Evidence at a glance
Loading source evidence…
What was done
Analysis of the Acrodea VIVID Runtime DRM, documenting package formats and enabling offline recovery of content encryption keys from preserved device data.
The Acrodea VIVID Runtime is a portable-binary execution environment used by the G-Gee store. Research documents the platform's package formats, including a custom LZMA wrapper and a ZIP-based expansion container with a 32-byte header offset. The DRM system utilizes a server-generated AES-256 content encryption key (CEK) that is not present in client binaries. While the CEK cannot be recovered from the package alone, the author reports that the rights object containing the CEK is cached on the device. Its protection is a hardcoded 16-byte constant XORed with the device's identity string, allowing for offline recovery using preserved keystore.dat and datastore.dat files. The author credits Claude as a co-author. The research confirms that content decryption is verified via GCM authentication tags. The platform's fsPacked inner scramble was fully reversed. The author notes that while earlier claims suggested signature digests could serve as a decryption oracle, this was corrected; digests are packaging checksums only. The recovery process is reproducible from public dumps containing the necessary runtime data.
Reproduce it
Use the provided ggee_drm.py tool on a preserved install's runtime/keystore.dat and datastore.dat files to recover the CEK and decrypt content.
Community
Ask a question, share what worked, or follow the next milestone.