|
Vista DRM-Security Hacked
|
Hacked or cracked, whichever you prefer, but broken either way, Vista's Protected Media Path DRM system is toast. Alex Ionescu has announced that his victory over the nasty little system, which degrades the playback quality of high-defintion input when it isn't hooked up via content cartel-approved inputs, such as HDCP.
Unfortunately, in his blog Ionesco does not specifically describe how he managed to do this. He says that he is not willing to provide too many details because his method is "definitely" a violation of the Digital Millennium Copyright Act (DMCA), and he does not want a raft of lawyers on his back.
To protect high-definition content on PCs, Microsoft developed what it calls a Protected Environment (PE) for Windows Vista. The PE creates a Protected Media Path (PMP), a corridor in the operating system that cannot be "tapped". The PMP is designed to protect high-definition data on their path from the medium to the graphics card. Among other things, Vista encrypts communication via the device bus, which is accessible to users, so that they cannot grab and analyse any data. All device drivers for the Protected Environment have to be digitally signed by the vendor and Microsoft. If there is no signature, a "constriction mode" is activated that breaks movies down into standard resolution and stereo audio. Vista device drivers also have to ensure that they communicate with genuine hardware, not with an emulation.
Ionescu says he has now programmed a demonstration that loads arbitrary code into the kernel. The PMP thus appears to be intact to audio and video applications even though its security has been compromised. In the process, Ionesco says he also cracked the PatchGuard in the 64-bit version of Vista, which is designed to prevent code from being injected into the kernel. Ionescu explicitly writes that he neither used an unsigned driver nor loaded a driver in the test-signing mode (BCDEDIT -set testsigning on). In the test mode, Vista recognizes drivers signed with any certificate as valid, even self-made ones. Ionescu says he boots Vista with another flag, though he does not provide any additional details.
View the blog |
|
Published on 30-01-2007 |
