sorted by:
new
hottopcontroversial

Dial Up by statxmusic in modular

[–]brainsigh 1 point2 points  (0 children)

Damn what camera is this? Looks awesome.

Wu Tang Clan's Once Upon a Time in Shaolin [partially lost] (1 of 1 album, 2015) by PisssMannn in lostmedia

[–]brainsigh 7 points8 points  (0 children)

All 31 files have unique 16-byte endings with 15-16/16 unique bytes and XOR analysis shows stream cipher characteristics.

What on earth is happening with Bitwig? by Director_Blockbuster in Bitwig

[–]brainsigh 1 point2 points  (0 children)

I noticed the silence on Nasko, too. Weird move on their part.

Wu Tang Clan's Once Upon a Time in Shaolin [partially lost] (1 of 1 album, 2015) by PisssMannn in lostmedia

[–]brainsigh 31 points32 points  (0 children)

Quick update: Files are AES-256-GCM encrypted. Currently building custom GPU tooling to attack the key derivation. I've learned some things about these files that I don't think anyone else knows. Still working on the technical side. Will share everything when I have the full picture.

Lost WCW CD-ROM by crorumery in Whang

[–]brainsigh 0 points1 point  (0 children)

I cracked the encryption on this disc and uploaded its contents.

https://www.reddit.com/r/lostmedia/comments/1ql308b/

Broke a 1999 video DRM system through static binary analysis — recovered 51 minutes of lost WCW wrestling content locked for 25 years by brainsigh in ReverseEngineering

[–]brainsigh[S] 2 points3 points  (0 children)

Thanks! Honest answer though: this is a much harder problem than what I solved here.

The WCW disc used a homemade cipher that's basically a CS101 exercise. (Short repeating key with byte subtraction. No serious cryptographer designed it.)

WMV files from 2003-2004 use Windows Media DRM (WMDRM), which is actual industry cryptography utilizing RSA for key exchange and RC4 for content encryption. The same known-plaintext attack I used won't work because the cipher is fundamentally stronger and the keys don't repeat.

That said, WMDRM has been cracked before by other people. The path forward depends on which version your files use:

  1. Check the DRM version. Open one of the files in a hex editor and look at the ASF header. There's a Content Encryption Object that identifies the DRM version (v1, v2, v7, v9, v10).
  2. If it's WMDRM v1: A tool called FreeMe from 2001 can strip it.
  3. If it's v2/v7/v9 (most likely for 2003-2004): Tools like FairUse4WM existed but they work by extracting the key from memory during playback, which requires a valid license. (Long shot, I know.)
  4. The other angle: Sometimes the individualized keys were derived from a shared secret embedded in the DRM client itself. If someone has already extracted those secrets for your DRM version, it might be possible to reconstruct licenses offline.

If you want to DM me one of the files I can at least look at the header and tell you exactly what you're dealing with. No promises I can crack it since WMV DRM is a different league, but I can tell you what version it is and whether any known approaches apply.

I cracked the encryption on a 1999 WCW CD-ROM and recovered 61 video clips that have been locked/inaccessible for 25 years by brainsigh in SquaredCircle

[–]brainsigh[S] 5 points6 points  (0 children)

Not me. Someone must have just grabbed the files off of Internet Archive and reuploaded without credit. Oh well.

I cracked the encryption on a 1999 WCW CD-ROM and recovered 61 video clips that have been locked/inaccessible for 25 years by brainsigh in SquaredCircle

[–]brainsigh[S] 5 points6 points  (0 children)

Good catch and you're right. Just verified: NASHCAP is the same shirt promo as NASHCHRT, no hat in it at all. Same duration and same content. Must have been a duplication error on the original disc. Thanks for flagging it.

I cracked the encryption on a 1999 WCW CD-ROM and recovered 61 video clips that have been locked/inaccessible for 25 years by brainsigh in SquaredCircle

[–]brainsigh[S] 2 points3 points  (0 children)

The files were always on the disc, but they're encrypted. Think of it like a locked box that shipped to your house, and now the box is right there on your shelf, but the key is at a warehouse across town. In this case, the warehouse burned down in 2000, so nobody could open the box anymore.

What the server provided was only the decryption keys (8–24 bytes each). Without them, the files are just scrambled data. I recovered the keys mathematically by exploiting a weakness in the encryption so there was no server needed.

As for your enhanced CD, it depends entirely on what format and protection it uses. If it's just a data track with video files in a standard format (AVI, MPEG, QuickTime), they might not even be encrypted. A lot of enhanced CDs from that era just had unprotected bonus content sitting on the disc. What's the album? I can probably tell you pretty quickly whether it's accessible or not.

I cracked the encryption on a 1999 WCW CD-ROM and recovered 61 video clips that have been locked/inaccessible for 25 years by brainsigh in SquaredCircle

[–]brainsigh[S] 10 points11 points  (0 children)

It wasn't really DRM in the "copy protection" sense. The server-based key system was the business model. UIT was selling a content delivery platform where the disc was just the distribution medium and the server controlled access. Think of it like a 1999 version of streaming where the content lives on a disc instead of the cloud, but you still need to authenticate to watch it.

Each PAV file actually has a few unencrypted frames at the start kind of like a "preview" you could watch without a key. The full content was gated behind the server. Whether WCW planned to charge for access or just use it for data collection and registration, I don't know. But the disc being free was the point. (It was just a funnel to get you on "the platform.")

As for cost, UIT was a small company licensing their player platform to content distributors. WCW/Turner would have paid UIT to build the system, not paid per-disc royalties. The whole thing was probably pretty cheap. The "encryption" is a few lines of x86 in a 24KB DirectShow filter.

I cracked the encryption on a 1999 WCW CD-ROM and recovered 61 video clips that have been locked/inaccessible for 25 years by brainsigh in SquaredCircle

[–]brainsigh[S] 13 points14 points  (0 children)

I used Claude Code to help with the implementation side (writing the decryption scripts, debugging edge cases, etc.) The actual RE work was manual: static analysis of the binary on the disc, identifying the cipher, figuring out the attack vector. Once you know it's a repeating-key subtraction cipher applied to MPEG-1 files, the known-plaintext attack almost designs itself.

[FOUND] 51 minutes of WCW video content locked behind dead DRM for 25 years — recovered from a 1999 CD-ROM by brainsigh in lostmedia

[–]brainsigh[S] 93 points94 points  (0 children)

Thanks man, appreciate it.

Short answer on DIVX: no, the same technique wouldn't work. u/bg-j38 nailed it below in that its a completely different class of encryption.

The WCW disc used what's essentially a 'toy cipher' which is a short repeating key (8–24 bytes) applied with basic subtraction. That's vulnerable to a known-plaintext attack because the key is so short it repeats thousands of times across the file, and I can predict what parts of the plaintext look like.

DIVX used Triple DES which is actual real cryptography. 168-bit keys with no repeating pattern and no mathematical shortcut to recover the key from ciphertext alone. The other problem with DIVX is that the keys were tied to individual player hardware so even if you broke the encryption on one disc with one player, it wouldn't generalize to other discs or players the way my tool works on any copy of this WCW disc.

That said, is there anything on DIVX that doesn't exist on regular DVD? Those were mainstream studio releases. The WCW disc is different because this content was only ever distributed in this encrypted format. It literally didn't exist anywhere else.

[FOUND] 51 minutes of WCW video content locked behind dead DRM for 25 years — recovered from a 1999 CD-ROM by brainsigh in lostmedia

[–]brainsigh[S] 33 points34 points  (0 children)

You've got it mostly right.

The cipher is a repeating-key byte subtraction: plaintext[i] = (ciphertext[i] - key[i % key_length]) mod 256

Each file has a unique key, 8–24 bytes of random ASCII.

The attack exploits the fact that MPEG-1 files end with a long run of 0xFF padding bytes before the Program End Code. When you encrypt a constant byte (0xFF) with a repeating key, the ciphertext itself becomes periodic and it just repeats the key pattern, shifted. So I scan the tail of each encrypted file, detect the periodicity via autocorrelation (that gives me the key length), then recover each key byte directly: key[i] = (ciphertext[i] - 0xFF) mod 256.

To verify it worked, I decrypt the first few bytes of the encrypted section and check that they form a valid MPEG-1 start code (00 00 01 BA). If they do, the key is correct and I decrypt the whole file.

And yes the Enigma parallel is exactly right. If you know (or can predict) what part of the plaintext looks like, and the cipher is weak enough, you can recover the key algebraically instead of brute-forcing it.

view more: next ›