Not long ago, there was news of a successful crack of Blu-Ray and Hi-def DVD copy protection, but it wasn’t a general crack. The crack relied on a weakness in extracting decryption information from discs, but it was a non-trivial effort. The new method builds on that to successfully break any AACS protected disc.
As I can understand some of you are interested in how I retrieved the Media and Processing Keys. I will tell what i did.
Most of the time I spend studying the AACS papers. A good understanding of how things worked have helped me greatly in knowing what to find in the first place (and how to recognize something). I may write an explanation of (my understanding) of how AACS works in particular the subset-difference technique (which is by far the hardest to understand) at a later date if you guys want to.
But anyway. Since the moment I found the Volume ID (which was much simpler than I had thought) my thought was to try to find the Media Key. But after some discussion I thought it might be better to go directly for the Device Keys (bad mistake). After looking at files created and changed by software player and trying to recognize Device Keys in memory dumps I was starting to get worried a bit. I wasn’t making any progress.
So I went back to my original idea: do a bottom-up approach. So first I tried to find the Media Key. One of the logical things to do even before that was to search for the Verify Media Key Record in memory. But it wasn’t there. I then started to work on a little proggy that would scan a memdump and see everything as a Media Key: thus trying to verify it with the Verify Media Key Record. No luck.
This was frustrating: all kinds of information was in the memdump but not the Media Key (I sort of assumed/hoped it would). I made several memdumps at different moments but nada, nothing. After throwing it all away I remembered I still had a “corrupt” memdump from WinHex (it failed to finish it because WinHex said the memory had changed). It was really small compared to the others so I didn’t have much hope. But when running it with my proggy: voila! I found it. Which finally gave me hope I was going in the right direction.
There were just two major problems left: how do you detect the Processing Key and if its not in memory how do you find it at all? Well since I now knew how things worked I knew the Processing Key had to be combined with a C-value to produce the Media Key.
OK, I don’t get any of that. But clearly others do, so I share this for their benefit. (via boingboing)
[tags]AACS copy protection broken, Next-gen video disc format protections broken[/tags]