Got a tip for us? Share it...

QTFairUse - iTunes Digital Rights Management (DRM) Circumvented?

A Register.co.uk article reports that the author of DeCSS has written a small command line Windows utility (QTFairUse) which "will dump the output of a QuickTime stream to a file". The Quicktime stream in question are AAC files.



While TheRegister tries to explain away the hack as an implementation of an analog stream-ripper, it appears to be a bit more sophisticated than that...



According to the QTFairUse README:



    Usage:


    Open and play a MPEG4 AAC file in QuickTime Player. The raw AAC data will be written to Desktop/QTFairUse.aac




The application clearly piggybacks off of Apple's Quicktime player and patches the "quicktimempeg4.qtx" file of Windows' Quicktime. It then outputs this "raw AAC data" to a file while the original AAC file plays under Quicktime. The proposed theory is that the application intercepts the Decrypted AAC data from Quicktime after authorization has taken place, and saves out the resultant decrypted (de-DRM'd) AAC data.



Based on limited testing from one user with Quicktime 6.4 under Windows... the application does create DRM-free ".aac" files when Protected AAC files are played through Quicktime. These output files, however, are unplayable in their raw form in most players. The reason for this is that these files represents the true "raw" AAC data that has been passed through to Quicktime to play. All header information has been removed. To create playable files, a further packaging of the files is required to add the appropriate MPEG headers. But the application does work as suggested -- stripping DRM from your protected AAC files (though is not of any practical use in its current form).




In any case, this is the first public attempt at breaking Apple's Digital Rights Management format. The potential for abuse and concern for an application such as this is greater than simple "stream rippers" in that this would introduce lossless ("perfect") copies of protected files.

Top Rated Comments

(View all)

107 months ago
Just to clarify, is this "hack" only available on Windows machines? Or can I try it on my Mac? If it is, then I might test it out.
Rating: 0 Positives / 0 Negatives
107 months ago

Originally posted by Freg3000
Just to clarify, is this "hack" only available on Windows machines? Or can I try it on my Mac? If it is, then I might test it out.


It's for Windows.

arn
Rating: 0 Positives / 0 Negatives
107 months ago
I really think people should not try to hack the DRM, because if they do, the record companies will be pissed and Apple will have to make a more strict DRM to appease them, thus ruining it for the rest of us.
Rating: 0 Positives / 0 Negatives
107 months ago
I'm sorry, I'm not testing out the utility, I don't own anything that runs windows.

Just to stick my nose in though (delete my post if its worthless, Arn), I don't see the point. There are a ton of ways to strip the DRM already that don't requre stream ripping. Virtually any application that can convert audio formats and has access to the Quicktime engine can strip the DRM by converting it to AIFF, WAV, mp3, etc.

The important thing is that in every case you are required to have permission (from iTunes) to PLAY the song to convert it, rip it, etc. This utility would be no different because, as it states, it would "dump the output of a Quicktime stream".

So. If this works, why is it important, it isn't doing anything novel?

And if it doesn't work, what does that prove, that Apple's DRM is tough to crack?

What am I missing here that is interesting?
Rating: 0 Positives / 0 Negatives
107 months ago

Originally posted by trog
Virtually any application that can convert audio formats and has access to the Quicktime engine can strip the DRM by converting it to AIFF, WAV, mp3, etc.
.......
What am I missing here that is interesting?


DRM AAC -> AIFF -> ACC is lossy and uninteresting. You can burn your CD and rerip it. There. no more DRM, but you lose some quality.

DRM AAC -> AAC - if it simply decrypts then it is NOT lossy. And is interesting.

arn
Rating: 0 Positives / 0 Negatives
107 months ago
Ahh I see, thanks. So the question then is whether the utility has to "re-compress" the file to AAC or not. All stream-rippers would essentially go AAC»AIFF»AAC and lose quality. Yup, I see why this would be interesting.

My guess is it wouldn't (yes, I'm jumping to conclusions, sorry), because from reading about Apple's DRM there isn't anything encoded into the song per se, there is only a lock on whether the song will play...

Hope someone can try this and see. Would there be a way to tell if the song has been re-encoded? Looking at the waveforms perhaps?
Rating: 0 Positives / 0 Negatives
107 months ago
Well i don't run Windows, but looking at the code (barely 200 lines), it's obvious that it's not doing much. It's just a patch that's modifying the binary, and I'm guessing that at some point _after_ QT has decrypted the song, it's making it run some alternate code to make QT spit the song to a file rather than to the sound device (just guessing, but I'm probably right). This new code is definitely not complex enough (100 bytes!!) to do anything intricate like encode AAC or decrypt M4P.

This would only work on one specific version of QT and Apple can easily release a new version with slightly more obfuscated code to make it much harder to repeat the exploit.

Still, it's great to know that when Apple stops supporting .m4p in 10 years (no seriously), leaving us with no where to play them, that I can go back an buy a 10-year old winpc for 5$ and decrypt my iTMS music:)
Rating: 0 Positives / 0 Negatives
107 months ago
Based on the source code, it appears it's two items.

1. QTFairUse.exe
2. November.DLL

QTFairUse.exe patches up QuickTimeMPEG4.qtx to call November.DLL, and November.DLL just purely dumps a blob of memory to disk (to the file Desktop\QTFairUse.aac to be exact)

So my guess is the following.

Quicktime opens an encrypted (DRM'd) aac file and un-encrypts it into ram. This patch causes it to than call November.DLL to write this un-encrypted version out to disk. Than it plays as normal.

That's my $0.02 review of it.

Now if I had a windows box, I'd try it out. But the best I could do is Virtual PC, and well screw that.
Rating: 0 Positives / 0 Negatives
107 months ago
yep... sounds likely that it just dumps post-decrypted, pre-decoded AAC.

someone's testing it... we'll see how it works.

arn
Rating: 0 Positives / 0 Negatives
107 months ago
I don't have any protected AACs to try it with, but I find the "build" file interesting. The first line is "#!/bin/sh" which tells a Unix system to use the "sh" shell. But if it's a Windows app, why does it have this Unix command?

Edit: I just looked at MinGW, and see that it's a small GNU implementation on Windows. That explains the line.
Rating: 0 Positives / 0 Negatives

[ Read All Comments ]