p2pnet.net news:- Anything which can be seen and/or heard can be copied by one means or another, just as anything which can be encrypted can be decrypted. Period. And, “Wooow! I think I just found the Volume ID of King Kong,” posted Arnezami on Doom9′s Forum on February 5.
“But I’m shocked! It doesn’t appear to be anywhere near random as I expected it to be!! This could mean (just maybe) its guessable/computable…If so then if we find the Media Key** we wouldn’t have to use WinDVD to grab keys anymore . And the Media Key doesn’t tell the AACS LA which software player was hacked so… This could also be the reason why AnyDVD supposedly can decrypt without the need for grabbing keys from WinDVD’s memory which puzzled b[m]e deeply.
“I don’t want to get ahead of things but if this is true this could be very deadly for AACS. I wonder if this is due to some technical limitation. I will tell more later. Have to go to work now …”
On February 11, “As I can understand some of you are interested in how I retrieved the Media and Processing Keys,” says Arnezami. “I will tell what i did.”
The two comments once again show dedication and the desire to push the envelope beat greed. Because as The Register puts it, Arnezami, “has unlocked the master key preventing the copying of high-definition DVDs in a development that is sure to get the entertainment industry’s knickers wrapped tighter than a magnet’s coil.”
And Arnezami achieved his feat through sheer brain-power.
“I’m not telling which player I used (well you can guess but you might guess wrong) to retrieve the Processing Key because I don’t want to give the AACS LA any extra legal ammunition against any player company,” he posts.
“Nothing was hacked, cracked or even reverse engineered btw: I only had to watch the ‘show’ in my own memory. No debugger was used, no binaries changed.”
Nor is Arnezami alone.
On the same Doom9 Forum, muslix64 wrote about BackupHDDVD which also gets around DRM (Digital Restrictions Management) consumer control in Blu-ray and HD DVD.
Meanwhile, here’s Arnezami’s description of how he did what he did:
Most of the time I spend studying the AACS papers. A good understanding of how things worked have helped me greatly in knowing what to find in the first place (and how to recognize something). I may write an explanation of (my understanding) of how AACS works in particular the subset-difference technique (which is by far the hardest to understand) at a later date if you guys want to.
But anyway. Since the moment I found the Volume ID (which was much simpler than I had thought) my thought was to try to find the Media Key. But after some discussion I thought it might be better to go directly for the Device Keys (bad mistake). After looking at files created and changed by software player and trying to recognize Device Keys in memory dumps I was starting to get worried a bit. I wasn’t making any progress.
So I went back to my original idea: do a bottom-up approach. So first I tried to find the Media Key. One of the logical things to do even before that was to search for the Verify Media Key Record in memory. But it wasn’t there. I then started to work on a little proggy that would scan a memdump and see everything as a Media Key: thus trying to verify it with the Verify Media Key Record. No luck.
This was frustrating: all kinds of information was in the memdump but not the Media Key (I sort of assumed/hoped it would). I made several memdumps at different moments but nada, nothing. After throwing it all away I remembered I still had a “corrupt” memdump from WinHex (it failed to finish it because WinHex said the memory had changed). It was really small compared to the others so I didn’t have much hope. But when running it with my proggy: voila! I found it. Which finally gave me hope I was going in the right direction.
There were just two major problems left: how do you detect the Processing Key and if its not in memory how do you find it at all? Well since I now knew how things worked I knew the Processing Key had to be combined with a C-value to produce the Media Key. The problem was there are 513 C-values in the MKB! Searching the memory (several megabytes) for a Processing Key and assuming just one C-value would take minutes (if not hours depending on the size of the dump). So doing them all would take very long. And that while I didn’t even know for sure there was a Processing Key in memory to begin with. I made a proggy that did this but using my favorite “corrupt” memdump I didn’t find any Processing Key in the first megabyte (not for any C-value). It didn’t look good.
But then I realized why I first didn’t find the Media Key: it was removed from memory after the Volume ID was retrieved and the VUK calculated. I also saw that in my “corrupt” memdump the VUK, Vol ID, Media Key and the Title Key MAC were all closely clustered in memory: in the first 50kb (of the entire multi megabyte file!) but there were large empty parts around it. Almost as if it was cleaned up.
This gave me an idea: what I wanted to do is “record” all changes in this part of memory during startup of the movie. Hopefully I would catch something insteresting. In the end I did something a little more effiecient: I used the hd dvd vuk extractor (thanks ape!) and adapted it to slow down the software player (while scanning its memory continously) and at the very moment the Media Key (which I now knew: my bottom-up approach really paid off here) was detected it halted the player. I then made a memdump with WinHex. I now had the feeling I had something.
And I did. Not suprisingly the very first C-value was a hit. I then checked if everyting was correct, asked for confirmation and here we are.
Hope you enjoyed the ride. I’m thinking about a concept of proof proggy which does all the steps (from Processing Key to C-value to Media Key to Volume ID to VUK). It would require a Volume ID as input (which might be retrieved/guessed in another program or extension whatever). But the most important part is done: we have a Processing Key.
I’m also thinking about doing a full explanation of the AACS protection system (or at least the subset-difference technique). But only if there is any demand for it.
“The AACS is investigating the claims right regarding of the hack,” according to AACS spokeswoman Jacqueline Price, quoted in Gadget Lab. “It is going to take a appropriate action if it can be verified.”
“Price said she could not disclose what their investigation might entail, or what ‘appropriate action’ might be.”
Doom9′s Forum – Processing Key, Media Key and Volume ID found!!!, February 5, 2007
The Register – Hacker cracks HD copy protection, February 14, 2007
BackupHDDVD – BackupHDDVD v1.00 now online, January 3, 2007
Gadget Lab – The New HD-DVD/Blu-Ray Hack: What It Might Mean For Us, February 13, 2007
Want to subscribe to p2pnet by email with Feedburner? Just click here.
rss feed: http://p2pnet.net/p2p.rss | | Mobile – http://p2pnet.net/index-wml.php | | And use our own p2pnet newsfeeds for your site
If your Net access is blocked by government restrictions, try Psiphon from the Citizen Lab at the University of Toronto’s Munk Centre for International Studies. Go here for the official download, here for the p2pnet download, and here for details. And if you’re Chinese and you’re looking for a way to access independent Internet news sources, try Freegate, the DIT program written to help Chinese citizens circumvent web site blocking outside of China. Download it here.