Print 46 comment(s) - last by SGWB.. on Feb 16 at 3:45 PM

The tool that arnezami and muslix64 used to defeat AACS

The HD DVD that gave up its Processing Key for all to use
One key to decrypt them all

Last December, a hacker named “Muslix64” circumvented HD DVD copy protection, resulting in the release of pirated copies on the Internet. Less than one month later, the same Muslix64, with the help of another hacker, was able to crack the encryption on Blu-ray Discs.

On Sunday, another Doom9 forum poster named “arnezami” presented the next great breakthrough in HD DVD and Blu-ray Disc decryption. Previously, every HD movie needed its own unique key in order to be decrypted; but with arnezami’s discovery, there is one key to rule them all -- at least for now, until the Advanced Access Content System Licensing Administrator gets on it.

What arnezami found was the Processing Key, which appears to be the silver bullet in decrypting all existing HD DVD and Blu-ray Discs. Arnezami was armed only with an Xbox 360 HD DVD player and the bundled King Kong movie. Other Doom9 forum contributors posted their keys to HD DVD movies such as The Departed and Spy Game, which were proved decryptable using the Processing Key.

Figuring that the copy protection schemes on Blu-ray Disc are similar to HD DVD, other posters reported data from Talladega Nights and House of Flying Daggers, which were also decrypted using the Processing Key found from King Kong.

Arnezami unlocked the secrets to HD DVD and Blu-ray Disc encryption without the use of any hacked software or hardware. “Most of the time I spend studying the AACS papers,” he wrote. “A good understanding of how things worked have helped me greatly in knowing what to find in the first place (and how to recognize something).”

Arnezami started his quest by finding the Volume ID to King Kong, which motivated him to find the Media Key. After a few trial and error attempts, arnezami had the idea to of watching the data move from the HD DVD drive to the memory on his computer. “What I wanted to do is ‘record’ all changes in this part of memory during startup of the movie,” he wrote in his explanation. “Hopefully I would catch something interesting.”

“In the end I did something a little more efficient: I used the HD DVD VUK extractor and adapted it to slow down the software player (while scanning its memory continuously) and at the very moment the Media Key was detected it halted the player,” arnezami continued. “I then made a memdump with WinHex.”

Using this method, arnezami found that his first C-value was a hit, leading to the discovery of the Processing Key. “I now had the feeling I had something,” he said.

Arnezami isn’t revealing which software player he used to expose the key information for fear that the Advanced Access Content System Licensing Administrator would crackdown on the software developer. What he did want to say, however, is that he made his discovery simply by watching the data as it passed through his system.

Comments     Threshold

This article is over a month old, voting and posting comments is disabled

Processing... key?
By Magnadoodle on 2/14/2007 10:21:12 AM , Rating: 2
I think there's been a lot of bad reporting on the web about this particular bit of news. Everyone seems confused about what exactly this processing key does.

This is from a staff member on the Slysoft forums one of you mentioned. It seems they deserve more attention after all:

The processing key still will not decrypt all HD-DVDs by itself. Another information is required: the Volume-ID.
This still either has to be fetched out of the memory of some weakly programmed HDDVD-software or read directly from the drive. The drive will only reveal it with proper authentication - and for that you need a Player-Key (often confused with the device key, but they are two distinct secrets).

Also: this processing key will most certainly only work with HD-DVDs mastered with an MKB version 1. As soon as any device gets revoked, the MKB version will change and a different processing key will be valid.

The way I see it, the processing key didn't bring them much closer to their final goal. Previously, you had to fumble VUKs out of WinDVDs memory, now it's the Volume ID - admittedly, a little easier to identify, as it always starts with 0x40 00.
When WinDVDs keys get revoked, you can bet on Intervideo not being so stupid to leave this hole open.

Sad thing: we already had the whole AACS done, when the boys from doom9 were still gathering title-keys from WinDVDs memory - but they're getting all the press... (hey, no offence, guys, you're doing the right thing )

"I modded down, down, down, and the flames went higher." -- Sven Olsen
Related Articles
Blu-ray Encryption Defeated
January 23, 2007, 6:49 PM
First Pirated HD DVDs Released
January 17, 2007, 4:30 PM
Hackers Claim HD DVD Encryption Circumvented
December 28, 2006, 12:24 PM

Copyright 2016 DailyTech LLC. - RSS Feed | Advertise | About Us | Ethics | FAQ | Terms, Conditions & Privacy Information | Kristopher Kubicki