# TiVoToGo DRM cracked



## MickeS (Dec 26, 2002)

I'm guessing this has already been posted here, but I couldn't find a thread about it... so if it HASN'T been posted, here's a thread. 

http://community.livejournal.com/tivolovers/384800.html

I wonder what this will mean for ToGo for Mac?


----------



## ZeoTiVo (Jan 2, 2004)

Well it is not really a crack per se as it still requires the Media Access Key from the user and just basically does the same pipe and filtering in a C program.

the good news for Mac and Linux users is that you do not need TiVo desktop installed to run this program.

While I do not think this will induce an uptick in files from TiVos shared on the internet - since people could have done that already by just getting a windows PC this si somewhat bad news for TiVo, inc. as it weakens the perception of security on their platform in the content owner's eyes.


----------



## Stu_Bee (Jan 15, 2002)

ZeoTiVo said:


> as it weakens the perception of security on their platform in the content owner's eyes.


Yeah..and that's all it is perception. Even tivo allows people to currently strip the DRM from their content via the Tivo Desktop+ transcoding to other video formats.
The only protection Tivo can be offering at this point is the Do Not Allow download flags.


----------



## Jiffylush (Oct 31, 2006)

I see this as bad news for S3 owners waiting for TTG and MRV.

I hope it isn't but this is just the type of thing cablelabs would use as a reason not to enable TTG and MRV.


----------



## MickeS (Dec 26, 2002)

Jiffylush said:


> I see this as bad news for S3 owners waiting for TTG and MRV.
> 
> I hope it isn't but this is just the type of thing cablelabs would use as a reason not to enable TTG and MRV.


Which never has made any sense to me, since recording devices for the PC are allowed.


----------



## ZeoTiVo (Jan 2, 2004)

MickeS said:


> Which never has made any sense to me, since recording devices for the PC are allowed.


it is all about the HD on premium channels and the coming downloading of movies.

OTA content or premium SD content is not so important to the copyright holders anymore, but they are looking for that locked down digital stream they can provide thier content on and feel like no one is dipping into the stream without paying.


----------



## jmoak (Jun 20, 2000)

> _from the soueceforge page:_
> The conversion still requires the valid MAK of the TiVo which recorded the file, *so it cannot be used to circumvent their protection*, simply to provide the same level of access as is already available on Windows.


So it's not actually "cracked", is it?

Or is it just a "perception" thing?

_It's not, but they say it is, but it's really not, but it does not matter, 'cause they say it is, even though it's not, so it may as well be, 'cause they say it is, even though it's not, everyone says it is, or is it? I mean, the title says it is, so it must be, right? right?_


----------



## MickeS (Dec 26, 2002)

Nope, I guess "cracked" is not entirely correct. More shorthand for "circumventable without TiVo-provided software" .


----------



## ZeoTiVo (Jan 2, 2004)

jmoak said:


> _It's not, but they say it is, but it's really not, but it does not matter, 'cause they say it is, even though it's not, so it may as well be, 'cause they say it is, even though it's not, everyone says it is, or is it? I mean, the title says it is, so it must be, right? right?_


I think you have it now. That is exactly how the content providers will think it through


----------



## rainwater (Sep 21, 2004)

Since the DRM scheme has been reverse engineered and you can circumvent the DRM without the TiVo software, then it has been officially cracked (whether it requires the MAK or not).


----------



## ZeoTiVo (Jan 2, 2004)

rainwater said:


> Since the DRM scheme has been reverse engineered and you can circumvent the DRM without the TiVo software, then it has been officially cracked (whether it requires the MAK or not).


 A crack to me denotes you can open any .tivo file without needing the specific key

I think it is better to say it has been hacked


----------



## Aflat (Aug 29, 2005)

MickeS said:


> Which never has made any sense to me, since recording devices for the PC are allowed.


Yes but recording devices using a cable card on a PC is not allowed. The only machiena cbale card can be installed into is an approved cable card computer. You can't make a home brewed media center PC that can read cable cards.


----------



## jmoak (Jun 20, 2000)

ZeoTiVo said:


> I think you have it now. That is exactly how the content providers will think it through


Who can blame 'em? Engadget (home of the famous "Tivo Deathwatch") titles it "TiVo DRM cracked, non-Windows users rejoice", this thread says "TiVoToGo DRM cracked", and I'll betcha a goggle search tomorrow will display at least a half dozen more "Tivo Cracked!" headlines.

Content providers, et. all.

Even though you still need the tivo key to do anything and even sourceforge plainly states "it cannot be used to circumvent their protection", many will loudly proclaim "it has been officially cracked!"

_edit:_
Woah! No sooner than I thought it, even before I posted it....


----------



## rainwater (Sep 21, 2004)

Aflat said:


> Yes but recording devices using a cable card on a PC is not allowed. The only machiena cbale card can be installed into is an approved cable card computer. You can't make a home brewed media center PC that can read cable cards.


It doesn't matter what you call it. Anyone who can get .tivo files off their TiVo is going to have the MAK anyways. Sure, you couldn't distribute .tivo files around, but that is not really a big concern anyways if you can just strip the DRM off immediately and have a MPEG-2 file. Of course you have been able to easily do this for a while so its not a big deal to Windows users. The big question will be what will TiVo do if someone writes a piece of software that mimics TiVo Desktop on the Mac.


----------



## mportuesi (Nov 11, 2002)

rainwater said:


> The big question will be what will TiVo do if someone writes a piece of software that mimics TiVo Desktop on the Mac.


I imagine it should be pretty straightforward to modify Galleon to call-out to this unlocking utility. That would pretty much put Galleon on par with TiVo Desktop.


----------



## jmoak (Jun 20, 2000)

rainwater said:


> Sure, you couldn't distribute .tivo files around, but that is not really a big concern anyways


That IS "The Big Concern", to the program providers, anyway.


rainwater said:


> The big question will be what will TiVo do if someone writes a piece of software that mimics TiVo Desktop on the Mac.


If this sourceforge development had been touted correctly, it would have been a boon to tivo. Heck, writing a workaround that allows other os's to work with tivo files while maintaining the need to use the tivo keys and authorization method? I'd imagine they'd say, "Thanks!!"

But to have it touted as a "crack" and therefore thought of as a circumvention of their drm system... WHEW! Lord only knows how they'll react.


----------



## id242 (Feb 24, 2006)

Wow, I guess the people who do run this forum, DO censor messages posted.

Even if you follow the guidelines listed in the forum rules, posts that the moderators don't personally agree with, somehow disappear.

All the regulars know this already, I guess that's what they mean when they write "IBTL", which either means "In Before The Lock" (Censorship) or "I Better Tellyou Later", which means "Hush Hush. We are not suppose to talk about such things in public".


----------



## Dan203 (Apr 17, 2000)

Your post was deleted because it was a duplicate, not because it was censored. 

Dan


----------



## davezatz (Apr 18, 2002)

rainwater said:


> Since the DRM scheme has been reverse engineered and you can circumvent the DRM without the TiVo software, then it has been officially cracked (whether it requires the MAK or not).


I think it's fair to say it's been cracked. Perhaps there are varying levels of 'crack' but deconstructing the decryption mechanism is a very big deal. If we want to argue that needing a MAK means it's not been cracked, someone will build us a brute force MAK testing engine and solve that lickity split.

I think most folks will use this for legit reasons. People want TiVoToGo on the Mac and TiVo hasn't delivered. As was mentioned above, let's plug this into Galleon and call it a day.


----------



## TydalForce (Feb 9, 2006)

Anybody who wants to record TV, edit out the commercials, and then distribute it under questionable circumstances is already doing so via computer-based TV Tuner cards. 

This really doesn't change anything. TV shows are still going to show up on BitTorrent, with our without TiVo around. 

This is, however, good news for those of us on Mac or Linux (or other?) who want to download a few shows from their TiVo to take on the go with them.


----------



## rainwater (Sep 21, 2004)

davezatz said:


> I think it's fair to say it's been cracked. Perhaps there are varying levels of 'crack' but deconstructing the decryption mechanism is a very big deal. If we want to argue that needing a MAK means it's not been cracked, someone will build us a brute force MAK testing engine and solve that lickity split.
> 
> I think most folks will use this for legit reasons. People want TiVoToGo on the Mac and TiVo hasn't delivered. As was mentioned above, let's plug this into Galleon and call it a day.


Yeah, the big deal is you can now remove the DRM without any dlls or TiVo software. This can't sit well with TiVo, but I'm not sure what they can do now that the source code is out there.

And I agree, I think this was all brought about due to lack of support from TiVo for platforms other than Windows (even though Tivo Desktop Plus removes the DRM itself for portable devices).

I would disagree that this affects the S3 because I have a hard time believing TTG will ever be possible on the S3 for digital cable recordings and I don't see how this affects MRV anyways.


----------



## davezatz (Apr 18, 2002)

TydalForce said:


> Anybody who wants to record TV, edit out the commercials, and then distribute it under questionable circumstances is already doing so via computer-based TV Tuner cards.


TiVo, Inc could make the argument that *bypassing their DRM scheme violates the DMCA* if they or their partners feel threatened. Megazone suggested this could lead to an arms war, though I wonder if TiVo has the skills on hand to come up with a new mechanism and get it out there in a timely fashion. (Mac TTG is nearly two years late...)

I don't mind republishing DirectShow Dump or GraphEdit stuff because we're essentially letting TiVo software decrypt the show (as designed) and we just happen to be saving the results. I briefly thought of hosting some of this new stuff on my site, but I think it's a grey area I don't want to touch.  I will however try it out tonight on my Mac.



rainwater said:


> I would disagree that this affects the S3 because I have a hard time believing TTG will ever be possible on the S3 for digital cable recordings and I don't see how this affects MRV anyways.


TTG for the S3 has always been a long shot due to political and technical issues, though it's more likely SD content could be moved around. MRV could be impacted just from a perception stand-point. If CableLabs feels like TiVo hasn't built a secure platform they could be reluctant to certify features they may not fully trust as it is.


----------



## minckster (Aug 31, 2006)

Edit: D'oh! Forget my question! I just noticed that --mak says "required."

Are you guys sure that the program requires the MAK? One of the flags (?) is "--noverify, do not verify MAK while decoding." I'm not sure what else that would mean.


> Usage: ./objects.dir/tivodecode [--help] [--verbose|-v] [--no-verify|-n] {--mak|-m} mak [{--out|-o} outfile] <tivofile>
> 
> --mak, -m media access key (required)
> --out, -o output file (default stdout)
> ...


----------



## petew (Jul 31, 2003)

minckster said:


> Are you guys sure that the program requires the MAK? One of the flags (?) is "--noverify, do not verify MAK while decoding." I'm not sure what else that would mean.


The MAK is part of the decrypt key. I presume if it's wrong and you use --noverify you'll just get a scrambled MPG output.


----------



## ZeoTiVo (Jan 2, 2004)

id242 said:


> All the regulars know this already,


that is was a duplicate thread of a thread right at the top of the first page with the obvious title "TiVoToGo DRM cracked"? - yah - we knew that


----------



## ZeoTiVo (Jan 2, 2004)

davezatz said:


> If we want to argue that needing a MAK means it's not been cracked, someone will build us a brute force MAK testing engine and solve that lickity split.


 If someone could come up with a way to do that then I would call it cracked and that would indictae weak encryption/security.

but to use the same pipe and filter method that TiVo does and require the MAK itself to do the decryption is a hack. A good hack, and one that will make Mac users with TiVos happy that they can do all the processing on a Mac now.

even the early ability to get content off a TiVo DVR before/without desktop was a hack and not a crack as they simply truned off the flag that said to decrypt the content as it was being recorded. All of this is still illegal under the DMCA as it all circumvents the security mechanisms so in court it would be a small distinction

I think the distinction is important due to the perception of content providers as they argue with TiVo over how secure content is on the TiVo box. And that argumnet is brewing now at cablelabs over certifying TiVoToGo in hardware with cable cards


----------



## MickeS (Dec 26, 2002)

jmoak said:


> Even though you still need the tivo key to do anything and even sourceforge plainly states "it cannot be used to circumvent their protection", many will loudly proclaim "it has been officially cracked!"


Since every single person who owns a TiVo Series 2 has a MAK, and this requires ownership of a Series 2 to extract files in the first place, I think "cracked" is fairly accurate shorthand for what they've done, since it doesn't require any official TiVo software. ZeoTivo's suggestion "hack" is probably better though.


----------



## Redux (Oct 19, 2004)

Do .tivo files have any advantage over .ty files?

Trying to manufacture an excuse to play with a new toy.


----------



## sommerfeld (Feb 26, 2006)

ZeoTiVo said:


> Well it is not really a crack per se as it still requires the Media Access Key from the user and just basically does the same pipe and filtering in a C program.


Except that the MAK is apparently only 32 bits long, which puts the crypto into the "good against your kid sister" class rather than the "good against a determined adversary" class.

To put this into concrete terms: a 32-bit key means that there are only 2^32 possible keys - just over 4 billion. This may seem like a lot, but current commodity desktop computers are clocked at around 2GHz - two billion ticks per second. Even if you need tens of thousands of cycles to try each key, modestly tuned key-search software running on commodity hardware most likely could try all four billion in a day.


----------



## sommerfeld (Feb 26, 2006)

MickeS said:


> ZeoTivo's suggestion "hack" is probably better though.


I'll stay professional and say that the file encoding has been reverse-engineered; as is typical for proprietary encodings not subject to public peer review, the encoding scheme appears to be cryptographically weak.


----------



## jblake (Jan 24, 2002)

So much for all of the excuses that I've heard for TiVo not having TTG on Mac OS X (although none of them officially from tivo):

*Tivo chose to go with Windows DRM, so its impossible to do on a mac
*Macs don't play well with MPEG -2 video (BS!)
*Not enough programmers for OS X
*Too hard to develop on OS X
*Apple won't work with Tivo (this one was actually quoted I think from a tivo exec some time in the past)

Maybe Tivo will buy or the developer will give this technology to tivo and we can finally have honest to god sanctioned TTG on our macs


----------



## jmemmott (Jul 12, 2003)

sommerfeld said:


> as is typical for proprietary encodings not subject to public peer review, the encoding scheme appears to be cryptographically weak.


I'm nit picking I know, but the "encoding scheme" (Turing) is actually cryptographically quite strong. It is one of modern stream cyphers and has been through peer review. As noted above, however, the key Tivo is using is weak and this is what would make it possible to break now that the specific cypher and stream key generation algorithms have been made public.


----------



## rainwater (Sep 21, 2004)

jblake said:


> Maybe Tivo will buy or the developer will give this technology to tivo and we can finally have honest to god sanctioned TTG on our macs


TiVo wrote the DRM to begin with, why would they need someone to tell them how it works? If TiVo wanted to remove the DRM automatically, then there would be no need for the DRM to begin with. The Tivo Desktop Plus software that converts the .tivo files to portable formats supposedly adds a watermark, whereas this method just removes the drm completely.


----------



## Dennis Wilkinson (Sep 24, 2001)

jblake said:


> *Tivo chose to go with Windows DRM, so its impossible to do on a mac


That was dismissed by people who understood the technical issues from the beginning.



> *Macs don't play well with MPEG -2 video (BS!)


Actually, the claim has been "QuickTime and the iApps don't play well with MPEG-2". The reports I've seen so far of QuickTime stuttering and audio dropouts with decrypted .tivo files using this tool reinforce the QuickTime part, and Apple's own docs describe the issues the iApps have with MPEG-2 (for example, iDVD can't use it as a source format. Neither can iMovie.).

MPlayer and VLC both work on Macs, and deal with MPEG-2 just fine.



> *Not enough programmers for OS X
> *Too hard to develop on OS X


There's nothing really Mac-like about this solution, either. It's worth noting that this decrypter is almost certainly _not anything like_ what a TiVoToGo for Mac implementation would have really looked like/might someday look like.



> *Apple won't work with Tivo (this one was actually quoted I think from a tivo exec some time in the past)


This isn't really terribly difficult to believe, depending on what it was that TiVo approached them to do. It's probably a pretty safe bet Apple didn't work with the folks that reverse-engineered the DRM here.


----------



## davezatz (Apr 18, 2002)

Dennis Wilkinson said:


> This isn't really terribly difficult to believe, depending on what it was that TiVo approached them to do. It's probably a pretty safe bet Apple didn't work with the folks that reverse-engineered the DRM here.


Dennis... the real question is, when will your front-end be ready? 

I've also emailed Leon and begged him to come out of retirement and integrate this functionality into Galleon. I guess it could be some sort of auxiliary add-on that's called, or could be rewritten in Java.


----------



## rainwater (Sep 21, 2004)

davezatz said:


> Dennis... the real question is, when will your front-end be ready?
> 
> I've also emailed Leon and begged him to come out of retirement and integrate this functionality into Galleon. I guess it could be some sort of auxiliary add-on that's called, or could be rewritten in Java.


Doesn't Galleon allow you to call a command line after a transfer completes? If so, no changes are needed except to change the command line.


----------



## davezatz (Apr 18, 2002)

rainwater said:


> Doesn't Galleon allow you to call a command line after a transfer completes? If so, no changes are needed except to change the command line.


That's fine for the geek crowd, but wouldn't it be nice if TiVoDecode didn't need to be compiled separately and didn't need to be run from the command line? Build it all in to one app so a larger group of customers can enjoy.


----------



## greg_burns (May 22, 2004)

davezatz said:


> That's fine for the geek crowd, but wouldn't it be nice if TiVoDecode didn't need to be compiled separately and didn't need to be run from the command line? Build it all in to one app so a larger group of customers can enjoy.


Wonder why the Windows version doesn't need to be compiled. The download is just the .exe.

Edit: Duh, I'm guessing he just doesn't own a mac to compile it with. Maybe he could host the .exe since he doesn't have an issue hosting the win32 version.


----------



## ZeoTiVo (Jan 2, 2004)

sommerfeld said:


> I'll stay professional and say that the file encoding has been reverse-engineered;


 that is indeed the more professional way to say hacked and is exactly what happened. The TiVo supplied DLL was reversed engineered along with the correct way to apply the keys to decrypt the file. Nothing more here really. My speculation is that this hack has been done for quite a while and they finally got tired of waiting for a Mac TTG and let this out into the public domain.



> as is typical for proprietary encodings not subject to public peer review, the encoding scheme appears to be cryptographically weak.


not so much weak as well known. Even at just 32 bits it still takes a day on good horsepower to truly crack the key. TiVo could just double the key length or shoot the moon to 128 bits if they felt that breaking .tivo files was really a problem. I doubt they will go to this expense and customer hassle though.

TiVo still has what it needs I think. Either the customer is breaking the TOS/DMCA by specifically circumventing the DRM and sharing the file or someone broke into the customers netwrok and stole the .tivo file and then cracked it.

With either case it is not a big deal on an SA TiVo DVR with SD content, especially since this has been circumvented on windows for some time and just made direct use of the TiVo supplied DLL.  The big deal will be how this could apply to HD content obtained through a cable card. Now personally I never saw much use in TiVoToGo and HD content since the files will be large and I really use TTG to get shows on my phone to watch. SD is fine enough quality for a 2 inch LCD screen.  I would be fine if TTG and MRV on an S3 were limited to SD content only for now.


----------



## sommerfeld (Feb 26, 2006)

jmemmott said:


> I'm nit picking I know, but the "encoding scheme" (Turing) is actually cryptographically quite strong. It is one of modern stream cyphers and has been through peer review. As noted above, however, the key Tivo is using is weak and this is what would make it possible to break now that the specific cypher and stream key generation algorithms have been made public.


By "encoding scheme" I was referring to the complete file encoding, not just the encryption algorithm.

(On the other hand, references I can find suggest that the Turing algorithm was first published in 2003, which means that in cryptographic terms it's still a very young cipher. If I were building a system intended to protect the rights of copyright holders by keeping material confidential for decades, I don't think I'd have picked such a new algorithm).


----------



## Justin Thyme (Mar 29, 2005)

Dang. No TTG for S3. Thanks a lot FrooBrar. Any chance you work for Motorolla or CableLabs?

If you are too busy Dennis, I'll write a front end for the Mac. It'll be ready in about 6 months between diaper changes. 

Seems to me though that incorporating it into VLP would be a good location for it, since then you could do the streaming server and playing stuff besides the conversion.

But really folks. If you are going to put stuff up on Zoom. Don't go this way. Really, it would be trivial to encrypt the MAK into the datastream for tracking purposes. 

Just use a DVD recorder and rip it to disk. Don't go through Tivo or you could get nailed big time. The studios are out for blood and making examples, etc. Tivo will only be too happy to show they are protecting their content.


----------



## classicsat (Feb 18, 2004)

Redux said:


> Do .tivo files have any advantage over .ty files?
> 
> Trying to manufacture an excuse to play with a new toy.


The primary advantage is that the .tivo files don't require hacking to get on Standalones, and easily go back. Secondarily, there are more apps to deal with them, most discussable here.

The downside is it is Standalone Series 2 only, and requires decryption (athough most of the aformentioned apps directly handle the .tivo files).

After decrpytion, they are pretty well as good as ty files. TyTools (I use 10r4) handles them fine.


----------



## Dennis Wilkinson (Sep 24, 2001)

Justin Thyme said:


> If you are too busy Dennis, I'll write a front end for the Mac. It'll be ready in about 6 months between diaper changes.


I'm a bit busy myself, between volunteer commitments, the holidays, and my own release calendar at the office. I'm pretty well booked through January, anyway. Now that there's a binary that can be downloaded from SourceForge (it's PPC, but Rosetta should handle it), it should be pretty easy for someone to put together something like an AppleScript droplet for drag-and-drop operation. Just a matter of collecting dropped file names and using 'do shell script' to invoke tivodecode. A Folder Action would be even better (watch for new downloaded .tivo files and decode them.)

AppleScript along the lines of:


```
property extension_list : {"TiVo"}
property media_access_key : "NNNNNNNNNN" -- replace with MAK

on open these_items
	set thesefiles to {}
	set the item_info to {}
	repeat with i from 1 to the count of these_items
		set this_item to (item i of these_items)
		set the item_info to info for this_item
		
		if (folder of the item_info is false) and (alias of the item_info is false) and ((the name extension of the item_info) is in the extension_list) then
			set theFilePath to (item i of these_items as string)
			set thePOSIXFilePath to POSIX path of theFilePath as string
			processFile(thePOSIXFilePath)
		end if
	end repeat
end open

on processFile(thePOSIXFileName)
	try
		set terminalCommand to ""
		set convertCommand to "/usr/bin/tivodecode " -- or whereever you installed it
		set newFileName to thePOSIXFileName & ".mpg"
		set terminalCommand to convertCommand & "--mak " & the media_access_key & " -f " & "\"" & thePOSIXFileName & "\"" & " -o " & "\"" & newFileName & "\""
		with timeout of 36000 seconds
			do shell script terminalCommand
		end timeout
	end try
end processFile
```
Should be enough to start someone down the right path.


----------



## jmemmott (Jul 12, 2003)

sommerfeld said:


> By "encoding scheme" I was referring to the complete file encoding, not just the encryption algorithm.
> 
> (On the other hand, references I can find suggest that the Turing algorithm was first published in 2003, which means that in cryptographic terms it's still a very young cipher. If I were building a system intended to protect the rights of copyright holders by keeping material confidential for decades, I don't think I'd have picked such a new algorithm).


It is strong enough for what Tivo needed to accomplish. For them it was important to balance security and deniability for complicity with piracy against the efficiency of the cypher on the light weight and busy Tivo CPU. Turing is ideal from that perspective.

Turing is a variation on a theme not a new concept. It has it roots in Blowfish, SAFER, SOBER and other cyphers that go back much earlier. In any case, it took a couple of years, significant persistence and a lot of ingenuity to reverse engineer it. It was not broken cryptographically. From what I know of that task I doubt that path could have been done. With a stronger key, it would still be beyond reach - even with what we now know.


----------



## Justin Thyme (Mar 29, 2005)

Others may wish to comment on the accuracy of the following metaphor.

It's like someone took apart a Schlage lock and figured out how to duplicate the tumblers so that it would work with your door key just like the lock you have on your house. He installs a door and magic- you can get into your house through another door not built by Tivo with your door key. Has he broken into your house? Can thieves now break into your house using this? Is there a backdoor- some sort of skeleton key now possible to get into your house?

The answer is no. So what is the big deal. Ok, you don't have to go through the Schlage built door. You can use one made by another vendor. But your house is just as secure as it was before. No one else can get in unless you give them your key.

What is different is that the public, including respected blogs like Gizmodo are saying that the Tivo DRM has been cracked. Well, in the metaphor, I would only say it was cracked if a skeleton key were produced, but that is not what is going on here. This is more like saying the DRM is now open sourceable.

That's the technical reality. The political reality I am afraid is rather grim. The big thing that is different now is that DRM advocates have political cover, and much greater ease to proclaim that cablelabs is entitled to be more restrictive on DRM issues. 

But the good news is that now we will be able to have TTG for Linux. That will make all the Penguin huggers happy. 

On a different subject, I saw one fly in the ointment about about the rights on this though. I read references to patents. Is there some twist on this like as with DVDs so that it can't be used in open source projects? What's the patent name?


----------



## ZeoTiVo (Jan 2, 2004)

Justin Thyme said:


> On a different subject, I saw one fly in the ointment about about the rights on this though. I read references to patents. Is there some twist on this like as with DVDs so that it can't be used in open source projects? What's the patent name?


 don't know the patent name but this does fly in the face of TiVo's IP. I could see TiVo shutting it down as a 'public' distribution and open source projects would need to be careful.
Of course TiVo may also wisely choose to ignore it and if it does not become too publicly acknowledged then just let it stay low key


----------



## davezatz (Apr 18, 2002)

Since this one can go either way and some good points have been made, I changed my blog post heading from TiVoToGo Cracked? to TiVoToGo Reverse Engineered. Though, I left the word 'cracked' in my post. The methodology has been cracked IMO, but without the MAK you can't do much. I say finding a MAK is no big deal, but we're splitting hairs as it is.


----------



## ping (Oct 3, 2005)

ZeoTiVo said:


> don't know the patent name but this does fly in the face of TiVo's IP. I could see TiVo shutting it down as a 'public' distribution and open source projects would need to be careful.
> Of course TiVo may also wisely choose to ignore it and if it does not become too publicly acknowledged then just let it stay low key


I would think this would have fallen in the area of trade secret. Typically you wouldn't go and patent (that is to say, publish) the details of something you didn't want others to know about.

BTW, my vote is for "cracked". If I understand the purpose of the scheme, it is to ensure the recording makes its way safely from the TiVo device to another secure device (such as a portable media player that would not allow a subsequent transfer) without ever being observed in the clear, not even by the person doing the transfer. Whether there were other workarounds or not is irrelevant. There are other workarounds for other forms of DRM (e.g. burning an allowed copy of an audio track to CD and then ripping to get an unlimited copy, using Total Recorder to record the sound card data during playback, etc.), too, but in this case it was the DRM itself that was subverted.


----------



## Dan203 (Apr 17, 2000)

I really don't see TiVo caring about this. Their encryption scheme has been compromised since the day TTG was released and we discovered that they used a DirectShow filter which output raw, unencrypted, MPEG data.

In fact I believe there are only two reason TiVo encrypts TTG files at all...

1) The video is already encrypted on the disk and it's easier to just leave it that way.

2) As long as they make a reasonable attempt to protect the content from ending up on file sharing services they're protected against law suites.

Since this software does nothing that couldn't already be done with the DirectShow filter I really don't see them cracking down on it too hard. They may stop the open source project and push it underground a little, but I doubt they're going to start issuing sopenas.

Dan


----------



## ZeoTiVo (Jan 2, 2004)

ping said:


> If I understand the purpose of the scheme, it is to ensure the recording makes its way safely from the TiVo device to another secure device (such as a portable media player that would not allow a subsequent transfer) without ever being observed in the clear, not even by the person doing the transfer.


 well that is not the case though. TiVo Desktop plus will convert to 4 different formats with no encryption on any of the four formats. iwth that you could copy the show to as many portable devices as you have time to. Also you could copy to one protable device and take it to another house and copy it to their PC or to their portable device and they could play it without any key needed. The four formats are all low res which is all that is needed for portable devices but not much value up on bit-torrent


----------



## Dan203 (Apr 17, 2000)

Actually the resolution of the 4 formats can be increased by modifying a simple XML document.

Like I said above if TiVo were really concerned about this they would have used an approach more secure then the DirectShow filter on Windows. Not only does that leave a gaping hole for capturing the MPEG data, but it allows TiVo files to be converted to other formats using any transcoding software that supports DirectShow. 

Dan


----------



## ping (Oct 3, 2005)

ZeoTiVo said:


> well that is not the case though. TiVo Desktop plus will convert to 4 different formats with no encryption on any of the four formats. iwth that you could copy the show to as many portable devices as you have time to. Also you could copy to one protable device and take it to another house and copy it to their PC or to their portable device and they could play it without any key needed. The four formats are all low res which is all that is needed for portable devices but not much value up on bit-torrent


OK, so the DRM was intended to protect the original-quality version.

I'm not familiar with DirectShow Dump (or TiVoToGo, really, as I only have DTiVos). Is it similar to my aforementioned Total Recorder (i.e. do you have to play it back in real time to capture the result?) If so, then this current development is a somewhat significant crack.

I think Dan's right, though: a good faith effort on TiVo's part to lock it down to satisfy rights owners, and they may or may not now commence with cat and mouse (I'd think they'd have to in order to continue showing good faith).


----------



## ZeoTiVo (Jan 2, 2004)

ping said:


> OK, so the DRM was intended to protect the original-quality version.
> 
> I'm not familiar with DirectShow Dump (or TiVoToGo, really, as I only have DTiVos). Is it similar to my aforementioned Total Recorder (i.e. do you have to play it back in real time to capture the result?) If so, then this current development is a somewhat significant crack.


No, TiVoToGo will transfer the show faster than realtime depending on network robustness and the TiVo model involved. the transcoding to another format is faster than real time as well and does not involve realtime playback. Basically the TiVo DLL, directShowDump and the new crack all work on moving the bits through a pipe. The filter uses the key to filter off the actual bits that make up the mpeg2 video and leave behind any encryption. So the decrypting is as fast as a file copy with a bit of extra overhead for the filter to run.


----------



## Dan203 (Apr 17, 2000)

The way TTG works on Windows is very simple. TiVo designed a DirectShow source filter which opens the .tivo file, decrypts it, and outputs a standard MPEG2 program stream. That approach allows .tivo files to be played by a wide variety of players, and codecs, but it also allows people to connect a simple dump filter to the output pin of the TiVo filter and capture the unencrypted MPEG2 data in it's full original quality.

This software basically does the same thing as the TiVo DirectShow filter except that it works on pretty much any platform. Which means Mac and Linux users can now do the same thing Windows users have been able to do since the day TTG was released.

Dan


----------



## ping (Oct 3, 2005)

I see. Carry on, nothing to see here. About the only scenario I can think of where TiVo would care about this hack/crack/whatever is if TiVo's DirectShow filter was adding some sort of watermark on the way out.


----------



## Justin Thyme (Mar 29, 2005)

ping said:


> Is it similar to my aforementioned Total Recorder (i.e. do you have to play it back in real time to capture the result?) If so, then this current development is a somewhat significant crack.


No it is not anything like capturing realtime output. The Tivo provided DLL is just like any other filter you put in a directshow pipeline. To get a quick idea of what Dan is talking about, download a copy of Graphedit.exe (a microsoft tool). You drag drop a .tivo file into it. It shows you the data pipeline for playing the file, with the Tivo DLL doing the output from the .tivo file. Now delete the boxes sending the output to the screen and instead send it to an MPeg Muxer and then to a file writer. Bingo, you have an unlocked non downrezed Mpeg2 file.

I think my metaphor is accurate, so if "crack" means subversion, then the development is insignificant.

However as a technical achievement, from what jmemmott was saying, it is a very significant effort and is deserving of respect for technical prowess.

I cannot respect it in the least in the political dimension. I repeat my fear that it is an idiotic move for anyone that cares about fighting the menace that DRM presents. Tivo is the one fighting the good fight for more openness about video data. Don't throw rocks at your allies.


----------



## davezatz (Apr 18, 2002)

ping said:


> I see. Carry on, nothing to see here. About the only scenario I can think of where TiVo would care about this hack/crack/whatever is if TiVo's DirectShow filter was adding some sort of watermark on the way out.


TiVo VP Jim Denney implied that at some point in the transfer/conversion process content is being marked. He mentioned it to me when the new TiVo Desktop software came out a few months ago. Blowing smoke or is it really there? If so where and how?



dan203 said:


> Like I said above if TiVo were really concerned about this they would have used an approach more secure then the DirectShow filter on Windows.


I agree with most of your points, but I wonder about this one... could there be an assumption this was more secure than it was? Could the engineers have told management we've locked it down? Having some experience in the tech field, I can imagine a scenario like this playing out.



Justin Thyme said:


> I repeat my fear that it is an idiotic move for anyone that cares about fighting the menace that DRM presents. Tivo is the one fighting the good fight for more openness about video data. Don't throw rocks at your allies.


You must have more than just Macs in your household.


----------



## Dennis Wilkinson (Sep 24, 2001)

davezatz said:


> TiVo VP Jim Denney implied that at some point in the transfer/conversion process content is being marked. He mentioned it to me when the new TiVo Desktop software came out a few months ago. Blowing smoke or is it really there? If so where and how?


My understanding is that the automatic conversions that TiVo Desktop does to other formats add watermarking, which makes sense -- they need to decompress the MPEG data before they can compress it in the other format, which gives them the opportunity to add watermarking. Barring the original .TiVo file being watermarked on the TiVo itself, I think we can safely rule out the DirectShow filter applying watermarking, since it'd need to decompress and recompress MPEG to do that (I suppose that if you were being incredibly clever, you _might_ be able to do this on very particular blocks within the data set on-the-fly, but I don't think that'd be very likely.)


----------



## Krosis (May 10, 2004)

The day I can no longer record tv shows off my Tivo is the day I unsubscibe. It's as simple as that. If they think they are gaining monetarily from me by restricting my ability to record shows they are very much mistaken. So any "hack" that allows me to do so helps guarantee that Tivo (and DirecTV) get money from me. That goes for all the movie channels I subscibe to as well, if I find I can't record them, bye bye subscription. 

I never watch anything real time, and sometimes I timeshift for months. That's the way it is, and if they don't like it then they don't get my money. 

FWIW I won't buy any CD or DVD that can't be copied either. 

The content providers need a new business model and need to stop using legal means to force an old and outdated business model into profitability.

Tivo's hackability is the primary reason I subscibe.


----------



## lampman (Dec 5, 2006)

Dennis Wilkinson said:


> Barring the original .TiVo file being watermarked on the TiVo itself, I think we can safely rule out the DirectShow filter applying watermarking, since it'd need to decompress and recompress MPEG to do that


Using tivodecode, it should now be possible to directly test that theory. Compare the output from tivodecode to the unencrypted tap of the DirectShow filter, using the same .tivo file.


----------



## davezatz (Apr 18, 2002)

Dennis Wilkinson said:


> My understanding is that the automatic conversions that TiVo Desktop does to other formats add watermarking, which makes sense -- they need to decompress the MPEG data before they can compress it in the other format, which gives them the opportunity to add watermarking. I think we can safely rule out the DirectShow filter applying watermarking, since it'd need to decompress and recompress MPEG to do that


Sounds logical and most likely to me given the set of codecs they've licensing as part of the new Desktop Plus - but that leaves WMV unmarked if you don't upgrade (theoretically) and anything run through DSD unmarked. Hm. I didn't do a before and after comparison of the .dll, but i think you're right it's unlikely they'd add it at that point especially since it'll be converted post .dll streaming. Of course no one has conclusively proven to me it exists.


----------



## Justin Thyme (Mar 29, 2005)

Digital watermarking is an interesting field. The problem is marking in a form that survives multiple generational transformations eg tivo Mpeg2 520x480 to Divx odd ratio to Video iPod H264 320x240.

Imagine for the sake of illustration a rudimentary scheme. You vary the luminence of the deep blacks 10% from frame to frame in a scene. The eye can't see the variation, but after a scene change, if you see that trigger, you know to look for the watermark. You vary the blacks over countless frames- if varied, it is a one, if not varied, it is a zero and so on, and you do it countless times throughout the entire recording so that no matter how small a clip that is taken, you have redundant repetitions of the code.

All you have to hide is 7 digits in a gigabyte of data. Mathematically of course there are much more sophisticated techniques to avoid various compression techniques that would obscure your signal. Some such as those I described are mathematically relatively easy to identify and strip. However frequency domain techniques are purportedly very strong. Anyway, such invisible digital watermarking is a well known field and is commonly used. Some more info is available to interested parties on wikipedia , but I don't know much about the math involved- just what I picked up when reading what the Macrovision folks were talking about at their research conferences.

So is Tivo blowing smoke or not? The interesting thing is that a Tivo doing such watermarking is inherently more attactive than a cable or satellite box which is just sending the digitized signal straight through to disk. Reason why is that with the MAK you can trace back copies to the originating offender. You think RIAA lawsuits were bad- this could be done as an automated operation and they would have hordes of cases.

Maybe they watermark, maybe it is just smoke. I'd say, if you are going to put clips up on youtube, use your DVD recorder and just rip the disk. It's faster than TTG anyway. Be sure to record the signal direct from source, not downstream of the Tivo.


----------



## jmoak (Jun 20, 2000)

It's _very_ cool that this can be done on linux/mac now, but,



> _from gizmodo.com:_
> TiVo To Go DRM Cracked
> The digital rights management (DRM) that locks up the TiVo To Go video you might want to transfer between your TiVo and PC has been cracked. Now you won't even need to use the TiVo Desktop software if you want to play back something you've recorded on your TiVo on a PC.





> _from dailytech.com:_
> TiVoToGo DRM Protection Cracked
> Playback now available on any device
> According to reports, the digital rights management (DRM) mechanism on TiVoToGo has been cracked, allowing users to use their TiVo to record video content for playback on other platforms and any devices.


These (and other) articles decry this as some great "freedom" from tivo's evil drm.

I've pulled video off my un-hacked tivo for quite a while now without using the tivo desktop software and have been able to play it back on any device I have ever wanted to. From my portable player, my buddies ipod, dvd's, my laptop.... no restrictions.

...and these quotes are from self-proclaimed wizz-bang tech news sites!!!!

please, please pardon my use of a over used icon, but it really fits these "news" stories


----------



## davezatz (Apr 18, 2002)

jmoak said:


> I've pulled video off my un-hacked tivo for quite a while now without using the tivo desktop software and have been able to play it back on any device I have ever wanted to.


I assume you used TiVo's .dll at some point to make it happen. 

Frankly, hype sells. I think we all know that. 'Cracking TiVo DRM' is more sensational/provocative than saying 'TiVoToGo Reverse Engineered.' And most of the bigger blogs don't specialize and may not have the same level of in-depth info on a certain company, product, or niche.

Personally I think TiVo has done a pretty decent job balancing everyone's needs *except* for getting a solution out to Mac users in a timely fashion. So that's the big news with this and what I think is worth emphasizing. I also find it interesting from a software engineering standpoint that the decryption mechanism was deconstructed.

Regardless, the news as it's been presented will sell boxes and I don't think TiVo will mind one bit... though they probably won't say that out loud. (Though I'm not giving them permission to stop work on the official Mac TiVoToGo.)


----------



## jmoak (Jun 20, 2000)

davezatz said:


> I assume you used TiVo's .dll at some point to make it happen.


Thanks to the good folks around here, it's all I've had to use!


davezatz said:


> Frankly, hype sells.


and in the name of sales and popularity, truth and clarity be damned.

I, for one, am ashamed of that.


I should be use to it by now, but it's still a bitter pill for this old man to swallow.


----------



## Redux (Oct 19, 2004)

Krosis said:


> content providers need a new business model and need to stop using legal means to force an old and outdated business model into profitability.


Why?

If buggy whip manufacturer's had had the same political clout, we'd have 17 buggy whips as federally-mandated equipment on every car sold today.

You get what you pay for, and protection for the old business model has been paid for.


----------



## Justin Thyme (Mar 29, 2005)

You don't have to believe that Tivo hired rocket scientists in order to put in watermarking. Broadcom has had it incorporated in their product offerings for some time. One product is quite imaginately called VideoMark (TM). Now, with VideoMark (TM, it is possible now to even putting forensic user specific marking into STBs! "Because piracy can be traced back to the source, and not just the network operator, content owners are ensured a higher protection level than other distribution methods, such as DVDs and VHS tapes. "

This is available for example on the Broadcom BCM7038, which as many of you know is the CPU on the S3.

Yay! No wait a minute. Boo! Or maybe not. And so it goes.


----------



## ZeoTiVo (Jan 2, 2004)

davezatz said:


> Personally I think TiVo has done a pretty decent job balancing everyone's needs *except* for getting a solution out to Mac users in a timely fashion. So that's the big news with this and what I think is worth emphasizing. I also find it interesting from a software engineering standpoint that the decryption mechanism was deconstructed.


and all that is the news that gets buried under the hyped up headlines and first paragraphs. Oh well, here is to mac users finally getting some TiVo goodness on their macs without a lot of hassle, and cheers to the Linux heads who made it possible. Maybe TiVo will think not to ignore the group next time.


----------



## greg_burns (May 22, 2004)

Where do you find this stuff Justin? 

http://www.verimatrix.com/press/press_releasedetail.php?pressrelease_id=7


> *About VideoMark*
> 
> VideoMark is the industrys first secure and invisible content tracking solution that enables forensic, user-specific marking of video at each PC or STB client in a pay-TV system. The VideoMark payload is robust against a wide range of video content manipulations, with recovery of the unique client identification possible from all unauthorized analog and digital distribution formats. Because any pirated copies can be traced to a unique user, and not just a system operator, content owners are assured of protection that extends beyond the digital network. VideoMark also complies with the rigorous requirements of the Digital Cinema Initiatives, LLC (DCI).


----------



## davezatz (Apr 18, 2002)

Justin Thyme said:


> This is available for example on the Broadcom BCM7038, which as many of you know is the CPU on the S3.
> 
> Yay! No wait a minute. Boo! Or maybe not. And so it goes.


That is _very _interesting.


----------



## jmoak (Jun 20, 2000)

> _Tivo press release, 11/21/2005_
> TiVo To Bring TV Programming To Apple Video iPodTM and PSPTM (Playstation® Portable)
> 
> TiVo to Provide New Capability for Quick and Easy Transfer of Viewer's Favorite TV Shows to iPod or PSP
> ...


ACK! Evil Tivo!


----------



## Justin Thyme (Mar 29, 2005)

greg_burns said:


> Where do you find this stuff Justin?


Someone has to keep an eye on what the bastards are up to...

(Of course, no offence to any industry players in the audience.)


----------



## Justin Thyme (Mar 29, 2005)

Anyone want to run a test on whether they are actually doing it now? EG: two S2.5 Tivos with different MAKs, same video signal- something homogenous like a blue screen. Both record at exactly the same time. After the MPeg2 decode, should be nearly identical outputs, right? If not, _something_ else is in the signal.

Theoretically, that is true, right? Any MPEG2 compression algorithm heads in the audience care to confirm the theoretical validity of that assumption? (That they should be identical outputs if no watermark).


----------



## classicsat (Feb 18, 2004)

For TiVo to use watermarking, well, it is a necessary evil to get some features we desire. It should have little impact on legitimate users, so there really is nothing to practically cry about.


----------



## AllAboutJeeps (Apr 3, 2003)

Quick question that may have been answered in another thread.

With the 'reverse engineering' of the scheme is the show information decyphered so that we can add our own description and other attributes?

Thanks.

...danny


----------



## davezatz (Apr 18, 2002)

Justin Thyme said:


> Both record at exactly the same time. After the MPeg2 decode, should be nearly identical outputs, right? If not, _something_ else is in the signal


How do we ensure recording with the precision we'd want? How do we measure the variation? I don't think this can be done with the gear a typical consumer has laying around.


----------



## Dan203 (Apr 17, 2000)

davezatz said:


> I agree with most of your points, but I wonder about this one... could there be an assumption this was more secure than it was? Could the engineers have told management we've locked it down? Having some experience in the tech field, I can imagine a scenario like this playing out.


I doubt TiVo's engineers are that nieve. This hole was discovered within a day of TTG being released. There is no way TiVos engineers didn't consider it when they designed the system.

Dan


----------



## minckster (Aug 31, 2006)

I haven't seen this posted yet. It's an applescript drag-n-drop interface. TiVo Decoder 1.0:

http://www.versiontracker.com/dyn/moreinfo/macosx/31409


----------



## Justin Thyme (Mar 29, 2005)

Dan is on the money. They call them speed bumps in the content protection papers. Macrovision guys also know that it is trivial to subvert broadcast flags and Macrovision scrambling. You just buy a box like the Sima at BestBuy and bingo- the same thing that allows you to dub VHS and DVDs allows you to record content coming from an STB that has flags on it. Did they somehow "forget" that there were devices that nuke the Vertical Blanking Interval where both the analog and digital protections reside? Of course not.


davezatz said:


> How do we ensure recording with the precision we'd want? How do we measure the variation? I don't think this can be done with the gear a typical consumer has laying around.


I'm not sure that you need a lot of precision. If you take a camcorder and just generate a blue screen, that will be highly uniform input. It won't matter that the timing is microseconds off when the recordings start. But I was really guessing and that's why I asked the advice of any MPEG2 encoder algorithm jocks that may be lurking.... if true, then it wouldn't be the gear that matters. Anyone that does this analysis is going to have to understand enough of the MPEG2 structure to isolate the visual data and just do compares on those streams. Not sure how worth it the test would be, since you really can't be sure that variations do mean a watermark is present. But who knows- you might get lucky and if the vast majority of blocks are identical, it is probably safe to assume they are not doing a watermarking scheme. No certainty there either, because if I was defending against pirates I would anticipate the move of attempting to isolate the encoding scheme by removing video signal complexity. So you get a video signal that is repetitious, and you don't weave your watermark signal into it.

Not as fun as paintball, but still a cat and mouse game.


----------



## Dan203 (Apr 17, 2000)

TiVos don't do watermarking on the MPEG2 streams. The MPEG2 streams are compressed with a hardware based MPEG2 encoder chip. The chip used in the Series 2 TiVos does not have the ability to watermark the stream.

TiVo claims to be watermarking MPEG-4 video transcoded via their TiVo Desktop Plus upgrade. However I've looked at the DirectShow filters they are using to transcode the files and none of appear to support watermarking either. Now I guess they could be tagging the header of the file somehow, but if that's true I'm sure it's easily stripped out.

Dan


----------



## TheSlyBear (Dec 26, 2002)

classicsat said:


> For TiVo to use watermarking, well, it is a necessary evil ...


What's the "evil" part? It will have no effect on legit users.


----------



## Justin Thyme (Mar 29, 2005)

bootedbear said:


> What's the "evil" part? It will have no effect on legit users.


Shhh. You're no fun.

Dan- certainly I have no specific knowlege of such watermarking capability. And if it was not clear to others, I have indulged in speculation that is not supportable by many facts. It should be taken with a grain of salt.

With that said, I did not make the speculations with utter disregard for facts and without any basis. The BCM7040 datasheet states it is capable of video preprocessing, and stream processing is highly programable and you can even set up your own wavelet transforms to manipulate video on the fly. And there are specific data insertion functions like VBI manipulation. Given that Broadcom does not give out specific specifications or manuals on their chips, I can't know for sure, but in theory there are tools there to do some watermarking. Without knowing more about the video processing instructions available, I can't get a perspective on how good such watermarking would be.

Do you have specific knowlege of the capabilities of the Broadcom chip or the Tivo code to exclude watermarking capability? I don't have any access to specs- only datasheets.


----------



## ZeoTiVo (Jan 2, 2004)

bootedbear said:


> What's the "evil" part? It will have no effect on legit users.


I agree, compared to MythTV or other PC setups using a TiVo to populate something like bit-torrent is just inefficient.TiVo could put my name on each show for all I care.


----------



## TydalForce (Feb 9, 2006)

If TiVo were to release a software update tomorrow that changed all the encoding on all the boxes to plain vanilla mpeg2, I don't think it would change the piracy landscape one bit. There would be no more (or less) content on BitTorrent. People would still use their TiVos as they have been. Others will buy stuff from iTunes. People will still buy DVDs of their favourite shows and movies.


----------



## Dennis Wilkinson (Sep 24, 2001)

Justin Thyme said:


> Anyone want to run a test on whether they are actually doing it now? EG: two S2.5 Tivos with different MAKs, same video signal- something homogenous like a blue screen. Both record at exactly the same time. After the MPeg2 decode, should be nearly identical outputs, right? If not, _something_ else is in the signal.
> 
> Theoretically, that is true, right? Any MPEG2 compression algorithm heads in the audience care to confirm the theoretical validity of that assumption? (That they should be identical outputs if no watermark).


I doubt that the analog sections of any 2 Series 2 TiVos are within such tolerances that you'd get the same output from the analog-to-digital converter, let alone be able to test for watermarking that way, without a lot of tweaking. Someone with the right equipment might be able to feed digital data representing a flat field onto the right spot on the main board, but there's usually a good amount of variance from part to part with any ADC.


----------



## Justin Thyme (Mar 29, 2005)

Well Rats. Thanks Dennis for the professional opinion.


----------



## Dan203 (Apr 17, 2000)

Now it is possible they could be embeding something in the VBI or even in a private stream in the MPEG2 data. However I'd think that if they were someone would have found it by now. And even if they did that too would be easily removed.

Dan


----------



## megazone (Mar 3, 2002)

As for the 'cracked' debate Bruce Schneier says 'cracked'. 

I think it is cracked, plain and simple. The DRM is a system, and as a system it has been defeated, cracked. We're not supposed to be able to free the MPEG-2 from the .tivo, that's what the DRM is meant to prevent - except for playback. Now we can. DirectShow Dump didn't crack the DRM, it exploited a loophole in DirectShow and captured frames from playback.

This doesn't require any playback, it is a straight decryption of the source file.

Sure, the algorithms used haven't been broken. But the key generation system has. So you need the MAK - big deal, that's a known text. It isn't meant to be secret, and it isn't even the key. It is part of the key generation. What they figured out is the full key generation, so they were able to reproduce the key - and the encryption is using standard algorithms from there.


----------



## FrooBrar (Dec 5, 2006)

lampman said:


> Using tivodecode, it should now be possible to directly test that theory. Compare the output from tivodecode to the unencrypted tap of the DirectShow filter, using the same .tivo file.


I am 99% sure that the directshow filter does no watermarking. At least, if it did, I never saw it. The way I tested the decoding early on was to compare bit-for-bit the output of the directshow filter with the output of my decoder for the scrambled packets, and I got identical results.


----------



## Dan203 (Apr 17, 2000)

megazone said:


> DirectShow Dump didn't crack the DRM, it exploited a loophole in DirectShow and captured frames from playback.


Actually DirectShow Dump doesn't require playback either! The TiVo DirectShow filter is basically a synchronous reader which opens the encrypted .tivo file and spits out unencrypted MPEG data. Just because it runs in the context of DirectShow, does not mean the file has to be played or even be capable of being played. The system I had going a long time ago used a DirectShow filter graph with exactly two filters. The TiVo filter and a modified version of the MS Dump filter which works in pull mode. No different then the system used by this code, other then the decryption code was written by TiVo themselves.

Now I'm not disputing that this is a "crack", I'm simply pointing out that all they've really done in rewritten the TiVo DirectShow filter in a cross platform manor.

Dan


----------



## megazone (Mar 3, 2002)

Dan203 said:


> Actually DirectShow Dump doesn't require playback either! The TiVo DirectShow filter is basically a synchronous reader which opens the encrypted .tivo file and spits out unencrypted MPEG data.


I phrased that poorly. It acts like a playback system in using DirectShow, but it isn't really playing the video. DirectShow can't tell the difference between that and a legitimate playback system, so you can't block the one without breaking playback.



> Now I'm not disputing that this is a "crack", I'm simply pointing out that all they've really done in rewritten the TiVo DirectShow filter in a cross platform manor.


Agreed. They reproduced the functionality through reverse engineering, it does pretty much exactly the same thing.


----------



## ZeoTiVo (Jan 2, 2004)

megazone said:


> Sure, the algorithms used haven't been broken. But the key generation system has. So you need the MAK - big deal, that's a known text. It isn't meant to be secret, and it isn't even the key. It is part of the key generation. What they figured out is the full key generation, so they were able to reproduce the key - and the encryption is using standard algorithms from there.


I will agree they "cracked" the key generation system, but to say you cracked .tivo files I still hold that to the level of you need to open any .tivo file without use of a MAK or use one MAK every time regardless of where the file came from.

the reverse engineering was figuring out what the TiVo DLL did and doing that again in a program that can be ported to any platform. This is all semnatics though, bottom line anyone on the 3 main OSes can now have a mpeg from a .tivo file instead of having to just use Windows and install TiVo desktop.

It would be nice if TiVo just went to a straight mpeg file for any SD content that was marked as copy allowed from the TiVo DVR, ironically that would take more processing power on the DVR as it would have to unencrypt the file while transferring it.


----------



## simontam0 (Sep 19, 2006)

Does anyone know if this works with a series 3 and HD content? Can you "port" the recorded HD content from the S3 and then watch the "ported" video on a PC or Mac at full hd resolution? Out of curiosity how big are some of the HD files? Let's say a regular 1 hour HD tv show?


----------



## davezatz (Apr 18, 2002)

simontam0 said:


> Does anyone know if this works with a series 3 and HD content?


TiVoToGo is not active on the S3.


----------



## davezatz (Apr 18, 2002)

megazone said:


> I think it is cracked, plain and simple. *The DRM is a system, and as a system it has been defeated*, cracked. We're not supposed to be able to free the MPEG-2 from the .tivo, that's what the DRM is meant to prevent - except for playback. Now we can.


Hmm... maybe I'll change my mind again on this. But don't tell Bruce since he kindly linked to my site.  Maybe if we leave the word 'crack' out of our discussion we can all agree on the significance. It seems like we get hung up on that one word and are splitting hairs.

Anyhow, looks like a few automation widgets are already out for the Mac. I'll have to give them a shot. Has anyone done anything on the PC? Don't make me install VisualBasic and make a little GUI. Who's got time for that?

Oh, I did hear back from Galleon Leon - he's totally preoccupied with a project and won't be making any updates. The code is all available though if someone has time and interest in integrating the TiVoDecode module and functionality. Wonder if Froo can rewrite as Java or if it even matters.


----------



## Dan203 (Apr 17, 2000)

davezatz said:


> Has anyone done anything on the PC? Don't make me install VisualBasic and make a little GUI. Who's got time for that?


There is no real reason to do this on the PC. DirectShow Dump does the exact same thing and it already a tried and tested method of decoding. Plus there are even better apps, like VideoReDo, that support .tivo files natively and not only decode them but allow you to edit them and correct stream errors.

Dan


----------



## HDTiVo (Nov 27, 2002)

megazone said:


> Sure, the algorithms used haven't been broken. But the key generation system has. So you need the MAK - big deal, that's a known text. It isn't meant to be secret, and it isn't even the key. It is part of the key generation. What they figured out is the full key generation, so they were able to reproduce the key - and the encryption is using standard algorithms from there.


The only thing about the MAK is that you have a contractual obligation with TiVo to keep yours private.

As I understand it, what they have done does not generate the key without the supplied MAK - which contractually can only be supplied by the MAK owner.


----------



## Gunnyman (Jul 10, 2003)

so I guess extraction talk is ok now eh dan?


----------



## HDTiVo (Nov 27, 2002)

Dan203 said:


> There is no real reason to do this on the PC. DirectShow Dump does the exact same thing and it already a tried and tested method of decoding. Plus there are even better apps, like VideoReDo, that support .tivo files natively and not only decode them but allow you to edit them and correct stream errors.
> 
> Dan


yeah.


----------



## davezatz (Apr 18, 2002)

Dan203 said:


> There is no real reason to do this on the PC. DirectShow Dump does the exact same thing and it already a tried and tested method of decoding.


Someone posted some stats and there was a significant increase in speed with TiVoDecode. Why install the TiVo Desktop (or at the very least TiVo .dll) if I have a tight, quick little app that will _both _download and strip shows in batches? It's something I'd use.


----------



## Dan203 (Apr 17, 2000)

davezatz said:


> Someone posted some stats and there was a significant increase in speed with TiVoDecode. Why install the TiVo Desktop (or at the very least TiVo .dll) if I have a tight, quick little app that will _both _download and strip shows in batches? It's something I'd use.


Be careful! Releasing such a program is a violation of the DMCA and could get you a call from TiVo's lawyers. Believe me I know from personal experience. DirectShow Dump gets away with because it's a generic program which works with all DirectShow content, not just TiVo files. Although it has been skewed toward TiVo use over the years.

That being said... You're right. Not having to install TiVo desktop just to get simple decoding would be very useful for some people. So if you do decide to do it I'm sure you'll find an audience for it.

Dan


----------



## HDTiVo (Nov 27, 2002)

Have they got TiVoToCome going on the Mac?

From the looks of things, as far as decoding, they've just matched the the functionality already available on the PC. So whatever you think of the PC situation - cracked, broken, intact, Moon Zappa'd - its still just the same, but you can do it with a Mac.

There should be no change to the S3's status because of this.


----------



## Dan203 (Apr 17, 2000)

The only difference here is that on the PC you can play a .tivo file without having to decrypt it first. With this, on a Mac, you have to defeat the encryption before the file can even be played. At this point it would be in TiVo's best interest to incorporate this code, or thier own, into an open source player such as VCL or mplayer so that people don't have to defeat the encryption just to play the file. The cat is already out of the bag, so all they can do now is minimize the damage.

Dan


----------



## FrooBrar (Dec 5, 2006)

Dan203 said:


> The only difference here is that on the PC you can play a .tivo file without having to decrypt it first. With this, on a Mac, you have to defeat the encryption before the file can even be played. At this point it would be in TiVo's best interest to incorporate this code, or thier own, into an open source player such as VCL or mplayer so that people don't have to defeat the encryption just to play the file.


This is acutally on my to-do list, to restructure the code to make it a library that can integrate into different players. However, one can currently play tivo files via mplayer using pipes. The default output for the tivodecode software is stdout for this purpose. Simply pipe the output into mplayer, and it plays without writing a file. There was a post couple days ago on the sourceforge forum of someone who figured out how to stream and play directly off of the tivo, with a command like

```
/usr/bin/curl -k --digest -u tivo:{MAK} -c cookies.txt "{tivo2go url}" | /usr/bin/tivodecode -m {MAK} -- - | /usr/bin/mplayer -vf pp=lb -cache 32768 -
```


----------



## Dan203 (Apr 17, 2000)

Good work! I asked over on the VCL forum if anyone could incorporate the code. But the only reply I got said that none of their active developers were in the US, so none of them had access to TiVos or TiVoToGo files.

Dan


----------



## Justin Thyme (Mar 29, 2005)

megazone said:


> As for the 'cracked' debate Bruce Schneier says 'cracked'.
> 
> I think it is cracked, plain and simple.


Mega, for once I think it is you and not me that has driven off into the weeds.

Bruce ammended the cracked claim today. He updated the previously mentioned page with the warning that he has been informed that the Tivo DRM has not been cracked nor hacked but reverse engineered...

The only thing new is that the decrypter is portable open source code, that's all. The encryption has not been broken, you still need to know the Mak for the file to be decrypted. My metaphor of the door with a duplicated tumbler applies. If no one can enter without the correct key, the home is still secure.


----------



## davezatz (Apr 18, 2002)

Dan203 said:


> Be careful! Releasing such a program is a violation of the DMCA and could get you a call from TiVo's lawyers. Believe me I know from personal experience.


Good reminder.  Maybe I'll do something else with my time! I read TNT is showing all Lord of the Rings movies 12/15 in HD.


----------



## HDTiVo (Nov 27, 2002)

Dan203 said:


> The only difference here is that on the PC you can play a .tivo file without having to decrypt it first. With this, on a Mac, you have to defeat the encryption before the file can even be played. At this point it would be in TiVo's best interest to incorporate this code, or thier own, into an open source player such as VCL or mplayer so that people don't have to defeat the encryption just to play the file. The cat is already out of the bag, so all they can do now is minimize the damage.
> 
> Dan


So all someone has to do is hook the output to an mpeg player program and its the same as with the PC, right?


----------



## HDTiVo (Nov 27, 2002)

davezatz said:


> Good reminder.  Maybe I'll do something else with my time! I read TNT is showing all Lord of the Rings movies 12/15 in HD.


Try to stay out of trouble the next 7 days.

Oh, and TNTHD always looks to me like 4x3 streched to 16x9.


----------



## greg_burns (May 22, 2004)

Dan203 said:


> DirectShow Dump gets away with because it's a generic program which works with all DirectShow content, not just TiVo files. Although it has been skewed toward TiVo use over the years.


 

How quickly we forget! DSD actually was first named, TivoPrep. Then quickly renamed Tivo Burning Rom (TBR). Finally, Shahar settled on DirectShow Dump after a sly attempt to disguise it's true purpose. (He also changed it at that time so it would convert any direstshow(?) file types, not just .tivo files).










If you recall, DSD originated from his eTivo program. It still references his EtiVoInterop.dll.

</history lesson>


----------



## SnakeEyes (Dec 26, 2000)

HDTiVo said:


> Have they got TiVoToCome going on the Mac?
> 
> From the looks of things, as far as decoding, they've just matched the the functionality already available on the PC. So whatever you think of the PC situation - cracked, broken, intact, Moon Zappa'd - its still just the same, but you can do it with a Mac.
> 
> There should be no change to the S3's status because of this.


Sending files to the TiVo via TiVo Desktop is available on Mac but hidden. Have to hold down command when opening the control panel to get the video tab.


----------



## Justin Thyme (Mar 29, 2005)

greg_burns said:


> Finally, Shahar settled on DirectShow Dump after a sly attempt to disguise it's true purpose.


Well, you may recall he did that because he recieved advice to do so. I'm not going to say from whom, but it wasn't me. Personally, I think it was prudent advice. Camoflage is not really the purpose. If a tool has significant legitimate uses, then just because some people can use it for illicit purposes. I don't recall exactly the wording of Betamax for "significant", but the idea was non trivial legitimate uses. Whether the other uses of DSD meet that threshold, I don't know. But at least there is something there to base a defence on.


----------



## HDTiVo (Nov 27, 2002)

SnakeEyes said:


> Sending files to the TiVo via TiVo Desktop is available on Mac but hidden. Have to hold down command when opening the control panel to get the video tab.


Wow, you got Come before you got Go.


----------



## jmemmott (Jul 12, 2003)

Of equal significance is that the DMCA generally prohibits someone from "circumventing" protections on a copyrighted work. However the DMCA also contains a set of exemptions that allow developers to not only circumvent the protections but to legally reverse engineer the mechanism and distribute the fruits of that process contingent upon the fact that the purpose of doing this is to interface the protected content with interdependently developed software that has commercial purposes beyond merely removing the protections. That was added to the act to prevent it from becoming a mechanism to lock independant developers out of the after market for entertainment products.


----------



## morac (Mar 14, 2003)

Justin Thyme said:


> Well, you may recall he did that because he recieved advice to do so. I'm not going to say from whom, but it wasn't me. Personally, I think it was prudent advice. Camoflage is not really the purpose. If a tool has significant legitimate uses, then just because some people can use it for illicit purposes. I don't recall exactly the wording of Betamax for "significant", but the idea was non trivial legitimate uses. Whether the other uses of DSD meet that threshold, I don't know. But at least there is something there to base a defence on.


IANAL, but I'm not sure his program would fall under the aspects of the DCMA because his program does not actually do any decrypting. That was all done by TiVo's own software. His program just took the already decrypted (by TiVo software) output and dumped it to disk.

The new program doesn't use the TiVo software. It reverse engineered the decoding scheme, which was made illegal by the DMCA except under certain circumstances. Software compatibility between programs is one of the exceptions, but not between data and software which is what is happening here. The whole thing is moot though if this was developed in another country where the DMCA does not apply.


----------



## jmemmott (Jul 12, 2003)

morac said:


> IANAL, but I'm not sure his program would fall under the aspects of the DCMA because his program does not actually do any decrypting.


Unfortuanately, the law doesn't say anything about decrypting, what it say is "No person shall circumvent a technological measure that effectively controls access to a work protected under this title." That is vague enough that only a test case in the courts will ever be able to define what in included and what isn't. Most people don't have deep enough pockets or the desire to be that test case so they take "prudent" though perhaps unnecessay steps to try to avoid it.

Hopefully by now it is a moot point with respect to .tivo files...


----------



## HDTiVo (Nov 27, 2002)

All this does is duplicate the functionality that's available on the PC so the Mac can do it too. I don't think there's any more issue about Copyright/DMCA than might already exist on the PC.


----------



## jmemmott (Jul 12, 2003)

HDTiVo said:


> All this does is duplicate the functionality that's available on the PC so the Mac can do it too. I don't think there's any more issue about Copyright/DMCA than might already exist on the PC.


With respect to use of this product, I would agree and if as moroc speculates, the work was done outside this country, then the rest is moot. However, if it was done inside this country then because of the way it was done, the reverse engineering exemptions in the DMCA might be useful to anyone involved or anyone that wishes to distribute the fruits of that process ( e.g. SourceForge ). Just a thought...


----------



## Schmye Bubbula (Oct 14, 2004)

SnakeEyes said:


> Sending files to the TiVo via TiVo Desktop is available on Mac but hidden. Have to hold down command when opening the control panel to get the video tab.


I get no difference when Command-clicking my TiVo Desktop icon in System Preferences in Mac OSuX 10.4.5. (But I get an "Enable Debugging" checkbox and some log options along the bottom when I Option-click.) Am I not getting a video tab because I'm in only TiVo Desktop v1.9.2? Is it in v1.9.3?



HDTiVo said:


> Wow, you got Come before you got Go.


Huh? I don't follow what you're saying.


----------



## SnakeEyes (Dec 26, 2000)

Schmye Bubbula said:


> I get no difference when Command-clicking my TiVo Desktop icon in System Preferences in Mac OSuX 10.4.5. (But I get an "Enable Debugging" checkbox and some log options along the bottom when I Option-click.) Am I not getting a video tab because I'm in only TiVo Desktop v1.9.2? Is it in v1.9.3?


upgrade


----------



## TydalForce (Feb 9, 2006)

The video trick was added in 1.9.3


----------



## MichaelK (Jan 10, 2002)

Considering that tivo strips youtube videos within hours of being posted here, the fact that this is still up on sourceforge days later seems to indicate that this is not a violation in their mind of the DMCA.

No lawyer her- but I'd think even if they are cool with it their lawyers would have them put up the stink if they believed it violated the dmca, or any other law, or even their license agreements with their useres for that matter. 

Will be interesting what goes on with MRV, TTG, the S3, and all this for sure...


----------



## MichaelK (Jan 10, 2002)

jmemmott said:


> I'm nit picking I know, but the "encoding scheme" (Turing) is actually cryptographically quite strong. It is one of modern stream cyphers and has been through peer review. As noted above, however, the key Tivo is using is weak and this is what would make it possible to break now that the specific cypher and stream key generation algorithms have been made public.


If Tivo made the MAK 128 bits would it slow down the encryption in the box? It sounds like the MAK is just used to make part of the key and isn't the key so maybe it wouldn't matter.

THen if the MAK was 128 bits would that basically preclude a brute force attack?

If so, I guess if they watermarked stuff somehow with the MAK (sounds like the s3 could do it?) then third parties couldn't distribute and they could track down teh person that violated the license terms/ DMCA/ whatever if stuff wound up all ove rthe net?


----------



## jmemmott (Jul 12, 2003)

MichaelK said:


> If Tivo made the MAK 128 bits would it slow down the encryption in the box? It sounds like the MAK is just used to make part of the key and isn't the key so maybe it wouldn't matter.
> 
> THen if the MAK was 128 bits would that basically preclude a brute force attack?


In this case, where the key generation mechanism and the cypher are fully known, the security rests entirely on the number of possible keys. Since we know the characteristics of a MAK, that sets the upper bound on the number of attempts I would have to make. Try one, see if the output looks like a valid mpeg stream, if it does repeat, if not abandon...

Add one bit to the MAK length and you double the number of attempts that may be required. Add two, you quadruple it. So the question is how big does the number of possible MAKs need to be to make this type of trial and error process impractical.

As far as speed goes, it would likely have little impact as that is a function of the encryption key size which as you note is larger than the MAK anyway. Additionally, Turning is one of those cyphers that is cheap to implement in hardware - a few shift registers, xor gates and memory registers. If they are doing it that way, encryption speed is not likely to be an issue. Design flexibility for the initial key generation step would be the control on their ablility to change size. If that step in is done in the CPU it would most likely be possible.

Personally, I don't see any benefit to changing anything - they have what they want. Without the MAK, it is not worth the effort to try to free the video and only the Tivo's owner should have the MAK.


----------



## MichaelK (Jan 10, 2002)

jmemmott said:


> In this case, where the key generation mechanism and the cypher are fully known, the security rests entirely on the number of possible keys. Since we know the characteristics of a MAK, that sets the upper bound on the number of attempts I would have to make. Try one, see if the output looks like a valid mpeg stream, if it does repeat, if not abandon...
> 
> Add one bit to the MAK length and you double the number of attempts that may be required. Add two, you quadruple it. So the question is how big does the number of possible MAKs need to be to make this type of trial and error process impractical.
> 
> ...


I guess I'm just trying to figure how to calm cablelabs down. (which might be an imposible task...)


----------



## HDTiVo (Nov 27, 2002)

jmemmott said:


> With respect to use of this product, I would agree and if as moroc speculates, the work was done outside this country, then the rest is moot. However, if it was done inside this country then because of the way it was done, the reverse engineering exemptions in the DMCA might be useful to anyone involved or anyone that wishes to distribute the fruits of that process ( e.g. SourceForge ). Just a thought...


That's a good point about reverse engineering.


----------



## pkscout (Jan 11, 2003)

MichaelK said:


> I guess I'm just trying to figure how to calm cablelabs down. (which might be an imposible task...)


I heard something on an episode of Torchwood that I think applies to CableLabs:

"I think even the stick up your a** has a stick up it's a**."

_edited to fix a spelling error_


----------



## briguymaine (Mar 17, 2004)

Wow, this is amazing! I am not a terminal kind of guy and I even got it working. Wow, is it fast. I think it took longer to download the files from my tivo than it took to convert it. Fantastic, a hearty "great job" to whoever got this running.


----------

