PCDVD數位科技討論區 - wmv10 drm保護是不是真的給人破了?

Guide: DRM Stripping
DISCLAIMER:
Nasze Forum supports your right to create your own personal backups of legally obtained media. While related discussions are permitted, we cannot allow links to any tools specifically designed to circumvent copy protection measures, such as DRM or broadcast TV encryption systems. Posting decryption keys is also forbidden.

DRM Stripping
By an anonymous member

The software works in two stages, drmdbg.exe and drm2wmv.exe. Here's how. The protected content needs to be decrypted using two keys, the KID and the SID. The KID is the 'public' key contained openly in the WMVHD file. The SID is the 'secret' key which is hidden in your licence: the licence on each user's machine is different, but the underlying SID is the same. The difficult task, performed by drmdbg.exe, is to grab the SID from within WMP itself. It does this by breaking into ("debugging") the WMP program .dll's at a location when the 'naked' SID is revealed in memory. Obviously it has to know the exact breakpoint location for the WMP .dll versions you are using. The problem for some people is that there are so many different versions of the .dlls: drmdbg.exe only knows the breakpoints for a few - oh yeah, also all versions of WMP10 since the February 2005update have contained code which detects and blocks early versions of drmdbg.exe.

When you know the good KID and SID for your WMVHD content, then the tool called drm2wmv.exe applies the decryption algorithm to the protected WMVHD content using that KID and SID. Drm2wmv.exe works on the DRM WMV files within a folder on your hard drive and outputs the DRM-free WMV files to the same folder.

The KID and the SID are the same for every copy of the same WMVHD disk (but note there were two different versions of the Terminator 2 disk in public circulation). Usually each file on the WMVHD disk uses the same KID and SID. Another person could tell you the KID and SID, to save you the trouble of finding them for yourself. In fact the KID is trivial to find, but some people have difficulty finding the SID - but if getting the KID and SID from another person it is best to get both together to ensure they are a good pair (see earlier note about different versions of the T2 disk).

This is about on-disk DRM: the principles for downloaded/streaming content (e.g. trailers) are similar but a bit more tricky, for more details see other forums or the (Japanese language) readme files that accompany the software.

Suggested route for dealing with on-disk DRM

Setup:

Make a folder for these programs in c:\Program Files or similar. Extract drmdbg.exe and drm2wmv.exe from their zip file to that folder. Instead of the original drm2wmv.exe, use the drm2wmv_e version (Doom9) for ease of use (advantages: messages are in English, and you don't need to mess around with the system date; originally the Japanese programmer included some basic date limitations on the software for some reason). Check that drm1 and drm2 subfolders have been created.

Use:

1) First, check disk plays OK in Windows Media Player. It is a good idea to practice for step (2) by starting Windows Media Player using the Start Menu or a desktop shortcut, and then in WMP using the File/Open... command to browse your DVD-ROM, locate a DRM-protected file and play it.

2) On any machine where the following works (no need for a fast machine or a large hard drive), run drmdbg.exe - depending on the configuration of the machine, either use latest WMP10 version of drmdbg from Doom9 post attachments, or maybe you can use an earlier version. (If using the original January 2005 version, it is best if you have an old WMP9 machine available e.g. Windows XP SP1, or SP2 and no updates since October 2004: there is no need to use the Japanese dlls if you have an original Windows XP SP1 install. The documentation and .ini file talk about three .dll files but you do not need all those dlls to be the right version, you just need one out of drmclien.dll and drmv2clt.dll to match the versions that drmdbg knows. This is because if drmdbg is able to set a good breakpoint in either one of those two .dlls then it can find the SID for you.)

Run drmdbg.exe in a DOS window. It will automatically start Windows Media Player. In Windows Media Player, use the normal "File/Open ..." menu command to browse and open your protected DRM file (you can read it straight off the data directory on the DVD-ROM at this stage). (Hint: probably only the main movie is DRM-protected and not the various logos.) Windows Media Player should start playing the file, and simultaneously drmdbg.exe in its little DOS window will start going crazy reporting accesses to the various .dll files. Drmdbg.exe may complain that it does not have the good .dll versions for some .dll's, but as noted already it only needs one .dll to be good to work. If it works, it should include the SID in its text output.

Assuming this has gone OK, identify and make a note of the SID which is shown in drmdbg's output. The easiest way to do that is to re-run drmdbg.exe with its output sent to a text file (see example in batch file below). You need to do the same File/Open... procedure in WMP as before, then you just need to run it for a few seconds for drmdbg to do its magic.

3) Now you have the SID the rest is easy. On any machine (e.g. your fast media server machine), file copy all the DRM protected WMVHD off your DVD into a new folder on your harddrive. You need free disk space at least twice the size of the WMVHD.

4) In drm2 subfolder create a new text file with the file extension .key (hint: you probably need to have Windows Explorer displaying file extensions). As long it has the file extension .key, it can have any name (e.g. name it to match the movie, the filename doesn't matter because the program checks all with .key extension). In Notepad, edit the .key file so that it is in exactly the correct form and contains the correct KID (which belongs to this WMVHD), also the SID which you found at step (2). To find the KID, don't mess with a hex editor, just run drm2wmv.exe on the WMVHD file once and if there is no .key file with the matching KID already then the program output will include the KID to make things easy for you!

5) In a DOS window, now run drm2wmv on the WMVHD. It should take about 5 minutes. It should show a percentage completion bar in ASCII: when that reaches 100% the output is done. (Sometimes there is a final error message after it reaches 100%: you can pretty much disregard it: the reason for the error is unknown unless maybe it has to do with indexing, see final note below.)

Here are a couple of batch files which do all these things for you - adapt file locations as necessary:

First, a batch file to run drmdbg.exe, with its output going to a text file called last.key. This batch file is to be run from the same folder that drmdbg.exe is in - usually a sister folder to the folder drm2wmv.exe is in. This batch file saves its output in last.key for use by the second batch file below. Hint: do not use this batch file the first time you run drmdbg.exe, you need to see its output the first time to check that it is OK with your .dll's.

@echo off
echo Press any key to start WMP9 - then within WMP9 use File/Open to open the target WMV file and play it for a while
drmdbg >..\drm2wmv\drm2\last.key

Next, a batch file to run drm2wmv.exe: it runs the tool twice, first to get you the KID and then to do the actual decryption. (For some reason on my machine drm2wmv.exe is named ddrm.exe, I cannot now remember why but it is the same tool.) This will open two instances of Notepad. All the user needs to do is a very easy cut, paste and tidy up in Notepad: take the KID from KID.txt and paste it into last.key, tidy up so it looks like the example below, and save. Close both instances of Notepad and the drm2wmv program should start decrypting. (If you like in Notepad you could 'Save As' and save last.key as something more memorable for posterity: as noted the filename does not affect program operation so long as it ends with the .key extension).

@echo off
echo -------------------------
echo Press Any Key to continue - copy KID in Notepad and close Notepad,
echo pasting KID into second instance of Notepad (last.key), editing as necessary.
echo Save last.key and close that second instance of Notepad.
echo -------------------------
"C:\Program Files\drm2wmv\ddrm" %1 >"C:\Program Files\Utility\drm2wmv\drm2\KID.txt"
C:\Windows\Notepad "C:\Program Files\drm2wmv\drm2\KID.txt"
C:\Windows\Notepad "C:\Program Files\drm2wmv\drm2\last.key"
"C:\Program Files\drm2wmv\ddrm" %1

For extra amusement, set up your File Types in Windows so that all WMV files can "Open with" the second batch file above. Then you don't ever need to go into a DOS window - you can just run the first batch file from Windows, and then right click on the WMV file to run the second batch file.

This is what a good key file should look like (bogus example key):

<DRM2WMV2>
<KID>QIleALwX9EBnqY+YfAfVTA==</KID>
<SID>ADNzXtHSRQhFHt1SkAt8zVFUg4U=</SID>
<INFO></INFO>
[]
</DRM2WMV2>

Note: do not double-click .key files, you do not want to add them to your registry! To open them, right-click them and choose 'Edit'.

Final note: sometimes the resulting WMV file plays OK but is not seekable. This is because it does not have the right index. You may be able to reindex it using the reindexing tool available in Windows Media Encoder (WMEncoder.exe downloadable from Microsoft I think). Alternatively, make the WMV into an AVI, then it will seek perfectly - details of how to convert WMV to AVI are everywhere, try one of the T2 threads.