[Tutorial] Zune DRM removal

[placebo]

Album Only tracks

Some "Album Only" tracks can be streamed/played in full-length, some are available in 30secs preview, and some can't be previewed: it doesnt matter, this post explains how you save the track, in all 3 cases, in full-length anyway!!!

In the 2 latter cases (bad luck, see below screenshot) you can use stream-recorder.com or simply look in the Temporary Internet Files folder to find the streamed (and automatically saved! by zune.exe) *.wma's. Look for "audio" in the file names and file extension could be *.dat, e.g. possible file names are audio[1].dat, audio.wma#0;1.000;0;0;1:2, etc.

From the track size and length, you can calculate the sound quality (bitrate). I always get ~126kbps (and never 128.0kbps).



(click on pic for more info)

Now you know the static URL's of the 126k media (DRM-protected WMA-files), good:

mms://stream.zune.net/a4241/e3/033/984/819/at/audio.wma
mms://stream.zune.net/a4241/e3/033/984/823/at/audio.wma
mms://stream.zune.net/a4241/e3/033/984/825/at/audio.wma
mms://stream.zune.net/a4241/e3/033/984/831/at/audio.wma
mms://stream.zune.net/a4241/e3/033/984/833/at/audio.wma
mms://stream.zune.net/a4241/e3/033/984/837/at/audio.wma

Interestingly, you can switch the protocol and nothing happens. If in doubt, use both sets and compare the files. If you havent f*cked it up, the files will be exactly the same!!

rtsp://stream.zune.net:554/a4241/e3/033/984/819/at/audio.wma
rtsp://stream.zune.net:554/a4241/e3/033/984/823/at/audio.wma
rtsp://stream.zune.net:554/a4241/e3/033/984/825/at/audio.wma
rtsp://stream.zune.net:554/a4241/e3/033/984/831/at/audio.wma
rtsp://stream.zune.net:554/a4241/e3/033/984/833/at/audio.wma
rtsp://stream.zune.net:554/a4241/e3/033/984/837/at/audio.wma

By default, zune.exe caches the streaming audio in Temporary Internet Files folder located at
C:\Documents and Settings\placebo\Local Settings\Temp\Temporary Internet Files\Content.IE5\W12Z8HA7\audio[1].dat
You must change that. Go to Internet Explorer>>Extras>>Internet Options...>>General (tab)>>Temporary Internet Files>>Settings...>>Current Location>>Move Folder...>>and choose "C:\Documents and Settings\placebo\Local Settings\" (and dont choose "C:\Documents and Settings\placebo\Local Settings\Temporary Internet Files\" or "C:\Documents and Settings\placebo\Local Settings\Temp\" or "C:\Documents and Settings\placebo\Local Settings\Temp\Temporary Internet Files\"), so that the Current Location displays as:
C:\Documents and Settings\placebo\Local Settings\Temporary Internet Files\

You might have to reboot.

From now on, zune.exe caches the streaming audio in Temporary Internet Files folder as depicted in the screenshot, i.e. as
C:\Documents and Settings\placebo\Local Settings\Temporary Internet Files\audio.wma#0;1.000;0;0;1:2
from which you can read the MMS-url directly. The MMS-url doesnt appear instantly; wait a little until the system has fully cached the streaming audio track.

Then use a valid license on WinPcap 4.1.2 to download the above set(s). Finally, strip off the DRM-protection with FairUse4WM. (it is instructive to compare the audio[1].dat, audio[2].dat, ... files from the Temporary Internet Files folder with the DRM-protected files and with the un'DRMed files from the rtsp/mms protocol download. visual byte-per-byte comparisons can be done with BC3, good luck)

As i can see in your face, this whole procedure is a little complicated. That's why i recommend it only for tracks for which an official DOWNLOAD-button (FREE 192k *.wma, DRM-protected) does not exist.

[placebo]

some additional general remarks to the above:

i've encountered several different cases (and there might be more!), which i find quite interesting. it means that the audio database of MZMP is not 100% coherent or structurally uniform but any posted album can have different 'properties'. Apart from the fact that the streaming url can always be read from the Temporary Internet Files folder, we have:

case a:
album has some 'Album Only' tracks and they cannot be previewed at all and you can guess their streaming url and download those tracks in full-length with the default method. (the Michael Jackson This Is It)

case b:
album has some 'Album Only' tracks and they can be previewed in full-length and their streaming url's download full-length *.wma's.

case c:
album has some 'Album Only' tracks and they can be previewed 30secs only and their streaming url's download 30secs *.wma's. the other tracks play (and 192k-download) in full-length but their streaming url's download, again, only 30secs *.wma's.

case d:
album has exclusively 'Album Only' tracks and they can be previewed 30secs only and their streaming url's download 30secs *.wma's.

case e:
etc.

etc.

Other cases might be possible -- so it is a matter of luck if your mms/rtsp url downloads a full-length *.wma; it depends on the album (as provided by the publisher/label) and maybe even Microsoft might be responsible for this. To sum up, 30secs previews most likely mean you're busted!

EDIT:
read on, you are not busted! . some clever boardie found a way to convert the 30secs url's to full-length url's. Congratulations to this key discovery!!! great 'team work', hehe...

[swooshycueb]

Something I just found: the stream urls have an "at" or "ap" just before audio.wma. at is a full track, and ap is a 30-sec preview. Example:

Full track:
mms://stream.zune.net/a4241/e3/109/711/767/at/audio.wma#0;1.000;0;0;1:2

30-sec preview:
mms://stream.zune.net/a4241/e3/109/711/767/ap/audio.wma#0;1.000;0;0;1:2

[placebo]

Originally Posted by placebo

HOLY SH*T!!!!!!!!!!!!!!!!!!
this is sooooooooooooooo cool! Thanks so much for this important information! It works yaaoouuuhhhhww

Excellent. i owe you a keg of beer, really. THANKS A LOT!!!

(i dont know if my posts were clear and sufficiently detailed. but your post proves that i dont need to write more details. you have found the MMS-url's and you used them to download the 128k server files with the default method. great job dude. btw, some VERY long AlbumOny tracks (30mins+) seem to pose some problem for the default method if you use the MMS-protocol. no doubt, the MMS-protocol is the preferred one because it surely gives exact/correct download results. in difficult cases (e.g. long tracks!) you need to employ the RTSP:554 protocol ... and dont wonder if everything around you crashes hehe.. The RTSP-protocol is simply not a clean protocol as MMS. Anyway, for a 10mins track, your file should have about 10MB's. If your file is 20MB's, then trash your method (and send me a PM for individual trouble-shooting).)

mms://stream.zune.net/a4241/e3/109/711/767/at/audio.wma#0;1.000;0;0;1:2

i've examined your given track. it is damn long!! almost 48mins.! wtf?!?!
Here the stats of your file:

protocol used: RTSP port 554
size: 44,4 MB (46.643.703 Bytes)
track length: 47'56'' (in WMP10)
meta data: A Thousand Suns: The Full Experience / Linkin Park
can be playback'ed by me: yes
can be un'DRMed by me: yes
CRC32: FB0173B6

Can you confirm it (especially the CRC32 code)? (also, see your PM inbox!)
As I found out, here is the url for the 192k track:

http://download.zune.net/d.php/109/711/767/wu/cache/audio.wmrm10

i get 66,1 MB (69.376.564 Bytes), crc32:43A09392, rename it to *.wma, it is all tagged, 192kpbs. i just cant get it to play with WMP10. [EDIT: 43A09392 re-confirmed on the school computer. download-rate 7.53MB/s!!]

Leaving the AlbumOnly tracks aside, for a normal track (192k WMA) i've compared the http-download-zune downloaded track with the standard download method (DOWNLOAD-button). File sizes are the same, but headers differ. This makes clear that 192k *must* be downloaded thru the DOWNLOAD-button, which will modify the file's header such that it contains some licensing sh*t. oh well. so maybe there's no way that we can get the 192k AlbumOnly tracks to play (or un'DRM).

[swooshycueb]

OK, this is getting a bit out of hand.

I would really like to be able to edit my old posts so we can get this thread a bit more organized. Anybody know how to get the admin's attention in a way that won't get me banned?

And yes, that is the correct track. (If I knew you were going to download the thing, I would have posted something smaller.) I don't know about the CRC, cuz I already stripped the DRM and got rid of the original.

Here's another:
stream.zune.net/a4241/e3/008/146/123/at/audio.wma#0;1.000;0;0;1:2
CRC32: 0A9D1AE5
Media Usage Rights tab in properties in WMP says "This file is missing media usage rights"

The 192k wma cites zune as the content distributor, while the 128k wma cites MusicNet.

[placebo]

Originally Posted by swooshycueb

Here's another:
stream.zune.net/a4241/e3/008/146/123/at/audio.wma#0;1.000;0;0;1:2
CRC32: 0A9D1AE5
Media Usage Rights tab in properties in WMP says "This file is missing media usage rights"

The 192k wma cites zune as the content distributor, while the 128k wma cites MusicNet.

on my home PC:
My 128k doesnt cite MusicNet/Zune (in the tags) but has the usual tags (Warner Bros, etc.), and WMP10 says "This file can be played until" (November). In any case, using the stream-recorder.com's default method i get
4,10 MB (4.304.213 Bytes), crc32: 95851B39 using the MMS-protocol (with no further port specification)
and 4,10 MB (4.304.213 Bytes), crc32: 95851B39 using the RTSP-protocol using port 554. Files result identically the same: my MMS-download result confirmed!

on the brandnew highschool PC's:
as you can see, the PCs have WMP9 installed. for the 128k/192k i get respective MusicNet/Zune messages, see attached GIF's. on the school PC again, i am re-confirming the download result(s) of my home pc, crc32: 95851B39.

here is the file if you want to binarily compare it with yours; i am guessing that your WinPcap settings are not 100% exact:
http://rapidshare.com/files/427225706/audio.wma

[Stream Ripper]

Originally Posted by swooshycueb

OK, this is getting a bit out of hand.

I would really like to be able to edit my old posts so we can get this thread a bit more organized. Anybody know how to get the admin's attention in a way that won't get me banned?

And yes, that is the correct track. (If I knew you were going to download the thing, I would have posted something smaller.) I don't know about the CRC, cuz I already stripped the DRM and got rid of the original.

Here's another:
stream.zune.net/a4241/e3/008/146/123/at/audio.wma#0;1.000;0;0;1:2
CRC32: 0A9D1AE5
Media Usage Rights tab in properties in WMP says "This file is missing media usage rights"

The 192k wma cites zune as the content distributor, while the 128k wma cites MusicNet.

The admins attention has been captured - what did you want to do exactly? We've disabled editing of old posts due to spammers making legit posts, and then coming back to change them when we're 'not looking'

[swooshycueb]

Originally Posted by placebo

on my home PC:
My 128k doesnt cite MusicNet/Zune (in the tags) but has the usual tags (Warner Bros, etc.),

Open the file in a text editor. You'll see what I'm talking about.

and WMP10 says "This file can be played until" (November).

I'm using WMP11b2

i am guessing that your WinPcap settings are not 100% exact:

I'm using SDP, not WinPcap. Works just as well.

Originally Posted by Stream Ripper

The admins attention has been captured - what did you want to do exactly? We've disabled editing of old posts due to spammers making legit posts, and then coming back to change them when we're 'not looking'

I can assure you I am no spammer. I would like to be able to edit my posts in this thread (or at least the first one) so we can make it more organized, and so the updated tutorial is not halfway down the page.

[placebo]

my 14days trial (was a great time! comfortable downloadings!!) has expired. since this here is "the zune thread (from A-Z)", does NE1 know if i can use the same credit card for setting up another 14days trial (by choosing a new Windows Live ID)?

let's be clear. RHDY costs US$9.99 and Thumbplay US$9.99 too (per month). Microsoft is really expensive.

Ouch!

[swooshycueb]

OK, I'm going to try to make this easier for people.

ThinApp to the rescue!

If this works, by the end of it all, you should have a little package that

• Can be run on any Windows OS
• Is 95% portable
• Counts as one computer registered to Zune Pass, no matter how many computers you run it on
• Can rip streams
• Can strip DRM
• Preserves changes

APPLICATION VIRTUALIZATION FOR THE WIN!