Should ISOs created with MPF be accessible?

[DQduck]

Hi, I'm not sure if the following should have worked or not. However I at least expected it to and the stated error messages kinda do not make sense (to me).

I first created a dump of a BD with MPF (media preservation frontend) that was reported as successful. Then I mounted it using DaemonTools and pointed MakeMKV towards the virtual drive to convert it into MKV files.

MakeMKV failed to open it. I then checked the BEE flags and the first two bytes were all zero. So even though it has AACS v16 it should have worked, right?
But instead MakeMKV showed an error about the host certificate being revoked by the drive. Which I'd be surprised by the DaemonTools virtual drive actually having done.

(I don't have a LibreDrive yet, but as far as I understood it, at worst I'd have ended up with an BEE encrypted image but as it isn't it should have been accessible by MakeMKV, right?)

[attachment=0]Screenshot 2025-12-17 135432.png[/attachment]

[MartyMcNuts]

Hi, I'm not sure if the following should have worked or not. However I at least expected it to and the stated error messages kinda do not make sense (to me).

I first created a dump of a BD with MPF (media preservation frontend) that was reported as successful. Then I mounted it using DaemonTools and pointed MakeMKV towards the virtual drive to convert it into MKV files.

MakeMKV failed to open it. I then checked the BEE flags and the first two bytes were all zero. So even though it has AACS v16 it should have worked, right?
But instead MakeMKV showed an error about the host certificate being revoked by the drive. Which I'd be surprised by the DaemonTools virtual drive actually having done.

(I don't have a LibreDrive yet, but as far as I understood it, at worst I'd have ended up with an BEE encrypted image but as it isn't it should have been accessible by MakeMKV, right?)

Screenshot 2025-12-17 135432.png

ISO's generally don't have all of the data from the disc. Pressed blu-ray discs have a section of the disc that is not copied when creating an ISO and MakeMKV needs to read this section of the disc, so no, ISO's generally don't work unless created with libredrive enabled at the time.

Some folks have done this by opening MakeMKV to enable libredrive then use ImgBurn to create an ISO. I'm pretty sure this encrypted ISO can then be opened in MakeMKV.

[DQduck]

Hi what section is missing? I thought it was the keys for the Bus Encryption which would show up as the first bit of the second byte of the /AACS/Content000.cer being set to 1 (BEE enabled). And libre drive would allow one to read the raw disk without the drive encrypting it where that bit then would be set to 0 (BEE disabled).

Is there more? What else is redumper (which is what the MPF tool uses by default) leaving out? Would Aaru include that part?

[MartyMcNuts]

Hi what section is missing? I thought it was the keys for the Bus Encryption which would show up as the first bit of the second byte of the /AACS/Content000.cer being set to 1 (BEE enabled). And libre drive would allow one to read the raw disk without the drive encrypting it where that bit then would be set to 0 (BEE disabled).

Is there more? What else is redumper (which is what the MPF tool uses by default) leaving out? Would Aaru include that part?

I can't remember off the top of my head what the section is called but it is a non-copyable section that contains the VolumeID which is needed for AACS decryption. Without it the AACS decryption process cannot be followed and keys cannot be derived.

[keydb_helper]

I can't remember off the top of my head what the section is called but it is a non-copyable section that contains the VolumeID which is needed for AACS decryption. Without it the AACS decryption process cannot be followed and keys cannot be derived.

Exactly right. A raw ISO dump will not contain the volume ID, but this can be mitigated by using the external public keydb. MakeMKV will avoid performing the full AACS authentication process when the disc keys are locally available in the keydb file.

MakeMKV actually documented this use case in the FAQ (Archive.org link as the FAQ is inaccessible: Link)

I first created a dump of a BD with MPF (media preservation frontend) that was reported as successful. Then I mounted it using DaemonTools and pointed MakeMKV towards the virtual drive to convert it into MKV files.
...
But instead MakeMKV showed an error about the host certificate being revoked by the drive. Which I'd be surprised by the DaemonTools virtual drive actually having done.

The host certificate issue you observed was due to DaemonTools not being able to emulate a licensed Blu-ray drive in response to MakeMKV trying to perform the AACS authentication process. It shouldn't be interpreted as DaemonTools actually revoking any host certificates.

[DQduck]

Mybe I was confusing some things then because of your LibreDrive mention (which is required for dealing with Buss Encryption but not for dealing with AACS).

I've now dumped the AACS keys as well and the FindVUK tool passes validation on the mounted ISO. But MakeMKV still isn't able to access it.

When I use the MakeMKV integration for VLC it can't play them either. HOWEVER when I use the libaacs and libbdplus from https://github.com/KnugiHK/libaacs-libbdplus-windows instead it works just fine (now).

Does MakeMKV not look into

Code: Select all

%AppData%/aacs/keydb.cfg

?

Code: Select all

MakeMKV v1.18.2 win(x64-release) started
Using direct disc access mode
Loaded content hash table, will verify integrity of M2TS files.
Error 'Scsi error - ILLEGAL REQUEST:INVALID FIELD IN CDB' occurred while issuing SCSI command A30..0020..03F to device 'SPTI:\Device\CdRom3'
Error 'Scsi error - ILLEGAL REQUEST:INVALID FIELD IN CDB' occurred while issuing SCSI command A40..0020..03F to device 'SPTI:\Device\CdRom3'
...
Can't read AACS VID from disc - most likely current AACS host certificate is revoked by your drive

@keydb_helper as you said

MakeMKV will avoid performing the full AACS authentication process when the disc keys are locally available in the keydb file.

am I doing something wrong then???

[keydb_helper]

Mybe I was confusing some things then because of your LibreDrive mention (which is required for dealing with Buss Encryption but not for dealing with AACS).

Just to be clear, bus encryption is very much an aspect of AACS and LibreDrive also assists with the metadata retrieval portion of AACS authentication. LibreDrive is pretty much essential for key generation with modern AACS versions.

I've now dumped the AACS keys as well and the FindVUK tool passes validation on the mounted ISO. But MakeMKV still isn't able to access it.

When I use the MakeMKV integration for VLC it can't play them either. HOWEVER when I use the libaacs and libbdplus from https://github.com/KnugiHK/libaacs-libbdplus-windows instead it works just fine (now).

Does MakeMKV not look into

Code: Select all

%AppData%/aacs/keydb.cfg

?

Correct, MakeMKV does not look for keydb.cfg in the standard libaacs locations. You'll need to put the keydb.cfg file in the MakeMKV data folder. This will be the same folder where MakeMKV stores its generated disc dump files.

[DQduck]

I think I figured it out.

For others:

1) You need to get the FindVUK tool and sync the aacs keys. + copy the KEYDB.cfg file into the .MakeMKV config directory. (NOTE: Keep the folder with the FindVUK tool together with your BD backups as you'll need these keys moving forward and you probably do not want to be relying on the online database to keep existing moving forward to be able to play your backups; aka you need it to play them offline on any device you want)
2) If the VUK for your BD is not yet in the database you'll have to dump it yourself first.

And here a bit of c'n'p from my notes for others in the same situation:

The VUK can be calculated using the VID and the MK. See https://xreveal.com/AACS.html and https://forum.doom9.org/showthread.php?t=184373 for explanations.

To get the VUK you can either use the DVDfab programs as explained in the FindVUK thread https://forum.doom9.org/showthread.php?t=172472
OR you can use MakeMKV to get the VID (and RDK if you do not have a LibreDrive to undo the bus encryption) followed by using the aacskeys tool (bundled with the FindVUK tool) to calculate the VUK. After that you can validate the VUK using the FindVUK tool which should also take care of syncing it where needed. See https://forum.doom9.org/showthread.php?t=184373 for more.

And sometimes new Device and Host Keys are needed to access BDs with higher MKB versions. They're apparently over in this thread: https://forum.doom9.org/showthread.php? ... ost1990091 (I've read somewhere that it is possible to dump ones own keys somehow but I don't know how, yet)

Furthermore I also found this thread quite helpful: https://forum.doom9.org/showthread.php? ... ost1886086

And final note if you want to test your BD dumps without setting up a 2nd "clean" PC, what I did so far is to get https://portableapps.com/apps/music_video/vlc_portable (+ https://portableapps.com/apps/utilities/java_portable for menus) followed by putting libaacs and libbdplus from https://github.com/KnugiHK/libaacs-libbdplus-windows into the VLCPortable\App\vlc folder and the latest KEYDB.cfg (the one you keep backed up together with your dumps) in the VLCPortable\Data\aacs folder (so that it is independent from the host PC and you know that you're able to access them even after reinstalling or loosing access to your PC)