Re: Idea: The ultimate CD/DVD auditing tool
As a basic idea it seems relatively workable. However, there's one detail that perhaps you might want to know about: "We can push the idea a step further, making a stripped-down CD/DVD drive that would be able basically just to follow the spiral track with its head in constant linear velocity" Unlike a vinyl record, the CD grooves don't form a spiral...they are concentric circles. Also, the beginning of the CD is towards the center, the end towards the edge. -TD
From: Thomas Shaddack <shaddack@ns.arachne.cz> To: cypherpunks <cypherpunks@lne.com> Subject: Idea: The ultimate CD/DVD auditing tool Date: Sun, 6 Jul 2003 04:13:32 +0200 (CEST)
Pondering. Vast majority of the CD/DVD "protection" methods is based on various deviations from the standards, or more accurately, how such deviations are (or aren't) handled by the drive firmware.
However, we can sidestep the firmware.
The drive contains the moving part with the head assembly. There is an important output signal there: the raw analog signal bounced from the disk and amplified.
We can tap it and connect it to a highspeed digital oscilloscope card. And sample obscene amount of data from it. In comparison with fast-enough ADCs, disk space is cheap. The problem can be in bandwidth, but for the drive speed set up to possible minimum (or for "normal" players) the contemporary machines should be sufficient. Real-time operating system (maybe RTOS-Linux) may be necessary.
We get the record of the signal captured from the drive's head - raw, with everything - dirt, drop-outs, sector headers, ECC bits. The low-level format is fairly well documented; now we have to postprocess the signal. Conversion from analog to digital data and then from the CD representation to 8-bit-per-byte should be fairly straightforward (at least for someone skilled with digital signal processing). Now we can identify the individual sectors on the disc and extract them to a disc image file that we can handle later by normal means.
We can push the idea a step further, making a stripped-down CD/DVD drive that would be able basically just to follow the spiral track with its head in constant linear velocity (easier to analyze than CAV) mode, with the ability to control the speed in accordance with how fast (and expensive) ADC, bus, and disks we have, and the possibility to interrupt/resume scanning anytimes in accordance with how much disk space we have (or to scan just a small area of the disc).
As a welcomed side effect, not only we'd get a device for circumvention of just about any contemporary (and possibly a good deal of the future ones) optical media "protections", but we would also get a powerful tool for retrieving data from even very grossly damaged discs, for audit of behavior of CD/DVD writers and CD vendors (eg, if they don't attempt to sneak in something like a hidden serial number of the writer), and for access to all areas of the discs - including the eventual ones unreachable through the drive's own firmware.
If we'd fill this idea with water, would it leak? Where? Why?
_________________________________________________________________ Help STOP SPAM with the new MSN 8 and get 2 months FREE* http://join.msn.com/?page=features/junkmail
Tyler Durden wrote:
As a basic idea it seems relatively workable. However, there's one detail that perhaps you might want to know about:
"We can push the idea a step further, making a stripped-down CD/DVD drive that would be able basically just to follow the spiral track with its head in constant linear velocity"
Unlike a vinyl record, the CD grooves don't form a spiral...they are concentric circles. Also, the beginning of the CD is towards the center, the end towards the edge.
Eh? It's a spiral. The constant linear velocity applies to the scan velocity (1.3 m/s at 1x), not the head velocity, which might cause problems. Also the spiral track/ holes in the centre aren't accurate enough to follow the track without real-time correction, done by some complex optical tricks and feedback loops. However, it should be quite easy to get a signal from somewhere in the CD player (especially from early ones which split the functions between lots of chips), probably best would be from the EFM (eight to fourteen modulation) or frame output. This will include all the interesting subcodes etc., plus sync and C1/C2 parity bytes. That's a fairly clean (it's digital, but with errors) signal at about 2.1 Mb/s at 1x speed, so it shouldn't be hard to capture and analyse in real time :). However, you will still have to do the CIRC decoding. If you are feeling adventurous you could just take a signal from the laser head, and do the timing, EFM, circ etc yourself. That will give you the pits, plus the errors, plus a lot (!) of work. Not recommended really, unlees you need it for some (anti?) copy-protection purpose. As for getting the player to actually follow the track on a protected disc, again the solution is probably to go for an older player and hack about. I used to repair them (a long time ago, when it was worth doing), it should be quite easy (though I'm no expert on CD copy protection). There was a mod involving just putting a few volts on one chip lead on an early Sony model, but I can't remember enough details to find a ref. A curiosity, only tenuously related - I just came across a Feb 1994 copy of Elector magazine, with plans for a S/PDIF copybit eliminator (for SCMS). Seems people have been defeating copy protection for a while.. -- Peter Fairbrother
On Tuesday, July 8, 2003, at 10:40 AM, Peter Fairbrother wrote:
A curiosity, only tenuously related - I just came across a Feb 1994 copy of Elector magazine, with plans for a S/PDIF copybit eliminator (for SCMS). Seems people have been defeating copy protection for a while..
I've owned an "Audio Alchemy" SCMS-stripper since 1991, when I bought my first DAT machine. It cost about $99, was about the size of a deck of cards, and stripped the SCMS bits out of the digital bitstream. A later DAT machine I bought, a Tascam portable pro deck, has the SCMS stripped by default. (It takes in digital signals and writes to the DAT with the SCMS code set to "unlimited number of digital copies allowed.") Likewise, a professional CD writer I own (HHB) bypasses SCMS. (Not just allowing a digital copy to be made, but making the resulting CD-R copyable freely.) A friend of mine bought his DVD player on EBay: it bypasses all region coding (i.e., it makes all DVDs "region-free"). Region coding is a different issue, but part of the DRM universe. Until George W. Bush and the Carlyle Group start putting money into these things and thus discover that SCMS strippers are terrorist tools, such tools will likely continue to be available. "Use a logic analyzer, go to jail." --Tim May "He who fights with monsters might take care lest he thereby become a monster. And if you gaze for long into an abyss, the abyss gazes also into you." -- Nietzsche
participants (3)
-
Peter Fairbrother -
Tim May -
Tyler Durden