matthew
1b9db6e9a4
Two changes that make AACS 1.0 / DVD self-sufficient: 1. MKB record-type identification bug fix. `mkb_find_mk_dv` was searching for type 0x10 (which is Type-and-Version, 12 bytes) when the Verify Media Key Record is actually type 0x81 for AACS 1.0 or type 0x86 for AACS 2.0/2.1. `mkb_version` had the inverse bug. PK and DK derivation paths therefore silently failed on every disc, masking how often the fallback paths could have worked. Fix searches the correct types; tests added covering both the 0x81 and 0x86 verify-record forms and the 0x10 version record at offset 8 of the body. 2. Built-in AACS keys + operator plugin slot. Four device keys (covering MKB v01-v82+) and three processing keys (covering v63-v68) compiled directly into the library. Combined with the 31 CSS player keys already in css/auth.rs, DVDs and Blu-rays (AACS 1.0) now decrypt with zero external files. New plugin path at ~/.config/freemkv/local_keys.cfg (same syntax as keydb.cfg) layered additively on top of built-ins and main keydb. `Disc::scan` no longer errors when keydb.cfg is absent; AACS 2.0 / UHD still surfaces a specific error when the disc needs keys none of the layers provide. Public docstrings in CLAUDE.md + README updated to describe the three additive layers (built-ins → keydb.cfg → local_keys.cfg).
34 lines
1.4 KiB
Rust
34 lines
1.4 KiB
Rust
//! AACS decryption — Volume Unique Key lookup and title key derivation.
|
|
//!
|
|
//! Two paths:
|
|
//! 1. VUK lookup: disc_hash → KEYDB.cfg → VUK (fast, 99% of discs)
|
|
//! 2. Full handshake: device_keys + MKB → Media Key → + Volume ID → VUK (fallback)
|
|
//!
|
|
//! KEYDB.cfg format:
|
|
//! | DK | DEVICE_KEY 0x... | DEVICE_NODE 0x... | KEY_UV 0x... | KEY_U_MASK_SHIFT 0x...
|
|
//! | PK | 0x...
|
|
//! | HC | HOST_PRIV_KEY 0x... | HOST_CERT 0x...
|
|
//! 0x<disc_hash> = <title> | D | <date> | M | 0x<media_key> | I | 0x<disc_id> | V | 0x<vuk> | U | <unit_keys>
|
|
//!
|
|
//! The VUK decrypts title keys from AACS/Unit_Key_RO.inf on disc.
|
|
//! Title keys decrypt m2ts stream content (AES-128-CBC).
|
|
|
|
pub(crate) mod builtin_keys;
|
|
pub mod decrypt;
|
|
pub mod handshake;
|
|
pub mod keydb;
|
|
pub mod keys;
|
|
|
|
// Explicit re-exports — only items needed by external consumers and sibling crate modules.
|
|
// AES primitives (aes_ecb_encrypt, aes_ecb_decrypt, aes_cbc_decrypt) are pub(crate) in decrypt.rs.
|
|
pub use decrypt::{
|
|
ALIGNED_UNIT_LEN, decrypt_bus, decrypt_unit, decrypt_unit_full, decrypt_unit_try_keys,
|
|
is_unit_encrypted,
|
|
};
|
|
pub use keydb::{DeviceKey, DiscEntry, HostCert, KeyDb};
|
|
pub use keys::{
|
|
ContentCert, ResolvedKeys, UnitKeyFile, decrypt_unit_key, derive_media_key_from_dk,
|
|
derive_media_key_from_pk, derive_vuk, disc_hash, disc_hash_hex, mkb_version,
|
|
parse_content_cert, parse_unit_key_ro, read_mkb_from_drive, resolve_keys,
|
|
};
|