AACS 2.0 full pipeline: handshake, bus key, decrypt, transparent API
- aacs.rs: content decryption (AES-CBC aligned units, bus decrypt, VUK derivation, unit key decrypt). 11 tests including synthetic roundtrip. - aacs_handshake.rs: SCSI authentication (ECDH on AACS 160-bit curve, ECDSA sign/verify, AES-CMAC, bus key derivation, read_data_key). 14 tests including EC order, ECDH shared secret, cert verification. - disc.rs: transparent API — Disc::scan() detects AACS, authenticates, derives keys internally. ContentReader decrypts on the fly. App never sees AACS details. - error.rs: AacsError (E7000) variant BF v12 complete: 284 unique matches from 8 AWS instances.
This commit is contained in:
MattJackson
+436
@@ -14,6 +14,8 @@
|
||||
//! Title keys decrypt m2ts stream content (AES-128-CBC).
|
||||
|
||||
use std::collections::HashMap;
|
||||
use aes::Aes128;
|
||||
use aes::cipher::{BlockEncrypt, BlockDecrypt, KeyInit, generic_array::GenericArray};
|
||||
|
||||
/// Parsed AACS key database.
|
||||
#[derive(Debug)]
|
||||
@@ -279,6 +281,235 @@ impl KeyDb {
|
||||
}
|
||||
}
|
||||
|
||||
// ── AACS constants ──────────────────────────────────────────────────────────
|
||||
|
||||
/// Fixed IV used by AACS for all AES-CBC operations.
|
||||
const AACS_IV: [u8; 16] = [
|
||||
0x0B, 0xA0, 0xF8, 0xDD, 0xFE, 0xA6, 0x1F, 0xB3,
|
||||
0xD8, 0xDF, 0x9F, 0x56, 0x6A, 0x05, 0x0F, 0x78,
|
||||
];
|
||||
|
||||
/// Size of an AACS aligned unit (3 × 2048-byte sectors).
|
||||
pub const ALIGNED_UNIT_LEN: usize = 6144;
|
||||
|
||||
/// Size of one sector.
|
||||
const SECTOR_LEN: usize = 2048;
|
||||
|
||||
/// Transport stream packet spacing in Blu-ray m2ts (192 bytes = 4 TP_extra + 188 TS).
|
||||
const TS_PACKET_LEN: usize = 192;
|
||||
|
||||
/// TS sync byte.
|
||||
const TS_SYNC: u8 = 0x47;
|
||||
|
||||
// ── AES primitives ──────────────────────────────────────────────────────────
|
||||
|
||||
/// AES-128-ECB encrypt a single 16-byte block.
|
||||
fn aes_ecb_encrypt(key: &[u8; 16], data: &[u8; 16]) -> [u8; 16] {
|
||||
let cipher = Aes128::new(GenericArray::from_slice(key));
|
||||
let mut block = GenericArray::clone_from_slice(data);
|
||||
cipher.encrypt_block(&mut block);
|
||||
let mut out = [0u8; 16];
|
||||
out.copy_from_slice(&block);
|
||||
out
|
||||
}
|
||||
|
||||
/// AES-128-ECB decrypt a single 16-byte block.
|
||||
pub fn aes_ecb_decrypt(key: &[u8; 16], data: &[u8; 16]) -> [u8; 16] {
|
||||
let cipher = Aes128::new(GenericArray::from_slice(key));
|
||||
let mut block = GenericArray::clone_from_slice(data);
|
||||
cipher.decrypt_block(&mut block);
|
||||
let mut out = [0u8; 16];
|
||||
out.copy_from_slice(&block);
|
||||
out
|
||||
}
|
||||
|
||||
/// AES-128-CBC decrypt in-place with the fixed AACS IV.
|
||||
/// AES-128-CBC decrypt in-place with the fixed AACS IV.
|
||||
fn aes_cbc_decrypt(key: &[u8; 16], data: &mut [u8]) {
|
||||
let cipher = Aes128::new(GenericArray::from_slice(key));
|
||||
let num_blocks = data.len() / 16;
|
||||
// Process blocks in reverse to avoid clobbering ciphertext needed for XOR
|
||||
for i in (0..num_blocks).rev() {
|
||||
let offset = i * 16;
|
||||
let prev = if i == 0 {
|
||||
AACS_IV
|
||||
} else {
|
||||
let mut p = [0u8; 16];
|
||||
p.copy_from_slice(&data[(i - 1) * 16..i * 16]);
|
||||
p
|
||||
};
|
||||
let mut block = GenericArray::clone_from_slice(&data[offset..offset + 16]);
|
||||
cipher.decrypt_block(&mut block);
|
||||
for j in 0..16 {
|
||||
data[offset + j] = block[j] ^ prev[j];
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// ── VUK derivation ──────────────────────────────────────────────────────────
|
||||
|
||||
/// Derive VUK from Media Key and Volume ID.
|
||||
/// VUK = AES-128-ECB-DECRYPT(media_key, volume_id) XOR volume_id
|
||||
pub fn derive_vuk(media_key: &[u8; 16], volume_id: &[u8; 16]) -> [u8; 16] {
|
||||
let mut vuk = aes_ecb_decrypt(media_key, volume_id);
|
||||
for i in 0..16 {
|
||||
vuk[i] ^= volume_id[i];
|
||||
}
|
||||
vuk
|
||||
}
|
||||
|
||||
/// Decrypt an encrypted unit key using the VUK (AES-128-ECB).
|
||||
pub fn decrypt_unit_key(vuk: &[u8; 16], encrypted_uk: &[u8; 16]) -> [u8; 16] {
|
||||
aes_ecb_decrypt(vuk, encrypted_uk)
|
||||
}
|
||||
|
||||
// ── Unit_Key_RO.inf parsing ─────────────────────────────────────────────────
|
||||
|
||||
/// Extract encrypted unit keys from Unit_Key_RO.inf data.
|
||||
/// Returns vec of (cps_unit_number, encrypted_key).
|
||||
pub fn parse_unit_key_ro(data: &[u8]) -> Vec<(u32, [u8; 16])> {
|
||||
// Minimum size check
|
||||
if data.len() < 0xA0 {
|
||||
return Vec::new();
|
||||
}
|
||||
|
||||
// Number of unit keys at offset 0x10 (big-endian u16)
|
||||
// But the first key is always at offset 0x90
|
||||
let mut keys = Vec::new();
|
||||
|
||||
// Read number of keys from offset 0x20 (varies by format)
|
||||
// Simple approach: key table starts at 0x90, each key is 16 bytes
|
||||
// First key is CPS unit 1
|
||||
let mut offset = 0x90;
|
||||
let mut unit_num = 1u32;
|
||||
|
||||
while offset + 16 <= data.len() {
|
||||
let mut key = [0u8; 16];
|
||||
key.copy_from_slice(&data[offset..offset + 16]);
|
||||
// Stop if we hit all zeros (no more keys)
|
||||
if key == [0u8; 16] {
|
||||
break;
|
||||
}
|
||||
keys.push((unit_num, key));
|
||||
unit_num += 1;
|
||||
offset += 16;
|
||||
}
|
||||
|
||||
keys
|
||||
}
|
||||
|
||||
// ── Content decryption ──────────────────────────────────────────────────────
|
||||
|
||||
/// Check if a 6144-byte aligned unit is encrypted (copy_permission_indicator bits).
|
||||
pub fn is_unit_encrypted(unit: &[u8]) -> bool {
|
||||
unit.len() >= ALIGNED_UNIT_LEN && (unit[0] & 0xC0) != 0
|
||||
}
|
||||
|
||||
/// Verify decrypted unit by checking TS sync bytes at expected offsets.
|
||||
fn verify_ts(unit: &[u8]) -> bool {
|
||||
// In a 6144-byte unit, TS packets start at byte 0 with 4-byte TP_extra_header
|
||||
// then 188-byte TS packet, repeating every 192 bytes.
|
||||
// Sync byte 0x47 should appear at offset 4, 196, 388, ...
|
||||
let mut count = 0;
|
||||
let mut offset = 4;
|
||||
while offset < unit.len() {
|
||||
if unit[offset] == TS_SYNC {
|
||||
count += 1;
|
||||
}
|
||||
offset += TS_PACKET_LEN;
|
||||
}
|
||||
// Expect at least most packets to have sync bytes
|
||||
let total = (unit.len() - 4) / TS_PACKET_LEN + 1;
|
||||
count > total / 2
|
||||
}
|
||||
|
||||
/// Decrypt one AACS aligned unit (6144 bytes) in-place.
|
||||
/// Returns true if decryption succeeded (verified by TS sync bytes).
|
||||
///
|
||||
/// Algorithm:
|
||||
/// 1. AES-128-ECB encrypt first 16 bytes with unit_key → derived
|
||||
/// 2. XOR derived with original 16 bytes → unit_decrypt_key
|
||||
/// 3. AES-128-CBC decrypt bytes 16..6143 with unit_decrypt_key and AACS IV
|
||||
/// 4. Clear encryption flag bits
|
||||
pub fn decrypt_unit(unit: &mut [u8], unit_key: &[u8; 16]) -> bool {
|
||||
if unit.len() < ALIGNED_UNIT_LEN {
|
||||
return false;
|
||||
}
|
||||
if !is_unit_encrypted(unit) {
|
||||
return true; // not encrypted
|
||||
}
|
||||
|
||||
// Save original first 16 bytes (they're plaintext TP_extra_header)
|
||||
let mut header = [0u8; 16];
|
||||
header.copy_from_slice(&unit[..16]);
|
||||
|
||||
// Step 1: Encrypt header with unit key to derive per-unit key
|
||||
let derived = aes_ecb_encrypt(unit_key, &header);
|
||||
|
||||
// Step 2: XOR to get the actual decryption key
|
||||
let mut decrypt_key = [0u8; 16];
|
||||
for i in 0..16 {
|
||||
decrypt_key[i] = derived[i] ^ header[i];
|
||||
}
|
||||
|
||||
// Step 3: Decrypt bytes 16..6143 with AES-CBC
|
||||
aes_cbc_decrypt(&decrypt_key, &mut unit[16..ALIGNED_UNIT_LEN]);
|
||||
|
||||
// Step 4: Clear encryption flag
|
||||
unit[0] &= !0xC0;
|
||||
|
||||
// Verify
|
||||
verify_ts(unit)
|
||||
}
|
||||
|
||||
/// Decrypt one aligned unit trying multiple unit keys. Returns the key index that worked.
|
||||
pub fn decrypt_unit_try_keys(unit: &mut [u8], unit_keys: &[[u8; 16]]) -> Option<usize> {
|
||||
if !is_unit_encrypted(unit) {
|
||||
return Some(0);
|
||||
}
|
||||
|
||||
// Save original for retry
|
||||
let original = unit[..ALIGNED_UNIT_LEN].to_vec();
|
||||
|
||||
for (i, key) in unit_keys.iter().enumerate() {
|
||||
unit[..ALIGNED_UNIT_LEN].copy_from_slice(&original);
|
||||
if decrypt_unit(unit, key) {
|
||||
return Some(i);
|
||||
}
|
||||
}
|
||||
|
||||
// Restore original on failure
|
||||
unit[..ALIGNED_UNIT_LEN].copy_from_slice(&original);
|
||||
None
|
||||
}
|
||||
|
||||
/// Remove bus encryption from an aligned unit (AACS 2.0 / UHD).
|
||||
/// Bus encryption uses read_data_key, decrypting bytes 16..2047 of each 2048-byte sector.
|
||||
pub fn decrypt_bus(unit: &mut [u8], read_data_key: &[u8; 16]) {
|
||||
for sector_start in (0..ALIGNED_UNIT_LEN).step_by(SECTOR_LEN) {
|
||||
if sector_start + SECTOR_LEN > unit.len() {
|
||||
break;
|
||||
}
|
||||
// First 16 bytes of each sector are plaintext
|
||||
aes_cbc_decrypt(read_data_key, &mut unit[sector_start + 16..sector_start + SECTOR_LEN]);
|
||||
}
|
||||
}
|
||||
|
||||
/// Full decrypt of an aligned unit: bus decrypt (if needed) then AACS decrypt.
|
||||
pub fn decrypt_unit_full(
|
||||
unit: &mut [u8],
|
||||
unit_key: &[u8; 16],
|
||||
read_data_key: Option<&[u8; 16]>,
|
||||
) -> bool {
|
||||
if !is_unit_encrypted(unit) {
|
||||
return true;
|
||||
}
|
||||
if let Some(rdk) = read_data_key {
|
||||
decrypt_bus(unit, rdk);
|
||||
}
|
||||
decrypt_unit(unit, unit_key)
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
@@ -310,6 +541,211 @@ mod tests {
|
||||
assert_eq!(hc.certificate.len(), 92);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn test_vuk_derivation() {
|
||||
// Civil War UHD: known MK, VID, VUK from KEYDB
|
||||
// MK = 15665F98..., VID (disc_id) = from entry, VUK = F96D7908...
|
||||
// VUK = AES-DEC(MK, VID) XOR VID
|
||||
let path = std::path::Path::new("");
|
||||
if !path.exists() { return; }
|
||||
|
||||
let db = KeyDb::load(path).unwrap();
|
||||
|
||||
// Find a disc with both MK, disc_id, and VUK so we can verify derivation
|
||||
let entry = db.disc_entries.values()
|
||||
.find(|e| e.media_key.is_some() && e.disc_id.is_some() && e.vuk.is_some())
|
||||
.expect("No disc with MK + VID + VUK");
|
||||
|
||||
let mk = entry.media_key.unwrap();
|
||||
let vid = entry.disc_id.unwrap();
|
||||
let expected_vuk = entry.vuk.unwrap();
|
||||
|
||||
let derived = derive_vuk(&mk, &vid);
|
||||
assert_eq!(derived, expected_vuk,
|
||||
"VUK derivation failed for disc: {} (hash {})", entry.title, entry.disc_hash);
|
||||
eprintln!("VUK derivation verified for: {}", entry.title);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn test_aes_ecb_roundtrip() {
|
||||
let key = [0x15u8, 0x66, 0x5F, 0x98, 0x01, 0x02, 0x03, 0x04,
|
||||
0x05, 0x06, 0x07, 0x08, 0x09, 0x0A, 0x0B, 0x0C];
|
||||
let plain = [0x41u8; 16];
|
||||
let enc = aes_ecb_encrypt(&key, &plain);
|
||||
let dec = aes_ecb_decrypt(&key, &enc);
|
||||
assert_eq!(dec, plain);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn test_decrypt_unit_unencrypted() {
|
||||
// Unit with 0xC0 bits clear should pass through unchanged
|
||||
let mut unit = vec![0u8; ALIGNED_UNIT_LEN];
|
||||
unit[0] = 0x00; // not encrypted
|
||||
let key = [0u8; 16];
|
||||
assert!(decrypt_unit(&mut unit, &key));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn test_aes_cbc_roundtrip() {
|
||||
let key = [0x11u8, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88,
|
||||
0x99, 0xAA, 0xBB, 0xCC, 0xDD, 0xEE, 0xFF, 0x00];
|
||||
let original = vec![0x42u8; 128]; // 8 blocks
|
||||
let mut data = original.clone();
|
||||
|
||||
// Encrypt with CBC manually (forward direction)
|
||||
fn aes_cbc_encrypt(key: &[u8; 16], data: &mut [u8]) {
|
||||
let cipher = Aes128::new(GenericArray::from_slice(key));
|
||||
let mut prev = super::AACS_IV;
|
||||
let num_blocks = data.len() / 16;
|
||||
for i in 0..num_blocks {
|
||||
let offset = i * 16;
|
||||
for j in 0..16 {
|
||||
data[offset + j] ^= prev[j];
|
||||
}
|
||||
let mut block = GenericArray::clone_from_slice(&data[offset..offset + 16]);
|
||||
cipher.encrypt_block(&mut block);
|
||||
data[offset..offset + 16].copy_from_slice(&block);
|
||||
prev.copy_from_slice(&data[offset..offset + 16]);
|
||||
}
|
||||
}
|
||||
|
||||
aes_cbc_encrypt(&key, &mut data);
|
||||
assert_ne!(data, original); // should be different after encrypt
|
||||
|
||||
super::aes_cbc_decrypt(&key, &mut data);
|
||||
assert_eq!(data, original); // should match after roundtrip
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn test_decrypt_unit_synthetic() {
|
||||
// Build a fake 6144-byte aligned unit with known TS sync pattern,
|
||||
// encrypt it with the AACS algorithm, then decrypt and verify.
|
||||
let unit_key = [0xAAu8; 16];
|
||||
|
||||
// Build plaintext unit with TS sync bytes every 192 bytes starting at offset 4
|
||||
let mut plain = vec![0u8; ALIGNED_UNIT_LEN];
|
||||
let mut offset = 4;
|
||||
while offset < ALIGNED_UNIT_LEN {
|
||||
plain[offset] = TS_SYNC;
|
||||
offset += TS_PACKET_LEN;
|
||||
}
|
||||
// Set encryption flag
|
||||
plain[0] |= 0xC0;
|
||||
|
||||
// Now encrypt bytes 16..6143 using the AACS algorithm (reverse of decrypt)
|
||||
let header: [u8; 16] = plain[..16].try_into().unwrap();
|
||||
let derived = super::aes_ecb_encrypt(&unit_key, &header);
|
||||
let mut encrypt_key = [0u8; 16];
|
||||
for i in 0..16 {
|
||||
encrypt_key[i] = derived[i] ^ header[i];
|
||||
}
|
||||
|
||||
// CBC encrypt bytes 16..6143
|
||||
let cipher = Aes128::new(GenericArray::from_slice(&encrypt_key));
|
||||
let mut prev = super::AACS_IV;
|
||||
let num_blocks = (ALIGNED_UNIT_LEN - 16) / 16;
|
||||
for i in 0..num_blocks {
|
||||
let off = 16 + i * 16;
|
||||
for j in 0..16 {
|
||||
plain[off + j] ^= prev[j];
|
||||
}
|
||||
let mut block = GenericArray::clone_from_slice(&plain[off..off + 16]);
|
||||
cipher.encrypt_block(&mut block);
|
||||
plain[off..off + 16].copy_from_slice(&block);
|
||||
prev.copy_from_slice(&plain[off..off + 16]);
|
||||
}
|
||||
|
||||
// Now plain contains encrypted data. Decrypt it.
|
||||
let mut unit = plain;
|
||||
assert!(is_unit_encrypted(&unit));
|
||||
assert!(decrypt_unit(&mut unit, &unit_key));
|
||||
assert!(!is_unit_encrypted(&unit)); // flag should be cleared
|
||||
|
||||
// Verify TS sync bytes
|
||||
let mut count = 0;
|
||||
let mut off = 4;
|
||||
while off < ALIGNED_UNIT_LEN {
|
||||
if unit[off] == TS_SYNC {
|
||||
count += 1;
|
||||
}
|
||||
off += TS_PACKET_LEN;
|
||||
}
|
||||
assert_eq!(count, (ALIGNED_UNIT_LEN - 4) / TS_PACKET_LEN + 1);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn test_decrypt_unit_key_from_vuk() {
|
||||
// Test the full chain: VUK → decrypt encrypted unit key → unit key
|
||||
// Use a known disc from KEYDB that has both VUK and unit keys
|
||||
let path = std::path::Path::new("");
|
||||
if !path.exists() { return; }
|
||||
|
||||
let db = KeyDb::load(path).unwrap();
|
||||
|
||||
// Find a disc with VUK and unit keys
|
||||
let entry = db.disc_entries.values()
|
||||
.find(|e| e.vuk.is_some() && !e.unit_keys.is_empty())
|
||||
.expect("No disc with VUK + unit keys");
|
||||
|
||||
eprintln!("Testing unit key decrypt for: {} ({})", entry.title, entry.disc_hash);
|
||||
eprintln!(" VUK: {:02X?}", entry.vuk.unwrap());
|
||||
for (num, key) in &entry.unit_keys {
|
||||
eprintln!(" Unit key {}: {:02X?}", num, key);
|
||||
}
|
||||
|
||||
// The unit keys in KEYDB are already decrypted — we can verify the chain
|
||||
// by encrypting with VUK and then decrypting
|
||||
let vuk = entry.vuk.unwrap();
|
||||
for (num, expected_uk) in &entry.unit_keys {
|
||||
let encrypted = aes_ecb_encrypt(&vuk, expected_uk);
|
||||
let decrypted = decrypt_unit_key(&vuk, &encrypted);
|
||||
assert_eq!(&decrypted, expected_uk,
|
||||
"Unit key {} roundtrip failed for {}", num, entry.title);
|
||||
}
|
||||
eprintln!(" All {} unit key roundtrips passed", entry.unit_keys.len());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn test_decrypt_real_unit() {
|
||||
// Try decrypting a real encrypted aligned unit from Civil War UHD
|
||||
// This disc is AACS 2.0 (BEE) so unit key alone won't work —
|
||||
// we need bus decryption first. But this verifies the pipeline.
|
||||
let unit_path = std::path::Path::new("/tmp/encrypted_unit.bin");
|
||||
if !unit_path.exists() { return; }
|
||||
|
||||
let original = std::fs::read(unit_path).unwrap();
|
||||
assert_eq!(original.len(), ALIGNED_UNIT_LEN);
|
||||
assert!(is_unit_encrypted(&original), "Unit should be encrypted");
|
||||
|
||||
let keydb_path = std::path::Path::new("");
|
||||
if !keydb_path.exists() { return; }
|
||||
let db = KeyDb::load(keydb_path).unwrap();
|
||||
|
||||
// Civil War UHD entries
|
||||
let civil_war_entries: Vec<&DiscEntry> = db.disc_entries.values()
|
||||
.filter(|e| e.title.contains("CIVIL WAR") && !e.unit_keys.is_empty())
|
||||
.collect();
|
||||
|
||||
eprintln!("Found {} Civil War entries with unit keys", civil_war_entries.len());
|
||||
|
||||
// Try each entry's unit keys
|
||||
for entry in &civil_war_entries {
|
||||
let keys: Vec<[u8; 16]> = entry.unit_keys.iter().map(|(_, k)| *k).collect();
|
||||
let mut unit = original.clone();
|
||||
|
||||
if let Some(idx) = decrypt_unit_try_keys(&mut unit, &keys) {
|
||||
eprintln!("SUCCESS: Decrypted with entry {} key {}", entry.disc_hash, idx);
|
||||
// Count TS sync bytes
|
||||
let ts = (0..32).filter(|&i| unit[4 + i * 192] == 0x47).count();
|
||||
eprintln!(" TS sync bytes: {}/32", ts);
|
||||
return;
|
||||
}
|
||||
}
|
||||
|
||||
// Expected: none work because this is AACS 2.0 and needs bus decryption first
|
||||
eprintln!("No unit key worked (expected for AACS 2.0 BEE disc — needs read_data_key)");
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn test_parse_full_keydb() {
|
||||
let path = std::path::Path::new("");
|
||||
|
||||
Reference in New Issue
Block a user