Samsung Security Storage BD C6900 -> Decrypted

[Denny]

Common keys in directory /mtd_drmregion_a/security/ss/0150fbf5 :
each file contain key for decryption of other subdirectorys.


fb3ebd79.sx :

Code: Select all

SecureStorage
e7340e06-59a5-4e48-a72e-13cd7087fd36BDP_App
129
f47ac10b-58cc-4372-a567-0e02b2c3d479
Access_Manager
1
0
93
93
6af1644f
-
4059e73c36bff3deb95b5ed50b928f59
e7340e06-59a5-4e48-a72e-13cd7087fd36
BDP_App
1
0
7abe07b5d099fbff7fa51609823f221ead0b0e0a

it decrypt files in directory /mtd_drmregion_a/security/ss/6af1644f using key : 4059e73c36bff3deb95b5ed50b928f59 by algo AES-CBC

a2e4f1ad.sx :

Code: Select all

SecureStorage
b6d8370a-9b1e-479f-a7ab-9a2ea14c1415WIDEVINE_DRM
129
f47ac10b-58cc-4372-a567-0e02b2c3d479
Access_Manager
1
0
98
98
19d6366f
-
b94a1601b8bea0236e74e38704879986
b6d8370a-9b1e-479f-a7ab-9a2ea14c1415
WIDEVINE_DRM
1
0
7d3623e8dab8613ddc714b67d63add366a49d8ff

it decrypt files in directory /mtd_drmregion_a/security/ss/19d6366f using key : b94a1601b8bea0236e74e38704879986 by algo AES-CBC

54f412a7.sx :

Code: Select all

SecureStorage
f5a5d048-7ed4-4e58-8d1f-9731e40f03e2WMDRM
129
f47ac10b-58cc-4372-a567-0e02b2c3d479
Access_Manager
1
0
91
91
9255b072
-
134dd7ce619037e45499805d4e5afadd
f5a5d048-7ed4-4e58-8d1f-9731e40f03e2
WMDRM
1
0
5cf3d89fe1464e8b6ff15c10f69bb1da2bcad08d


it decrypt files in directory /mtd_drmregion_a/security/ss/9255b072 using key : 134dd7ce619037e45499805d4e5afadd  by algo AES-CBC

9ce2dcae.sx :

Code: Select all

SecureStorage
65064a33-616c-49a3-8967-905c51c0ceebHDCP_App
129
f47ac10b-58cc-4372-a567-0e02b2c3d479
Access_Manager
1
0
94
94
b3e4bfd5
-
c0f12d1305dcf495edccc0edcecae5f2
65064a33-616c-49a3-8967-905c51c0ceeb
HDCP_App
1
0
2b57f34cde814fb82a82282c006e0a06c98310a1

it decrypt files in directory /mtd_drmregion_a/security/ss/b3e4bfd5 using key : c0f12d1305dcf495edccc0edcecae5f2 by algo AES-CBC

8a2013ee.sx :

Code: Select all

SecureStorage
46798ab9-11a0-448f-b17f-292d08633a96Pharos_App
129
f47ac10b-58cc-4372-a567-0e02b2c3d479
Access_Manager
1
0
96
96
2a01ad12
-
6aaad6a28f4ce844f6c12837d0df484e
46798ab9-11a0-448f-b17f-292d08633a96
Pharos_App
1
0
3e55b9035a96b746a706dc7f54c28803552dd613


it decrypt files in directory /mtd_drmregion_a/security/ss/2a01ad12 using key : 6aaad6a28f4ce844f6c12837d0df484e by algo AES-CBC

2f444814.sx :

Code: Select all

SecureStorage
84b3150b-2038-48fe-b6c0-2c1729a8aa07ContentsHome
1
f47ac10b-58cc-4372-a567-0e02b2c3d479
Access_Manager
1
0
98
98
a32f9f00
-
3fc147a1c635d5bf019e5d804e427edb
84b3150b-2038-48fe-b6c0-2c1729a8aa07
ContentsHome
1
0
938cec1e9455ffc9d720952081eced5868551968

it decrypt files in directory /mtd_drmregion_a/security/ss/a32f9f00 using key : 3fc147a1c635d5bf019e5d804e427edb by algo AES-CBC

1e12a501.sx:

Code: Select all

SecureStorage
e6e7c1b1-3069-4363-9535-dece73b8b64fAACS_App
129
f47ac10b-58cc-4372-a567-0e02b2c3d479
Access_Manager
1
0
94
94
f57f8503
-
08a7c7573374fca96fe40b0d08f4a8f2
e6e7c1b1-3069-4363-9535-dece73b8b64f
AACS_App
1
0
54391d14c8e766ace43b9871219c426d972fd653

it decrypt files in directory /mtd_drmregion_a/security/ss/f57f8503 using key : 08a7c7573374fca96fe40b0d08f4a8f2 by algo AES-CBC

0d4fd46b.sx:

Code: Select all

SecureStorage
fe3810c4-fe47-4ea2-9025-38e5fbcbaf43NETFLIX
129
f47ac10b-58cc-4372-a567-0e02b2c3d479
Access_Manager
1
0
93
93
d075d1bf
-
041a90cf5c446de3f8f83af1f7d09727
fe3810c4-fe47-4ea2-9025-38e5fbcbaf43
NETFLIX
1
0
26034de4a21b8306b770eee9c5e6e81c154fc4c1

it decrypt files in directory /mtd_drmregion_a/security/ss/d075d1bf using key : 041a90cf5c446de3f8f83af1f7d09727 by algo AES-CBC

all crypted files can be downloaded here :
http://www.multiupload.com/61QYA97AFA




Denny

[mirsev]

Hello Denny,

Probably I do something wrong but

Code: Select all

openssl aes-128-cbc -d -K 4059e73c36bff3deb95b5ed50b928f59 -iv 0 -in mtd_drmregion_a/security/ss/6af1644f/1051e412.sx -out test.dec
bad decrypt
3078407900:error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt:evp_enc.c:536:

How do you get keys or AES passwords to decrypt those files?

Another question: how can I decrypt .cmk files in the Widget Manager?

Thank you.

[Denny]

mirsev

just a smaple on 1st 16 bytes
file 1051e412.sx contain :

Code: Select all

00000000h: 6D 77 A4 02 42 32 E6 72 BE 1C F3 27 3D 48 2D EE ; mw?.B2?r?.?'=H-?

aes_decrypt(key = 4059e73c36bff3deb95b5ed50b928f59; data_in = 6D77A4024232E672BE1CF3273D482DEE; data_out);

data out should give this : 53 65 63 75 72 65 53 74 6F 72 61 67 65 0A 44 65

check is data_in same as in my one.

about cmk, i release as soon i get signing success.


Denny

[mirsev]

Seems different:

Code: Select all

$ hexdump -C mtd_drmregion_a/security/ss/6af1644f/1051e412.sx | head

00000000  94 a8 03 e2 ab 8b 09 af  ad ca a8 23 bc 41 6f 7a  |...........#.Aoz|
00000010  59 0e b0 a3 10 b1 e1 bb  ad 0c 9d 03 1d a1 37 72  |Y.............7r|
00000020  1d 45 5c 85 60 8e 1a f6  b4 fd 22 bc b7 a3 5f 48  |.E\.`....."..._H|
00000030  45 4f 4b ac cd f0 28 b7  65 d1 75 70 3e b2 1d ea  |EOK...(.e.up>...|
00000040  4e a0 3e fd 96 70 4b 8d  9d 2f cd de e2 b9 ac 3f  |N.>..pK../.....?|
00000050  42 bf c2 85 71 cb 14 38  54 db c5 d8 01 e1 d0 1d  |B...q..8T.......|
00000060  04 46 3b 0d 78 03 35 a4  2e 1d f7 c7 8e b7 60 0b  |.F;.x.5.......`.|
00000070  3b f1 65 e5 56 db 96 a6  eb d5 c5 f3 2b e0 fa c8  |;.e.V.......+...|
00000080  1a 8b f2 b6 cd dc db c0  ec bb 11 38 95 b5 80 d3  |...........8....|
00000090  0c b0 22 3a d4 f3 1c ae  d2 d2 3b ca 84 3c 4d 22  |..":......;..<M"|

[Denny]

ok was thinking that the common keys are same ,
we make a tool later that will do the job

Denny

[erdem_ua]

I wonder that if that tool allows users to record NetFlix's videos?
I heard something like that. Could you explain BDSS and why does it used?
This hack allows us what? What is the purpose of decrypting BDSS?
I really don't know about it and wanted to know.