9 but I had 10 and none of them worked before I added the vuks so they didn't exist beforehand in the DB

[nalor]

Hi! So as far as I can see you encountered 3 strange things

1) FindVUK cannot find the necessary data in the memory dump for the >GAME_OF_THRONES_S2_EPISODE_ONE▼< bluray.
>> in this case the memory dump should still be available in the dump subdirectory of the findvuk folder - it would be great if you could upload it somewhere and send me the location as pm so I can download it and check what is going wrong in this case.
You can check yourself with a hex editor if you can find the DiscId >AB6DAF1F77EEB06782525D440B84CF4F52D96452< in the memory dump.

2) FindVUK reported the found VUK to be invalid but it still works? Please post the logfile from such a disc - in case there's something wrong in my validation routine I'd like to correct it as soon as possible

3) The updater only updates 9 of 10 keys - well, please report this in the thread of the updater as honestly I have no idea why this is happening...

[shadowofdarkness]

Originally Posted by nalor

Hi! So as far as I can see you encountered 3 strange things

1) FindVUK cannot find the necessary data in the memory dump for the >GAME_OF_THRONES_S2_EPISODE_ONE▼< bluray.
>> in this case the memory dump should still be available in the dump subdirectory of the findvuk folder - it would be great if you could upload it somewhere and send me the location as pm so I can download it and check what is going wrong in this case.
You can check yourself with a hex editor if you can find the DiscId >AB6DAF1F77EEB06782525D440B84CF4F52D96452< in the memory dump.

2) FindVUK reported the found VUK to be invalid but it still works? Please post the logfile from such a disc - in case there's something wrong in my validation routine I'd like to correct it as soon as possible

3) The updater only updates 9 of 10 keys - well, please report this in the thread of the updater as honestly I have no idea why this is happening...

1) It turns out the problem with the Game of Thrones disc is that it can't create the dump file which can be seen by it having some strange character at the end of the volume label.

To make it worse for you to figure out I tried putting the log on pastebin but that character was deleted even opening the txt file in Notepad on Windows didn't show it. The only way I even saw it was when I opened the log file on my Linux machine.

I have attached the original txt file in case you also run Linux to see it and a screenshot of it open in vi incase you don't. I didn't even have to highlight the problems since it seems highlighted on its own.

2) The log is also doing the Jurassic Park 3D discs which gives a false invalid. But I know works since I have propagated it manually to my Linux laptop and Raspberry Pi which both started playing the disc fine afterwards.

3) I'll definitely find the updater thread because I may also have others that didn't upload but I thought it was coincidence that someone else added them because I got a updated db as I was doing the upload that time. But maybe not if it also added less this time when no other update happened.

[nalor]

Ahh! You're right - this strange character will be the problem! I'm only wondering why procdump.exe doesn't return an error when it fails because of the filename...

I'll remove all strange characters in future from the filename - I think this will solve the problem

Give me a few minutes - I'll upload the next release soon!

Unfortunately I cannot download your logfile because it still needs approval... maybe you can simply upload it to file-upload.net or another easy to use filehoster and paste the link here?

[nalor]

Decided to create a new release with the fix immediatly - because it definitely is a show-stopper for first-time users

In case the ini-parameter is still set to the wrong entry it's changed to the correct entry.

So 0.68 is now available in the first post.

Kudos to Neph for finding this bug!

[avih]

@nalor, v0.68 is detected with 4 threats from 41 engines - https://www.metascan-online.com/#!/r...0cfbf3/regular

I hope that these are false positives, but I can't tell for sure and I don't intend to dig into it to find out. I think it'd be best if you could find a proper external host to place your files at.

[nalor]

Hi, just checked your results and as far as i can see 3 of the 4 hits are related to the automatic download of the dump Tool from sysinternals.
Couldnt find details about the last of the 4 results at the moment.
Will check all of them tonight after work.
Regarding the file hoster, i dont care which one i am using. Make a suggestion :-)
I upload every release also directly into the forum, but it takes about a week until the forum file gets the admin approval and this is the reason why i am uploading the file also to a different location.

As i know that there are is no malware hidden in my tool i am sure all 4 hits are false positives.

Will post a hash value for all releases tonight, so everybody can check if his download is really untouched ;-)


Gesendet von meinem D5803 mit Tapatalk

[nalor]

Released 0.70 with a few bugfixes and new features - for details take a look at the first post.

Unfortunately I haven't found time to check for the 4 threats...

Edit: I compiled a release where I've simply removed the download option but it didn't make a change - need to check tomorrow what is really the problem with those false positives (in case they find 4 threats in a fresh compiled exe those alerts are false positives for sure... ) so I can also say that the file-hoster file-upload.net isn't respoonsible for those 4 detected problems ...
It has to be something special in the compiler I'm using...

[avih]

Originally Posted by nalor

Regarding the file hoster, i dont care which one i am using. Make a suggestion :-)

Open source your code, put it on github, and use github releases to host your releases. Or just pay for some host and put up a web page for this application. Or find a free one. Really, up to you.

Originally Posted by nalor

I upload every release also directly into the forum, but it takes about a week until the forum file gets the admin approval and this is the reason why i am uploading the file also to a different location.

Because admins don't approve attachments daily.

Originally Posted by nalor

As i know that there are is no malware hidden in my tool i am sure all 4 hits are false positives.

I didn't say it was malware, just that the scan found threats and I don't intend to dig into it. Also, if you had malicious intents (which I believe you don't, but still), then your response would have been the same, something like "yeah, they're all false positives, go ahead and use it".

Bottom line, we don't have the resources to validate which threats are false positives, discuss it with authors which upload executables, and put the time into figuring out whether or not it's actually a threat.

Just find a proper external host for your files, free or payed-for or github, and use it as the main distribution for your releases.

[Sparktank]

If you go open-source, there's also a greater chance that someone might be able to see what's causing the false-positives.

In most cases like this, for freeware tools, it's usually come down to the installer itself.

But, you would need to be more open for others to volunteer to look into things.

I'm no dev, but just what I see in most cases.