Blu-ray playback with libaacs & libbdplus

[candela]

After a long hiatus, discoveries in the past few years on this forum have made Blu-ray playback possible again on free (libre) software such as VLC without proprietary solutions such as DVDFab, MakeMKV or AnyDVD.

Presented here is a new libaacs & libbdplus build for Windows with some improvements made by several different people. Included are Win32/Win64 builds and the actual source patches. It would be nice if someone actually good at C can clean these up and integrate them on the VideoLan source repository.

Improvements:

• Cached BD+ tables support: circumvent the need for the BD+ Virtual Machine (VM) and play BD+ discs of all generations without menus
• UHD support: play 4K Blu-ray discs
• Read Data Key (RDK) caching: play Bus Encrypted Enabled (BEE) discs on Bus Encryption Enabled (BEC) drives after the Host Certificate (HC) is revoked
• Media Key (MK) caching: similar to already existing Volume Unique Key (VUK) and VolumeID (VID) caching. This enables possible scraping in the future by FindVUK
• Incomplete Unit Key (UK) support: allow (partial) playback of discs in case not all unit keys are available in KEYB.cfg and the VUK is not available

How To (Windows):

• Put the 32-bit or 64-bit libaacs/libbdplus DLLs (all 4) in the corresponding VLC directory
• Put the BD+ vm files in the %APPDATA%\bdplus\vm0 directory
• Put the cached BD+ tables (1.5GB) in the %APPDATA%\bdplus\convtab directory
  • updated tables 2020-07-05 (36MB)
  • updated tables 2021-01-06 (31MB)
  • updated tables 2022-06-19 (12MB)
  • updated tables 2023-07-28 (3MB)
• Put FindVUK's KEYDB.cfg in the %APPDATA%\aacs directory
• Edit KEDYB.cfg and add/replace the device keys (DK), processing keys (PK) and host certificates (HC) at the top with the ones from this post (valid up to MKBv81). Older keys can be found in this thread

Builds:

• 2019-10-21_libaacs_libbdplus.7z
  • libaacs 0.9.0 + patches
  • libbdplus 0.1.2 + patches
• 2020-07-26_libaacs_libbdplus.7z
  • libaacs 0.11.0
  • libbdplus 0.1.2 + patches
  • extra Kodi patch from user nst no longer required, use Kodi version > 18.7 because of BD playback bug

Directories:

• base aacs/bdplus directories in above "How To:" are different depending on OS and user-based or system-based (all users) installation
• Windows:
  • aacs (per user): %APPDATA%\aacs
  • aacs (system wide): %ProgramData%\aacs
  • bdplus (per user): %APPDATA%\bdplus
  • bdplus (system wide): %ProgramData%\bdplus
  • dll 32-bit: C:\Program Files (x86)\VideoLAN\VLC
  • dll 64-bit: C:\Program Files\VideoLAN\VLC
• Linux:
  • aacs (per user): ~/.config/aacs
  • aacs (system wide): /etc/xdg/aacs
  • bdplus (per user): ~/.cache/bdplus
  • bdplus (system wide): /etc/xdg/bdplus
• MacOS:
  • aacs (per user): ~/Library/Preferences/aacs
  • aacs (system wide): /Library/Preferences/aacs
  • bdplus (per user): ~/Library/Caches/bdplus
  • bdplus (system wide): /Library/Preferences/bdplus
  • dylib: /usr/local/lib

Decryption keys:

• Simplified, libaacs/libbdplus uses the following flow to remove supported protections
  • if Disc = BEE and Drive = BEC then
    • HC -> RDK -> remove bus encryption
  • if Disc = AACS then
    • DK -> PK -> MK
    • HC -> VID
    • MK + VID -> VUK -> UK -> remove AACS encryption
  • if Disc = BD+ then
    • BD+ VM -> BD+ table -> remove BD+ protection
• When either DK or HC has been revoked, libaacs cannot generate decryption keys anymore. However, any step in the process can be skipped by using cached keys in the local aacs directory or KEYDB.cfg. For example, when VUK is cached DK + HC are no longer needed for AACS decryption. Check the following threads to retrieve all necessary keys without a valid DK and HC
  • FindVUK tool - get VUK of all Blurays supported by DVDfab applications
  • Get Blu-ray VID and RDK from MakeMKV
• The BD+ VM only supports a very limited amount of early titles. In practice cached BD+ tables will be necessary for all your discs

Debugging:

• debug output is possible using environment variables, ref. source util\logging.h and util\logging.c for more information
• e.g. in Windows open CMD window and execute the following:
  • set AACS_DEBUG_MASK=65535
  • set BD_DEBUG_MASK=512
  • set AACS_DEBUG_FILE=c:\temp\debuglog_aacs.txt
  • set BDPLUS_DEBUG_FILE=c:\temp\debuglog_bdplus.txt
  • set BD_DEBUG_FILE=c:\temp\debuglog_libbluray.txt
• start VLC from command line in the same CMD window

About BD+:

• BD+ tables contain the necessary patches to fix the video errors and circumvent the need to emulate the BD+ VM. Since Blu-ray menus interact with the BD+ VM, cached BD+ tables are incompatible with VLC Blu-ray menu support
• To save space, it is assumed that all discs with the same MK also have the same BD+ table. Therefore cached BD+ tables are loaded from the filename MK*.bin. For clarity, provided tables are named MK_VolumeLabel.bin
• At this moment, the last known discs with BD+ protection were released in 2017 (MKBv60). Hence PKs are available in KEYDB.cfg to calculate the necessary MK for all BD+ discs
• BD+ tables can also be used by DumpHD (command line --convtable:table.bin) and BlurayTest&Decrypt (loaded from %APPDATA%\bdplus\convtab\DiscID*.bin)
• There is no way to validate BD+ tables without playing the actual disc and checking if video corruption is fixed. Therefore the tables that are offered come with no guarantees. Fixes for tables reported as bad:
  - 1677D189ECCC2161451A3C0FA4F53CD4_THE_PHANTOM_MENACE.bin
  
• In case the BD+ table included for the MK of your disc does not work, you can try retrieving a working table using Nalor's BlurayTest&Decrypt. The table will be saved in %APPDATA%\bdplus\convtab\DiscID*.bin and will have to be renamed to MK*.bin to use with libbdplus

About RDK:

• Discs that have BEE (all UHD and <10% of BD) and are played on a BEC drive (i.e. all recent drives) require a valid Host Cert to be present in KEYDB.CFG in order to calculate the RDK. Once the current Host Cert is revoked by the drive, the previously cached RDK can still used instead
• The RDK, drive and disc specific, is saved in %APPDATA%\aacs\rdk\[DriveID]\[DiscID]. The [DriveID] is a hash of the Drive Cert which is assumed to be unique
• It seems possible some BEC drive would calculate a different RDK each time the same BEE disc is played. In this case, caching the RDK will obviously not work. No such drives are known at this time
• Updating a drive's firmware may or may not change the RDK

About UHD:

• UHD playback requires a UHD friendly drive, i.e. a non-AACS2.0 drive that supports reading UHD discs and accepts AACS1.0 Host Certs
• It may be possible to convert your non-friendly UHD drive to a friendly one by flashing a different firmware. Read the following topic VERY carefully Ultimate UHD Drives Flashing Guide Updated 2022
• No AACS2.0 PK or DK are currently known. Playback depends on a valid VUK, UK or MK being available in KEYDB.cfg
• AACS2.1 discs are currently not supported. At the moment 5 such discs exist (Fury, The Patriot, Stand By Me, Charlie's Angels, Zombieland)

About Java menus:

• In order to play Blu-rays with Java based menus the Java Runtime Environment (JRE) is required
• Install one of the following:
  • OpenJDK
  • Oracle
  • Note that recent JRE versions appear to crash VLC. The last known working version is 8u322b06
• Make sure the %JAVA_HOME% environment variable is set and points to the installation directory, e.g. "JAVA_HOME=C:\Program Files\Java\jre1.8.0_221". The OpenJDK installer can set this automatically
• In Windows, e.g. Vista, environment variables can be set in Control Panel > System And Maintenance > System > Advanced System Settings > Environment Variables
  

About Region Coding:

• Some Blu-ray discs may be region locked when menus are enabled in VLC. Select the correct region in VLC to circumvent this. Goto Tools > Preferences > Show Settings: All > Input / Codecs > Access Modules > Blu-ray and select the Region Code that matches the disc: A, B or C

Command line tools:

• Using commandline tools like aacs_info or aacskeys allows getting all keys VUK/MK/VID/UK and learning about AACS
• aacs_info is included with libaacs and uses keys in KEYDB.cfg. Debug output as described above is also possible. Example usage: aacs_info F:
• aacskeys and accompanying keyfiles can be downloaded here. Example usage: aacskeys -v F:
• instructions for Mplayer by hnsteyding

To do:

• Playlist obfuscation is a protection where the correct playlist (BDMV\PLAYLIST\*.mpls) for a disc is hidden between hundreds of fake playlists. Although the FindVUK KEYDB.cfg lists the correct playlist for many discs, it's not possible to actually select this playlist in VLC when playing without menus. VLC uses its own title index that has no obvious relation with the actual mpls file. This would need to be changed in libbluray
• Implementation of HD-DVD playback. Although VLC can play files on unprotected HD-DVDs, libaacs has no support for HD-DVD. The source code of aacskeys could be used as an example
• Improvement of BD+ VM libbdplus. Complete implementation will likely be very difficult and require reverse engineering of official players. However, it is plausible that minor improvements to the libbdplus implementation could result in the generation of encrypted BD+ tables. In this case, only (much smaller) decryption keys need to be cached instead of complete tables. This method appears to be used by several non-official players. To study how BD+ tables work load them in ConvTableView and look at the libbdplus source

[maetel99]

This is a very interesting post. I'm curious about the cached BD+ tables you posted. Is this archive really comprehensive? If so, then there really is no longer a need for libbdplus, vm0, and all that.

You could just locate the correct decrypted BD+ table for the disc, parse it, and deliver the patches directly in response to requests for particular sectors of data. That code is pretty simple and could be incorporated directly into libaacs.

[candela]

Originally Posted by maetel99

This is a very interesting post. I'm curious about the cached BD+ tables you posted. Is this archive really comprehensive?

It's difficult to say for certain. Out of 5051 known BD+ discs this archive provides tables for at least 4811 so that's ~95%. There's almost 100.000 discs in KEYDB.cfg now but that's probably only 50-60% of existing discs. However, BD+ is only used by Fox on high profile titles so I guess most of those titles are already in KEYDB.cfg. And the titles that are not in KEYDB.cfg likely use an MK for which a table is available. So support for 90-95% of BD+ titles is probably a good estimation.

Originally Posted by maetel99

If so, then there really is no longer a need for libbdplus, vm0, and all that.

It's still needed for menu support for those early BD+ generations that are supported.

Originally Posted by maetel99

You could just locate the correct decrypted BD+ table for the disc, parse it, and deliver the patches directly in response to requests for particular sectors of data. That code is pretty simple and could be incorporated directly into libaacs.

While possible, that doesn't seem a good idea to me and probably requires changes in libbluray to disable libbdplus. This patch is just a quick hack to use existing libbdplus functions without interfering with the things that do work

And I still hope the libbdplus implementation will be improved at some point in time

[maetel99]

Originally Posted by candela

It's still needed for menu support for those early BD+ generations that are supported.

I guess I don't follow what you mean here. The BD+ fixup table contains sub-tables with arrays of patches for each modified m2ts file. Menus are also stored in m2ts files. If you have the full BD+ table, then it seems like you have everything necessary to remove the BD+ modifications from the disc. Am I missing something?

Originally Posted by candela

While possible, that doesn't seem a good idea to me and probably requires changes in libbluray to disable libbdplus. This patch is just a quick hack to use existing libbdplus functions without interfering with the things that do work

I don't think there would be changes necessary for libbluray. Each time a block of data is requested from libaacs, it would decrypt it as needed and also check if there are BD+ patches that need to be applied. If there are patches, it would just apply them before returning the decrypted data to libbluray.

[Sparktank]

Thanks for the updated libraries!

I just stumbled through the forum looking for updated downloads so I can start watching Community on bluray with all the commentary.
It's a lot easier for tv blurays to start from the menu, as most programs just start with the longest title first when using something like DVDFab Passkey.

[mick0]

Originally Posted by maetel99

I guess I don't follow what you mean here. The BD+ fixup table contains sub-tables with arrays of patches for each modified m2ts file. Menus are also stored in m2ts files. If you have the full BD+ table, then it seems like you have everything necessary to remove the BD+ modifications from the disc. Am I missing something?

When you try playing java menus with cached tables you will just get a warning message saying that you need to update your player firmware.

Originally Posted by maetel99

I don't think there would be changes necessary for libbluray. Each time a block of data is requested from libaacs, it would decrypt it as needed and also check if there are BD+ patches that need to be applied. If there are patches, it would just apply them before returning the decrypted data to libbluray.

It's actually libbluray that dlopens libaacs and libbdplus on demand so yes it would require disabling libbdplus in libbluray.

[Dandu]

Hi

I have tried this on Mac OS X, but without success

I have patched libaacs and libbdplus and the compilation works. I can read the Blu-ray, libaacs cache the MK, but i can't read BD+ Blu-ray (i have the corruption).

Can you help me ?

[candela]

Originally Posted by Dandu

Hi

I have tried this on Mac OS X, but without success

I have patched libaacs and libbdplus and the compilation works. I can read the Blu-ray, libaacs cache the MK, but i can't read BD+ Blu-ray (i have the corruption).

Can you help me ?

are you sure the table is available for your MK and in the correct dir ? also try enabling debug logs using the environment vars in util\logging.c although I didn't manage for some reason (I can do it for AACS logs). it should show you which table get's loaded "BD_DEBUG(DBG_BDPLUS | DBG_CRIT, "[bdplus] Opening cached CONVERSION TABLE from %s ...\n", file);"

Also can you adapt How To: for mac so I can put in my initial post

[mick0]

Originally Posted by Dandu

...i can't read BD+ Blu-ray (i have the corruption).

Can you help me ?

On Mac you probably need to use "cache" dir for tables instead of "config" dir - at least that's how it's on Linux. On Windows these two are one and the same. It's also possible to use system wide config dir so the configuration doesn't need to be duplicated for all users.

Windows:
%AppData%\bdplus\convtab (per user installation)
or
%ProgramData%\bdplus\convtab (system wide installation)

Linux:
$HOME/.cache/bdplus/convtab (per user installation)
or
/etc/xdg/bdplus/convtab (system wide installation)

Mac (I'm not 100% sure about these):
$HOME/Library/Caches/bdplus/convtab (per user installation)
or
/Library/Preferences/bdplus/convtab (system wide installation)

I hope this helps.

[Dandu]

Thank you, it works.

My error was dumb : the convtab was in $HOME/Library/Preferences/bdplus/convtab

I have placed the files in the good place and it works !

[nst]

FWIW, I tried this with Kodi and the libbluray/libaacs/libbdplus stack (with the patches from candela, of course) and wondered why BD+ wasn't working, despite the convtab.bin's being at the right place. I found out that after selecting the desired title from Kodi's title selection dialog, it always said "bdplus_m2ts(...): no conversation table" without any real traces of libbdplus doing anything beforehand.

So I patched bdplus.c:bdplus_m2ts() to simply trigger a BDPLUS_RUN_CONVTAB event based on the bdplus_test.c example and finally got it working that way.

What I did to "fix" this might be a very bad idea, and even libbluray or Kodi might be doing something wrong, but I thought anyway I'd share my findings and also the patch to apply to the libbdplus sources, see the attached file.

Maybe someone finds another way to fix this "the right way", though until then hopefully this is of any help for anyone.

Thanks to candela (and whoever is involved in this) for getting BD+ playback to work in this way!

EDIT: Seems like the attachment needs approval, until this is done, I've uploaded the patch to https://anonfile.com/U0Hfh885nf/bdpl...vtab.patch_txt (no mega account, sorry).

[RealSnoopyDog]

Thank you very much for this
I tested the 32 bit variant on Windows 10 together with the LAV codecs and DVBViewer on two different PCs. In my HTPC, I have an "UHD friendly" drive. I used some older and some brandnew Blu-Rays and also my few 4k Blu-Rays. Everything played back fine so far.
I have no problems with Blu-Ray playlists because I developed a little add on for DVBViewer which manages and displays the playlists on it's own. It tries to detect the main movie and if this fails, you can choose any other playlist as the main movie.

[mick0]

New host certificate. Already revoked in MKBv72, but since it works up to MKBv71 it might help someone else.

| HC | HOST_PRIV_KEY 0x909250D0C7FC2EE0F0383409D896993B723FA965 | HOST_CERT 0x0203005CFFFF800001C100003A5907E685E4CBA2A8CD5616665DFAA74421A14F6020D4CFC9847C23107697C39F9D109C8B2D5B93280499661AAE588AD3BF887C48DE144D48226ABC2C7ADAD0030893D1F3F1832B61B8D82D1FAFFF81 ; Revoked in MKBv72

[DanTheMann15]

holy crap mick0, thanks!

[Buck]

Originally Posted by candela

How To (Windows):

• Put the 32-bit or 64-bit libaacs/libbdplus DLLs (all 4) in the corresponding VLC directory
• Put the BD+ vm files in the %APPDATA%\bdplus\vm0 directory
• Put the cached BD+ tables (1.5GB) in the %APPDATA%\bdplus\convtab directory
• Put the FindVUK KEYDB.cfg in the %APPDATA%\aacs directory
• Edit the KEDYB.cfg and put the keys and certs from this post on top

All MEGA links expired? For example, #1:
mega:#!oJVjwKCT!0L7a7ftjQhVqcIOXUOZid88818Rnsu-y_CyKY3ra4-4?_escaped_fragment_=oJVjwKCT!0L7a7ftjQhVqcIOXUOZid88818Rnsu-y_CyKY3ra4-4

Enter decryption key
The provided key is invalid. Please check that the key is correct or ask the creator of the link again.

[candela]

Originally Posted by Buck

All MEGA links expired? For example, #1:
mega:#!oJVjwKCT!0L7a7ftjQhVqcIOXUOZid88818Rnsu-y_CyKY3ra4-4?_escaped_fragment_=oJVjwKCT!0L7a7ftjQhVqcIOXUOZid88818Rnsu-y_CyKY3ra4-4

I changed the first link today because I included MacOS libs compiled by Dandu. But the links seem to work for me. Not sure where this escape_fragment stuff in your link is coming from

[nst]

Originally Posted by candela

[*]In case the BD+ table included for the MK of your disc does not work, you can try retrieving a working table using Nalor's BlurayTest&Decrypt. The table will be saved in %APPDATA%\bdplus\convtab\DiscID*.bin and will have to be renamed to MK*.bin to use with libbdplus[/LIST]

One question regarding this: Is there any other way to retrieve these tables? For me, (at least) the convtab for "Star Wars Ep. 1 - The Phantom Menace" (1677D189ECCC2161451A3C0FA4F53CD4_THE_PHANTOM_MENACE.bin) doesn't fully work (picture errors starting from around ~0:30:00 playtime). I tried playing the disc with Leawo (where the tables seem to come from) and it yields the same error. Other discs from the Star Wars box (played episodes 4-6) work fine, so I believe the patched libbdplus is fine in this regard. Any info on this might help with other discs of course.

Thanks,
nst

[candela]

Originally Posted by nst

One question regarding this: Is there any other way to retrieve these tables? For me, (at least) the convtab for "Star Wars Ep. 1 - The Phantom Menace" (1677D189ECCC2161451A3C0FA4F53CD4_THE_PHANTOM_MENACE.bin) doesn't fully work (picture errors starting from around ~0:30:00 playtime). I tried playing the disc with Leawo (where the tables seem to come from) and it yields the same error. Other discs from the Star Wars box (played episodes 4-6) work fine, so I believe the patched libbdplus is fine in this regard. Any info on this might help with other discs of course.

Thanks,
nst

The table seems to have problems. Please try this table

[nst]

Originally Posted by candela

The table seems to have problems. Please try this table

That one seems to work fine (didn't watch the whole movie but skipped through the chapters and watched a bit of the end, didn't notice any glitches). Thank you!

[RealSnoopyDog]

I have one question regarding the disc keys in the keydb.cfg
Today I tried to playback the UHD of Valerian and the playback failed because the disc key was missing. So I queried the key with the little program "aacs_info", duplicated the line of the existing VALERIAN UHD and excanged only the disc key with the queried one. Is this already ok? The disc seems to playback fine with this modification.