Sunday, April 10, 2005
HOWTO de-obfuscate proprietary Sony Network Walkman files
Waider sez, "I've spent some time over the past fortnight unravelling Sony's obfuscated MP3 file format as used on the Network Walkman device I have, and probably others in the same product range. The URL has a full writeup that should allow folk to roll their own code - I've already got command-line tools to load, list and unload the device under Linux, and I've made a first pass at a plugin for XMMS to allow you to play files straight off the device. Note, this isn't ATRAC - it's obfuscated MP3."
* The file starts with a 4-byte signature, "WMMP"See, this is why DRM is doomed: some guy spends a couple weeks' spare time picking apart a file-format for the intellectual challenge, and then your system is irrevocably, totally, permanently b0rked. Sucks to be a DRM engineer: how do they sleep nights, anyway? Link (Thanks, Waider!)* Next is a 4-byte longword giving the total file-size in bytes. This includes the file header, i.e. it's exactly what you'd see displayed in a directory listing of the file.
* Next is the duration of the track in milliseconds, again in a 4-byte longword.
* The third 4-byte longword gives the number of frames in the file. If you're trying to write a file to the device using your own code, I recommend ripping bits out of XMMS or mp3info to get this number, as I had difficulty locating a library that would calculate it without actually decoding the entire file.
* There are 16 bytes of magic: there's the 0x08 0x9f 0x9e 0xff sequence that occurs in the PBLIST file, followed by 0x01, and padded out to 16 bytes with 0x00. I've no idea what any of this is but it seems unchanging.
* The rest of the file is the obfuscated MP3 data, with no ID3 frames - strip those out before you encode or your file will not play in the device.
posted by Cory Doctorow at 10:30:00 AM permalink | Other blogs' comments
