DRMLab

tools/playready_rev.py

@@ -0,0 +1,206 @@
+#!/usr/bin/env python3
+"""
+PlayReady public key hash revocation checker.
+
+- Fetches Microsoft's revocation XML.
+- Extracts the PlayReady Silverlight Runtime revocation list.
+- Prints all 32-byte public key hashes (Base64).
+- If a hash is provided (argv[1] or prompted), reports whether it's revoked.
+- If 'bgroupcert.dat' in directory, extract the hash and reports whether it's revoked.
+
+Compatible with Python 3.8+.
+"""
+
+from __future__ import annotations
+
+import base64
+import struct
+import sys
+import uuid
+from typing import Iterable, List, Optional
+
+import requests
+import xmltodict
+
+# --- Configuration ----------------------------------------------------------------
+
+REV_URL = "https://go.microsoft.com/fwlink/?LinkId=110086"
+
+# GUID for PlayReady Silverlight Runtime (as raw bytes like original code)
+GUID_PR_SILVERLIGHT_RUNTIME = bytes([
+    0x4E, 0x9D, 0x8C, 0x8A, 0xB6, 0x52, 0x45, 0xA7,
+    0x97, 0x91, 0x69, 0x25, 0xA6, 0xB4, 0x79, 0x1F
+])
+
+# If construct is available, we’ll use it to parse the binary blob declaratively.
+try:
+    from construct import Struct as CStruct, Bytes, Int32ub
+    _HAS_CONSTRUCT = True
+except Exception:
+    _HAS_CONSTRUCT = False
+
+
+# --- Helpers ----------------------------------------------------------------------
+
+def _expected_guid_le_hex(guid_bytes: bytes) -> str:
+    """
+    The source blob compares the first 16 bytes against UUID(...).bytes_le.
+    Keep that exact behavior to match the original script.
+    """
+    return uuid.UUID(guid_bytes.hex()).bytes_le.hex()
+
+
+def _parse_revocation_blob_with_construct(blob: bytes) -> Optional[List[bytes]]:
+    """
+    Parse a revocation list blob using construct (if installed).
+    Format per original code:
+      [0:16]  GUID
+      [16:20] unknown / reserved
+      [20:24] entries_count (u32 big-endian)
+      [24: ]  entries_count * 32-byte hashes
+    """
+    if not _HAS_CONSTRUCT:
+        return None
+
+    RevHeader = CStruct(
+        "type_guid" / Bytes(16),
+        "reserved"  / Bytes(4),
+        "entries_count" / Int32ub,
+    )
+
+    # First parse header to get count
+    if len(blob) < 24:
+        return []
+
+    header = RevHeader.parse(blob[:24])
+
+    # Verify GUID (same logic/endianness as original)
+    if blob[:16].hex() != _expected_guid_le_hex(GUID_PR_SILVERLIGHT_RUNTIME):
+        return []
+
+    # Extract entries
+    start = 24
+    end = start + (header.entries_count * 32)
+    if end > len(blob):
+        # Truncated blob; be defensive
+        end = min(len(blob), start + ((len(blob) - start) // 32) * 32)
+
+    entries = [blob[i:i+32] for i in range(start, end, 32)]
+    return entries
+
+
+def _parse_revocation_blob_manually(blob: bytes) -> List[bytes]:
+    """
+    Manual parser (no construct). Mirrors the original byte slicing exactly.
+    """
+    if len(blob) < 24:
+        return []
+
+    # GUID check with the same endianness trick as original
+    if blob[:16].hex() != _expected_guid_le_hex(GUID_PR_SILVERLIGHT_RUNTIME):
+        return []
+
+    # entries_count is big-endian u32 at offset 20
+    entries_count = struct.unpack_from(">I", blob, 20)[0]
+    cursor = 24
+    out: List[bytes] = []
+    for _ in range(entries_count):
+        if cursor + 32 > len(blob):
+            break
+        out.append(blob[cursor:cursor+32])
+        cursor += 32
+    return out
+
+
+def _iter_revocation_lists(xml_root: dict) -> Iterable[bytes]:
+    """
+    Yields each decoded revocation list (ListData) as raw bytes.
+    Handles the cases where Revocation is a dict or a list of dicts.
+    """
+    rev = xml_root.get("RevInfo", {}).get("Revocation")
+    if rev is None:
+        return
+
+    items = rev if isinstance(rev, list) else [rev]
+    for item in items:
+        data_b64 = item.get("ListData")
+        if not data_b64:
+            continue
+        try:
+            yield base64.b64decode(data_b64)
+        except Exception:
+            continue
+
+
+def _fetch_revocation_index(url: str = REV_URL) -> dict:
+    resp = requests.get(url, timeout=20)
+    resp.raise_for_status()
+    # xmltodict produces nested OrderedDict-like structures; dict() is fine
+    return xmltodict.parse(resp.text)
+
+
+def _collect_public_key_hashes(xml_root: dict) -> List[str]:
+    """
+    Returns Base64-encoded 32-byte public key hashes from the
+    PlayReady Silverlight Runtime revocation list.
+    """
+    hashes_b64: List[str] = []
+
+    for blob in _iter_revocation_lists(xml_root):
+        # Try construct first (if available), then fallback
+        entries = _parse_revocation_blob_with_construct(blob) if _HAS_CONSTRUCT else None
+        if entries is None:
+            entries = _parse_revocation_blob_manually(blob)
+
+        if not entries:
+            continue
+
+        for entry in entries:
+            hashes_b64.append(base64.b64encode(entry).decode("ascii"))
+
+    return hashes_b64
+
+
+# --- CLI --------------------------------------------------------------------------
+
+def main(argv: List[str]) -> int:
+    try:
+        xml_root = _fetch_revocation_index(REV_URL)
+    except Exception as e:
+        print(f"Failed to fetch or parse revocation index: {e}", file=sys.stderr)
+        return 2
+
+    publickey_hashes = _collect_public_key_hashes(xml_root)
+
+    # Print the list (like the original)
+    if publickey_hashes:
+        print("\n".join(publickey_hashes))
+
+    # Determine the input hash
+    pubkey_hash: Optional[str] = None
+    if len(argv) > 1 and argv[1]:
+        pubkey_hash = argv[1].strip()
+        print()
+        print("Provided hash:", pubkey_hash)
+   
+    if not pubkey_hash:
+        bcert = open("bgroupcert.dat", "rb").read()
+        pubkey_hash = base64.b64encode(bcert[0x48:0x68]).decode()
+        print()
+        print("Calculated hash:", pubkey_hash)
+
+    if not pubkey_hash:
+        print("No hash provided.")
+        return 1
+
+    if pubkey_hash in publickey_hashes:
+        print("one of hashes in CRL match the input hash.")
+        print("PlayReady Cert is revoked.")
+        return 0
+    else:
+        print("PlayReady Cert is valid.")
+        return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main(sys.argv))