Adventures in discovering the K4PC PID.

[JSWolf]

Originally Posted by kennyc

Except that there is nothing to work with yet. Not even example/sample epubs from B&N as far as I know.

Actually, there are. I downloaded the free Star Wars book Skyborn and it came in ePub with the new flavor of DRM. The only way to view it was to use the B&N Desktop Reader.

[labba]

i♥cabbages : did you saw my post regarding this :

Originally Posted by labba

Hi! Progress:
if i set a BP on the sub_54F7E0, then dumping the buffer pointed to by arg_0. You will get 8 PID characters,
i think i need to add the two checksum chars my self accurding to the checksumPid function in the mobidedrm scripts.
the BP will stop 5 time and will give 5 different strings... i will let you know if this could be the answer..

c ya for now..
LaBBa.

what do you say is that the PID that just need fixing for checksum ?

[kennyc]

Originally Posted by JSWolf

Actually, there are. I downloaded the free Star Wars book Skyborn and it came in ePub with the new flavor of DRM. The only way to view it was to use the B&N Desktop Reader.

Yes. I posted that before I knew better. Apparently there are epub books available from B&N with the new DRM -- unfortunately they are not readily identifiable on the B&N site.

I did learn (on a B&N forum) that Sony DRMd books can be imported to the nook/B&N reader and work if that device is authorized by Adobe DE.

I downloaded that book as well from B&N and when I tried to import it into Adobe DE it tells me:

"starwars_9780345519399.epub:
Document is licensed for a different user account"

Fwiw.

[KevinH]

Hi,

That user message makes it sound like everything went like normal but just the adept key did not match.

A wild guess but someone could try the ineptepub.pyw script as it stands but with a different adeptkey.der key file that instead uses the combination of name and credit card (last 8 digits) mangled exactly as in the ereader2html.py script now.

In other words, hope that all Adobe agreed to was to exchange the adobe adept key with a key normally used by ereader (and that they really did not change the software much at all).

Worth a try anyway. I would but being from Canada, I simply can not buy (even a free e-book) from the B&N site to play around with.

Kevin

[kennyc]

Originally Posted by KevinH

Hi,

That user message makes it sound like everything went like normal but just the adept key did not match.

A wild guess but someone could try the ineptepub.pyw script as it stands but with a different adeptkey.der key file that instead uses the combination of name and credit card (last 8 digits) mangled exactly as in the ereader2html.py script now.

In other words, hope that all Adobe agreed to was to exchange the adobe adept key with a key normally used by ereader (and that they really did not change the software much at all).

Worth a try anyway. I would but being from Canada, I simply can not buy (even a free e-book) from the B&N site to play around with.

Kevin

Certainly worth a try. I'm not where I can do it at the moment.

[i♥cabbages]

Originally Posted by labba

what do you say is that the PID that just need fixing for checksum ?

That approach totally works, and I've actually already got a script working which automates doing exactly that. The problem is that the final PID is (mostly) *book-specific*. I'm going to make one more stab at a more elegant solution Amazon can't kill by changing the address of one function, but if that doesn't work then I'll go ahead and release this as is.

[phenomshel]

You're a GENIUS!!!! However, I'm not, so when you do release whatever it is, could you please PM me and give me very very basic instructions?

[labba]

so this is the solution for now:
run OllyDbg and open the K4PC exe
then go to offset : 00570A94
and set a BreakPoint on this line(f2)

you can see that Eax will contain a String
not press F9 this will break on this line for about 4-5 times the last time that it will break this will be the PID.
you will need to fix your checkSum so:
create a new python file:
just use the checksumPid function that is in the latest mobidedrm.py (v0.07)
and call it: checksumPid(pid)

then you can run the new fix checksum with : mobidedrm.py (v0.07) script to decrypt.

enjoy !!

PS : i♥cabbages : fix me if somthing that i wrote is wrong or you have a better way to do this...

LaBBa.

[i♥cabbages]

Originally Posted by labba

PS : i♥cabbages : fix me if somthing that i wrote is wrong or you have a better way to do this...

By "I wrote a script" I meant "I wrote a script which uses the Windows debugging API to automatically drive the K4PC executable, set the breakpoint, and extract the PID." I'll push that script out if a different approach I'm trying doesn't work.

That said, your instructions look correct, but I understand this forum discourages direct posting of content describing DRM circumvention, so you may wish to move them elsewhere and replace with a link.

[kennyc]

Originally Posted by i♥cabbages

By "I wrote a script" I meant "I wrote a script which uses the Windows debugging API to automatically drive the K4PC executable, set the breakpoint, and extract the PID." I'll push that script out if a different approach I'm trying doesn't work.

That said, your instructions look correct, but I understand this forum discourages direct posting of content describing DRM circumvention, so you may wish to move them elsewhere and replace with a link.

Thank you for that.



and all your work. DRM is evil.

[labba]

Originally Posted by i♥cabbages

By "I wrote a script" I meant "I wrote a script which uses the Windows debugging API to automatically drive the K4PC executable, set the breakpoint, and extract the PID." I'll push that script out if a different approach I'm trying doesn't work.

That said, your instructions look correct, but I understand this forum discourages direct posting of content describing DRM circumvention, so you may wish to move them elsewhere and replace with a link.

i done the editing will post somware else..

[labba]

i posted the solution on other Reverse Engineering forum with all the solution:

http://www.woodmann.com/forum/showth...4064#post84064


enjoy.

LaBBa.

[omk3]

[Gaurnim]

Originally Posted by labba

i posted the solution on other Reverse Engineering forum with all the solution:

http://www.woodmann.com/forum/showth...4064#post84064


enjoy.

LaBBa.

Thanks for sharing your work, labba.

I tried to download the files provided through your link, but I get an antivirus alert about the virus PUS:App/PtchCrk-A.
Is there a problem with the files or is this a false positive ?

[Terisa de morgan]

I used it, but the windows doesn't shown anything Only strange characters.