1 /*****************************************************************************
2 * css.c: Functions for DVD authentication and descrambling
3 *****************************************************************************
4 * Copyright (C) 1999-2003 VideoLAN
6 * Modified for use with MPlayer, changes contained in libdvdcss_changes.diff.
7 * detailed CVS changelog at http://www.mplayerhq.hu/cgi-bin/cvsweb.cgi/main/
10 * Authors: Stéphane Borel <stef@via.ecp.fr>
11 * Håkan Hjort <d95hjort@dtek.chalmers.se>
14 * - css-auth by Derek Fawcus <derek@spider.com>
15 * - DVD CSS ioctls example program by Andrew T. Veliath <andrewtv@usa.net>
16 * - The Divide and conquer attack by Frank A. Stevenson <frank@funcom.com>
17 * (see http://www-2.cs.cmu.edu/~dst/DeCSS/FrankStevenson/index.html)
18 * - DeCSSPlus by Ethan Hawke
20 * see http://www.lemuria.org/DeCSS/ by Tom Vogt for more information.
22 * This program is free software; you can redistribute it and/or modify
23 * it under the terms of the GNU General Public License as published by
24 * the Free Software Foundation; either version 2 of the License, or
25 * (at your option) any later version.
27 * This program is distributed in the hope that it will be useful,
28 * but WITHOUT ANY WARRANTY; without even the implied warranty of
29 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
30 * GNU General Public License for more details.
32 * You should have received a copy of the GNU General Public License
33 * along with this program; if not, write to the Free Software
34 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111, USA.
35 *****************************************************************************/
37 /*****************************************************************************
39 *****************************************************************************/
45 #include <sys/types.h>
47 #ifdef HAVE_SYS_PARAM_H
48 # include <sys/param.h>
63 #include "libdvdcss.h"
64 #include "csstables.h"
68 /*****************************************************************************
70 *****************************************************************************/
71 static void PrintKey ( dvdcss_t
, char *, uint8_t const * );
73 static int GetBusKey ( dvdcss_t
);
74 static int GetASF ( dvdcss_t
);
76 static void CryptKey ( int, int, uint8_t const *, uint8_t * );
77 static void DecryptKey ( uint8_t,
78 uint8_t const *, uint8_t const *, uint8_t * );
80 static int DecryptDiscKey ( dvdcss_t
, uint8_t const *, dvd_key_t
);
81 static int CrackDiscKey ( dvdcss_t
, uint8_t * );
83 static void DecryptTitleKey ( dvd_key_t
, dvd_key_t
);
84 static int RecoverTitleKey ( int, uint8_t const *,
85 uint8_t const *, uint8_t const *, uint8_t * );
86 static int CrackTitleKey ( dvdcss_t
, int, int, dvd_key_t
);
88 static int AttackPattern ( uint8_t const[], int, uint8_t * );
90 static int AttackPadding ( uint8_t const[], int, uint8_t * );
93 /*****************************************************************************
94 * _dvdcss_test: check if the disc is encrypted or not
95 *****************************************************************************/
96 int _dvdcss_test( dvdcss_t dvdcss
)
98 int i_ret
, i_copyright
;
100 i_ret
= ioctl_ReadCopyright( dvdcss
->i_fd
, 0 /* i_layer */, &i_copyright
);
105 /* Maybe we didn't have enough privileges to read the copyright
106 * (see ioctl_ReadCopyright comments).
107 * Apparently, on unencrypted DVDs _dvdcss_disckey() always fails, so
108 * we can check this as a workaround. */
111 if( _dvdcss_disckey( dvdcss
) < 0 )
120 /* Since it's the first ioctl we try to issue, we add a notice */
121 print_error( dvdcss
, "css error: ioctl_ReadCopyright failed, "
122 "make sure there is a DVD in the drive, and that "
123 "you have used the correct device node." );
131 /*****************************************************************************
132 * _dvdcss_title: crack or decrypt the current title key if needed
133 *****************************************************************************
134 * This function should only be called by dvdcss->pf_seek and should eventually
135 * not be external if possible.
136 *****************************************************************************/
137 int _dvdcss_title ( dvdcss_t dvdcss
, int i_block
)
139 dvd_title_t
*p_title
;
140 dvd_title_t
*p_newtitle
;
141 dvd_key_t p_title_key
;
142 int i_fd
, i_ret
= -1, b_cache
= 0;
144 if( ! dvdcss
->b_scrambled
)
149 /* Check if we've already cracked this key */
150 p_title
= dvdcss
->p_titles
;
151 while( p_title
!= NULL
152 && p_title
->p_next
!= NULL
153 && p_title
->p_next
->i_startlb
<= i_block
)
155 p_title
= p_title
->p_next
;
159 && p_title
->i_startlb
== i_block
)
161 /* We've already cracked this key, nothing to do */
162 memcpy( dvdcss
->css
.p_title_key
, p_title
->p_key
, sizeof(dvd_key_t
) );
166 /* Check whether the key is in our disk cache */
167 if( dvdcss
->psz_cachefile
[0] )
169 /* XXX: be careful, we use sprintf and not snprintf */
170 sprintf( dvdcss
->psz_block
, "%.10x", i_block
);
171 i_fd
= open( dvdcss
->psz_cachefile
, O_RDONLY
);
176 unsigned char psz_key
[KEY_SIZE
* 3];
177 unsigned int k0
, k1
, k2
, k3
, k4
;
179 psz_key
[KEY_SIZE
* 3 - 1] = '\0';
181 if( read( i_fd
, psz_key
, KEY_SIZE
* 3 - 1 ) == KEY_SIZE
* 3 - 1
182 && sscanf( psz_key
, "%x:%x:%x:%x:%x",
183 &k0
, &k1
, &k2
, &k3
, &k4
) == 5 )
190 PrintKey( dvdcss
, "title key found in cache ", p_title_key
);
192 /* Don't try to save it again */
201 /* Crack or decrypt CSS title key for current VTS */
204 i_ret
= _dvdcss_titlekey( dvdcss
, i_block
, p_title_key
);
208 print_error( dvdcss
, "fatal error in vts css key" );
214 print_debug( dvdcss
, "unencrypted title" );
215 /* We cache this anyway, so we don't need to check again. */
219 /* Key is valid, we store it on disk. */
220 if( dvdcss
->psz_cachefile
[0] && b_cache
)
222 i_fd
= open( dvdcss
->psz_cachefile
, O_RDWR
|O_CREAT
, 0644 );
225 unsigned char psz_key
[KEY_SIZE
* 3 + 2];
227 sprintf( psz_key
, "%02x:%02x:%02x:%02x:%02x\r\n",
228 p_title_key
[0], p_title_key
[1], p_title_key
[2],
229 p_title_key
[3], p_title_key
[4] );
231 write( i_fd
, psz_key
, KEY_SIZE
* 3 + 1 );
236 /* Find our spot in the list */
238 p_title
= dvdcss
->p_titles
;
239 while( ( p_title
!= NULL
) && ( p_title
->i_startlb
< i_block
) )
241 p_newtitle
= p_title
;
242 p_title
= p_title
->p_next
;
245 /* Save the found title */
246 p_title
= p_newtitle
;
248 /* Write in the new title and its key */
249 p_newtitle
= malloc( sizeof( dvd_title_t
) );
250 p_newtitle
->i_startlb
= i_block
;
251 memcpy( p_newtitle
->p_key
, p_title_key
, KEY_SIZE
);
253 /* Link it at the head of the (possibly empty) list */
254 if( p_title
== NULL
)
256 p_newtitle
->p_next
= dvdcss
->p_titles
;
257 dvdcss
->p_titles
= p_newtitle
;
259 /* Link the new title inside the list */
262 p_newtitle
->p_next
= p_title
->p_next
;
263 p_title
->p_next
= p_newtitle
;
266 memcpy( dvdcss
->css
.p_title_key
, p_title_key
, KEY_SIZE
);
270 /*****************************************************************************
271 * _dvdcss_disckey: get disc key.
272 *****************************************************************************
273 * This function should only be called if DVD ioctls are present.
274 * It will set dvdcss->i_method = DVDCSS_METHOD_TITLE if it fails to find
276 * Two decryption methods are offered:
277 * -disc key hash crack,
278 * -decryption with player keys if they are available.
279 *****************************************************************************/
280 int _dvdcss_disckey( dvdcss_t dvdcss
)
282 unsigned char p_buffer
[ DVD_DISCKEY_SIZE
];
283 dvd_key_t p_disc_key
;
286 if( GetBusKey( dvdcss
) < 0 )
291 /* Get encrypted disc key */
292 if( ioctl_ReadDiscKey( dvdcss
->i_fd
, &dvdcss
->css
.i_agid
, p_buffer
) < 0 )
294 print_error( dvdcss
, "ioctl ReadDiscKey failed" );
298 /* This should have invaidated the AGID and got us ASF=1. */
299 if( GetASF( dvdcss
) != 1 )
301 /* Region mismatch (or region not set) is the most likely source. */
303 "ASF not 1 after reading disc key (region mismatch?)" );
304 ioctl_InvalidateAgid( dvdcss
->i_fd
, &dvdcss
->css
.i_agid
);
308 /* Shuffle disc key using bus key */
309 for( i
= 0 ; i
< DVD_DISCKEY_SIZE
; i
++ )
311 p_buffer
[ i
] ^= dvdcss
->css
.p_bus_key
[ 4 - (i
% KEY_SIZE
) ];
314 /* Decrypt disc key */
315 switch( dvdcss
->i_method
)
317 case DVDCSS_METHOD_KEY
:
319 /* Decrypt disc key with player key. */
320 PrintKey( dvdcss
, "decrypting disc key ", p_buffer
);
321 if( ! DecryptDiscKey( dvdcss
, p_buffer
, p_disc_key
) )
323 PrintKey( dvdcss
, "decrypted disc key is ", p_disc_key
);
326 print_debug( dvdcss
, "failed to decrypt the disc key, "
327 "faulty drive/kernel? "
328 "cracking title keys instead" );
330 /* Fallback, but not to DISC as the disc key might be faulty */
331 dvdcss
->i_method
= DVDCSS_METHOD_TITLE
;
334 case DVDCSS_METHOD_DISC
:
336 /* Crack Disc key to be able to use it */
337 memcpy( p_disc_key
, p_buffer
, KEY_SIZE
);
338 PrintKey( dvdcss
, "cracking disc key ", p_disc_key
);
339 if( ! CrackDiscKey( dvdcss
, p_disc_key
) )
341 PrintKey( dvdcss
, "cracked disc key is ", p_disc_key
);
344 print_debug( dvdcss
, "failed to crack the disc key" );
345 memset( p_disc_key
, 0, KEY_SIZE
);
346 dvdcss
->i_method
= DVDCSS_METHOD_TITLE
;
351 print_debug( dvdcss
, "disc key needs not be decrypted" );
352 memset( p_disc_key
, 0, KEY_SIZE
);
356 memcpy( dvdcss
->css
.p_disc_key
, p_disc_key
, KEY_SIZE
);
362 /*****************************************************************************
363 * _dvdcss_titlekey: get title key.
364 *****************************************************************************/
365 int _dvdcss_titlekey( dvdcss_t dvdcss
, int i_pos
, dvd_key_t p_title_key
)
367 static uint8_t p_garbage
[ DVDCSS_BLOCK_SIZE
]; /* we never read it back */
368 uint8_t p_key
[ KEY_SIZE
];
371 if( dvdcss
->b_ioctls
&& ( dvdcss
->i_method
== DVDCSS_METHOD_KEY
||
372 dvdcss
->i_method
== DVDCSS_METHOD_DISC
) )
374 /* We have a decrypted Disc key and the ioctls are available,
375 * read the title key and decrypt it.
378 print_debug( dvdcss
, "getting title key at block %i the classic way",
381 /* We need to authenticate again every time to get a new session key */
382 if( GetBusKey( dvdcss
) < 0 )
387 /* Get encrypted title key */
388 if( ioctl_ReadTitleKey( dvdcss
->i_fd
, &dvdcss
->css
.i_agid
,
392 "ioctl ReadTitleKey failed (region mismatch?)" );
396 /* Test ASF, it will be reset to 0 if we got a Region error */
397 switch( GetASF( dvdcss
) )
400 /* An error getting the ASF status, something must be wrong. */
401 print_debug( dvdcss
, "lost ASF requesting title key" );
402 ioctl_InvalidateAgid( dvdcss
->i_fd
, &dvdcss
->css
.i_agid
);
407 /* This might either be a title that has no key,
408 * or we encountered a region error. */
409 print_debug( dvdcss
, "lost ASF requesting title key" );
413 /* Drive status is ok. */
414 /* If the title key request failed, but we did not loose ASF,
415 * we might stil have the AGID. Other code assume that we
416 * will not after this so invalidate it(?). */
419 ioctl_InvalidateAgid( dvdcss
->i_fd
, &dvdcss
->css
.i_agid
);
426 /* Decrypt title key using the bus key */
427 for( i
= 0 ; i
< KEY_SIZE
; i
++ )
429 p_key
[ i
] ^= dvdcss
->css
.p_bus_key
[ 4 - (i
% KEY_SIZE
) ];
432 /* If p_key is all zero then there really wasn't any key present
433 * even though we got to read it without an error. */
434 if( !( p_key
[0] | p_key
[1] | p_key
[2] | p_key
[3] | p_key
[4] ) )
440 PrintKey( dvdcss
, "initial disc key ", dvdcss
->css
.p_disc_key
);
441 DecryptTitleKey( dvdcss
->css
.p_disc_key
, p_key
);
442 PrintKey( dvdcss
, "decrypted title key ", p_key
);
446 /* All went well either there wasn't a key or we have it now. */
447 memcpy( p_title_key
, p_key
, KEY_SIZE
);
448 PrintKey( dvdcss
, "title key is ", p_title_key
);
453 /* The title key request failed */
454 print_debug( dvdcss
, "resetting drive and cracking title key" );
456 /* Read an unscrambled sector and reset the drive */
457 dvdcss
->pf_seek( dvdcss
, 0 );
458 dvdcss
->pf_read( dvdcss
, p_garbage
, 1 );
459 dvdcss
->pf_seek( dvdcss
, 0 );
460 _dvdcss_disckey( dvdcss
);
465 /* METHOD is TITLE, we can't use the ioctls or requesting the title key
466 * failed above. For these cases we try to crack the key instead. */
468 /* For now, the read limit is 9Gb / 2048 = 4718592 sectors. */
469 i_ret
= CrackTitleKey( dvdcss
, i_pos
, 4718592, p_key
);
471 memcpy( p_title_key
, p_key
, KEY_SIZE
);
472 PrintKey( dvdcss
, "title key is ", p_title_key
);
477 /*****************************************************************************
478 * _dvdcss_unscramble: does the actual descrambling of data
479 *****************************************************************************
480 * sec : sector to unscramble
481 * key : title key for this sector
482 *****************************************************************************/
483 int _dvdcss_unscramble( dvd_key_t p_key
, uint8_t *p_sec
)
485 unsigned int i_t1
, i_t2
, i_t3
, i_t4
, i_t5
, i_t6
;
486 uint8_t *p_end
= p_sec
+ DVDCSS_BLOCK_SIZE
;
488 /* PES_scrambling_control */
489 if( !(p_sec
[0x14] & 0x30) )
494 i_t1
= (p_key
[0] ^ p_sec
[0x54]) | 0x100;
495 i_t2
= p_key
[1] ^ p_sec
[0x55];
496 i_t3
= (p_key
[2] | (p_key
[3] << 8) |
497 (p_key
[4] << 16)) ^ (p_sec
[0x56] |
498 (p_sec
[0x57] << 8) | (p_sec
[0x58] << 16));
500 i_t3
= i_t3
* 2 + 8 - i_t4
;
504 while( p_sec
!= p_end
)
506 i_t4
= p_css_tab2
[i_t2
] ^ p_css_tab3
[i_t1
];
508 i_t1
= ( ( i_t1
& 1 ) << 8 ) ^ i_t4
;
509 i_t4
= p_css_tab5
[i_t4
];
510 i_t6
= ((((((( i_t3
>> 3 ) ^ i_t3
) >> 1 ) ^
511 i_t3
) >> 8 ) ^ i_t3
) >> 5 ) & 0xff;
512 i_t3
= (i_t3
<< 8 ) | i_t6
;
513 i_t6
= p_css_tab4
[i_t6
];
515 *p_sec
= p_css_tab1
[*p_sec
] ^ ( i_t5
& 0xff );
523 /* Following functions are local */
525 /*****************************************************************************
526 * GetBusKey : Go through the CSS Authentication process
527 *****************************************************************************
528 * It simulates the mutual authentication between logical unit and host,
529 * and stops when a session key (called bus key) has been established.
530 * Always do the full auth sequence. Some drives seem to lie and always
531 * respond with ASF=1. For instance the old DVD roms on Compaq Armada says
532 * that ASF=1 from the start and then later fail with a 'read of scrambled
533 * block without authentication' error.
534 *****************************************************************************/
535 static int GetBusKey( dvdcss_t dvdcss
)
537 uint8_t p_buffer
[10];
538 uint8_t p_challenge
[2*KEY_SIZE
];
541 dvd_key_t p_key_check
;
542 uint8_t i_variant
= 0;
546 print_debug( dvdcss
, "requesting AGID" );
547 i_ret
= ioctl_ReportAgid( dvdcss
->i_fd
, &dvdcss
->css
.i_agid
);
549 /* We might have to reset hung authentication processes in the drive
550 * by invalidating the corresponding AGID'. As long as we haven't got
551 * an AGID, invalidate one (in sequence) and try again. */
552 for( i
= 0; i_ret
== -1 && i
< 4 ; ++i
)
554 print_debug( dvdcss
, "ioctl ReportAgid failed, "
555 "invalidating AGID %d", i
);
557 /* This is really _not good_, should be handled by the OS.
558 * Invalidating an AGID could make another process fail somewhere
559 * in its authentication process. */
560 dvdcss
->css
.i_agid
= i
;
561 ioctl_InvalidateAgid( dvdcss
->i_fd
, &dvdcss
->css
.i_agid
);
563 print_debug( dvdcss
, "requesting AGID" );
564 i_ret
= ioctl_ReportAgid( dvdcss
->i_fd
, &dvdcss
->css
.i_agid
);
567 /* Unable to authenticate without AGID */
570 print_error( dvdcss
, "ioctl ReportAgid failed, fatal" );
574 /* Setup a challenge, any values should work */
575 for( i
= 0 ; i
< 10; ++i
)
580 /* Get challenge from host */
581 for( i
= 0 ; i
< 10 ; ++i
)
583 p_buffer
[9-i
] = p_challenge
[i
];
586 /* Send challenge to LU */
587 if( ioctl_SendChallenge( dvdcss
->i_fd
,
588 &dvdcss
->css
.i_agid
, p_buffer
) < 0 )
590 print_error( dvdcss
, "ioctl SendChallenge failed" );
591 ioctl_InvalidateAgid( dvdcss
->i_fd
, &dvdcss
->css
.i_agid
);
595 /* Get key1 from LU */
596 if( ioctl_ReportKey1( dvdcss
->i_fd
, &dvdcss
->css
.i_agid
, p_buffer
) < 0)
598 print_error( dvdcss
, "ioctl ReportKey1 failed" );
599 ioctl_InvalidateAgid( dvdcss
->i_fd
, &dvdcss
->css
.i_agid
);
603 /* Send key1 to host */
604 for( i
= 0 ; i
< KEY_SIZE
; i
++ )
606 p_key1
[i
] = p_buffer
[4-i
];
609 for( i
= 0 ; i
< 32 ; ++i
)
611 CryptKey( 0, i
, p_challenge
, p_key_check
);
613 if( memcmp( p_key_check
, p_key1
, KEY_SIZE
) == 0 )
615 print_debug( dvdcss
, "drive authenticated, using variant %d", i
);
623 print_error( dvdcss
, "drive would not authenticate" );
624 ioctl_InvalidateAgid( dvdcss
->i_fd
, &dvdcss
->css
.i_agid
);
628 /* Get challenge from LU */
629 if( ioctl_ReportChallenge( dvdcss
->i_fd
,
630 &dvdcss
->css
.i_agid
, p_buffer
) < 0 )
632 print_error( dvdcss
, "ioctl ReportKeyChallenge failed" );
633 ioctl_InvalidateAgid( dvdcss
->i_fd
, &dvdcss
->css
.i_agid
);
637 /* Send challenge to host */
638 for( i
= 0 ; i
< 10 ; ++i
)
640 p_challenge
[i
] = p_buffer
[9-i
];
643 CryptKey( 1, i_variant
, p_challenge
, p_key2
);
645 /* Get key2 from host */
646 for( i
= 0 ; i
< KEY_SIZE
; ++i
)
648 p_buffer
[4-i
] = p_key2
[i
];
651 /* Send key2 to LU */
652 if( ioctl_SendKey2( dvdcss
->i_fd
, &dvdcss
->css
.i_agid
, p_buffer
) < 0 )
654 print_error( dvdcss
, "ioctl SendKey2 failed" );
655 ioctl_InvalidateAgid( dvdcss
->i_fd
, &dvdcss
->css
.i_agid
);
659 /* The drive has accepted us as authentic. */
660 print_debug( dvdcss
, "authentication established" );
662 memcpy( p_challenge
, p_key1
, KEY_SIZE
);
663 memcpy( p_challenge
+ KEY_SIZE
, p_key2
, KEY_SIZE
);
665 CryptKey( 2, i_variant
, p_challenge
, dvdcss
->css
.p_bus_key
);
670 /*****************************************************************************
671 * PrintKey : debug function that dumps a key value
672 *****************************************************************************/
673 static void PrintKey( dvdcss_t dvdcss
, char *prefix
, uint8_t const *data
)
675 print_debug( dvdcss
, "%s%02x:%02x:%02x:%02x:%02x", prefix
,
676 data
[0], data
[1], data
[2], data
[3], data
[4] );
679 /*****************************************************************************
680 * GetASF : Get Authentication success flag
681 *****************************************************************************
684 * 0 if the device needs to be authenticated,
686 *****************************************************************************/
687 static int GetASF( dvdcss_t dvdcss
)
691 if( ioctl_ReportASF( dvdcss
->i_fd
, NULL
, &i_asf
) != 0 )
693 /* The ioctl process has failed */
694 print_error( dvdcss
, "GetASF fatal error" );
700 print_debug( dvdcss
, "GetASF authenticated, ASF=1" );
704 print_debug( dvdcss
, "GetASF not authenticated, ASF=0" );
710 /*****************************************************************************
711 * CryptKey : shuffles bits and unencrypt keys.
712 *****************************************************************************
713 * Used during authentication and disc key negociation in GetBusKey.
714 * i_key_type : 0->key1, 1->key2, 2->buskey.
715 * i_variant : between 0 and 31.
716 *****************************************************************************/
717 static void CryptKey( int i_key_type
, int i_variant
,
718 uint8_t const *p_challenge
, uint8_t *p_key
)
720 /* Permutation table for challenge */
721 uint8_t pp_perm_challenge
[3][10] =
722 { { 1, 3, 0, 7, 5, 2, 9, 6, 4, 8 },
723 { 6, 1, 9, 3, 8, 5, 7, 4, 0, 2 },
724 { 4, 0, 3, 5, 7, 2, 8, 6, 1, 9 } };
726 /* Permutation table for variant table for key2 and buskey */
727 uint8_t pp_perm_variant
[2][32] =
728 { { 0x0a, 0x08, 0x0e, 0x0c, 0x0b, 0x09, 0x0f, 0x0d,
729 0x1a, 0x18, 0x1e, 0x1c, 0x1b, 0x19, 0x1f, 0x1d,
730 0x02, 0x00, 0x06, 0x04, 0x03, 0x01, 0x07, 0x05,
731 0x12, 0x10, 0x16, 0x14, 0x13, 0x11, 0x17, 0x15 },
732 { 0x12, 0x1a, 0x16, 0x1e, 0x02, 0x0a, 0x06, 0x0e,
733 0x10, 0x18, 0x14, 0x1c, 0x00, 0x08, 0x04, 0x0c,
734 0x13, 0x1b, 0x17, 0x1f, 0x03, 0x0b, 0x07, 0x0f,
735 0x11, 0x19, 0x15, 0x1d, 0x01, 0x09, 0x05, 0x0d } };
737 uint8_t p_variants
[32] =
738 { 0xB7, 0x74, 0x85, 0xD0, 0xCC, 0xDB, 0xCA, 0x73,
739 0x03, 0xFE, 0x31, 0x03, 0x52, 0xE0, 0xB7, 0x42,
740 0x63, 0x16, 0xF2, 0x2A, 0x79, 0x52, 0xFF, 0x1B,
741 0x7A, 0x11, 0xCA, 0x1A, 0x9B, 0x40, 0xAD, 0x01 };
743 /* The "secret" key */
744 uint8_t p_secret
[5] = { 0x55, 0xD6, 0xC4, 0xC5, 0x28 };
746 uint8_t p_bits
[30], p_scratch
[10], p_tmp1
[5], p_tmp2
[5];
747 uint8_t i_lfsr0_o
; /* 1 bit used */
748 uint8_t i_lfsr1_o
; /* 1 bit used */
749 uint8_t i_css_variant
, i_cse
, i_index
, i_combined
, i_carry
;
751 uint32_t i_lfsr0
, i_lfsr1
;
756 for (i
= 9; i
>= 0; --i
)
757 p_scratch
[i
] = p_challenge
[pp_perm_challenge
[i_key_type
][i
]];
759 i_css_variant
= ( i_key_type
== 0 ) ? i_variant
:
760 pp_perm_variant
[i_key_type
-1][i_variant
];
763 * This encryption engine implements one of 32 variations
764 * one the same theme depending upon the choice in the
765 * variant parameter (0 - 31).
767 * The algorithm itself manipulates a 40 bit input into
769 * The parameter 'input' is 80 bits. It consists of
770 * the 40 bit input value that is to be encrypted followed
771 * by a 40 bit seed value for the pseudo random number
775 /* Feed the secret into the input values such that
776 * we alter the seed to the LFSR's used above, then
777 * generate the bits to play with.
779 for( i
= 5 ; --i
>= 0 ; )
781 p_tmp1
[i
] = p_scratch
[5 + i
] ^ p_secret
[i
] ^ p_crypt_tab2
[i
];
785 * We use two LFSR's (seeded from some of the input data bytes) to
786 * generate two streams of pseudo-random bits. These two bit streams
787 * are then combined by simply adding with carry to generate a final
788 * sequence of pseudo-random bits which is stored in the buffer that
789 * 'output' points to the end of - len is the size of this buffer.
791 * The first LFSR is of degree 25, and has a polynomial of:
792 * x^13 + x^5 + x^4 + x^1 + 1
794 * The second LSFR is of degree 17, and has a (primitive) polynomial of:
797 * I don't know if these polynomials are primitive modulo 2, and thus
798 * represent maximal-period LFSR's.
801 * Note that we take the output of each LFSR from the new shifted in
802 * bit, not the old shifted out bit. Thus for ease of use the LFSR's
803 * are implemented in bit reversed order.
807 /* In order to ensure that the LFSR works we need to ensure that the
808 * initial values are non-zero. Thus when we initialise them from
809 * the seed, we ensure that a bit is set.
811 i_lfsr0
= ( p_tmp1
[0] << 17 ) | ( p_tmp1
[1] << 9 ) |
812 (( p_tmp1
[2] & ~7 ) << 1 ) | 8 | ( p_tmp1
[2] & 7 );
813 i_lfsr1
= ( p_tmp1
[3] << 9 ) | 0x100 | p_tmp1
[4];
815 i_index
= sizeof(p_bits
);
820 for( i_bit
= 0, i_val
= 0 ; i_bit
< 8 ; ++i_bit
)
823 i_lfsr0_o
= ( ( i_lfsr0
>> 24 ) ^ ( i_lfsr0
>> 21 ) ^
824 ( i_lfsr0
>> 20 ) ^ ( i_lfsr0
>> 12 ) ) & 1;
825 i_lfsr0
= ( i_lfsr0
<< 1 ) | i_lfsr0_o
;
827 i_lfsr1_o
= ( ( i_lfsr1
>> 16 ) ^ ( i_lfsr1
>> 2 ) ) & 1;
828 i_lfsr1
= ( i_lfsr1
<< 1 ) | i_lfsr1_o
;
830 i_combined
= !i_lfsr1_o
+ i_carry
+ !i_lfsr0_o
;
832 i_carry
= ( i_combined
>> 1 ) & 1;
833 i_val
|= ( i_combined
& 1 ) << i_bit
;
836 p_bits
[--i_index
] = i_val
;
837 } while( i_index
> 0 );
839 /* This term is used throughout the following to
840 * select one of 32 different variations on the
843 i_cse
= p_variants
[i_css_variant
] ^ p_crypt_tab2
[i_css_variant
];
845 /* Now the actual blocks doing the encryption. Each
846 * of these works on 40 bits at a time and are quite
850 for( i
= 5, i_term
= 0 ; --i
>= 0 ; i_term
= p_scratch
[i
] )
852 i_index
= p_bits
[25 + i
] ^ p_scratch
[i
];
853 i_index
= p_crypt_tab1
[i_index
] ^ ~p_crypt_tab2
[i_index
] ^ i_cse
;
855 p_tmp1
[i
] = p_crypt_tab2
[i_index
] ^ p_crypt_tab3
[i_index
] ^ i_term
;
857 p_tmp1
[4] ^= p_tmp1
[0];
859 for( i
= 5, i_term
= 0 ; --i
>= 0 ; i_term
= p_tmp1
[i
] )
861 i_index
= p_bits
[20 + i
] ^ p_tmp1
[i
];
862 i_index
= p_crypt_tab1
[i_index
] ^ ~p_crypt_tab2
[i_index
] ^ i_cse
;
864 p_tmp2
[i
] = p_crypt_tab2
[i_index
] ^ p_crypt_tab3
[i_index
] ^ i_term
;
866 p_tmp2
[4] ^= p_tmp2
[0];
868 for( i
= 5, i_term
= 0 ; --i
>= 0 ; i_term
= p_tmp2
[i
] )
870 i_index
= p_bits
[15 + i
] ^ p_tmp2
[i
];
871 i_index
= p_crypt_tab1
[i_index
] ^ ~p_crypt_tab2
[i_index
] ^ i_cse
;
872 i_index
= p_crypt_tab2
[i_index
] ^ p_crypt_tab3
[i_index
] ^ i_term
;
874 p_tmp1
[i
] = p_crypt_tab0
[i_index
] ^ p_crypt_tab2
[i_index
];
876 p_tmp1
[4] ^= p_tmp1
[0];
878 for( i
= 5, i_term
= 0 ; --i
>= 0 ; i_term
= p_tmp1
[i
] )
880 i_index
= p_bits
[10 + i
] ^ p_tmp1
[i
];
881 i_index
= p_crypt_tab1
[i_index
] ^ ~p_crypt_tab2
[i_index
] ^ i_cse
;
883 i_index
= p_crypt_tab2
[i_index
] ^ p_crypt_tab3
[i_index
] ^ i_term
;
885 p_tmp2
[i
] = p_crypt_tab0
[i_index
] ^ p_crypt_tab2
[i_index
];
887 p_tmp2
[4] ^= p_tmp2
[0];
889 for( i
= 5, i_term
= 0 ; --i
>= 0 ; i_term
= p_tmp2
[i
] )
891 i_index
= p_bits
[5 + i
] ^ p_tmp2
[i
];
892 i_index
= p_crypt_tab1
[i_index
] ^ ~p_crypt_tab2
[i_index
] ^ i_cse
;
894 p_tmp1
[i
] = p_crypt_tab2
[i_index
] ^ p_crypt_tab3
[i_index
] ^ i_term
;
896 p_tmp1
[4] ^= p_tmp1
[0];
898 for(i
= 5, i_term
= 0 ; --i
>= 0 ; i_term
= p_tmp1
[i
] )
900 i_index
= p_bits
[i
] ^ p_tmp1
[i
];
901 i_index
= p_crypt_tab1
[i_index
] ^ ~p_crypt_tab2
[i_index
] ^ i_cse
;
903 p_key
[i
] = p_crypt_tab2
[i_index
] ^ p_crypt_tab3
[i_index
] ^ i_term
;
909 /*****************************************************************************
910 * DecryptKey: decrypt p_crypted with p_key.
911 *****************************************************************************
912 * Used to decrypt the disc key, with a player key, after requesting it
913 * in _dvdcss_disckey and to decrypt title keys, with a disc key, requested
914 * in _dvdcss_titlekey.
915 * The player keys and the resulting disc key are only used as KEKs
916 * (key encryption keys).
917 * Decryption is slightly dependant on the type of key:
918 * -for disc key, invert is 0x00,
919 * -for title key, invert if 0xff.
920 *****************************************************************************/
921 static void DecryptKey( uint8_t invert
, uint8_t const *p_key
,
922 uint8_t const *p_crypted
, uint8_t *p_result
)
924 unsigned int i_lfsr1_lo
;
925 unsigned int i_lfsr1_hi
;
926 unsigned int i_lfsr0
;
927 unsigned int i_combined
;
933 i_lfsr1_lo
= p_key
[0] | 0x100;
934 i_lfsr1_hi
= p_key
[1];
936 i_lfsr0
= ( ( p_key
[4] << 17 )
938 | ( p_key
[2] << 1 ) )
939 + 8 - ( p_key
[2] & 7 );
940 i_lfsr0
= ( p_css_tab4
[i_lfsr0
& 0xff] << 24 ) |
941 ( p_css_tab4
[( i_lfsr0
>> 8 ) & 0xff] << 16 ) |
942 ( p_css_tab4
[( i_lfsr0
>> 16 ) & 0xff] << 8 ) |
943 p_css_tab4
[( i_lfsr0
>> 24 ) & 0xff];
946 for( i
= 0 ; i
< KEY_SIZE
; ++i
)
948 o_lfsr1
= p_css_tab2
[i_lfsr1_hi
] ^ p_css_tab3
[i_lfsr1_lo
];
949 i_lfsr1_hi
= i_lfsr1_lo
>> 1;
950 i_lfsr1_lo
= ( ( i_lfsr1_lo
& 1 ) << 8 ) ^ o_lfsr1
;
951 o_lfsr1
= p_css_tab4
[o_lfsr1
];
953 o_lfsr0
= ((((((( i_lfsr0
>> 8 ) ^ i_lfsr0
) >> 1 )
954 ^ i_lfsr0
) >> 3 ) ^ i_lfsr0
) >> 7 );
955 i_lfsr0
= ( i_lfsr0
>> 8 ) | ( o_lfsr0
<< 24 );
957 i_combined
+= ( o_lfsr0
^ invert
) + o_lfsr1
;
958 k
[i
] = i_combined
& 0xff;
962 p_result
[4] = k
[4] ^ p_css_tab1
[p_crypted
[4]] ^ p_crypted
[3];
963 p_result
[3] = k
[3] ^ p_css_tab1
[p_crypted
[3]] ^ p_crypted
[2];
964 p_result
[2] = k
[2] ^ p_css_tab1
[p_crypted
[2]] ^ p_crypted
[1];
965 p_result
[1] = k
[1] ^ p_css_tab1
[p_crypted
[1]] ^ p_crypted
[0];
966 p_result
[0] = k
[0] ^ p_css_tab1
[p_crypted
[0]] ^ p_result
[4];
968 p_result
[4] = k
[4] ^ p_css_tab1
[p_result
[4]] ^ p_result
[3];
969 p_result
[3] = k
[3] ^ p_css_tab1
[p_result
[3]] ^ p_result
[2];
970 p_result
[2] = k
[2] ^ p_css_tab1
[p_result
[2]] ^ p_result
[1];
971 p_result
[1] = k
[1] ^ p_css_tab1
[p_result
[1]] ^ p_result
[0];
972 p_result
[0] = k
[0] ^ p_css_tab1
[p_result
[0]];
977 /*****************************************************************************
978 * player_keys: alternate DVD player keys
979 *****************************************************************************
980 * These player keys were generated using Frank A. Stevenson's PlayerKey
981 * cracker. A copy of his article can be found here:
982 * http://www-2.cs.cmu.edu/~dst/DeCSS/FrankStevenson/mail2.txt
983 *****************************************************************************/
984 static const dvd_key_t player_keys
[] =
986 { 0x01, 0xaf, 0xe3, 0x12, 0x80 },
987 { 0x12, 0x11, 0xca, 0x04, 0x3b },
988 { 0x14, 0x0c, 0x9e, 0xd0, 0x09 },
989 { 0x14, 0x71, 0x35, 0xba, 0xe2 },
990 { 0x1a, 0xa4, 0x33, 0x21, 0xa6 },
991 { 0x26, 0xec, 0xc4, 0xa7, 0x4e },
992 { 0x2c, 0xb2, 0xc1, 0x09, 0xee },
993 { 0x2f, 0x25, 0x9e, 0x96, 0xdd },
994 { 0x33, 0x2f, 0x49, 0x6c, 0xe0 },
995 { 0x35, 0x5b, 0xc1, 0x31, 0x0f },
996 { 0x36, 0x67, 0xb2, 0xe3, 0x85 },
997 { 0x39, 0x3d, 0xf1, 0xf1, 0xbd },
998 { 0x3b, 0x31, 0x34, 0x0d, 0x91 },
999 { 0x45, 0xed, 0x28, 0xeb, 0xd3 },
1000 { 0x48, 0xb7, 0x6c, 0xce, 0x69 },
1001 { 0x4b, 0x65, 0x0d, 0xc1, 0xee },
1002 { 0x4c, 0xbb, 0xf5, 0x5b, 0x23 },
1003 { 0x51, 0x67, 0x67, 0xc5, 0xe0 },
1004 { 0x53, 0x94, 0xe1, 0x75, 0xbf },
1005 { 0x57, 0x2c, 0x8b, 0x31, 0xae },
1006 { 0x63, 0xdb, 0x4c, 0x5b, 0x4a },
1007 { 0x7b, 0x1e, 0x5e, 0x2b, 0x57 },
1008 { 0x85, 0xf3, 0x85, 0xa0, 0xe0 },
1009 { 0xab, 0x1e, 0xe7, 0x7b, 0x72 },
1010 { 0xab, 0x36, 0xe3, 0xeb, 0x76 },
1011 { 0xb1, 0xb8, 0xf9, 0x38, 0x03 },
1012 { 0xb8, 0x5d, 0xd8, 0x53, 0xbd },
1013 { 0xbf, 0x92, 0xc3, 0xb0, 0xe2 },
1014 { 0xcf, 0x1a, 0xb2, 0xf8, 0x0a },
1015 { 0xec, 0xa0, 0xcf, 0xb3, 0xff },
1016 { 0xfc, 0x95, 0xa9, 0x87, 0x35 }
1019 /*****************************************************************************
1021 *****************************************************************************
1022 * Decryption of the disc key with player keys: try to decrypt the disc key
1023 * from every position with every player key.
1024 * p_struct_disckey: the 2048 byte DVD_STRUCT_DISCKEY data
1025 * p_disc_key: result, the 5 byte disc key
1026 *****************************************************************************/
1027 static int DecryptDiscKey( dvdcss_t dvdcss
, uint8_t const *p_struct_disckey
,
1028 dvd_key_t p_disc_key
)
1030 uint8_t p_verify
[KEY_SIZE
];
1031 unsigned int i
, n
= 0;
1033 /* Decrypt disc key with the above player keys */
1034 for( n
= 0; n
< sizeof(player_keys
) / sizeof(dvd_key_t
); n
++ )
1036 PrintKey( dvdcss
, "trying player key ", player_keys
[n
] );
1038 for( i
= 1; i
< 409; i
++ )
1040 /* Check if player key n is the right key for position i. */
1041 DecryptKey( 0, player_keys
[n
], p_struct_disckey
+ 5 * i
,
1044 /* The first part in the struct_disckey block is the
1045 * 'disc key' encrypted with itself. Using this we
1046 * can check if we decrypted the correct key. */
1047 DecryptKey( 0, p_disc_key
, p_struct_disckey
, p_verify
);
1049 /* If the position / player key pair worked then return. */
1050 if( memcmp( p_disc_key
, p_verify
, KEY_SIZE
) == 0 )
1057 /* Have tried all combinations of positions and keys,
1058 * and we still didn't succeed. */
1059 memset( p_disc_key
, 0, KEY_SIZE
);
1063 /*****************************************************************************
1065 *****************************************************************************
1066 * Decrypt the title key using the disc key.
1067 * p_disc_key: result, the 5 byte disc key
1068 * p_titlekey: the encrypted title key, gets overwritten by the decrypted key
1069 *****************************************************************************/
1070 static void DecryptTitleKey( dvd_key_t p_disc_key
, dvd_key_t p_titlekey
)
1072 DecryptKey( 0xff, p_disc_key
, p_titlekey
, p_titlekey
);
1075 /*****************************************************************************
1076 * CrackDiscKey: brute force disc key
1077 * CSS hash reversal function designed by Frank Stevenson
1078 *****************************************************************************
1079 * This function uses a big amount of memory to crack the disc key from the
1080 * disc key hash, if player keys are not available.
1081 *****************************************************************************/
1082 #define K1TABLEWIDTH 10
1085 * Simple function to test if a candidate key produces the given hash
1087 static int investigate( unsigned char *hash
, unsigned char *ckey
)
1089 unsigned char key
[KEY_SIZE
];
1091 DecryptKey( 0, ckey
, hash
, key
);
1093 return memcmp( key
, ckey
, KEY_SIZE
);
1096 static int CrackDiscKey( dvdcss_t dvdcss
, uint8_t *p_disc_key
)
1098 unsigned char B
[5] = { 0,0,0,0,0 }; /* Second Stage of mangle cipher */
1099 unsigned char C
[5] = { 0,0,0,0,0 }; /* Output Stage of mangle cipher
1100 * IntermediateKey */
1101 unsigned char k
[5] = { 0,0,0,0,0 }; /* Mangling cipher key
1102 * Also output from CSS( C ) */
1103 unsigned char out1
[5]; /* five first output bytes of LFSR1 */
1104 unsigned char out2
[5]; /* five first output bytes of LFSR2 */
1105 unsigned int lfsr1a
; /* upper 9 bits of LFSR1 */
1106 unsigned int lfsr1b
; /* lower 8 bits of LFSR1 */
1107 unsigned int tmp
, tmp2
, tmp3
, tmp4
,tmp5
;
1109 unsigned int nStepA
; /* iterator for LFSR1 start state */
1110 unsigned int nStepB
; /* iterator for possible B[0] */
1111 unsigned int nTry
; /* iterator for K[1] possibilities */
1112 unsigned int nPossibleK1
; /* #of possible K[1] values */
1113 unsigned char* K1table
; /* Lookup table for possible K[1] */
1114 unsigned int* BigTable
; /* LFSR2 startstate indexed by
1115 * 1,2,5 output byte */
1118 * Prepare tables for hash reversal
1121 /* initialize lookup tables for k[1] */
1122 K1table
= malloc( 65536 * K1TABLEWIDTH
);
1123 memset( K1table
, 0 , 65536 * K1TABLEWIDTH
);
1124 if( K1table
== NULL
)
1129 tmp
= p_disc_key
[0] ^ p_css_tab1
[ p_disc_key
[1] ];
1130 for( i
= 0 ; i
< 256 ; i
++ ) /* k[1] */
1132 tmp2
= p_css_tab1
[ tmp
^ i
]; /* p_css_tab1[ B[1] ]*/
1134 for( j
= 0 ; j
< 256 ; j
++ ) /* B[0] */
1136 tmp3
= j
^ tmp2
^ i
; /* C[1] */
1137 tmp4
= K1table
[ K1TABLEWIDTH
* ( 256 * j
+ tmp3
) ]; /* count of entries here */
1140 if( tmp4 == K1TABLEWIDTH )
1142 print_debug( dvdcss, "Table disaster %d", tmp4 );
1145 if( tmp4
< K1TABLEWIDTH
)
1147 K1table
[ K1TABLEWIDTH
* ( 256 * j
+ tmp3
) + tmp4
] = i
;
1149 K1table
[ K1TABLEWIDTH
* ( 256 * j
+ tmp3
) ] = tmp4
;
1153 /* Initing our Really big table */
1154 BigTable
= malloc( 16777216 * sizeof(int) );
1155 memset( BigTable
, 0 , 16777216 * sizeof(int) );
1156 if( BigTable
== NULL
)
1163 print_debug( dvdcss
, "initializing the big table" );
1165 for( i
= 0 ; i
< 16777216 ; i
++ )
1167 tmp
= (( i
+ i
) & 0x1fffff0 ) | 0x8 | ( i
& 0x7 );
1169 for( j
= 0 ; j
< 5 ; j
++ )
1171 tmp2
=((((((( tmp
>> 3 ) ^ tmp
) >> 1 ) ^ tmp
) >> 8 )
1172 ^ tmp
) >> 5 ) & 0xff;
1173 tmp
= ( tmp
<< 8) | tmp2
;
1174 out2
[j
] = p_css_tab4
[ tmp2
];
1177 j
= ( out2
[0] << 16 ) | ( out2
[1] << 8 ) | out2
[4];
1182 * We are done initing, now reverse hash
1184 tmp5
= p_disc_key
[0] ^ p_css_tab1
[ p_disc_key
[1] ];
1186 for( nStepA
= 0 ; nStepA
< 65536 ; nStepA
++ )
1188 lfsr1a
= 0x100 | ( nStepA
>> 8 );
1189 lfsr1b
= nStepA
& 0xff;
1191 /* Generate 5 first output bytes from lfsr1 */
1192 for( i
= 0 ; i
< 5 ; i
++ )
1194 tmp
= p_css_tab2
[ lfsr1b
] ^ p_css_tab3
[ lfsr1a
];
1195 lfsr1b
= lfsr1a
>> 1;
1196 lfsr1a
= ((lfsr1a
&1)<<8) ^ tmp
;
1197 out1
[ i
] = p_css_tab4
[ tmp
];
1200 /* cumpute and cache some variables */
1202 C
[1] = nStepA
& 0xff;
1203 tmp
= p_disc_key
[3] ^ p_css_tab1
[ p_disc_key
[4] ];
1204 tmp2
= p_css_tab1
[ p_disc_key
[0] ];
1206 /* Search through all possible B[0] */
1207 for( nStepB
= 0 ; nStepB
< 256 ; nStepB
++ )
1209 /* reverse parts of the mangling cipher */
1211 k
[0] = p_css_tab1
[ B
[0] ] ^ C
[0];
1212 B
[4] = B
[0] ^ k
[0] ^ tmp2
;
1214 nPossibleK1
= K1table
[ K1TABLEWIDTH
* (256 * B
[0] + C
[1]) ];
1216 /* Try out all possible values for k[1] */
1217 for( nTry
= 0 ; nTry
< nPossibleK1
; nTry
++ )
1219 k
[1] = K1table
[ K1TABLEWIDTH
* (256 * B
[0] + C
[1]) + nTry
+ 1 ];
1222 /* reconstruct output from LFSR2 */
1223 tmp3
= ( 0x100 + k
[0] - out1
[0] );
1224 out2
[0] = tmp3
& 0xff;
1225 tmp3
= tmp3
& 0x100 ? 0x100 : 0xff;
1226 tmp3
= ( tmp3
+ k
[1] - out1
[1] );
1227 out2
[1] = tmp3
& 0xff;
1228 tmp3
= ( 0x100 + k
[4] - out1
[4] );
1229 out2
[4] = tmp3
& 0xff; /* Can be 1 off */
1231 /* test first possible out2[4] */
1232 tmp4
= ( out2
[0] << 16 ) | ( out2
[1] << 8 ) | out2
[4];
1233 tmp4
= BigTable
[ tmp4
];
1235 C
[3] = ( tmp4
>> 8 ) & 0xff;
1236 C
[4] = ( tmp4
>> 16 ) & 0xff;
1237 B
[3] = p_css_tab1
[ B
[4] ] ^ k
[4] ^ C
[4];
1238 k
[3] = p_disc_key
[2] ^ p_css_tab1
[ p_disc_key
[3] ] ^ B
[3];
1239 B
[2] = p_css_tab1
[ B
[3] ] ^ k
[3] ^ C
[3];
1240 k
[2] = p_disc_key
[1] ^ p_css_tab1
[ p_disc_key
[2] ] ^ B
[2];
1242 if( ( B
[1] ^ p_css_tab1
[ B
[2] ] ^ k
[ 2 ] ) == C
[ 2 ] )
1244 if( ! investigate( &p_disc_key
[0] , &C
[0] ) )
1250 /* Test second possible out2[4] */
1251 out2
[4] = ( out2
[4] + 0xff ) & 0xff;
1252 tmp4
= ( out2
[0] << 16 ) | ( out2
[1] << 8 ) | out2
[4];
1253 tmp4
= BigTable
[ tmp4
];
1255 C
[3] = ( tmp4
>> 8 ) & 0xff;
1256 C
[4] = ( tmp4
>> 16 ) & 0xff;
1257 B
[3] = p_css_tab1
[ B
[4] ] ^ k
[4] ^ C
[4];
1258 k
[3] = p_disc_key
[2] ^ p_css_tab1
[ p_disc_key
[3] ] ^ B
[3];
1259 B
[2] = p_css_tab1
[ B
[3] ] ^ k
[3] ^ C
[3];
1260 k
[2] = p_disc_key
[1] ^ p_css_tab1
[ p_disc_key
[2] ] ^ B
[2];
1262 if( ( B
[1] ^ p_css_tab1
[ B
[2] ] ^ k
[ 2 ] ) == C
[ 2 ] )
1264 if( ! investigate( &p_disc_key
[0] , &C
[0] ) )
1275 memcpy( p_disc_key
, &C
[0], KEY_SIZE
);
1283 /*****************************************************************************
1284 * RecoverTitleKey: (title) key recovery from cipher and plain text
1285 * Function designed by Frank Stevenson
1286 *****************************************************************************
1287 * Called from Attack* which are in turn called by CrackTitleKey. Given
1288 * a guessed(?) plain text and the cipher text. Returns -1 on failure.
1289 *****************************************************************************/
1290 static int RecoverTitleKey( int i_start
, uint8_t const *p_crypted
,
1291 uint8_t const *p_decrypted
,
1292 uint8_t const *p_sector_seed
, uint8_t *p_key
)
1294 uint8_t p_buffer
[10];
1295 unsigned int i_t1
, i_t2
, i_t3
, i_t4
, i_t5
, i_t6
;
1297 unsigned int i_candidate
;
1301 for( i
= 0 ; i
< 10 ; i
++ )
1303 p_buffer
[i
] = p_css_tab1
[p_crypted
[i
]] ^ p_decrypted
[i
];
1306 for( i_try
= i_start
; i_try
< 0x10000 ; i_try
++ )
1308 i_t1
= i_try
>> 8 | 0x100;
1309 i_t2
= i_try
& 0xff;
1310 i_t3
= 0; /* not needed */
1313 /* iterate cipher 4 times to reconstruct LFSR2 */
1314 for( i
= 0 ; i
< 4 ; i
++ )
1316 /* advance LFSR1 normaly */
1317 i_t4
= p_css_tab2
[i_t2
] ^ p_css_tab3
[i_t1
];
1319 i_t1
= ( ( i_t1
& 1 ) << 8 ) ^ i_t4
;
1320 i_t4
= p_css_tab5
[i_t4
];
1321 /* deduce i_t6 & i_t5 */
1325 i_t6
= ( i_t6
+ 0xff ) & 0x0ff;
1332 i_t5
+= i_t6
+ i_t4
;
1333 i_t6
= p_css_tab4
[ i_t6
];
1334 /* feed / advance i_t3 / i_t5 */
1335 i_t3
= ( i_t3
<< 8 ) | i_t6
;
1341 /* iterate 6 more times to validate candidate key */
1342 for( ; i
< 10 ; i
++ )
1344 i_t4
= p_css_tab2
[i_t2
] ^ p_css_tab3
[i_t1
];
1346 i_t1
= ( ( i_t1
& 1 ) << 8 ) ^ i_t4
;
1347 i_t4
= p_css_tab5
[i_t4
];
1348 i_t6
= ((((((( i_t3
>> 3 ) ^ i_t3
) >> 1 ) ^
1349 i_t3
) >> 8 ) ^ i_t3
) >> 5 ) & 0xff;
1350 i_t3
= ( i_t3
<< 8 ) | i_t6
;
1351 i_t6
= p_css_tab4
[i_t6
];
1352 i_t5
+= i_t6
+ i_t4
;
1353 if( ( i_t5
& 0xff ) != p_buffer
[i
] )
1363 /* Do 4 backwards steps of iterating t3 to deduce initial state */
1365 for( i
= 0 ; i
< 4 ; i
++ )
1368 i_t3
= ( i_t3
>> 8 );
1369 /* easy to code, and fast enough bruteforce
1370 * search for byte shifted in */
1371 for( j
= 0 ; j
< 256 ; j
++ )
1373 i_t3
= ( i_t3
& 0x1ffff ) | ( j
<< 17 );
1374 i_t6
= ((((((( i_t3
>> 3 ) ^ i_t3
) >> 1 ) ^
1375 i_t3
) >> 8 ) ^ i_t3
) >> 5 ) & 0xff;
1383 i_t4
= ( i_t3
>> 1 ) - 4;
1384 for( i_t5
= 0 ; i_t5
< 8; i_t5
++ )
1386 if( ( ( i_t4
+ i_t5
) * 2 + 8 - ( (i_t4
+ i_t5
) & 7 ) )
1389 p_key
[0] = i_try
>>8;
1390 p_key
[1] = i_try
& 0xFF;
1391 p_key
[2] = ( ( i_t4
+ i_t5
) >> 0 ) & 0xFF;
1392 p_key
[3] = ( ( i_t4
+ i_t5
) >> 8 ) & 0xFF;
1393 p_key
[4] = ( ( i_t4
+ i_t5
) >> 16 ) & 0xFF;
1402 p_key
[0] ^= p_sector_seed
[0];
1403 p_key
[1] ^= p_sector_seed
[1];
1404 p_key
[2] ^= p_sector_seed
[2];
1405 p_key
[3] ^= p_sector_seed
[3];
1406 p_key
[4] ^= p_sector_seed
[4];
1413 /******************************************************************************
1414 * Various pieces for the title crack engine.
1415 ******************************************************************************
1416 * The length of the PES packet is located at 0x12-0x13.
1417 * The the copyrigth protection bits are located at 0x14 (bits 0x20 and 0x10).
1418 * The data of the PES packet begins at 0x15 (if there isn't any PTS/DTS)
1419 * or at 0x?? if there are both PTS and DTS's.
1420 * The seed value used with the unscrambling key is the 5 bytes at 0x54-0x58.
1421 * The scrabled part of a sector begins at 0x80.
1422 *****************************************************************************/
1425 static int i_tries
= 0, i_success
= 0;
1427 /*****************************************************************************
1428 * CrackTitleKey: try to crack title key from the contents of a VOB.
1429 *****************************************************************************
1430 * This function is called by _dvdcss_titlekey to find a title key, if we've
1431 * chosen to crack title key instead of decrypting it with the disc key.
1432 * The DVD should have been opened and be in an authenticated state.
1433 * i_pos is the starting sector, i_len is the maximum number of sectors to read
1434 *****************************************************************************/
1435 static int CrackTitleKey( dvdcss_t dvdcss
, int i_pos
, int i_len
,
1436 dvd_key_t p_titlekey
)
1438 uint8_t p_buf
[ DVDCSS_BLOCK_SIZE
];
1439 const uint8_t p_packstart
[4] = { 0x00, 0x00, 0x01, 0xba };
1441 int i_encrypted
= 0;
1442 int b_stop_scanning
= 0;
1443 int b_read_error
= 0;
1446 print_debug( dvdcss
, "cracking title key at block %i", i_pos
);
1453 i_ret
= dvdcss
->pf_seek( dvdcss
, i_pos
);
1455 if( i_ret
!= i_pos
)
1457 print_error( dvdcss
, "seek failed" );
1460 i_ret
= dvdcss_read( dvdcss
, p_buf
, 1, DVDCSS_NOFLAGS
);
1462 /* Either we are at the end of the physical device or the auth
1463 * have failed / were not done and we got a read error. */
1468 print_debug( dvdcss
, "read returned 0 (end of device?)" );
1470 else if( !b_read_error
)
1472 print_debug( dvdcss
, "read error at block %i, resorting to "
1473 "secret arcanes to recover", i_pos
);
1475 /* Reset the drive before trying to continue */
1476 _dvdcss_close( dvdcss
);
1477 _dvdcss_open( dvdcss
);
1485 /* Stop when we find a non MPEG stream block.
1486 * (We must have reached the end of the stream).
1487 * For now, allow all blocks that begin with a start code. */
1488 if( memcmp( p_buf
, p_packstart
, 3 ) )
1490 print_debug( dvdcss
, "non MPEG block found at block %i "
1491 "(end of title)", i_pos
);
1495 if( p_buf
[0x0d] & 0x07 )
1496 print_debug( dvdcss
, "stuffing in pack header" );
1498 /* PES_scrambling_control does not exist in a system_header,
1499 * a padding_stream or a private_stream2 (and others?). */
1500 if( p_buf
[0x14] & 0x30 && ! ( p_buf
[0x11] == 0xbb
1501 || p_buf
[0x11] == 0xbe
1502 || p_buf
[0x11] == 0xbf ) )
1506 if( AttackPattern(p_buf
, i_reads
, p_titlekey
) > 0 )
1508 b_stop_scanning
= 1;
1511 if( AttackPadding(p_buf
, i_reads
, p_titlekey
) > 0 )
1513 b_stop_scanning
= 1;
1522 /* Emit a progress indication now and then. */
1523 if( !( i_reads
& 0xfff ) )
1525 print_debug( dvdcss
, "at block %i, still cracking...", i_pos
);
1528 /* Stop after 2000 blocks if we haven't seen any encrypted blocks. */
1529 if( i_reads
>= 2000 && i_encrypted
== 0 ) break;
1531 } while( !b_stop_scanning
&& i_len
> 0);
1533 if( !b_stop_scanning
)
1535 print_debug( dvdcss
, "end of title reached" );
1538 /* Print some statistics. */
1539 print_debug( dvdcss
, "successful attempts %d/%d, scrambled blocks %d/%d",
1540 i_success
, i_tries
, i_encrypted
, i_reads
);
1542 if( i_success
> 0 /* b_stop_scanning */ )
1544 print_debug( dvdcss
, "vts key initialized" );
1548 if( i_encrypted
== 0 && i_reads
> 0 )
1550 memset( p_titlekey
, 0, KEY_SIZE
);
1551 print_debug( dvdcss
, "no scrambled sectors found" );
1555 memset( p_titlekey
, 0, KEY_SIZE
);
1560 /******************************************************************************
1561 * The original Ethan Hawke (DeCSSPlus) attack (modified).
1562 ******************************************************************************
1563 * Tries to find a repeating pattern just before the encrypted part starts.
1564 * Then it guesses that the plain text for first encrypted bytes are
1565 * a contiuation of that pattern.
1566 *****************************************************************************/
1567 static int AttackPattern( uint8_t const p_sec
[ DVDCSS_BLOCK_SIZE
],
1568 int i_pos
, uint8_t *p_key
)
1570 unsigned int i_best_plen
= 0;
1571 unsigned int i_best_p
= 0;
1574 /* For all cycle length from 2 to 48 */
1575 for( i
= 2 ; i
< 0x30 ; i
++ )
1577 /* Find the number of bytes that repeats in cycles. */
1579 j
< 0x80 && ( p_sec
[0x7F - (j
%i
)] == p_sec
[0x7F - j
] );
1582 /* We have found j repeating bytes with a cycle length i. */
1583 if( j
> i_best_plen
)
1591 /* We need at most 10 plain text bytes?, so a make sure that we
1592 * have at least 20 repeated bytes and that they have cycled at
1593 * least one time. */
1594 if( ( i_best_plen
> 3 ) && ( i_best_plen
/ i_best_p
>= 2) )
1599 memset( p_key
, 0, KEY_SIZE
);
1600 res
= RecoverTitleKey( 0, &p_sec
[0x80],
1601 &p_sec
[ 0x80 - (i_best_plen
/ i_best_p
) * i_best_p
],
1602 &p_sec
[0x54] /* key_seed */, p_key
);
1603 i_success
+= ( res
>= 0 );
1607 fprintf( stderr
, "key is %02x:%02x:%02x:%02x:%02x ",
1608 p_key
[0], p_key
[1], p_key
[2], p_key
[3], p_key
[4] );
1609 fprintf( stderr
, "at block %5d pattern len %3d period %3d %s\n",
1610 i_pos
, i_best_plen
, i_best_p
, (res
>=0?"y":"n") );
1613 return ( res
>= 0 );
1621 /******************************************************************************
1622 * Encrypted Padding_stream attack.
1623 ******************************************************************************
1624 * DVD specifies that there must only be one type of data in every sector.
1625 * Every sector is one pack and so must obviously be 2048 bytes long.
1626 * For the last pice of video data before a VOBU boundary there might not
1627 * be exactly the right amount of data to fill a sector. Then one has to
1628 * pad the pack to 2048 bytes. For just a few bytes this is done in the
1629 * header but for any large amount you insert a PES packet from the
1630 * Padding stream. This looks like 0x00 00 01 be xx xx ff ff ...
1631 * where xx xx is the length of the padding stream.
1632 *****************************************************************************/
1633 static int AttackPadding( uint8_t const p_sec
[ DVDCSS_BLOCK_SIZE
],
1634 int i_pos
, uint8_t *p_key
)
1636 unsigned int i_pes_length
;
1637 /*static int i_tries = 0, i_success = 0;*/
1639 i_pes_length
= (p_sec
[0x12]<<8) | p_sec
[0x13];
1641 /* Coverd by the test below but usfull for debuging. */
1642 if( i_pes_length
== DVDCSS_BLOCK_SIZE
- 0x14 ) return 0;
1644 /* There must be room for at least 4? bytes of padding stream,
1645 * and it must be encrypted.
1646 * sector size - pack/pes header - padding startcode - padding length */
1647 if( ( DVDCSS_BLOCK_SIZE
- 0x14 - 4 - 2 - i_pes_length
< 4 ) ||
1648 ( p_sec
[0x14 + i_pes_length
+ 0] == 0x00 &&
1649 p_sec
[0x14 + i_pes_length
+ 1] == 0x00 &&
1650 p_sec
[0x14 + i_pes_length
+ 2] == 0x01 ) )
1652 fprintf( stderr
, "plain %d %02x:%02x:%02x:%02x (type %02x sub %02x)\n",
1653 DVDCSS_BLOCK_SIZE
- 0x14 - 4 - 2 - i_pes_length
,
1654 p_sec
[0x14 + i_pes_length
+ 0],
1655 p_sec
[0x14 + i_pes_length
+ 1],
1656 p_sec
[0x14 + i_pes_length
+ 2],
1657 p_sec
[0x14 + i_pes_length
+ 3],
1658 p_sec
[0x11], p_sec
[0x17 + p_sec
[0x16]]);
1662 /* If we are here we know that there is a where in the pack a
1663 encrypted PES header is (startcode + length). It's never more
1664 than two packets in the pack, so we 'know' the length. The
1665 plaintext at offset (0x14 + i_pes_length) will then be
1666 00 00 01 e0/bd/be xx xx, in the case of be the following bytes
1669 /* An encrypted SPU PES packet with another encrypted PES packet following.
1670 Normaly if the following was a padding stream that would be in plain
1671 text. So it will be another SPU PES packet. */
1672 if( p_sec
[0x11] == 0xbd &&
1673 p_sec
[0x17 + p_sec
[0x16]] >= 0x20 &&
1674 p_sec
[0x17 + p_sec
[0x16]] <= 0x3f )
1679 /* A Video PES packet with another encrypted PES packet following.
1680 * No reason execpt for time stamps to break the data into two packets.
1681 * So it's likely that the following PES packet is a padding stream. */
1682 if( p_sec
[0x11] == 0xe0 )
1689 /*fprintf( stderr, "key is %02x:%02x:%02x:%02x:%02x ",
1690 p_key[0], p_key[1], p_key[2], p_key[3], p_key[4] );*/
1691 fprintf( stderr
, "at block %5d padding len %4d "
1692 "type %02x sub %02x\n", i_pos
, i_pes_length
,
1693 p_sec
[0x11], p_sec
[0x17 + p_sec
[0x16]]);