Decrypting MKBv81 disc with libaacs

[prozistka]

Hello!

This thread is not asking for solution but some background knowledge.
I'm trying to understand how AACSv1 works and there is a strange phenomenon for me.
I have an MKBv81 disc and a driver with LibreDrive enabled.

• The disc is MKBv81
• The AACS version of my driver is v81 too
• The current keydb.cfg does not contain VUK of this specific disc
• The keydb.cfg does not contain HC for MKBv81

The following is what I encountered

• VLC can play this disc perfectly with only libaacs
• Xreveal with low version 2.4.x can decrypt the disc perfectly
• Xreveal(Free) with current version 2.7.0 cannot decrypt the disc

Here are some questions.

• Why VLC (or libaacs) can decrypt my disc without HC for MKBv81? From what I've known, one need a valid HC to decrypt a disc with specific MKB version.
• Following the previous question, is it because of LibreDrive such that I can decrypt the disc without HC?
• If I want to calculate VUK of this specific disc, is there any advice except DVDFab since my goal is understanding AACSv1?

The following is the information from makemkv:

Drive Information
OS device name: F:
Current profile: BD-ROM
Manufacturer: BUFFALO
Product: Optical Drive
Revision: BU10
Serial number: ############
Firmware date: 2117-05-30 17:28
Bus encryption flags: 1F
Highest AACS version: 81

LibreDrive Information
Status: Enabled
Drive platform: MT1959
Firmware type: Original (unpatched)
Firmware version: 0.BU10O
DVD all regions: Yes
BD raw data read: Yes
BD raw metadata read: Yes
Unrestricted read speed: Yes

Disc Information
Label: ###################
Timestamp: ##################
Protection: AACS v81
Data capacity: 3.8 Gb
Disc type: BD-ROM
Number of layers: 1
Channel bit length: 74,5 nm (25.0 GB max. per layer)

[coopervid]

You should also report this to the Xreveal guys.

[Bandits]

You might have the keys cached from libaacs.dll. Check the MK, VID, and VUK directory in your Appdata\Roaming\aacs folder for files named with the DiscID. If they are cached libaacs.dll doesn't use your keydb.cfg file or need the HC.

You can always add the current v81 HC to your keydb.cfg. It might fix the Xreveal issue.

The v81 HC can be found in this thread:
https://forum.doom9.org/showthread.p...91#post1990091

I myself went down the rabbit hole of AACS when we lost AnyDVD-HD. I didn't want to depend on something that could go away, so I made my own program to generate keys using aacs_info and aacskeys with the help of libaacs.dll. Hasn't failed me yet with Xreveal using my generated keydb.cfg. Works with MKBv81 and BEE discs.

[prozistka]

Originally Posted by Bandits

You might have the keys cached from libaacs.dll. Check the MK, VID, and VUK directory in your Appdata\Roaming\aacs folder for files named with the DiscID. If they are cached libaacs.dll doesn't use your keydb.cfg file or need the HC.

You can always add the current v81 HC to your keydb.cfg. It might fix the Xreveal issue.

The v81 HC can be found in this thread:
https://forum.doom9.org/showthread.p...91#post1990091

I myself went down the rabbit hole of AACS when we lost AnyDVD-HD. I didn't want to depend on something that could go away, so I made my own program to generate keys using aacs_info and aacskeys with the help of libaacs.dll. Hasn't failed me yet with Xreveal using my generated keydb.cfg. Works with MKBv81 and BEE discs.

Thanks!
I just tried on my old computer which did not install any blu-ray related software. And libaacs cannot decrypt the disc with only keydb. It might because of VUK cache or makemkv I installed.

[prozistka]

The MKBv81 HC is somehow invoked by my drive ( at least aacskeys said so).
But aacskeys managed to extract MK.
And thanks to makemkv, I can extract VID.
So all I have to do is merely calculate VUK manually and use BlurayTestAndDecrypt to extract ISO.

OK, now problem solved.

[Bandits]

aacs_info.exe will give you MK, VID, VUK, and RDK with libaacs.dll.

You can try this.
https://www.dropbox.com/scl/fi/zn4ey...=ayg873mi&dl=0

[prozistka]

Originally Posted by Bandits

aacs_info.exe will give you MK, VID, VUK, and RDK with libaacs.dll.

You can try this.
https://www.dropbox.com/scl/fi/zn4ey...=ayg873mi&dl=0

Thanks for sharing, it seems the tool cannot get VID from my drive ( maybe because its UHD official drive?), but its much more convenient when getting MK!

[Bandits]

You didn't have any other decrypter's running when you tried did you?

I've only used it for Blu-Ray's on one non-UHD drive that does support Bus Encryption.

I have a UHD drive in another computer I can try later, but it is a UHD friendly drive.

[prozistka]

Originally Posted by Bandits

You didn't have any other decrypter's running when you tried did you?

I've only used it for Blu-Ray's on one non-UHD drive that does support Bus Encryption.

I have a UHD drive in another computer I can try later, but it is a UHD friendly drive.

No, only the program you provided.

[Bandits]

Ya, totally not working on UHD. Does work in UHD friendly drive with a normal Blu-Ray but not UHD. Now that I broke out a UHD disc from storage, I will see if I can make it work.

[MrPenguin]

Originally Posted by prozistka

I have an MKBv81 disc and a driver with LibreDrive enabled.

• The disc is MKBv81
• The AACS version of my driver is v81 too
• The current keydb.cfg does not contain VUK of this specific disc
• The keydb.cfg does not contain HC for MKBv81

The following is what I encountered

• VLC can play this disc perfectly with only libaacs

Here are some questions.

• Why VLC (or libaacs) can decrypt my disc without HC for MKBv81? From what I've known, one need a valid HC to decrypt a disc with specific MKB version.

The following is the information from makemkv:

I suspect part of the answer is that VLC is secretly using MakeMKV's "alternative" implementation of libaacs, and so is actually decrypting your disk using MakeMKV's device key and host certificate rather than those from KEYDB.cfg.

On Linux, this alternative implementation is called libmmbd.so.0. I don't know what it's called on Windows - perhaps libmmbd.dll?

The ability to choose an alternative libaacs DLL at runtime is part of libbluray, which is one of VLC's dependencies. However, I would expect aacs_info to have a static dependency on libaacs.

[Bandits]

So, trying to understand your issue better. You have a MKBv81 Blu-Ray (AACSv1) disc and are using an official UHD (AACSv2) drive?

I have tested a MKBv81 disc in a (AACSv1) and friendly (AACSv2) drive, both working with Generate Keys. I don't have an official (AACSv2) drive to test.

If you have MakeMKV installed, could you test your official (AACSv2) drive by opening a command prompt, navigating to your MakeMKV directory, and running makemkvcon64.exe info X: (Where X is your drive letter). Leaving that window open, try running Generate Keys.

I'm thinking bus encryption for your official (AACSv2) drive is where your issue is. Your drive might be Libredrive capable, but I don't think the bypass works all the time, only when something activates it. Using makemkvcon64.exe info X: will activate Libredrive, bypassing bus encryption until you eject the disc.

As for MakeMKV's version of libaacs.dll. For Windows it's libmmbd.dll or libmmbd64.dll. Apparently, it can be renamed to libaacs.dll and libbdplus.dll and copied to your players directory. If you are using this setup, this is why it doesn't matter what is in your keydb.cfg. I can also confirm it won't work with aacs_info.

[prozistka]

Originally Posted by Bandits

I'm thinking bus encryption for your official (AACSv2) drive is where your issue is. Your drive might be Libredrive capable, but I don't think the bypass works all the time, only when something activates it. Using makemkvcon64.exe info X: will activate Libredrive, bypassing bus encryption until you eject the disc.

As for MakeMKV's version of libaacs.dll. For Windows it's libmmbd.dll or libmmbd64.dll. Apparently, it can be renamed to libaacs.dll and libbdplus.dll and copied to your players directory. If you are using this setup, this is why it doesn't matter what is in your keydb.cfg. I can also confirm it won't work with aacs_info.

Thanks, I tried with makemkvcon64.exe, but nothing changed, Generate Keys still doesn't work for my drive. I also think it might because my driver is official UHD drive.

[prozistka]

I tried to use aacs_info and it showed:

Opening f using libaacs 0.11.0 ...
src/libaacs/aacs.c:449: Unable to open AACS\Content000.cer
src/libaacs/aacs.c:449: Unable to open AACS\Content001.cer
src/libaacs/aacs.c:1104: Failed to read content certificate file
src/libaacs/aacs.c:449: Unable to open AACS\Unit_Key_RO.inf
src/libaacs/aacs.c:449: Unable to open AACS\DUPLICATE\Unit_Key_RO.inf
src/libaacs/aacs.c:1082: Failed to read unit key file (AACS/Unit_Key_RO.inf)
libaacs open failed: Corrupt disc
syntax error: line 156846
bad entry at or around line 156846
(a lot of lines)

Use aacskeys to get the P-MKB, it shows

D:\aacskeys\Generate Keys>aacskeys.exe -v f d
aacskeys 0.4.0f by arnezami, KenD00, Key, Nobu1789, anon

Current path: D:\aacskeys\Generate Keys

Error: Could not find recordtype 0x10
MKBv: Type And Version record not found!
Drive FW info: [DEDACTED]
AACS Version: 01
Number of concurrent AGIDs: 2
Supports BN generation: YES
BN Block Count: 1
Inserted medium AACS protected: YES

AGID: 00

Host Private Key (Hpriv): [DEDACTED]
Host certificate (Hcert): [DEDACTED]
Host Nonce (Hn): [DEDACTED]

AGID: 00

Host Private Key (Hpriv): [DEDACTED]
Host certificate (Hcert): [DEDACTED]
Host Nonce (Hn): [DEDACTED]

AGID: 00

Host Private Key (Hpriv): [DEDACTED]
Host certificate (Hcert): [DEDACTED]
Host Nonce (Hn): [DEDACTED]

AGID: 00

Host Private Key (Hpriv): [DEDACTED]
Host certificate (Hcert): [DEDACTED]
Host Nonce (Hn): [DEDACTED]

AGID: 00

Drive Partial MKB > V28

Maybe my driver is not fully supported by libaacs?

[Bandits]

I take that your drive letter is "f"

What does "aacs_info.exe f: keydb.hed" report when ran from inside Generate Keys folder?
What does "aacskeys.exe -v f" report? Or just "aacskeys.exe f"?

Can you run "makemkvcon64.exe f --list" and get your disc:#? If you only have 1 drive it is usually disc:0. Then run "makemkvcon64.exe info disc:#". If it is working it should show "Using LibreDrive mode" and list the disc contents. If that works, leave the window open and retry getting your keys. When done, to turn Libredrive back off close the makemkvcon64.exe window and eject your disc.

I still think bus encryption is blocking your official drive.

[prozistka]

Originally Posted by Bandits

I take that your drive letter is "f"

What does "aacs_info.exe f: keydb.hed" report when ran from inside Generate Keys folder?
What does "aacskeys.exe -v f" report? Or just "aacskeys.exe f"?

Can you run "makemkvcon64.exe f --list" and get your disc:#? If you only have 1 drive it is usually disc:0. Then run "makemkvcon64.exe info disc:#". If it is working it should show "Using LibreDrive mode" and list the disc contents. If that works, leave the window open and retry getting your keys. When done, to turn Libredrive back off close the makemkvcon64.exe window and eject your disc.

I still think bus encryption is blocking your official drive.

Using libre drive mode changes nothing. orz

PS D:\aacskeys\Generate Keys> .\aacs_info.exe f: keydb.hed
Opening f: using libaacs 0.11.0 ...
src/libaacs/mmc.c:457: Host key / Certificate (id 0xffff80000217) has been revoked by your drive ?
src/libaacs/mmc.c:457: Host key / Certificate (id 0xffff800001c1) has been revoked by your drive ?
src/libaacs/mmc.c:457: Host key / Certificate (id 0xffff800001b1) has been revoked by your drive ?
src/libaacs/mmc.c:457: Host key / Certificate (id 0xffff80000189) has been revoked by your drive ?
src/libaacs/mmc.c:457: Host key / Certificate (id 0xffff80000146) has been revoked by your drive ?
src/libaacs/mmc.c:457: Host key / Certificate (id 0xffff800000ad) has been revoked by your drive ?
src/libaacs/mmc.c:457: Host key / Certificate (id 0xffff800000c4) has been revoked by your drive ?
src/libaacs/mmc.c:457: Host key / Certificate (id 0xffff80000039) has been revoked by your drive ?
src/libaacs/mmc.c:454: Certificate (id 0xffff00000064) can not be used with bus encryption capable drive
src/libaacs/mmc.c:454: Certificate (id 0xffff000000ae) can not be used with bus encryption capable drive
src/libaacs/mmc.c:454: Certificate (id 0xffff0000000c) can not be used with bus encryption capable drive
libaacs open failed: Revoked certificate
syntax error: line 156839
bad entry at or around line 156839
src/libaacs/mmc.c:457: Host key / Certificate (id 0xffff80000217) has been revoked by your drive ?
src/libaacs/mmc.c:457: Host key / Certificate (id 0xffff800001c1) has been revoked by your drive ?
src/libaacs/aacs.c:1509: aacs_get_vid() failed
syntax error: line 156839
bad entry at or around line 156839
syntax error: line 156839
bad entry at or around line 156839
src/libaacs/mmc.c:457: Host key / Certificate (id 0xffff80000217) has been revoked by your drive ?
src/libaacs/mmc.c:457: Host key / Certificate (id 0xffff800001c1) has been revoked by your drive ?
Disc ID: F0F3C93672426E499F5DB4F7FBF297C5DFE75465
VID : ???
MK : 309C50F4694A78C5B80A5DF7C3D61217
MKBv : 81
PMSN : ???
Bus encryption:
Device support: yes
Enabled in media: no
Content Certificate ID: 0002800BA600
BD-J Root Cert hash: 0000000000000000000000000000000000000000
Device binding ID: [DEDACTED]
Host Revocation List (MKB version 81):
000000000001 - 0000000003e8
000080000001 - 0000800080e8
000080a3000b
015380013c69 - 015380018a88
06d580000015 - 06d580000028
270f80000001 - 270f80000bb8
ff2210100001 - ff221010001f
ff221010005f - ff2210100064
ff2210100068 - ff221010006b
ff2210400001 - ff221040001f
ff22104004f7 - ff22104004fb
ff22104084f6 - ff22104084fa
ff2220000001 - ff22200000ff
ff22200084f6 - ff22200084fa
ff22200104f6 - ff22200104fa
ff2290100001 - ff229010001f
ff2290400001 - ff229040001f
ff22a0000001 - ff22a00000ff
ff2318000001 - ff231800001f
ff2318100001 - ff231810001f
ff2318400001 - ff231840001f
ff23184004f7 - ff23184004fb
ff2340000001 - ff23400000ff
ff2710000001 - ff271000001f
ff2710000063 - ff2710000068
ff271000006c - ff271000006f
ff2790000001 - ff279000001f
ffff0000000b - ffff00000014
ffff00000016
ffff00000021 - ffff0000002a
ffff00000035 - ffff00000038
ffff0000004e - ffff00000052
ffff00000054 - ffff00000057
ffff0000005d - ffff00000066
ffff00000080
ffff00000088 - ffff00000091
ffff00000094
ffff000000ae
ffff000000b2 - ffff000000bb
ffff000027db
ffff00002817
ffff00002820
ffff00002834 - ffff0000283d
ffff00002846
ffff0000284b
ffff80000001 - ffff80000024
ffff80000029
ffff80000039
ffff80000045
ffff80000053
ffff80000071
ffff80000079
ffff8000007c - ffff8000007e
ffff800000ad
ffff800000c4 - ffff800000c6
ffff800000d0
ffff800000f4 - ffff800000fd
ffff8000012d - ffff8000012e
ffff80000153 - ffff80000154
ffff80000174
ffff80000189
ffff80000196 - ffff80000197
ffff800001b1
ffff800001b4
ffff800001c0 - ffff800001c9
ffff800001d2
ffff800001e9
ffff800001eb
Drive Revocation List (MKB version 81):
000000000001 - 0000000003e8
000080000001 - 0000800055f0
270f20000001 - 270f20000514
270f80000001 - 270f800007d0
ff2600000001 - ff2600000096

PS D:\aacskeys\Generate Keys> .\aacskeys.exe -v f
aacskeys 0.4.0f by arnezami, KenD00, Key, Nobu1789, anon

Current path: D:\aacskeys\Generate Keys

MKBv: 81
Device key: 861B3719B02F24BE6F1A30E2E3ABEE94
Processing key: E3A7F07F545CC6955908941158AB2AD5
Encrypted C-value: 8A9108203F87AD9293C0221EF787BDE9
Corresponding uv: 00000C20

Decrypted C-value: 309C50F4694A78C5B80A5DF7C3D61E37
Media key: 309C50F4694A78C5B80A5DF7C3D61217
Encrypted verification data: 04EB508A457334BE8677E02EF149552E
Decr verif data should be: 0123456789ABCDEF
Decrypted verification data: 0123456789ABCDEF23E2FACE87617B1E

Drive FW info: BU10O[DEDACTED]
AACS Version: 01
Number of concurrent AGIDs: 2
Supports BN generation: YES
BN Block Count: 1
Inserted medium AACS protected: YES

AGID: 00

Host Private Key (Hpriv): 4B7AEF00859AF7F8E88AE97418D862FBE404571A
Host certificate (Hcert): 0203005CFFFF800002170000473B98057A4A9129
6C0A6FDF0E314F449A557C2A146BF1E54C25E365
95210C4CAAE373872178B47A7E46A766A550EA6C
0B8895855E29DA80C77FF37837EEE336C7FA9F1A
95E86F2F4D03E3DEE3BE9217
Host Nonce (Hn): 2923BE84E16CD6AE529049F1F1BBE9EBB3A6DB3C

AGID: 00

The given Host Certficate / Private Key has been revoked by your drive.


ERROR: SENDHOSTCHAL: SK: 0x5, ASC: 0x6F, ASCQ: 0x00, errnr: -2

PS D:\aacskeys\Generate Keys> .\aacskeys.exe f
aacskeys 0.4.0f by arnezami, KenD00, Key, Nobu1789, anon

The given Host Certficate / Private Key has been revoked by your drive.


ERROR: SENDHOSTCHAL: SK: 0x5, ASC: 0x6F, ASCQ: 0x00, errnr: -2

[Bandits]

The current keydb.cfg does have this:

0xF0F3C93672426E499F5DB4F7FBF297C5DFE75465 = BLUE_PROTOCOL_SONGS_COLLECTION (『BLUE PROTOCOL』Songs Collection) | D | 2024-04-23 | V | 0xA8826699531953FB8E657E1D5789A2A0 | M | 0x309C50F4694A78C5B80A5DF7C3D61217 | I | 0x0DAA713CFF7F0BEE65D77CF3831AEC84 | U | 1-0xEC1179CC6013653043597A992DF94CFE ; MKBv81/FindVUK 1.79 - MainPlaylist: 01001.mpls - VolumeSize: 3306749952 (BD)

libaacs.dll will use this info to play the disc if it can't do it itself.

I can only reproduce this error:

ERROR: SENDHOSTCHAL: SK: 0x5, ASC: 0x6F, ASCQ: 0x00, errnr: -2

by not having the correct HC. Your logs show you have a good HC for v81 disc's, which is located in HostKeyCertificate.txt for aacskeys. This disc doesn't even require bus encryption, but I do not know if official drives use it all the time regardless of the disc's request.

Seems crazy that aacs_info and aacskeys can't handle a AACSv1 disc regardless of the drive.

These errors:

bad entry at or around line 156839
syntax error: line 156839
bad entry at or around line 156839

indicate you have bad entries in your keydb.cfg. You should get the newest version.

[prozistka]

Originally Posted by Bandits

The current keydb.cfg does have this:

0xF0F3C93672426E499F5DB4F7FBF297C5DFE75465 = BLUE_PROTOCOL_SONGS_COLLECTION (『BLUE PROTOCOL』Songs Collection) | D | 2024-04-23 | V | 0xA8826699531953FB8E657E1D5789A2A0 | M | 0x309C50F4694A78C5B80A5DF7C3D61217 | I | 0x0DAA713CFF7F0BEE65D77CF3831AEC84 | U | 1-0xEC1179CC6013653043597A992DF94CFE ; MKBv81/FindVUK 1.79 - MainPlaylist: 01001.mpls - VolumeSize: 3306749952 (BD)

libaacs.dll will use this info to play the disc if it can't do it itself.

I can only reproduce this error:

ERROR: SENDHOSTCHAL: SK: 0x5, ASC: 0x6F, ASCQ: 0x00, errnr: -2

by not having the correct HC. Your logs show you have a good HC for v81 disc's, which is located in HostKeyCertificate.txt for aacskeys. This disc doesn't even require bus encryption, but I do not know if official drives use it all the time regardless of the disc's request.

Seems crazy that aacs_info and aacskeys can't handle a AACSv1 disc regardless of the drive.

These errors:

bad entry at or around line 156839
syntax error: line 156839
bad entry at or around line 156839

indicate you have bad entries in your keydb.cfg. You should get the newest version.

Thanks, seems the problems IS the UHD Official Drive.
I bought a cheap(like $3) normal AACSv1 drive and aacs_keys ran successfully!

[MrPenguin]

Originally Posted by prozistka

Thanks, seems the problems IS the UHD Official Drive.
I bought a cheap(like $3) normal AACSv1 drive and aacs_keys ran successfully!

A UHD drive maintains separate revocation lists for AACSv1 and AACSv2. And KEYDB can only contain AACSv1 host certificates because AFAIK there are no publicly available host certificates for AACSv2.

Now it is conceivable (because I have a LG drive that does this....) that your AACSv1 host certificate is being accepted by the AACSv1 revocation list, but is still being rejected by the AACSv2 one, despite you decrypting an AACSv1 disk.

I also own a Pioneer UHD drive that does not apply the AACSv2 revocation list to an AACSv1 host certificate when decrypting an AACSv1 disk. So I consider my LG's behavior here to be down to buggy firmware.