qrpff Explained

<body bgcolor="white"> <body bgcolor="white"> <pre> $_='<font color="orange">while(read+STDIN,$_,2048)</font>{$a=29;$c=142;if((<font color="#8b65 8">@a=unx"C*",$_</font>)[20]&48){$h=5; <font color="browm">$_=unxb24,join"",</font><font color="red">@b=map{xB8,unxb8,chr($_^$a[--$h+84])}@ARGV;</font><font color="browm">s/...$/1$&/;$d= unxV,xb25,$_;</font>$b=73;<font color="purple">$e=256|(ord$b[4])<<9|ord$b[3];</font><font color="orchid">$d=$d>>8^($f=($t=255)&($d >>12^$d>>4^$d^$d/8))<<17,$e=$e>>8^($t&($g=($q=$e>>14&7^$e)^$q*8^$q<<6))<<9</font> ,<font color="darkblue">$_=</font><font color="blue">(map{$_%16or$t^=$c^=($m=(11,10,116,100,11,122,20,100)[$_/16%8])&110;$t ^=(72,@z=(64,72,$a^=12*($_%16-2?0:$m&17)),$b^=$_%64?12:0,@z)[$_%8]}(16..271))</font> <font color="darkblue">[$_]^(($h>>=8)+=$f+(~$g&$t))</font><font color="darkgreen">for@a[128..$#a]}print+x"C*",@a}</font>';<font color="#3cb371">s/x/pack+/g;eval</font> </pre> </body> <hr> <body bgcolor="white"> <h1><tt>qrpff</tt> Explained</h1> <dl> <dt><dd><p> This program, called <tt>qrpff</tt>, decodes CSS, the DVD Content Scrambling System. To understand <tt>qrpff</tt>, we first need to understand CSS.</p> <p>The heart of CSS is something called a <i>linear feedback shift register</i> (<i>LFSR</i>). An LFSR is a sequence of bits. At each step in the algorithm, certain of the bits are combined to make an output bit. The output bit is then appended to the sequence on the right, and the leftmost bit in the sequence is discarded to make room. <p> <p>The output of an LFSR isn't random, but it has many of the properties of a random sequence.</p> <p>CSS uses two LFSRs. One is 17 bits long and the other is 25 bits long. The video data is combined with the outputs of the two LFSRs to yield the encrypted data on the DVD. When the DVD player combines the encrypted data with the LFSR output, the LFSR part cancels out, yielding the original data.</p> <dt><font color="#3cb371"><tt>s/x/pack+/g;eval</tt></font> <dt><dd><p><tt>qrpff</tt> itself is written in a deliberately obfuscated way. Most of the code is actually contained in a string. In the string, <tt>pack</tt> is abbreviated to <tt>x</tt> and <tt>unpack</tt> to <tt>unx</tt>. This part replaces all the <tt>x</tt>es with <tt>pack</tt>s, and then compiles and executes the result.</p> <dt><font color="orange"><tt>while(read+STDIN,$_,2048)</tt></font> <dd><p>The main loop of <tt>qrpff</tt> reads 2Kb 'sectors' of video data into memory.</p> <dt><font color="#8b65 8"><tt>@a=unx"C*",$_</tt></font> <dd><p>Each sector contains a <i>sector key</i> which is used to initialize the LFSRs. This part extracts the sector key and stores the bits in the variable <tt>@a</tt>.</p> <dt><font color="red"><tt>@b=map{xB8,unxb8,chr($_^$a[--$h+84])}@ARGV;</tt></font> <dd><p>The sector key is encoded too---it must first be combined with a <i>title key</i> that is the same for every sector in the entire movie. This section does that. A DVD player would get the title key by combining its secret built-in 'player key' with an encrypted title key on the DVD itself. <tt>qrpff</tt> assumes that the decrypted title key was supplied as an argument when <tt>qrpff</tt> was run.</p> <dt><font color="browm"><tt>$_=unxb24,join"",</tt></font> and <font color="browm"><tt>s/...$/1$&/;$d=unxV,xb25,$_;</tt></font> <dd><p>This extracts 24 bits of the sector key to set up the larger LFSR, which is in <tt>$d</tt>.</p> <dt><font color="purple"><tt>$e=256|(ord$b[4])<<9|ord$b[3];</tt></font> <dd><p>This extracts 16 bits of the sector key to set up the smaller LFSR, stored in <tt>$e</tt>.</p> <dt><font color="orchid"><tt>$d=$d>>8^($f=($t=255)&($d>>12^$d>>4^$d^$d/8))<<17, $e=$e>>8^($t&($g=($q=$e>>14&7^$e)^$q*8^$q<<6))<<9 </tt></font> <dd><p>This section operates the two LFSRs. The important parts are saved in variables <tt>$f</tt> and <tt>$g</tt>.</p> <dt><font color="blue"><tt>(map{$_%16or$t^=$c^=($m=(11,10,116,100,11,122,20,100)[$_/16%8])&110;$t ^=(72,@z=(64,72,$a^=12*($_%16-2?0:$m&17)),$b^=$_%64?12:0,@z)[$_%8]}(16..271))</tt></font> <dd><p>The other part of the decryption process involves transforming the bytes by looking up the values in a table. This is just like the substitution ciphers you might have used when you were a kid, where <tt>a</tt> was replaced by <tt>z</tt>, <tt>b</tt> by <tt>y</tt>, and so on---except the rule is less straightforward. This part computes the lookup table. </p> <dt><font color="darkblue"><tt>$_=</tt></font> and <font color="darkblue"><tt>[$_]^(($h>>=8)+=$f+(~$g&$t))</tt></font> <dd><p> The transformed byte is combined with the LFSR output, which is in <tt>$f</tt> and <tt>$g</tt>.</p> <dt><font color="darkgreen"><tt>for@a[128..$#a]}print+x"C*",@a}</tt></font> <dd><p> The table lookup and LFSR step are performed for each byte of data in the sector, and the result is printed.</p> </dl> </body> </body>