BD+

BD+ is effectively a virtual machine embedded in authorized players. It allows content providers to include executable programs on Blu-ray Discs. Such programs can:[7]

• examine the host environment, to see if the player has been tampered with. Every licensed playback device manufacturer must provide the BD+ licensing authority with memory footprints that identify their devices.
• verify that the player's keys have not been changed.
• execute native code, possibly to patch an otherwise insecure system.
• transform the audio and video output. Parts of the content will not be viewable without letting the BD+-program repair it.

If a playback device manufacturer finds that its devices have been hacked, it can potentially release BD+-code that detects and circumvents the vulnerability. These programs can then be included in all new disc releases.[8]

The specifications of the BD+ virtual machine are only officially available to licensed device manufacturers. A list of licensed adopters is available from the BD+ website.[9] Both SlySoft (now RedFox) and members of the Doom9 forum have reverse engineered the virtual machine specification, however.

According to the reverse-engineered specification, the virtual machine consists of a 32-bit big endian DLX like processor with 4MB of RAM. It has 32 32-bit registers available for use. A TRAP instruction is used to allow the virtual machine host to perform more complex actions as system calls.[10]

To prevent simple, static disassembly of the BD+ code, an instruction filter is available that can perform an XOR operation on an opcode before executing it. By varying the instruction filter at runtime, the compiler can force an adversary to trace through the code at runtime before they can fully disassemble it.[11]

This program which can be found inside the BDSVM directory of a BD+ protected disc is called content code.[10] The content code is executed on a virtual big endian DLX-like processor interfacing 4MB of memory. The processor supports 59 different instructions and a register set consisting of 32 general purpose registers and three special purpose registers for the instruction filter, the clock cycle counter and the program counter. The BD+ Virtual Machine applies memory protection by masking memory access addresses to prevent them from falling outside of the designated memory areas. The execution of content code starts at address 0x1000 relative to the beginning of the payload of the first block of the file 00001.svm (located inside the BDSVM directory).

On November 8, 2007, SlySoft announced that BD+ discs can be copied with their AnyDVD HD software.[12] This was possible because first generation BD+ titles did not check if AACS was present. This allowed a user to copy a BD to the harddrive and play it back from there using only a specific version of Cyberlink's PowerDVD (3319a), but not to transcode, otherwise manipulate the content or play it back from a burned BD-R or BD-RE. Updated versions of BD+ security code plugged this hole.

On January 9, 2008, engadgethd.com reported that Fox has stated that BD+ has yet to be compromised.[13] When asked how hi-def 20th Century Fox titles had become available online, the rep reported that the titles were available as HD DVDs in Europe.

On March 3, 2008, SlySoft updated AnyDVD HD allowing the full decryption of BD+,[14] allowing not only the viewing of the film itself but also playing and copying disks with third-party software.

On March 19, 2008, a new version of AnyDVD HD was released (6.4.0.0) that supported the full removal of the BD+ copy protection for all titles released to date.[15][16][17]

In May 2008 the Blu-ray release of Jumper introduced a modified version of BD+ security code which prevented the Slysoft AnyDVD HD software from removing BD+. This modified version was again circumvented by Slysoft several months after Jumper was initially released.

In August 2008, members of the Doom9 forum began work on an independent project to create an open-source implementation of BD+.[18]

In late October 2008, the same Doom9 members made the first working repaired BD+ movie with the previously developed open source tools,[19] and as of November 1, 2008, have created code to debug content produced for BD+'s virtual machine.[20]

On November 2, 2008, Doom9 forums announced that early (pre-May 2008) BD+ discs can be played back using open source software only.[21]

In early November 2008 multiple versions of BD+ security code were released which, according to Slysoft, may take a few months to circumvent.[22]

On December 29, 2008 Slysoft announced that AnyDVD HD 6.5.0.2 decrypts copy protection on all current Blu-ray movies.[23]

On February 13, 2009 a 4th version of BD+ security code was discovered on the movie Australia,[24] rendering Slysoft's existing AnyDVD HD software ineffective.

On March 19, 2009 Slysoft announced that AnyDVD HD 6.5.3.1 adds support for some new BD+ protection in movies, e.g. Australia, The Robe, and South Pacific.[25] Some BD+ movies were not supported by Slysoft's update, e.g. Slumdog Millionaire, The Day the Earth Stood Still, Marley & Me, and the X-Men Trilogy.[26] Since then, Slysoft has released several updates adding support for newer titles.

On October 7, 2009 support for BD+ was announced for MakeMKV, making it the second application capable of handling all BD+ discs released to date.[27]

In 2010 four other companies released software that can decrypt BD+: DVDFab Blu-ray Copy, Pavtube Blu-ray Copy, and BlindWrite.

On December 18, 2013, the VideoLAN developers released libbdplus, an open-source library for BD+ decryption. As with libdvdcss, the API allows media players to use it transparently.[28]

• Blu-ray Digital Rights Management