DVD-Audio Copy Protection Defeated via WinDVD Software Hack

The music industry is buzzing with the news that high-resolution DVD-Audio content can be ripped, bypassing most of the format’s copy-protection safeguards. A small suite of applications that patch InterVideo’s WinDVD 5, 6 or 7 program allow data to be routed directly to .WAV files on the user’s hard-disk, instead of to a soundcard for digital-to-analogue conversion.

The three utilities are:

  • DVD-A Ripper, which is intended to decrypt CPPM protected AOB and VOB files,
  • PPCM Ripper, used to capture Packed PCM (MLP) streams (stereo or multi-channel) to .WAV files and
  • DVD-A Explorer which allows the user to browse a DVD-Audio track structure.

The applications use WinDVD’s licensed DVD-Audio and MLP decoders to access the unprotected data, which can then be freely shared. The only caveat is that DVD-Audio’s Verance digital watermarking, embedded in the audio signal itself, cannot be removed. The Verance watermark contains seventy-two bits of data comprising four CCI (copy control information) bits and eight usage identifier bits every fifteen seconds plus sixty content identifier bits every thirty seconds – if a DVD-Audio player detects that an embedded watermark does not match that of a specific disc (in other words if ripped DVD-Audio content is burnt to a blank DVD-R disc using an authoring program such as DiscWelder BRONZE), the machine will halt playback after thirty seconds.

The WinDVD hack does however, bypass two layers of DVD-Audio encryption, a media key block used to authenticate the player (which itself is encrypted) and Content Protection for Pre-recorded Media (CPPM), which was developed by 4C (comprising IBM, Intel, MEI and Toshiba) and uses fifty-six bit keys – instead of the forty bit keys used for CSS – and the Cryptomeria Cipher (C2) for content encryption. This is not a hack of CPPM itself, but rather a ‘backdoor’ method of intercepting the digital data after it has been decrypted by WinDVD.

One interesting aspect of CPPM is that it allows for a hacked playback device to be revoked using a Media Key Block (MKB). Each licensed decoder – in this case WinDVD – has assigned to it a set of unique keys that allow it to obtain the Media Key (used to encrypt the audio content) from the MKB and decrypt the audio content. As WinDVD is now compromised in its current form, future DVD-Audio releases could be prevented from playing back on the software, rendering the hack useless… were it not for the thousands of DVD-Audio titles already released, all of which can be (in theory at least) copied using the DVD-A Ripper, PPCM Ripper and DVD-A Explorer applications and either a current or legacy version of WinDVD.

Created by someone calling him/herself “MaximA”, the suit of tools has been privately used since 2004, but only today have they been uploaded to various web sites for widespread download and use with both standard DVD-Audio titles and the new generation of DualDiscs.

Needless to say although the applications have some legitmate value for enthusiasts (the ability to tell whether a disc has Verance watermarking and being able to analyse the audio content digitally to spot up-sampled discs for example), the use of either DVD-A Ripper, PPCM Ripper or DVD-A Explorer to actually copy the content of discs has considerable legal implications and as High Fidelity Review does not condone the theft of intellectual property or music piracy, we will not be posting a link to the Rarewares download site at this time. Readers who are looking for further information are advised to check one of the popular search engines or a high-resolution discussion forum for applicable URLs.

Update: 09/07/2005

The RIIA lawyers have been quick to respond to the public availability of the DVD-Audio ripping tools. The administrator of the Rarewares site upon which the programs were first posted reports being contacted by a firm of lawyers in his locale who had been given the task of preventing the site from distributing the programs mention in this article. The Rarewares site has complied with their request and the tools have since been removed.
DVD-Audio Explorer tells us all sorts of things about the first track on the new Rob Thomas DualDisc, such as the copy control info, the sample rate, bit-depth and the amount of PCM compression (59.11% in case you were wondering…)