Analyzing the Monoprice Blackbird HDCP 2.2 to 1.4 Down Converter
I bought my fingers on a
Monoprice Blackbird 4K Pro HDCP 2.2 to 1.4 Converter.
In keeping with the advertising and marketing copy it “is the definitive answer for playback of recent 4K HDCP 2.2 encoded
content material on 4K shows with the outdated HDCP 1.4 customary.”
Stuffed after a scrumptious Thanksgiving meal, I made a decision to take it aside after the friends had left. It’s
a easy single-function system, so I didn’t count on a lot, however perhaps there’s some issues to be realized?
If you need a cryptographically safe system, there’s nothing worse than creating your individual customized protocol
as an alternative of confirmed one, however that’s precisely what occurred within the case of
High-Bandwidth Digital Content Protection (HDCP).
Model 1 was developed someplace initially of the century and turned out to be terribly damaged.
By 2010, it was utterly defeated with the discharge of the
master key that can be utilized to
generate transmit and obtain keys at will.
To maintain Hollywood completely satisfied, a succesor was invented: HDCP 2.0, a wholly new protocol with no similarities
to revision 1. This time, the creators determined to make use of confirmed cryptography algorithms reminiscent of public key
authentication, and 128-bit AES encryption. HDCP 2.1 added the idea of content material stream sorts to dam the
retransmition of top quality video streams (e.g. 4K or HDR).
Regardless of utilizing known-good core algorithms, there was nonetheless
a major issue
in the way in which sure information was exchanged between transmitter and receiver, necessitating a 2.2 revision
that wasn’t backward appropriate with variations 2.0 and a couple of.1. There’s an HDCP model 2.3 now, however
it’s not reallly clear if there are any real-world penalties…
At present, all new TVs assist each HDCP 2 and HDCP 1 in order that legacy HDCP 1-only sources reminiscent of DVD gamers
are nonetheless supported. Equally, most HDCP 2 sources will fall again to HDCP 1 when coping with older
TVs that don’t have HDCP 2 assist.
There’s a serious concern nevertheless: bear in mind how HDCP 2.1 added content material stream sorts? There are at the moment solely 2 of
them: kind 0 and sort 1, the place kind 1 is taken into account excessive worth. It’s as much as a content material supplier to determine
whether or not a video stream will get tagged as such. Within the case of Netflix, UHD (4K) or HDR content material is assessed as
kind 1 whereas conventional HD content material (720p and 1080p non-HDR) is kind 0. On Amazon Prime, 1080p HDR content material
is assessed as kind 0 content material, however UHD, with our with out HDR, is assessed as kind 1.
So you probably have a 4K show that solely helps HDCP 1, you’re out of luck: Netflix and Amazon will solely serve
1080p streams. The difficulty can’t be solved with repeaters reminiscent of house theater video receivers, as a result of
the HDCP specification prohibits retransmision of kind 1 content material.
And but, the Monoprice Blackbird claims to do HDPC 2 to HDCP 1 downconversion simply advantageous. Perhaps it solely helps
kind 0 content material, making it technically HDCP 2 compliant even when it doesn’t helps solely a fraction of the accessible
content material?
The surface of the Blackbird is forgettable, with the form of black steel case that’s utilized by most
protocol conversion bins.
After eradicating the highest cowl, you’re greeted with the next:
(Click on to enlarge)
The design is simple: a principal conversion IC, an SPI flash reminiscence, a microcontroller,
and a bunch of jellybean parts to create energy rails.
Let’s have a look at the principle actors:
-
Silicon Picture Sil9679CNUC
Google has fairly a little bit of hits for this product, however they’re all articles from method again when HDCP 2.2
succesful TV silicon was uncommon. Apparently, this chip was the very first one which allowed televsion
producers so as to add assist for HDCP 2.2 to their 4K TVs. It solely helps the YUV 4:2:0 shade format,
however that’s ample for many TV content material.Just a few years in the past, Silicon Picture was acquired by Lattice Semiconductor, so the Sil9679 is now listed on the Lattice
TV HDMI / MHL Receivers product page:
(Click on to enlarge)However there’s no datasheet to be discovered.
BTW, discover how the desk above lists HDMI 2.0 assist. Most individuals affiliate HDMI 2.0 with full high quality 4K 60Hz
assist, which requires a cable bandwidth above the restrict of HDMI 1.4. 4K 60Hz in YUV 4:2:0 mode, nevertheless,
suits properly inside the capabilities of HDMI 1.4. It’s a thriller why the desk claims HDMI 2.0 capabilities…A Google seek for “Sil9679 datasheet” turns up a
datasheet for the Sil9678
on LCSC. It’s a unique product that does precisely the other: convert from HDCP 1.4 to HDCP 2.2, however
it has the identical packages and after shut examination of the PCB, the pinout appears similar at properly.Likelihood is excessive that the Sil9678 and Sil9679 use the identical silicon with completely different features
fused off… -
STMicroelectronics STM8S005K6T6C Microcontroller
No secrets and techniques right here: the datasheet is available.
This member of the STM8 series has an 8-bit CPU, 32KB of flash reminiscence,
2KB of RAM, and the same old assortment of timers, UART, I2C, and SPI interfaces. It’s simply what you want for
some easy configuration and management of one other chip. -
Console Connector J1
You may visually hint the PCB traces from connector J1 to the STM8 controller: 2 pins are linked
to its UART interface. We’re positively going to have a better have a look at that. -
Debug Connector J2
The second pin of connector J2 is linked to the SWIM pin of the STM8. SWIM is brief for
Single Wire Interface Module.
It’s a single-pin various of the extra frequent JTAG interface.
To check whether or not or not the HDCP converter works, I did a few experiments.
The tools:
- an Amazon Fireplace TV Stick 4K
- a 15 12 months outdated Samsung TV, 1080p, no HDR, HDCP1 solely
- a 5 12 months outdated Monoprice 4K 32” monitor, HDR assist (horrible high quality), HDCP1 solely
- the Monoprice HDCP 2 to HDCP 1 converter
For content material, I picked a random Amazon Prime present with UHD/4K and HDR10+ assist:
Z, the Starting of Every thing.
Samsung 1080p TV, Fireplace TV Stick, no converter
The primary take a look at counts as a final analysis. With the Fireplace TV plugged in straight into the
outdated TV, I needed to see whether or not or not there’d be a visible indication that the Fireplace TV was
taking part in decrease high quality content material.
This was certainly the case. Whereas the content material browing display screen indicated assist for UHD
and HDR10+, urgent pause throughout taking part in confirmed “HD 1080p”.
MonoPrice 4K monitor, Fireplace TV Stick, no converter
For the following step, I plugged the Fireplace TV instantly into my 4K monitor. Because the monitor
doesn’t assist HDCP 2, I anticipated decrease high quality playback than 4K/HDR, and that’s what I bought.
This time, the participant confirmed “HD 1080p HDR”.
MonoPrice 4K monitor, Fireplace TV Stick, with HDCP converter
The ultimate take a look at places the HDCP converter between the Fireplace TV and the monitor. If the converter
does its job, I ought to be seeing 4K with HDR enabled.
And it does! The participant now reveals “Extremely HD HDR”.
As an intermediate conclusion, we will agree that the HDCP converter is certainly doing
one thing that makes the Fireplace TV imagine that it’s coping with one thing higher than an
outdated HDCP1 enabled show.
However what’s it doing precisely?
Let’s dig deeper. The apparent second step is to wire up the UART pins of the
microcontroller and see if there’s something fascinating to see there.
I used a USB to serial converter to seize UART site visitors with a 115200 bit charge.
The TX port of the UART is chatty each time there’s some main occasion: booting up,
plugging an HDMI cable in or out, or going to sleep. I typed a bunch of instructions again
to the system, however was not capable of get a response of out it.
Booting Up
The message after plugging within the energy cable:
Copyright Silicon Picture Inc, 2013
Construct Time: Aug 31 2015-14:50:30
Host Software program Model: 01.02.02
Adapter Driver Model: 01.00.11
Require FW model: 02.02.xx
Ready Boot Accomplished ....
Booting is completed efficiently.
Chip ID: 0x9679
Firmware Model: 01.02.06
***Error: Chip FW Model not match.
Plugging within the sink
After I plug within the output HDMI cable to attach the monitor
to the converter, it sends out this:
Downstream Join Standing Modified:
Hyperlink Kind is: HDMI/DVI
Tx HDCP Model:
HDCP model is: 1.x
Tx HDCP Standing Modified:
Tx HDCP Authentication Off.
Rx HDCP Model:
HDCP model not assist
Rx HDCP Standing Modified:
Rx HDCP Authentication Off.
Edid Standing: Avaliable
Edid Block 0 Information:
00 ff ff ff ff ff ff 00 24 62 00 32 01 01 01 01
10 1c 01 03 80 47 28 78 3e 64 35 a5 54 4f 9e 27
12 50 54 bf ef 80 d1 c0 b3 00 a9 c0 95 00 90 40
81 80 81 40 81 c0 40 d0 00 a0 f0 70 3e 80 30 20
35 00 54 4f 21 00 00 1a b4 66 00 a0 f0 70 1f 80
30 20 35 00 80 88 42 00 00 1a 00 00 00 fc 00 48
44 4d 49 32 0a 20 20 20 20 20 20 20 00 00 00 fd
00 18 90 0f de 3c 00 0a 20 20 20 20 20 20 01 30
Edid Block 1 Information:
02 03 4f f2 5e 04 05 10 13 14 1f 20 21 22 27 48
49 4a 4b 4c 5d 5e 5f 60 61 62 63 64 65 66 67 68
69 6a 6b e2 00 c0 e3 05 c0 00 23 09 7f 07 83 01
00 00 e5 0f 00 00 0c 00 67 03 0c 00 10 00 38 78
67 d8 5d c4 01 78 88 01 e6 06 05 01 69 69 4f 02
3a 80 18 71 38 second 40 58 2c 25 00 55 50 21 00 00
1e 69 5e 00 a0 a0 a0 29 50 30 20 35 00 00 b0 31
00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 df
We will see the way it doesn’t undergo HDCP authentication but, but it surely waits
for the supply on the enter HDMI port.
The EDID information incorporates all of the details about the linked monitor: supported
resolutions and refresh charges, colometry data, audio modes and so forth.
After eradicating the “Edid Block 1 Information”, you’ll be able to paste these hex values straight into
an online EDID parser to extract all of the
EDID data in a readable format.
The converter wants this EDID information in order that it could move it on to the upstream
supply system on its enter port.
Plugging within the supply
Most vital is what occurs when plugging within the supply:
Upstream Join Standing Modified:
Hyperlink Kind is: HDMI/DVI
Sync Detect: ON
Clock Detect: ON
Rx HDCP Model:
HDCP model is: 2.2
Rx HDCP Standing Modified:
Rx HDCP Authenticating...
AV Mute Standing Modified:
AV Mute ON
Tx HDCP Model:
HDCP model is: 1.x
Tx HDCP Standing Modified:
Tx HDCP Authenticating...
Rx HDCP Model:
HDCP model is: 2.2
Rx HDCP Standing Modified:
Rx HDCP Authenticating...
AV Mute Standing Modified:
AV Mute OFF
Tx HDCP Model:
HDCP model is: 1.x
Tx HDCP Standing Modified:
Tx HDCP Authentication Accomplished.
Rx HDCP Model:
HDCP model is: 2.2
Rx HDCP Standing Modified:
Rx HDCP Authenticating...
Rx HDCP Model:
HDCP model is: 2.2
Rx HDCP Standing Modified:
Rx HDCP Authentication Accomplished.
We will see how the enter/RX and the output/TX port undergo
an HDCP2 and HDCP1 authentication respectively.
Sadly, the console log nonetheless doesn’t inform us whether or not or not the HDCP2
authentcation is for kind 0 or kind 1 content material.
To actually know what’s occurring, we have to observe the management site visitors that runs
over the Display Data Channel (DDC) of
the HDMI cable. DDC makes use of the usual I2C protocol that
will be decoded by any self-respecting logic analyzer or oscilloscope.
The SCL and SDA indicators of the DDC channel are current on pins 15 and 16 of the HDMI connector.
It takes a little bit of endurance, a gentle hand, and, in my case, a microscope to solder two
tiny wires to these pins, but it surely’s completely doable with a advantageous tipped soldering iron. As soon as in
place, you’ll be able to seize the I2C transactions with a logic analyzer reminiscent of a Saleae or DSLogic
for additional evaluation:
There are a number of I2C units on the DDC bus:
-
EDID: tackle 0x50
This incorporates the EDID data that we noticed earlier on the console log. On many older
displays there’s actually an I2C PROM soldered onto the wire. Newer displays deal with EDID
I2C requests with an I2C system controller within the scaler chip. -
SCDC: tackle 0x54
The Standing and Management Information Channel was launched for HDMI 2.0. For earlier variations,
information transmission over the high-speed HDMI hyperlinks was a pure one-way fire-and-forget
affair. HDMI 2.0 added standing registers to look at hyperlink high quality and management registers to
management clock to information ratio, allow or disable scrambling operation and so forth.The HDMI converter solely helps HDMI 1.4, so you’ll be able to count on to supply requests to
tackle 0x54 to end in an I2C NAK (not-acknowledged) response. -
HDCP: 0x3A
This tackle is used for learn and write entry to varied HDCP registers which are used
to change authentication and standing data.
I2C Transactions
Let’s stroll by means of the important thing I2C transactions of the recorded hint.
Initially, nothing is linked, and the sink, the HDCP converter on this case, doesn’t reply:
// HDCP... Nothing linked
write to 0x3A nak
...
write to 0x3A nak
Subsequent, the supply reads the EDID data:
// Learn EDID Web page 0
write to 0x50 ack information: 0x00
learn to 0x50 ack information: 0x00 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0x00 ...
// Learn EDID Web page 1
write to 0x50 ack information: 0x80
learn to 0x50 ack information: 0x02 0x03 0x4F 0xF2 0x5E 0x04 0x05 0x10 ...
The supply then checks if it’s coping with an HDMI 2.0 sink. It’s not,
so the entry ends in a NAK:
// SCDC
write to 0x54 nak
The supply is now able to allow HDCP safety. HDCP paperwork will be discovered
on the HDCP Specifications web page
of the Digital Content material Safety consortium.
There are specs that describe the overall ideas, such because the
HDCP Specification Rev. 2.2 Interface Impartial Adaptation, in addition to
specs with interface particular implementation particulars, such because the
HDCP 2.3 on HDMI Specification. We will use the latter to decode the
that means of the I2C transactions. Part 2.14 HDCP Port reveals all of the
supported I2C registers.
First, the supply checks the HDCP2Version register. Bit 2 of register 0x50 signifies
that HDCP2 is supported.
// HDCP HDCP2Version
write to 0x3A ack information: 0x50
// Helps HDCP2.2 or larger
learn to 0x3A ack information: 0x04
That is then adopted by the precise cryptographic change sequence.
The supply signifies that it needs an HDCP2 authentication:
// HDCP Write_Message: msg_id=0x02 AKE_Init, Information len=11
// Final 3 bytes: 0x02 0x00 0x00 -> HDCP transmitter model = 0x02
write to 0x3A ack information: 0x60 0x02 0xBB 0xDA 0x14 0x6B 0x44 0xFB 0x1A 0x0C 0x02 0x00 0x00
This ends in the sink returning a message that’s 534 bytes lengthy. It incorporates the
monitor’s authentication certificates, a public key, but in addition whether or not or not the sink is
a closing terminal or a repeater:
// HDCP RxStatus
write to 0x3A ack information: 0x70
// Message size 0x216/534
learn to 0x3A ack information: 0x16 0x02
// HDCP Read_Message
write to 0x3A ack information: 0x80
// Learn 534 bytes: msg_id=0x03 AKE_Send_Cert
// Final 3 bytes: 0x02 0x00 0x00 -> RxCaps: receiver model 0x02, REPEATER=0 (!)
learn to 0x3A ack information: 0x03 0xF1 0x60 0xD1 0x6B ... 0x02 0x00 0x00
The sink signifies that it’s NOT a repeater. That is the knowledge I used to be in search of: repeaters have
strict guidelines about easy methods to deal several types of content material and are NOT allowed to ahead
kind 1 content material.
The HDCP converter merely pronounces itself as a closing video endpoint… but nonetheless repeats the
content material to its output port. With no very costly HDMI protocol analyzer, we will’t
verify if the supply is tagging the content material as kind 0 or kind 1, however there is no such thing as a motive now
to assume that it’s not kind 1.
The remainder of the I2C hint follows the HDCP specification authentication playbook, however doesn’t
present any extra clues concerning the content material kind.
The hint ends with the supply polling the sink at common interval to verify the HDCP hyperlink remains to be energetic:
// HDCP RxStatus
write to 0x3A ack information: 0x70
learn to 0x3A ack information: 0x00 0x00
write to 0x3A ack information: 0x70
learn to 0x3A ack information: 0x00 0x00
...
All of this made me query the legality of all this. Monoprice sells low-cost merchandise, but it surely’s not a
shady backside feeder. After a little bit of Googling round, I discovered
the following article.
There was a lawsuit about this type of down-converter, however the case was settled. Right here’s the cash
quote:
In its reply, LegendSky defined that their units don’t “strip” any HDCP copy safety.
As an alternative, the contested HDFury system merely downgrades the upper HDCP safety to a decrease
model, which is permitted as an exception below the DMCA.
And that’s the tip of the story: the converters work, they’re passing by means of kind 1 contents, and
there’s nothing the film studios can do about it. It’s all good.