Crack, Decrypt and Copy HD DVD AACS DRM Protected Movies with BackupHDDVD

HD DVD which also known as High Density DVD or High-Definition DVD is a high-density optical disc format designed for the storage of data and high-definition video. For the purpose of using HD DVD discs to store and distribute video and movie contents and releases from Hollywood film studios to retail sales, an encryption system and digital rights management (DRM) copy protection technology named Advanced Access Content System (AACS) has been incorporated into commercialized HD DVDs and Blu-Ray Discs in order to restrict access and limit ability to copy from the HD DVD or Blu-Ray Disc. However, a hacker named “muslix64″ has released a AACS and HD DVD exploit and crack utility named BackupHDDVD on the doom9.org forums.

If you own a HD DVD drive, or XBox 360 external USB HD DVD drive with movie titles in HD DVD format, now you can use BackupHDDVD to copy, transfer, backup or rip movie from HD-DVD disc to your hard disk. BackupHDDVD is a simple Java based command line tool for decrypting AACS protected movies, which is most HD DVD video contents and movie releases based on. The crack or exploit hack apparently used the same decryption methodology as the DeCSS hack to crack DVD copy protection encryption scheme DRM named CSS (content scrambling system) by exploiting weak player keys. BackupHDDVD is developed out of motivation from the frustration the hacker faced when he could not play the HD video simply because his video card was not HDCP-compliant, and he had a HD monitor plugged with a DVI interface.

Muslix64 has posted a demo video to showcase how the to backup, rip or copy the movies and films from HD DVD by exploiting and cracking the title keys of the HD DVD disk so that the contents can be decrypted and decompressed.

As you can see, the copying and ripping of video from a HD DVD is a simple command issuing process, with the demo or tutorial video guide uses Warner Bros’ Full Metal Jacket. The problem is that users will need to find and retrieve the HD DVD title keys themselves. An ACCS-protected HD DVD is encrypted using one or more title keys, which are usually derived from a combination of a media key and other elements such as the physical serial number embedded on a DVD and a cryptographic hash of the title usage rules.

BackupHDDVD v0.999 can be downloaded from here (BackupHDDVD.zip) or here, or from original thread about BackupHDDVD in doom9.org where you can also find more information about the utility.

BackupHDDVD v1.0 has also been released with the following new features:

- Volume key support
- Partial resume of an interrupted decryption session
- New file format and file name for key database file, which has been renamed to KEYDB.cfg from TKDB.cfg.

Download BackupHDDVD v1.0 (BackupHDDVD100.zip) from here, here or here.

There is also a modification to version 1.0 of BackupHDDVD by OverlordQ (aptly named OQ Mod 0.1) with the following features:

- Will report the calculated Disc Hash.
- If Hash value is not found in key file (KEYDB.cfg), will add it to the key list after prompting for the name of the movie.

Download BackupHDDVD V1.00 (OQ Mod 0.1 – compiled with Java 5.0) from here and here.
Download BackupHDDVD V1.00 (OQ Mod 0.1 – compiled with Java 1.4 compatible) from here and here.

To use BackupHDDVD to backup HDDVD, simply unpack or extract the zip file into a folder, and open a command prompt console window and change to the “run” sub-directory. Before you start your decryption and copying process, the correct and valid title key has to be found and populate in TKDB.cfg file located in same “run” sub-directory. Without the title key, the video copied or transferred will not be decrypted and will stay in original encrypted state, which are unviewable. When you’re ready, issue the command in the following syntax:

BackupHDDVD f: e:\movies\mymovie

where “f:” is the source drive or your HD DVD drive and “e:\movies\mymovie” is the destination directory where you want to put your ‘fair use’ movie.

As mentioned, TKDB.cfg is a important hash file that stores SHA1 hash of VTKF000.AACS file on HD-DVD disk, HD video title and the respective title key. The default TKDB.cfg has the following value, with the value of title key for various HD movie titles (on the rightmost column) been stripped off to incomplete, invalid or empty.

CE6339246F34087AB355681DEB656D23DCD5BD86=Full Metal Jacket | 1-00000000000000000000000000000000
486198E3855B57CD40F6DC0C60645BDE8E1E9AC5=Van Helsing |19-00000000000000000000000000000000
B5A8E784B83E793AB246D0C5F7C148A39D7F4856=Tomb Raider 1 | 6-00000000000000000000000000000000
4ACABE525F5CBF77DAA43EA2B83E04918D5FA6D4=Apollo 13 | 1-00000000000000000000000000000000
3D357B0653A66176583C5218FD0149EAF8832FB0=The Last Samurai | 1-00000000000000000000000000000000
610CF1EB362D40050123E92F063D51AC05676F37=The Fugitive | 1-00000000000000000000000000000000

Update: With the release of BackupHDDVD version 1.0, the name of the TKDB.cfg has been changed to KEYDB.cfg with new file format. For explanation of the new file format, visit here.

For the HD DVD crack BackupHDDVD to work properly, a valid title key must be found and populate into TKDB.cfg file. BetaNews and BackupHDDVD FAQ has provided some insight on how to find out the vulnerable title keys of certain HDDVD movies, by using Cyberlink PowerDVD 6.5 HD DVD edition. (Note: Version 6.5 no longer available on Cyberlink website, you will need to find it on torrent or warez websites instead.) It’s believed that wrongly implemented AACS-compliant PowerDVD 6.5 HD DVD player retrieves the encrypted title key from the HD-DVD disc and stores the key in a database-formatted configuration file that PowerDVD at some points loads into unencrypted portion of memory in clear text format. By using this title key, the revocation system which intends to protect the DRM from crack can be bypassed or failed as useless too.

Update: The cryptographic title keys and the volume unique keys of HD-DVD videos and movies discs have been successfully cracked, decoded and decrypted by Doom9.org forumers. Check out the method to decrypt the keys and some available keys.

Related Articles

• Decrypted Title Keys and Volume Unique Key for BackupHDDVD to Bypass HD-DVD AACS DRM
• How to Copy Encrypted or Copy-Protected DVD
• Remove Restrictions and Decrypt Password Protected PDF Files With PDF Unlocker
• Easy Way to Remember Master Processing Key to Crack HD-DVD and Blu-Ray DRM
• Convert DRM Protected Music or Movies To Unprotected Format With SoundTaxi Pro VideoRip v3.4.5
• Crack, Remove and Disable Windows Media Player DRM License Acquisition and Music Copy Protection with FairUse4WM
• Sony Demonstrates How To Transfer Blu-ray Disc Movies To PSP
• Free Aplus DVD Copy (Disc Clone Tool) License Name and Code from GOTD
• Copy Path Information for Multiple Files to Clipboard with Copy Path
• Firefox Add-ons: Copy Plain Text to Copy Text Without Formatting

This entry was posted on Monday, January 1st, 2007 at 5:30 pm and is filed under Audio & Video. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.