interactive dvd disc pin number

[r0lZ]

OK, I'll try to find a DVD with a similar protection, and I'll let you know.

[r0lZ]

OK, I got the IFOs, and found how it is protected. It's not the 3 digits protection of DVDLab, but a more complex 4 digits protection.

Use the trace mode to examine the different PGCs and their commands. (Use the Break red button to stop the trace, and the -> Step button to execute one command at a time.)

The whole menu, including the keypad to enter the code is in the VMGM. The main menu is in PGC 2. When you click on the protected scenes buttons, the nav continues to PGC 4, where you have the Play All button and a button for each 6 scenes. The Play All button sets GPRM 10 to value 100. The 6 individual scene buttons lead to a short title and then come back to the VMGM PGC 7 to 12 respectively. It's a new menu where you can change your mind and select again a Play All button, or continue with the individual scene. If you continue, GPRM 10 is set to 11, 12, 13, 14, 15 or 16 respectively. So, GPRM 10 contains a number identifying what the user wants to see. In any case, when you continue, a new menu is shown, explaining how to buy the password. Then, if you continue again, the keypad menu is shown.

We are now in VMGM PGC 13, the menu where you can enter the first digit. All buttons have the same command: LinkPGCN PGC 19. So, wehn you click a digit, the nav continues with the dummy PGC 19. It contains 7 conditional links to jump to a different PGC according to the content of GPRM 10:

[20 A4 00 0A 00 0B 00 15]   1  if ( gprm(10) == 11 ) then { LinkPGCN PGC 21 } 
[20 A4 00 0A 00 0C 00 16]   2  if ( gprm(10) == 12 ) then { LinkPGCN PGC 22 } 
[20 A4 00 0A 00 0D 00 17]   3  if ( gprm(10) == 13 ) then { LinkPGCN PGC 23 } 
[20 A4 00 0A 00 0E 00 18]   4  if ( gprm(10) == 14 ) then { LinkPGCN PGC 24 } 
[20 A4 00 0A 00 0F 00 19]   5  if ( gprm(10) == 15 ) then { LinkPGCN PGC 25 } 
[20 A4 00 0A 00 10 00 1A]   6  if ( gprm(10) == 16 ) then { LinkPGCN PGC 26 } 
[20 A4 00 0A 00 64 00 14]   7  if ( gprm(10) == 100 ) then { LinkPGCN PGC 20 }

As you can see, if, say, the user has selected the Play All option, GPRM 10 holds 100 and therefore the nav will continue to PGC 20.

PGC 20 (below) contains the commands to verify the code. It is called 4 times: one time for each digit.

GPRM 0 holds 0 when the PGC is called for the first time, but it is incremented by command 1, so it will hold the number of the digit.

Lines 2 and 3 copies the current button number in GPRM 1, so if you have typed, say, 5, then it will hold 5.

Lines 4 to 7 go to a different section of the PGC according to the current digit number. So, the first time, it will jump to line 9.

Lines 9 and 10 are especially interesting: Line 9 checks the typed digit, and go to line 11 and jump directly to PGC 14 if it is not 9. Line 10 (highlighted in red below) checks also the typed digit, and if it is 9, then it jumps to line 13, where GPRM 2 is incremented, and the next line jumps also to PGC 14.

So, we have learned 2 things: the first digit of the code is 9, and GPRM 2 holds a counter of the right digits. (It is tested later, in lines 16, 24 and 32, and if its value is not correct, that means that the user has not entered the right first digits, and the logic will continue differently.)

PGC 14 holds the second keypad menu. There is only one visual change: a star indicating that the first digit has been typed. The button commands are also LinkPGCN PGC 19, so when you type a new digit, you end up again in PGC 20, but this time, the digit number, again incremented by line 1, is 2, so the part of the code that will check the value of the second digit starts at line 16.

Lines 17 and 18 check the value of the 2nd digit, exactly like line 9 and 10 for the first digit, but this time, the right value is 4.

Similarly, the 3rd digit is checked by lines 25 and 26 and the 4th digit by lines 33 and 34. So, we can see that the final code is 9488, highlighted in red below.

[73 00 00 00 00 01 00 00]   1  Set gprm(0) +=(add) 1 
[61 00 00 01 00 88 00 00]   2  Set gprm(1) =(mov) sprm(8:Highlighted button number) 
[76 00 00 01 04 00 00 00]   3  Set gprm(1) /=(div) 1024 
[00 A1 00 00 00 01 00 09]   4  if ( gprm(0) == 1 ) then { Goto line 9 } 
[00 A1 00 00 00 02 00 10]   5  if ( gprm(0) == 2 ) then { Goto line 16 } 
[00 A1 00 00 00 03 00 18]   6  if ( gprm(0) == 3 ) then { Goto line 24 } 
[00 A1 00 00 00 04 00 20]   7  if ( gprm(0) == 4 ) then { Goto line 32 } 
[00 02 00 00 00 00 00 00]   8  Break 
[00 B1 00 01 00 09 00 0B]   9  if ( gprm(1) != 9 ) then { Goto line 11 } 
[00 A1 00 01 00 09 00 0D]  10  if ( gprm(1) == 9 ) then { Goto line 13 } 
[20 04 00 00 00 00 00 0E]  11  LinkPGCN PGC 14 
[00 02 00 00 00 00 00 00]  12  Break 
[73 00 00 02 00 01 00 00]  13  Set gprm(2) +=(add) 1 
[20 04 00 00 00 00 00 0E]  14  LinkPGCN PGC 14 
[00 02 00 00 00 00 00 00]  15  Break 
[00 B1 00 02 00 01 00 13]  16  if ( gprm(2) != 1 ) then { Goto line 19 } 
[00 B1 00 01 00 04 00 13]  17  if ( gprm(1) != 4 ) then { Goto line 19 } 
[00 A1 00 01 00 04 00 15]  18  if ( gprm(1) == 4 ) then { Goto line 21 } 
[20 04 00 00 00 00 00 0F]  19  LinkPGCN PGC 15 
[00 02 00 00 00 00 00 00]  20  Break 
[73 00 00 02 00 01 00 00]  21  Set gprm(2) +=(add) 1 
[20 04 00 00 00 00 00 0F]  22  LinkPGCN PGC 15 
[00 02 00 00 00 00 00 00]  23  Break 
[00 B1 00 02 00 02 00 1B]  24  if ( gprm(2) != 2 ) then { Goto line 27 } 
[00 B1 00 01 00 08 00 1B]  25  if ( gprm(1) != 8 ) then { Goto line 27 } 
[00 A1 00 01 00 08 00 1D]  26  if ( gprm(1) == 8 ) then { Goto line 29 } 
[20 04 00 00 00 00 00 10]  27  LinkPGCN PGC 16 
[00 02 00 00 00 00 00 00]  28  Break 
[73 00 00 02 00 01 00 00]  29  Set gprm(2) +=(add) 1 
[20 04 00 00 00 00 00 10]  30  LinkPGCN PGC 16 
[00 02 00 00 00 00 00 00]  31  Break 
[00 B1 00 02 00 03 00 28]  32  if ( gprm(2) != 3 ) then { Goto line 40 } 
[00 B1 00 01 00 08 00 28]  33  if ( gprm(1) != 8 ) then { Goto line 40 } 
[00 A1 00 01 00 08 00 23]  34  if ( gprm(1) == 8 ) then { Goto line 35 } 
[71 00 00 00 00 00 00 00]  35  Set gprm(0) =(mov) 0 
[71 00 00 02 00 00 00 00]  36  Set gprm(2) =(mov) 0  
[71 00 00 03 00 64 00 00]  37  Set gprm(3) =(mov) 100 
[20 04 00 00 00 00 00 11]  38  LinkPGCN PGC 17 
[00 02 00 00 00 00 00 00]  39  Break 
[71 00 00 00 00 00 00 00]  40  Set gprm(0) =(mov) 0 
[71 00 00 02 00 00 00 00]  41  Set gprm(2) =(mov) 0 
[20 04 00 00 00 00 00 12]  42  LinkPGCN PGC 18 
[00 02 00 00 00 00 00 00]  43  Break 
[20 04 00 00 00 00 00 14]  44  LinkPGCN PGC 20

PGCs 21 to 25, corresponding to scenes 1-6, have exactly the same logic, but of course, the digits values are different.

BTW, per chance, all commands beginning with "if ( gprm(1) ==" are used to check the code, so, to see easily all codes, just type "if ( gprm(1) ==" (without the quotes) in the PgcEdit search box in the bottom right of the main window, and click the "All" button: you will see the 28 commands, containing the 7 codes.


Now that we have understood how to find the codes and how the protection works, it should be easy to remove completely the check, so that typing any code will be accepted.

Note that when the user has typed the 4th correct digit, the commands executed are different than for the 3 first digits. Instead of going to the next keypad input screen, lines 35 to 38 (in green above) are executed.

Lines 35 and 36 reset the GPRMs 0 and 2 to 0.

Line 37 sets GPRM 3 to 100, and finally, line 38 jumps to PGC 17, a green screen confirming that the code has been typed correctly.

Of course, if the user did not type the right code, GPRM 2 does not contain the right number of right digits, and the nav is directed by lines 40 to 42 to PGC 18, a red screen indicating the error. Note that in that case, GPRM 3 is not set to 100, so we are now sure that GPRM 3 must hold 100 to indicate later that the right code has been typed correctly.

So, to bypass the digits verification, it is sufficient to delete all lines of the PGC 20, and leave only the lines confirming that the code has been entered correctly, the original lines 35 to 38:

[71 00 00 00 00 00 00 00]   1  Set gprm(0) =(mov) 0 
[71 00 00 02 00 00 00 00]   2  Set gprm(2) =(mov) 0 
[71 00 00 03 00 64 00 00]   3  Set gprm(3) =(mov) 100 
[20 04 00 00 00 00 00 11]   4  LinkPGCN PGC 17

Similarly, you can replace the lines of PGCs 21 to 26 with the lines 35 to 38 of the respective PGCs.
Note that line 37 contains a different number in each PGC: 100 for the Play All PGC 20, and 11 to 16 for PGCs 21 to 26. (They are exactly the same value than the values hold in GPRM 10 when entering the first digit menu, and they identify the title to play.)

After having removed all lines except lines 35 to 38 (you can safely remove also the post-command, as it is useless anyway), check if the code input screens are correctly bypassed by restarting the trace. You will still have to type a single digit, but any digit will unlock the movie. If finally the right title is played, then you did the things correctly.


Be sure to apply the same method in all PGCs (20 to 26), and you can clean the DVD further.

It is now useless to have to see the screen that asks for the payment, the first digit input pad and the green confirmation screen, so we will kill them. It's much more simple to do.

The VMGM PGCs 5 to 12 are the payment requests. Kill them all. (Select the PGC in the left pane, and call PGC -> Kill PGC Playback or press Control-K.) Each time, you will see a dialog, very similar to the menu viewer. Select the Continue button. (Be ABSOLUTELY SURE to select the right button, as if you select the Back button, it will be impossible to watch the scene! By default, the Back or Watch All button is selected, so take care!) Then click Kill Playback. (If PgcEdit asks you if you want to convert the PGC to a dummy, you can answer yes, although it's not necessary.)

PGCs 13 to 16 hold the keypads (for digits 1 to 4), and we can kill them too. But this time, select any digit button. (Do NOT select Back or Reset!)

PGCs 17 and 18 hold the green and red dialogs, and we can kill them too. Select Start for the green screen, and any button for the red one (since you will never enter a wrong code, that screen is useless and the selected button doesn't matter.)

Again, verify by restarting the trace. Now, as soon as you select the Play All or a scene button, you should see the right title(s) immediately!
You can now save the DVD, burn and enjoy it.
It was fun to crack the code and clean the DVD, right?

End of lesson.


Out of topic: the DVD has been badly authored, as there are numerous authoring errors. For example, in VMGM PGC 29, there is an invalid CallSS command in line 1. You can delete it (as it is useless), or copy it (select it and click the "Copy" button) and paste it over the original command (Paste Replace button). PgcEdit will fix it for you. In total, I've located 122 errors in the DVD! You are lucky if your player plays it without problem!

[mazinz]

Here is a silly question for you, why couldn't you just use pgcedit or dvdremakepro and change the first play go to command and have it hit your feature and completely bypass that menu all together

[r0lZ]

Just changing the FP-PGC command is not sufficient to be sure that the title will play, as there might be controls in the pre-command of the movie, redirecting the nav elsewhere if the code has been simply bypassed that way. (It is possible to use PgcEdit's Jump to PGC Upon DVD Insert to do what you suggest the clean way, and be assured that the title will play, but to use it, you have to trace to the title, and therefore you need the code. So, the first part of my explanation is necessary anyway.)

Secondly, that DVD is a collection of several shorts (all in their own VTS), so if you jump straight to title 1, how will you reach title 2, 3 etc...?

Thirdly, with your method, the menus are lost.

Fourthly, I wanted to crack the code, just for the fun.

[SLK001]

Here is a silly question for you, why couldn't you just use pgcedit or dvdremakepro and change the first play go to command and have it hit your feature and completely bypass that menu all together

This is not the purpose of the OP. He showed that it was a trivial task to rip the movie and burn what you wanted on a DVD-R. What he wanted was a way to "crack the code" so none of that was necessary, so that he could watch the original DVD by just entering the proper 4 digit code.

BTW, this method was discussed here many years ago and I mean at least 7 to 10 years ago. We discussed an additional technique called "channel scrambling" where the actual video chapters were scrambled on the original DVD. What I mean by scrambling is that the order of the chapters are out, so instead of 1-2-3-4-5-6-7-8-9, it is burned on the DVD as 1-4-6-2-9-8-3-5-7 so that the "rip-and-burn" crowd wouldn't be able to have any success without a lot of extra work.

[mazinz]

Just changing the FP-PGC command is not sufficient to be sure that the title will play, as there might be controls in the pre-command of the movie, redirecting the nav elsewhere if the code has been simply bypassed that way. (It is possible to use PgcEdit's Jump to PGC Upon DVD Insert to do what you suggest the clean way, and be assured that the title will play, but to use it, you have to trace to the title, and therefore you need the code. So, the first part of my explanation is necessary anyway.)

Secondly, that DVD is a collection of several shorts (all in their own VTS), so if you jump straight to title 1, how will you reach title 2, 3 etc...?

Thirdly, with your method, the menus are lost.

Fourthly, I wanted to crack the code, just for the fun.

understood, but for myself I would have found it easier to remove any "junk" pre (or post) commands and fixed the navigation if I had to and have it so it goes to the actual disc menu bypassing (in my case removing it) the security lock menu. Though like yourself I would have enjoyed taking a crack at that lock

Here is a silly question for you, why couldn't you just use pgcedit or dvdremakepro and change the first play go to command and have it hit your feature and completely bypass that menu all together

This is not the purpose of the OP. He showed that it was a trivial task to rip the movie and burn what you wanted on a DVD-R. What he wanted was a way to "crack the code" so none of that was necessary, so that he could watch the original DVD by just entering the proper 4 digit code.

right but by reading what the OP wrote it also sounded like he was unaware that you could skip some menus to avoid the issue, which is why I wrote what I did

[r0lZ]

understood, but for myself I would have found it easier to remove any "junk" pre (or post) commands and fixed the navigation if I had to and have it so it goes to the actual disc menu bypassing (in my case removing it) the security lock menu. Though like yourself I would have enjoyed taking a crack at that lock

Of course, it's possible, but certainly not easier for a newbie.

Personally, I would have made a compilation of all titles (with PgcEdit's Import VTST titles, or DVDShrink in re-author mode), then added the original menu in the VMGM, removed all useless menu PGCs and all commands of the DVD, and re-authored the necessary VM commands from scratch. But again, it's not easy, it's a long procedure, and extremely tedious to explain with enough details. Furthermore, I though that explaining how to find the code and remove the dialog screens could be informative to many persons. It's also a good introduction on how to use the PgcEdit trace feature.

And, as I said, it was a fun job!

[Descrasnezul]

lol. Thanks for all the help guys. I was trying to use a decrypter but I kept running into errors. Also I think the program was telling me to make a backup but when I did it said "failed to make backup". Popping the DVD into my PC then just looking at what PGCedit shows me with "if ( gprm(1) ==" is an easy way to impress my friends anyways. Again, thanks for all the help.

[DB83]

But surely, at the end of the day there is nothing 'ground-breaking' in this protection.

There was talk earlier in the thread of a 'unique code' being generated. But unless I read it wrong then every disk belonging to the batch will have the same code.

Now if someone wants to go out and actually develop a system that genuinely has a unique code for every end-user..........

[r0lZ]

But surely, at the end of the day there is nothing 'ground-breaking' in this protection.

There was talk earlier in the thread of a 'unique code' being generated. But unless I read it wrong then every disk belonging to the batch will have the same code.

I fully agree.

Now if someone wants to go out and actually develop a system that genuinely has a unique code for every end-user..........

That's impossible to do without burning a different (patched) copy for every user, as there is no way to get the code from outside of the DVD. Doing personalized copies is too expensive for a normal commercial usage.

[tcha]

OK... really cool...
I even been able to get the pin number of a few ones...
but I can't understand this one...

********** pre commands:
[00 00 00 00 00 00 00 00] 1 NOP
[00 00 00 00 00 00 00 00] 2 NOP
[00 00 00 00 00 00 00 00] 3 NOP
[00 00 00 00 00 00 00 00] 4 NOP
[00 00 00 00 00 00 00 00] 5 NOP
[71 00 00 06 00 40 00 00] 6 Set gprm(6) =(mov) 64
[61 00 00 00 00 04 00 00] 7 Set gprm(0) =(mov) gprm(4)
[79 00 00 00 00 3F 00 00] 8 Set gprm(0) &=(and) 63
[00 B1 00 00 00 00 00 0B] 9 if ( gprm(0) != 0 ) then { Goto line 11 }
[71 00 00 00 00 01 00 00] 10 Set gprm(0) =(mov) 1
[79 00 00 00 00 3F 00 00] 11 Set gprm(0) &=(and) 63
[75 00 00 00 04 00 00 00] 12 Set gprm(0) *=(mul) 1024
[00 00 00 00 00 00 00 00] 13 NOP
[71 00 00 03 00 02 00 00] 14 Set gprm(3) =(mov) 2
[46 00 00 00 00 00 00 00] 15 (SetHL_BTN) Set Highlighted Button =(mov) gprm(0)
[71 00 00 01 00 00 00 00] 16 Set gprm(1) =(mov) 0
********** post commands:
[71 00 00 03 00 00 00 00] 1 Set gprm(3) =(mov) 0
[61 00 00 00 00 88 00 00] 2 Set gprm(0) =(mov) sprm(8:Highlighted button number)
[76 00 00 00 04 00 00 00] 3 Set gprm(0) /=(div) 1024
[00 B1 00 00 00 01 00 08] 4 if ( gprm(0) != 1 ) then { Goto line 8 }
[71 00 00 04 00 00 00 00] 5 Set gprm(4) =(mov) 0
[20 04 00 00 00 00 00 0B] 6 LinkPGCN PGC 11
[00 00 00 00 00 00 00 00] 7 NOP
[00 B1 00 00 00 02 00 0C] 8 if ( gprm(0) != 2 ) then { Goto line 12 }
[71 00 00 04 00 00 00 00] 9 Set gprm(4) =(mov) 0
[20 04 00 00 00 00 00 0E] 10 LinkPGCN PGC 14
[00 00 00 00 00 00 00 00] 11 NOP
[00 B1 00 00 00 03 00 10] 12 if ( gprm(0) != 3 ) then { Goto line 16 }
[71 00 00 04 00 00 00 00] 13 Set gprm(4) =(mov) 0
[20 04 00 00 00 00 00 0E] 14 LinkPGCN PGC 14
[00 00 00 00 00 00 00 00] 15 NOP
[00 B1 00 00 00 04 00 14] 16 if ( gprm(0) != 4 ) then { Goto line 20 }
[71 00 00 04 00 00 00 00] 17 Set gprm(4) =(mov) 0
[20 04 00 00 00 00 00 0E] 18 LinkPGCN PGC 14
[00 00 00 00 00 00 00 00] 19 NOP
[00 B1 00 00 00 05 00 18] 20 if ( gprm(0) != 5 ) then { Goto line 24 }
[71 00 00 04 00 00 00 00] 21 Set gprm(4) =(mov) 0
[20 04 00 00 00 00 00 0E] 22 LinkPGCN PGC 14
[00 00 00 00 00 00 00 00] 23 NOP
[00 B1 00 00 00 06 00 1C] 24 if ( gprm(0) != 6 ) then { Goto line 28 }
[51 00 00 00 00 82 00 00] 25 (SetSTN) Set Angle = 2
[71 00 00 04 00 00 00 00] 26 Set gprm(4) =(mov) 0
[20 04 00 00 00 00 00 0E] 27 LinkPGCN PGC 14
[00 B1 00 00 00 07 00 20] 28 if ( gprm(0) != 7 ) then { Goto line 32 }
[71 00 00 04 00 00 00 00] 29 Set gprm(4) =(mov) 0
[20 04 00 00 00 00 00 0E] 30 LinkPGCN PGC 14
[00 00 00 00 00 00 00 00] 31 NOP
[00 B1 00 00 00 08 00 24] 32 if ( gprm(0) != 8 ) then { Goto line 36 }
[71 00 00 04 00 00 00 00] 33 Set gprm(4) =(mov) 0
[20 04 00 00 00 00 00 0E] 34 LinkPGCN PGC 14
[00 00 00 00 00 00 00 00] 35 NOP
[00 B1 00 00 00 09 00 28] 36 if ( gprm(0) != 9 ) then { Goto line 40 }
[71 00 00 04 00 00 00 00] 37 Set gprm(4) =(mov) 0
[20 04 00 00 00 00 00 0E] 38 LinkPGCN PGC 14
[00 00 00 00 00 00 00 00] 39 NOP
[00 B1 00 00 00 0A 00 2C] 40 if ( gprm(0) != 10 ) then { Goto line 44 }
[71 00 00 04 00 00 00 00] 41 Set gprm(4) =(mov) 0
[20 04 00 00 00 00 00 0E] 42 LinkPGCN PGC 14
[00 00 00 00 00 00 00 00] 43 NOP
[00 00 00 00 00 00 00 00] 44 NOP
********** cell commands:


somebody really understand something in that???

[r0lZ]

I have not enough info to guess the code, but lines 1 to 3 of the post commands copy the button number in GPRM 0, then it is compared to values 1 to 9. All values except 1 jump to PGC 14, so I guess that "1" is the digit to type. It jumps to PGC 11 where I suppose that the next digit is requested. If it has a similar structure, it should be easy to find the second digit:
You have to look for the LinkPGCN command that jumps to an unique PGC. In this PGC, it's line 6, with the jump to PGC 11. Two lines above, you find "if ( gprm(0) != 1 ) then { Goto line 8 }", that means that the button is compared to value 1. 1 is therefore (probably) the right digit. Apply the same logic to PGC 11 to find the second digit and the next PGC to examine for the third digit, etc...

[tcha]

You're right... It's always seem so logical when somebody explain it...
thank you very much...

[Nelson37]

Hey, these guys are stealing my idea!!

Anybody have details on how I could dispute their patent application, and/or leverage a percentage of their income from this?

I will pledge right now that 90% of any financial gain from this would go to this site to cover operating costs, with the percentage reduced if those costs were covered in full.

As SLK mentioned, the "channel scrambling" was an important part of this. There should be several "valid" playable selections, but only one with the actual movie in order. My original idea also included segments of scrambled video and/or static, repeated sections, etc.

If one of the developers would wish to contact me, just PM and we can discuss a reasonable consultant's fee.

I have given this idea some thought over the years and have come up with some additional tweaks that I have not yet publicized.

[r0lZ]

Hey, these guys are stealing my idea!!

If you have not your own patent, I doubt you can do something. That idea (at least the basic idea without your additional refinements) is, after all, really simple, and could be invented by anybody.
Good luck anyway!

[tcha]

I got one that it even more scramble...
seem very confusing to me...
to get you a little idea...

we start here...
********** pre commands:
[00 00 00 00 00 00 00 00] 1 NOP
[00 00 00 00 00 00 00 00] 2 NOP
[00 00 00 00 00 00 00 00] 3 NOP
[00 00 00 00 00 00 00 00] 4 NOP
[00 00 00 00 00 00 00 00] 5 NOP
[71 00 00 06 01 80 00 00] 6 Set gprm(6) =(mov) 384
[61 00 00 00 00 04 00 00] 7 Set gprm(0) =(mov) gprm(4)
[79 00 00 00 00 3F 00 00] 8 Set gprm(0) &=(and) 63
[00 B1 00 00 00 00 00 0B] 9 if ( gprm(0) != 0 ) then { Goto line 11 }
[71 00 00 00 00 01 00 00] 10 Set gprm(0) =(mov) 1
[79 00 00 00 00 3F 00 00] 11 Set gprm(0) &=(and) 63
[75 00 00 00 04 00 00 00] 12 Set gprm(0) *=(mul) 1024
[00 00 00 00 00 00 00 00] 13 NOP
[71 00 00 03 00 0C 00 00] 14 Set gprm(3) =(mov) 12
[46 00 00 00 00 00 00 00] 15 (SetHL_BTN) Set Highlighted Button =(mov) gprm(0)
[71 00 00 01 00 00 00 00] 16 Set gprm(1) =(mov) 0
********** post commands:
[71 00 00 03 00 00 00 00] 1 Set gprm(3) =(mov) 0
[61 00 00 00 00 88 00 00] 2 Set gprm(0) =(mov) sprm(8:Highlighted button number)
[76 00 00 00 04 00 00 00] 3 Set gprm(0) /=(div) 1024
[00 B1 00 00 00 01 00 08] 4 if ( gprm(0) != 1 ) then { Goto line 8 }
[20 04 00 00 00 00 00 25] 5 LinkPGCN PGC 37
[00 00 00 00 00 00 00 00] 6 NOP
[00 00 00 00 00 00 00 00] 7 NOP
[00 B1 00 00 00 02 00 0C] 8 if ( gprm(0) != 2 ) then { Goto line 12 }
[20 04 00 00 00 00 00 25] 9 LinkPGCN PGC 37
[00 00 00 00 00 00 00 00] 10 NOP
[00 00 00 00 00 00 00 00] 11 NOP
[00 B1 00 00 00 03 00 10] 12 if ( gprm(0) != 3 ) then { Goto line 16 }
[20 04 00 00 00 00 00 25] 13 LinkPGCN PGC 37
[00 00 00 00 00 00 00 00] 14 NOP
[00 00 00 00 00 00 00 00] 15 NOP
[00 B1 00 00 00 04 00 14] 16 if ( gprm(0) != 4 ) then { Goto line 20 }
[20 04 00 00 00 00 00 25] 17 LinkPGCN PGC 37
[00 00 00 00 00 00 00 00] 18 NOP
[00 00 00 00 00 00 00 00] 19 NOP
[00 B1 00 00 00 05 00 18] 20 if ( gprm(0) != 5 ) then { Goto line 24 }
[20 04 00 00 00 00 00 24] 21 LinkPGCN PGC 36
[00 00 00 00 00 00 00 00] 22 NOP
[00 00 00 00 00 00 00 00] 23 NOP
[00 B1 00 00 00 06 00 1C] 24 if ( gprm(0) != 6 ) then { Goto line 28 }
[20 04 00 00 00 00 00 25] 25 LinkPGCN PGC 37
[00 00 00 00 00 00 00 00] 26 NOP
[00 00 00 00 00 00 00 00] 27 NOP
[00 B1 00 00 00 07 00 20] 28 if ( gprm(0) != 7 ) then { Goto line 32 }
[20 04 00 00 00 00 00 24] 29 LinkPGCN PGC 36
[00 00 00 00 00 00 00 00] 30 NOP
[00 00 00 00 00 00 00 00] 31 NOP
[00 B1 00 00 00 08 00 24] 32 if ( gprm(0) != 8 ) then { Goto line 36 }
[20 04 00 00 00 00 00 25] 33 LinkPGCN PGC 37
[00 00 00 00 00 00 00 00] 34 NOP
[00 00 00 00 00 00 00 00] 35 NOP
[00 B1 00 00 00 09 00 28] 36 if ( gprm(0) != 9 ) then { Goto line 40 }
[20 04 00 00 00 00 00 25] 37 LinkPGCN PGC 37
[00 00 00 00 00 00 00 00] 38 NOP
[00 00 00 00 00 00 00 00] 39 NOP
[00 B1 00 00 00 0A 00 2C] 40 if ( gprm(0) != 10 ) then { Goto line 44 }
[20 04 00 00 00 00 00 24] 41 LinkPGCN PGC 36
[00 00 00 00 00 00 00 00] 42 NOP
[00 00 00 00 00 00 00 00] 43 NOP
[00 B1 00 00 00 0B 00 30] 44 if ( gprm(0) != 11 ) then { Goto line 48 }
[20 04 00 00 00 00 00 30] 45 LinkPGCN PGC 48
[00 00 00 00 00 00 00 00] 46 NOP
[00 00 00 00 00 00 00 00] 47 NOP
[00 00 00 00 00 00 00 00] 48 NOP
********** cell commands:


36:
********** pre commands:
[20 A4 00 0F 00 64 00 26] 1 if ( gprm(15) == 100 ) then { LinkPGCN PGC 38 }
[20 A4 00 0F 00 0B 00 27] 2 if ( gprm(15) == 11 ) then { LinkPGCN PGC 39 }
[20 A4 00 0F 00 0C 00 28] 3 if ( gprm(15) == 12 ) then { LinkPGCN PGC 40 }
[20 A4 00 0F 00 0D 00 29] 4 if ( gprm(15) == 13 ) then { LinkPGCN PGC 41 }
[20 A4 00 0F 00 0E 00 2A] 5 if ( gprm(15) == 14 ) then { LinkPGCN PGC 42 }
[20 A4 00 0F 00 0F 00 2B] 6 if ( gprm(15) == 15 ) then { LinkPGCN PGC 43 }
[20 A4 00 0F 00 10 00 2C] 7 if ( gprm(15) == 16 ) then { LinkPGCN PGC 44 }
********** post commands:
********** cell commands:
37:
********** pre commands:
[61 00 00 09 00 88 00 00] 1 Set gprm(9) =(mov) sprm(8:Highlighted button number)
[76 00 00 09 04 00 00 00] 2 Set gprm(9) /=(div) 1024
[00 A1 00 09 00 09 00 0C] 3 if ( gprm(9) == 9 ) then { Goto line 12 }
[00 A1 00 09 00 03 00 0F] 4 if ( gprm(9) == 3 ) then { Goto line 15 }
[00 A1 00 09 00 08 00 12] 5 if ( gprm(9) == 8 ) then { Goto line 18 }
[00 A1 00 09 00 06 00 15] 6 if ( gprm(9) == 6 ) then { Goto line 21 }
[00 A1 00 09 00 02 00 18] 7 if ( gprm(9) == 2 ) then { Goto line 24 }
[00 A1 00 09 00 01 00 1B] 8 if ( gprm(9) == 1 ) then { Goto line 27 }
[00 A1 00 09 00 04 00 1E] 9 if ( gprm(9) == 4 ) then { Goto line 30 }
[20 04 00 00 00 00 00 24] 10 LinkPGCN PGC 36
[00 00 00 00 00 00 00 00] 11 NOP
[71 00 00 0F 00 0B 00 00] 12 Set gprm(15) =(mov) 11
[20 04 00 00 00 00 00 24] 13 LinkPGCN PGC 36
[00 00 00 00 00 00 00 00] 14 NOP
[71 00 00 0F 00 0C 00 00] 15 Set gprm(15) =(mov) 12
[20 04 00 00 00 00 00 24] 16 LinkPGCN PGC 36
[00 00 00 00 00 00 00 00] 17 NOP
[71 00 00 0F 00 0D 00 00] 18 Set gprm(15) =(mov) 13
[20 04 00 00 00 00 00 24] 19 LinkPGCN PGC 36
[00 00 00 00 00 00 00 00] 20 NOP
[71 00 00 0F 00 0E 00 00] 21 Set gprm(15) =(mov) 14
[20 04 00 00 00 00 00 24] 22 LinkPGCN PGC 36
[00 00 00 00 00 00 00 00] 23 NOP
[71 00 00 0F 00 0F 00 00] 24 Set gprm(15) =(mov) 15
[20 04 00 00 00 00 00 24] 25 LinkPGCN PGC 36
[00 00 00 00 00 00 00 00] 26 NOP
[71 00 00 0F 00 10 00 00] 27 Set gprm(15) =(mov) 16
[20 04 00 00 00 00 00 24] 28 LinkPGCN PGC 36
[00 00 00 00 00 00 00 00] 29 NOP
[71 00 00 0F 00 64 00 00] 30 Set gprm(15) =(mov) 100
[20 04 00 00 00 00 00 24] 31 LinkPGCN PGC 36
********** post commands:
********** cell commands:

38:
********** pre commands:
[61 00 00 09 00 88 00 00] 1 Set gprm(9) =(mov) sprm(8:Highlighted button number)
[76 00 00 09 04 00 00 00] 2 Set gprm(9) /=(div) 1024
[00 A1 00 09 00 09 00 0C] 3 if ( gprm(9) == 9 ) then { Goto line 12 }
[00 A1 00 09 00 03 00 0F] 4 if ( gprm(9) == 3 ) then { Goto line 15 }
[00 A1 00 09 00 08 00 12] 5 if ( gprm(9) == 8 ) then { Goto line 18 }
[00 A1 00 09 00 06 00 15] 6 if ( gprm(9) == 6 ) then { Goto line 21 }
[00 A1 00 09 00 02 00 18] 7 if ( gprm(9) == 2 ) then { Goto line 24 }
[00 A1 00 09 00 01 00 1B] 8 if ( gprm(9) == 1 ) then { Goto line 27 }
[00 A1 00 09 00 04 00 1E] 9 if ( gprm(9) == 4 ) then { Goto line 30 }
[20 04 00 00 00 00 00 24] 10 LinkPGCN PGC 36
[00 00 00 00 00 00 00 00] 11 NOP
[71 00 00 0F 00 0B 00 00] 12 Set gprm(15) =(mov) 11
[20 04 00 00 00 00 00 24] 13 LinkPGCN PGC 36
[00 00 00 00 00 00 00 00] 14 NOP
[71 00 00 0F 00 0C 00 00] 15 Set gprm(15) =(mov) 12
[20 04 00 00 00 00 00 24] 16 LinkPGCN PGC 36
[00 00 00 00 00 00 00 00] 17 NOP
[71 00 00 0F 00 0D 00 00] 18 Set gprm(15) =(mov) 13
[20 04 00 00 00 00 00 24] 19 LinkPGCN PGC 36
[00 00 00 00 00 00 00 00] 20 NOP
[71 00 00 0F 00 0E 00 00] 21 Set gprm(15) =(mov) 14
[20 04 00 00 00 00 00 24] 22 LinkPGCN PGC 36
[00 00 00 00 00 00 00 00] 23 NOP
[71 00 00 0F 00 0F 00 00] 24 Set gprm(15) =(mov) 15
[20 04 00 00 00 00 00 24] 25 LinkPGCN PGC 36
[00 00 00 00 00 00 00 00] 26 NOP
[71 00 00 0F 00 10 00 00] 27 Set gprm(15) =(mov) 16
[20 04 00 00 00 00 00 24] 28 LinkPGCN PGC 36
[00 00 00 00 00 00 00 00] 29 NOP
[71 00 00 0F 00 64 00 00] 30 Set gprm(15) =(mov) 100
[20 04 00 00 00 00 00 24] 31 LinkPGCN PGC 36
********** post commands:
********** cell commands:

and so on...
the pin number don't appear so clearly then in the other to me...

[tcha]

excuse me...

38:
********** pre commands:
[73 00 00 08 00 01 00 00] 1 Set gprm(8) +=(add) 1
[61 00 00 09 00 88 00 00] 2 Set gprm(9) =(mov) sprm(8:Highlighted button number)
[76 00 00 09 04 00 00 00] 3 Set gprm(9) /=(div) 1024
[00 A1 00 08 00 01 00 09] 4 if ( gprm(8) == 1 ) then { Goto line 9 }
[00 A1 00 08 00 02 00 0F] 5 if ( gprm(8) == 2 ) then { Goto line 15 }
[00 A1 00 08 00 03 00 17] 6 if ( gprm(8) == 3 ) then { Goto line 23 }
[00 A1 00 08 00 04 00 1F] 7 if ( gprm(8) == 4 ) then { Goto line 31 }
[00 00 00 00 00 00 00 00] 8 NOP
[71 00 00 04 00 00 00 00] 9 Set gprm(4) =(mov) 0
[20 B4 00 09 00 04 00 13] 10 if ( gprm(9) != 4 ) then { LinkPGCN PGC 19 }
[73 00 00 0A 00 01 00 00] 11 Set gprm(10) +=(add) 1
[71 00 00 04 00 00 00 00] 12 Set gprm(4) =(mov) 0
[20 04 00 00 00 00 00 13] 13 LinkPGCN PGC 19
[00 00 00 00 00 00 00 00] 14 NOP
[71 00 00 04 00 00 00 00] 15 Set gprm(4) =(mov) 0
[20 B4 00 0A 00 01 00 14] 16 if ( gprm(10) != 1 ) then { LinkPGCN PGC 20 }
[71 00 00 04 00 00 00 00] 17 Set gprm(4) =(mov) 0
[20 B4 00 09 00 01 00 14] 18 if ( gprm(9) != 1 ) then { LinkPGCN PGC 20 }
[73 00 00 0A 00 01 00 00] 19 Set gprm(10) +=(add) 1
[71 00 00 04 00 00 00 00] 20 Set gprm(4) =(mov) 0
[20 04 00 00 00 00 00 14] 21 LinkPGCN PGC 20
[00 00 00 00 00 00 00 00] 22 NOP
[71 00 00 04 00 00 00 00] 23 Set gprm(4) =(mov) 0
[20 B4 00 0A 00 02 00 15] 24 if ( gprm(10) != 2 ) then { LinkPGCN PGC 21 }
[71 00 00 04 00 00 00 00] 25 Set gprm(4) =(mov) 0
[20 B4 00 09 00 09 00 15] 26 if ( gprm(9) != 9 ) then { LinkPGCN PGC 21 }
[73 00 00 0A 00 01 00 00] 27 Set gprm(10) +=(add) 1
[71 00 00 04 00 00 00 00] 28 Set gprm(4) =(mov) 0
[20 04 00 00 00 00 00 15] 29 LinkPGCN PGC 21
[00 00 00 00 00 00 00 00] 30 NOP
[00 B1 00 0A 00 03 00 27] 31 if ( gprm(10) != 3 ) then { Goto line 39 }
[00 B1 00 09 00 06 00 27] 32 if ( gprm(9) != 6 ) then { Goto line 39 }
[71 00 00 08 00 00 00 00] 33 Set gprm(8) =(mov) 0
[71 00 00 0A 00 00 00 00] 34 Set gprm(10) =(mov) 0
[71 00 00 0E 00 64 00 00] 35 Set gprm(14) =(mov) 100
[71 00 00 04 00 00 00 00] 36 Set gprm(4) =(mov) 0
[20 04 00 00 00 00 00 16] 37 LinkPGCN PGC 22
[00 00 00 00 00 00 00 00] 38 NOP
[71 00 00 08 00 00 00 00] 39 Set gprm(8) =(mov) 0
[71 00 00 0A 00 00 00 00] 40 Set gprm(10) =(mov) 0
[71 00 00 04 00 00 00 00] 41 Set gprm(4) =(mov) 0
[20 04 00 00 00 00 00 17] 42 LinkPGCN PGC 23
********** post commands:
********** cell commands:

... nearly 50 of them... nearly identical... just to confuse you I suppose...

[Cornucopia]

Hey, these guys are stealing my idea!!

If you have not your own patent, I doubt you can do something. That idea (at least the basic idea without your additional refinements) is, after all, really simple, and could be invented by anybody.
Good luck anyway!

Most patents "Could" be invented by anybody, they're just a new, inspired perspective on old problems. I have 3 patents in the works that probably "could" have been done by most people. It's just that I'M the one that thought it up 1st, concretized it, worked it out and then did all the paperwork & legwork necessary to get a patent.

Problem is, if you make your idea public (like in a public forum like this) BEFORE you submit your patent application, you're likely to forfeit it because now there is "PRIOR KNOWLEDGE".

But I'm all for giving Nelson37 creds, as I'm pretty sure he's the one that suggested the scrambling in that original thread.

I think it's hilarious though that, by this date, people would still be hindered from watching a DVD clip by such a WEAK protection!
Even old DVDShrink in Reauthor mode, Movie only can pull any clip you wanted...

Scott

[Nelson37]

Yep, that was me.

How would this "prior knowledge" work if the company mentioned is trying to patent it? Would that mean they couldn't, or could everybody here make a claim on their profits?

I wonder how much change would have to be made to make it a new idea and get around the "prior knowledge".

Like different code numbers for each individual user. Got that, piece of cake.

And they laughed, ha ha, they LAUGHED! It was the strawberries, see, I had them there, I proved with Geometric Logic that there WAS a duplicate key, but there was clearly a conspiracy......

[Nelson37]

I have a question related to this issue. Say that it was clearly spelled out that if any attempt was made to enter an incorrect number or to hack the disk, serious damage could happen to the user's equipment. Maybe add a 3 to 5 second countdown before the damage occurred, could the disk maker be held liable for such damage?

[Cornucopia]

IANAL, but ff there's "Prior Knowledge", NOBODY can patent it (including yourself), because it's already part of the public domain.

Yep, change something a little bit, in order to provide a LITTLE BIT MORE USABILITY/EFFICIENCY/NOVELTY. Then it's patentable again. That's what I've done on Panasonic/Matsushita's patent that I mentioned on here years ago.

What's that quote you spouted @ the end?

I'm assuming you jest re: actual damage being able to happen. Certainly not with STANDARD DVD-Video specs, as the only thing you can manipulate there are the player's VM registers (and even then, only somewhat). Moreso with BD, but even then it's still a safe sandbox that gets the slate wiped clean when you turn off the player.
Or are you talking about DVD-Extra or other similar DVD+WebAPIs (Spruce Convergence, PCFriendly, etc) - there could be an exploit in there that might allow "hijinx" on the user's PC?...
If you could do this and mean to, shame. And you could be liable, "contract/EULA/Warning" or no.

Scott

[jman98]

Nelson37 - I am also not a lawyer, but my best friend is and he's taught me a lot about the law. Also, I keep up somewhat with IT related patent issues. You might be surprised at how trivial some changes are in IT patents that lead to brand new patents. It's called "submarining". The cost barrier isn't high enough to discourage trivial applications and the US patent office does a terrible job with IT patents (they award far too many and rarely deny on "prior knowledge") so there's no reason not to give it a shot if you don't mind spending the money.

[SLK001]

Yep, that was me.

How would this "prior knowledge" work if the company mentioned is trying to patent it? Would that mean they couldn't, or could everybody here make a claim on their profits?

I wonder how much change would have to be made to make it a new idea and get around the "prior knowledge".

Like different code numbers for each individual user. Got that, piece of cake.

And they laughed, ha ha, they LAUGHED! It was the strawberries, see, I had them there, I proved with Geometric Logic that there WAS a duplicate key, but there was clearly a conspiracy......

To prove "prior knowledge" just produce the link to the original discussion here 7-10 years ago (I haven't looked for it, since the search doesn't work well for very old posts). Since it was openly discussed by many knowledgeable people, that discussion qualifies as "prior knowledge". "Prior knowledge" is knowledge that is obvious to anyone in the profession would be able to easily put to use. Any patent obtained using a method anything like that original discussion would therefore be invalid. It would fall into the public domain and could be used by anyone.

[r0lZ]

... nearly 50 of them... nearly identical... just to confuse you I suppose...

Not sure. Is your DVD made of several different short movies? In that case, they need several codes, and several PGCs to compare them. In this case, it is also possible that the same PGC is reused to check several codes (or the different digits of the same code), as they use GPRM 9 and/or 15 to hold the code or digit number.

Anyway, without the DVD (or at least the IFOs), I can't understand the logic. With the help of the PgcEdit trace, you can try to input any (wrong) code, and see where the navigation goes. With that info, it should be relatively simple to exclude the numbers that go to that PGC, and examine the other ones.

[Nelson37]

Scott - You never saw the Caine Mutiny? One of my favorite movies.

The damage exploit concerns another area I've been interested in, simpler than what you are looking at. I agree, probably a bad idea. I guess I shouldn't mention it here, but if you have an interest PM me and I will reply.

As for the "prior knowledge" bit, I'm not sure that it was so much "openly discussed" as put forward by me. Is the "discussion" a necessary element or is it simply the publication of the idea, prior to the patent application? I'm guessing the second is true.

By god I just may put in the patent app. I can tell you that the methods discussed in this thread would not, by themselves, break it. I got more digits, different code numbers, and the possibility of the damage exploit.

I would assume that discussion of the properties without mentioning the specific methods involved does not place the idea in the public domain?

I wonder what the liability would be if I owned the patent, and a licensee produced the product which then caused the damage.

[Cornucopia]

Bogie? Yeah, I saw it a LONG time ago, in HS. Probably in B/W although I know the movie itself is in color. Love just about anything Bogie.

I'll get back to you later re: exploit, etc.

2nd is true - just the existence of it being "open/public" negates it's "patentable use". The improvement/modification would still be patentable, IRRC.

General public discussion of properties, yes. Specifics, no. Private discussions are always OK (as long as there isn't documentation that could later become public), but then you might start worrying about "is this dude gonna take my idea and beat me to the finish?"

I have no idea about Liability. Check with a Lawyer first.

Scott

[John Doe]

tcha, where you able to track down your pin number on the last code you posted? After looking it over, seems like there is 7 codes on your DVD. I'm guessing one for each of the six scenes and a master. I won’t repost code, in PCG 36 the 100 value is the loop for your master pin. The 11 value is the loop for scene one and so on and so forth to value 16 being the loop for scene six. Shown in PCG 37 the values shown for lines 3 thru 9 are the starting digits in your seven pins for this DVD. In the second PCG 38 you posted is for the master pin, the first number in the value shown on line 10 second is on 18 third is on 26 and the forth is on 32. Hope this helps see if you can track down the other six pins.