This is the per-disc key backup script I use. Grew out of a solution I used prior to switching to FindVUK, but then repurposed to pretty-print things and continue to make sure that I have backups of the keys for the discs I actually own.
Code:
#!/bin/bash
VOLUMEDRIVE="$(ddwin64 --list 2>&1 > /dev/null | grep -A1 CD-ROM | grep Mounted | tail -c4)"
VOLUMENAME="$(cmd //c "vol $VOLUMEDRIVE" | grep "Volume in drive" | sed 's/is/\t/' | cut -f2 | sed 's/^ //')"
echo "$VOLUMENAME" > "$VOLUMENAME.aacsinfo.txt"
aacs_info "$VOLUMEDRIVE" >> "$VOLUMENAME.aacsinfo.txt"
DISCID="$(aacs_info "$VOLUMEDRIVE" | grep "Disc ID" | cut -f2 -d : | sed 's/ //g')"
VID="$(aacs_info "$VOLUMEDRIVE" | grep "VID" | cut -f2 -d : | sed 's/ //g')"
#VUK="$(cat $(echo $APPDATA\\aacs\\vuk\\$DISCID) | tr '[:lower:]' '[:upper:]')"
MEDK="$(aacs_info "$VOLUMEDRIVE" | grep -w "MK" | cut -f2 -d : | sed 's/ //g')"
FULLKEYS="$(cd "/e/Programs/aacskeys/bin/win64/" && aacskeys.exe "$VOLUMEDRIVE" v "$VID")"
VUK="$(cd "/e/Programs/aacskeys/bin/win64/" && aacskeys.exe "$VOLUMEDRIVE" "$VID" | grep "Volume Unique Key" | cut -f2 -d : | sed 's/ //g')"
MKB="$(grep MKB "$VOLUMENAME.aacsinfo.txt" | cut -f2 -d : | sed 's/ //g')"
fromdos "$VOLUMENAME.aacsinfo.txt"
sed -i '/VID/aVUK : '"$VUK"'' "$VOLUMENAME.aacsinfo.txt"
todos "$VOLUMENAME.aacsinfo.txt"
grep $DISCID "$APPDATA\\aacs\\KEYDB.cfg" > "$VOLUMENAME.keydb.txt"
mkdir -p aacsbk/vuk
echo "$VUK" > aacsbk/vuk/"$DISCID"
echo "$FULLKEYS" > "$VOLUMENAME.fullkeys.txt"
echo "0x$DISCID = $VOLUMENAME | V | 0x$VUK | M | 0x$MEDK | I | 0x$VID ; MKBv$MKB" > "$VOLUMENAME.keydb_forinsert.txt"
Requires ddwin, aacs_info (with working PK/DK/Cert in KEYDB.cfg), aacskeys (with working keys/cert in the right files), and standard GNU userland on Windows (MSys2, or maybe Cygwin if you change the paths to account for Windows drives being under /cygdrive there).
Note: it does use the old key order, but FindVUK adjusts it when it verifies the info. It also assumes aacskeys resides in E:\Programs\, so adjust that accordingly, especially if on something other than Windows.
Run the script first, see what differs between the
*.keydb.txt and
*.keydb_forinsert.txt. If the plain keydb output either lacks some keys or has NOTVALIDATED / LEGACY, then copy the line (or just the missing parts of the line) from
_forinsert.txt into the main keydb.cfg.
Then optionally run FindVUK to let it fix things up (maybe just Synchronize if you don't care about some of the meta stuff), and then to re-verify, run the above script again and compare the *keydb/*forinsert files again to ensure things look okay.
The script is a little older, obviously; with libaacs allowing the MK cache and such now, those values could probably be read out a lot easier than they had to be at the time (although since the VUK isn't printed by aacs_info, that still needs aacskeys).