Consumer Media Protections (CMP) To Think About Has anyone burned a CD for a friend? Did they purchase that CD afterwards? Is your DVD player hooked to.

Consumer Media Protections (CMP)

To Think About Has anyone burned a CD for a friend?

Did they purchase that CD afterwards? Is your DVD player hooked to your

television via VIDEO, S-VIDEO or Component?

Do you own a copy of The Patriot DVD? (RCE)

Have you ever modified or had modified a game console (PS1)?

How long does a US Copyright last? (post-1978=death+70yrs, pre-1978=95yrs)

(L)=Link on CD, (R)=Resource on CD

CMP: See No Evil, Hear No Evil, Speak No Evil

What We’re Going To Talk About Existing CMPs in video games, video and

audio Laws and arguments pro/con In-depth: existing video game CMPs

including Playstation 1, Playstation 2 and Microsoft’s Xbox

Demonstration: bypassing a video game CMP (PS1), strategies and tools

In-depth: existing video CMPs including VHS, DVD and graphics cards

Demonstration: bypassing a video CMP (Macrovision), strategies and tools

In depth: existing audio CMPs in CDs Demonstration: bypassing an audio CMP

(key2audio), strategies and tools CMP Realities and Rights

CMP: Facts and Figures

THE TRUTH WARNING: This stuff will make you

angry but at least you’ll learn enough to argue and fight effectively

Jupiter Communications: Napster and other file-sharing users are 45% more likely to purchase music

Gartner Group: CD sales were up 10% each quarter while file-sharing services were operating unrestricted

VideoBusiness: 20% of DVD players sold internationally are region-free

SEC: 30% of Blockbuster game renters have pirated at least one PS1 game

SEC: 40 million DVD players will be in U.S. homes by the end of 2002, fastest adoption of a consumer device

CMP: 3 Immutable Laws.1

Audio Home Recording Act (1992) “…guaranteed consumers the right to

use all analog and digital audio recording formats to make personal-use copies of CDs and other digital sources of music.” (Computer Currents 6/02)

Key points:• Both analog/digital REC formats• Protects all personal-use• Refers to all current and future

recording formats (CD-R/RW, MiniDisc, MemoryStick)

• Includes digital sources• Mixes and non-copyrighted recordings

OK but no $$$

CMP: 3 Immutable Laws.2

Digital Millennium Copyright Act (1996)

“…bans the manufacture and distribution of devices designed to undermine technology used to protect copyrighted works.” (Computer Currents 6/02)

Key points:• “device” is ambiguous, may refer to

PDF crack, dongle, etc.• “technology” is non-specific, could be

one ASM instruction or 448-bit Blowfish-encrypted routines, simple to complex

• May punish OEM manufacturers who are contracted to manufacture devices that ignore protections in favor of cost savings, etc.

CMP: 3 Immutable Laws.3

No Electronic Theft Act (1997) “…sound recording

infringements…can be criminally prosecuted even where no commercial gain is derived from the infringement” (Computer Currents 6/02)

Key points:• Originally intended for software• “commercial gain” redefined as

anything of value and prosecuted• Statute of limitations extended

from three to five years for NET offenses and criminal not civil

CMP: Pro and Con

Arguments Pro

• You are guaranteed personal-use reproduction rights of both analog/digital sources and recording formats. Big5 infringe upon your rights.

• You may make song mixes under the ARA as long as they are not for commercial gain.

• You may trade recordings of non-copyrighted material as long as it is not for commercial gain.

Con• You may not produce devices that

disassemble or reverse-engineer protection technologies for media

• You may not distribute copyrighted works for commercial gain (publishing rights controlled by ASCAP, usually)

Video Game CMP.1 Basics of media

format craziness Playstation 1 CMP Playstation 2 CMP Xbox CMP Strategies/Tools Demonstration

www.getanygame.com

Video Game CMP.2 Basics of media format craziness

Most video games are not produced according to PC-readable file systems (NTFS, etc.) but instead use uncommon sector sizes, boot blocks/code or use non-standard structure to obscure the contents

Many are rendered unreadable by CD-R/RW Custom file systems are poorly-documented or

protected by NDAs, applied in manufacturing, patented (GD-ROM)

Remember, they have to be shared with someone to produce titles for the consoles!

Some utilize key exchange, others encyrption

Video Game CMP.3 Playstation 1 CMP

Media restrictions: CD-ROM and region-coded Hardware authenticates region and media-

based key during boot and refuses to load Some games have LibCrypt included which

detects a ModChip (authentication bypass) and refuses to load, developed by Sony

Some games have custom CMP including extra files, unreadable data or false headers preventing many PC apps’ duplication success

Video Game CMP.4 Playstation 2 CMP

Media restrictions: DVD-ROM, CD-ROM and region-coded

Hardware authenticates the region and media-based key, corrupts game if fails

ModChips come in different versions for region-free/specific and key-disable

Sony has successfully prosecuted ModChip manufacturers in U.S. using DCMA threats

Video Game CMP.5 Xbox CMP

Media restrictions: DVD-ROM, CD-ROM and key-encrypted

Xtender and Enigmah ModChips: play import and backup games, disable DVD MV and region-encoding, allow custom code at boot

Recent push to get Linux running on an Xbox, $200,000 prize, first program developed w/o Xbox SDK

Analysis by MIT Computer Scientist of Xbox CMP reveals weaknesses and bypass (R1)

Analysis: Microsoft sacrificed bus speed for CMP complexity, performance hit

Video Game CMP.6 Strategies / Tools

For Console DVD playback: pass your analog output through a video filter (Sima Color Corrector, Zorilla Video Filter)

To copy PS1 games: use the proper settings in Nero or try a RAW-mode copier such as CloneCD (R2)

To copy PS2 or Xbox games: use a DVD ripper Options for PS1 CMP bypass: bootable CD, ModChip Options for PS2 CMP bypass: solder/no-solder ModChip Options for Xbox CMP bypass: solder ModChip On the horizon: Xbox hard-drive game storage/loader (L1) Xbox custom software such as a Media Player, DivX, etc.

Video Game CMP.7 Demo: Copying A PS1 Game

1. Hardware: Toshiba laptop with built-in CD-RW, PlayStation 1 game

2. Modify Nero settings to properly read/write CD3. Copy game4. Discuss boot-loader option5. Discuss ModChip option

Video CMP.1 Macrovision, the

only game in town How Macrovision

works Software CMP

(VHS, DVD) Hardware CMP Strategies/Tools Demonstration

Video CMP.2 Macrovision, the only game in town

Macrovision was founded in February of 1983 in sunny California and is publicly-traded on NASDAQ

MV licenses their technology to DVD, Semiconductor, Set-top Box, PVR, PPV, VHS and Replicators (DVD-R)

MV technology can be applied internationally to all video standards (PAL/NTSC)

MV sued by Verance for patent infringements on video signal protection and watermarking

In May, Warner Bros. released Harry Potter without MV in the U.S./U.K., the first commercially-released MV-free DVD ever. MV changed their licensing to require 100% coverage or an external label from now on.

Video CMP.3 How Macrovision works

MV adds carefully timed electronic pulses to a video signal during duplication that alternate high/low

Protection-through-degradation (bad!): TVs tolerate while VCRs fail to keep sync

Confuses a VCR’s automatic gain control (AGC) causing banding and dropout

Tell-tale signs: VHS tapes that alternate light-to-dark at the top, DVD-to-VCR recording problems (sync, b&w)

Some family videos erode and trigger MV!

Video CMP.4 Software CMPs

550 million videocassettes are MV-protected DVDs may include Macrovision and/or Content

Scrambling System (CSS) CSS uses a secret key exchange to ensure

that DVD video and audio (MPEG2) are unencrypted by the player

MV is “triggered-distortion” and is part of the DVD Video spec, license and recommendation

Video CMP.5 Hardware CMPs

DVD analog outs: VIDEO and S-VIDEO MV-enabled…by the video processor

ATI Radeon and All-In-Wonder cards: video processor-embedded, forced into a license by MV after abuses, contains MV on inputs and outputs

ATI inputs driver-limited to 10-30 seconds of recording, produces stalling and skipping

ATI outputs produce MV signal on all recordings Nvidia and S3 planning future modifications

Video CMP.6 Strategies / Tools

For VHS, S-VHS or DVD: pass your analog output through a video filter (Sima Color Corrector, Zorilla Video Filter) or non-Macrovision inhibited monitor (Canopus ADVC-100, even has Firewire!)

For Hardware DVD: purchase a hackable or modifiable DVD player, list at VCDHelp (L2)

For Software DVD: simultaneously run an application such as Remote Selector Tool (L3)

For DVD burners: rip your DVD to a file on your HD and strip out MV w/ SmartRipper, etc.

For ATI cards: disable MV with a patch from Doom9 (L4), also contains tutorials and app links

For analog video capture: use alternative MV-free capture cards like Hauppauge WinTV, Pinnacle Studio AV or Dazzle

Video CMP.7 Demo: MV-free Video Capture

1. Hardware: Toshiba laptop, DVD player, ADS Firewire (Cardbus), Canopus ADVC-100

2. Capture to AVI “Matrix” 30secs raw3. View result, notice MV degradation4. Apply undocumented method to remove

Macrovision detection/pass-through on Canopus (Input Select w/ color bars)

5. Capture to AVI “Matrix” 30secs MV-free6. View result, so fresh and so clean, clean!

Audio CMP.1 Scary facts SafeAudio CMP Key2Audio CMP Strategies/Tools Demonstration

Audio CMP.2 Scary facts

The first U.S. CD released with copy protection was Charley Pride’s Tribute To Jim Reeves by Fahrenheit Entertainment, a lawsuit in California resulted

According to Jupiter Communications, only 2% of CD buyers rip to MP3 and publish 1st-generation material to file-sharing services

Although Eminem’s The Eminem Show was the most heavily pirated and swapped CD ever, it still sold 284,000 in three days and 1.3 million in week one

Big5 music distribution companies (Universal, Sony, Warner, BMG and EMI) control 90% of all music

By many estimates, six million CMP CDs have been slipstreamed into U.S. retail without warning labels

Audio CMP.3 SafeAudio CMP (R3+R4)

Developed for $20 million+ by Macrovision and TTR, introduced 2001, Big5 looking at adding it 2002

More than 2 million SafeAudio CMP CDs are in circulation including N’Sync Celebrity

Three different components: coding protection, timing protection and hiding audio tracks from PCs

Works by exploiting the poor error correction capabilities of PC CD drives, v3 works at the music data’s bit level by creating slight, random bit corruptions which cause pops and brownouts

SafeAudio coding protection (structural) is rated 99% readable in consumer audio devices

Audio CMP.4 Key2Audio CMP

Developed for $40 million+ by Sony, introduced 2001, Sony labels and licensees

More than 17 million key2audio CMP CDs are in circulation including Celine Dion’s latest

Works by placing a special hidden signature and junk data files on the outside of CD during manufacturing, CD-R/RW unreadable

Audio portion of key2audio CMP CD conforms to Red Book standard, unchanged stream

Audio CMP.5 Strategies / Tools

Analyze which audio CMP is used via ClonyXXL (R5) Buy a RAW-mode CD-R/RW such as Lite-On 16X+, verify support via

CloneCD at (L5) Discover specifications and burning techniques for CMPs at CD Media

World (L6) For SafeAudio CDs: use analog-to-digital rip trick below or for

Windows 9X use the alternate cdfs.vxd (R6) driver which shows .cda tracks as .wav files, drag-and-drop

For Key2Audio CDs: employ the black marker method, use an opaque, permanent marker to draw a 1/4 –inch ring around the outside of your CD and voila! Play it and burn it.

Analog-to-digital: patch line-out to line-in (RadioShack), record wav, split into tracks, convert to MP3 using MusicMatch

Use an MP3 recording device that accepts line-in such as the PoGo RipFlash (L7)

Audio CMP.6 Demo: Analog->WAV->MP3

1. Hardware: Toshiba laptop, CD Player, patch cord, Michael Jackson CD (used, of course)

2. Attempt to play in PC. Won’t even read CD.3. Identify copy protection using ClonyXXL.4. Rip to WAV via line-in.5. Convert to MP3.6. Play result. Clean copy.7. GOTCHA: Beware of recording levels8. TIP: Use SPDIF I/O for pure digital copying!

Conclusion.1 Consumer Media Protections (CMP)

Video Games: PS1, PS2, Xbox employ media format tricks and techniques

Video: ugly, bad Macrovision in software and through hardware

Audio: SafeAudio, Key2Audio work through structural modification and audio corruption

Conclusion.2 CMP: Realities

Anything digitally-created will be bypassed True protection would remove the incentive

(economic) of commercial gain Copyright law is outdated and needs to be

amended for digital technologies The laws discussed provide consumers with

well-defined personal-use rights Congressmen probably listen to WAV and MP3

mixed CDs behind closed doors

Conclusion.3 CMP: What You Can Do (Media Corp.)

Simple economic formula: best offer=the most accepted and successful after option

Create “best offers”: • Release high-quality, high-caliber efforts that are

actually good, good still sells• Lower the price of CDs closer to real-world

manufacturing and distribution costs• Reduce price and restrictions on downloadable music

while broadening catalogs, micro-payments OK Stop placing CMPs on video games, video signals

or audio that degrades quality or playability, this is ANTI-CONSUMER

Conclusion.4 CMP: What You Can Do (Individual)

Continue legal personal-use of consumer media by exploring protections

Educate anyone who will listen Preserve your right to backup your expensive

purchases such as DVDs and CDs Refuse to buy CDs marked as protected (ex:

“Will not play on MAC/PC”=key2audio) Buy a black Sharpie. Wear around neck.

Conclusion.5 “dir \CMP” on DEF CON 10 CD

CMP Presentation (PowerPoint) ClonyXXL (freeware) CloneCD (shareware) Alternate CDFS driver (Self-Extracting) SafeAudio FAQ & Overview (PDF) Xbox paper from MIT (PDF) IE shortcuts to sites mentioned