How Stuff Gets eXposed

PowerDVD is a bit irrelevant though. PowerDVD no longer supports UHD BD playback after 10th gen Intel, IIRC, because Intel dumped SGX on consumer platforms. Not that it matters anyway - the pirates had the idea to keep their stolen decryption key and generate the disc-specific decryption keys themselves and post them online. These disc-unique keys are then retrieved and used by a modded drive to decrypt the disc, without revealing what the stolen drive key is (so that AACS LA can't revoke it). Thus the AACS LA is in a stalemate, where they could revoke the pirate key, but don't know which one the pirates are using, and so can't fix this problem without revoking all keys which is simply impractical. This won't change though, don't worry, because storing keys in a TEE of some kind is mandatory for the 4K Blu-ray spec. (This happy accident for pirates also happened because 4K Blu-ray is mostly readable by standard Blu-ray-only BDXL drives made years before the standard, which doesn't seem to have been intentional.)

A TEE wasn't mandatory for the original Blu-ray because... well... it was 2005... and so now there are no shortage of stolen Blu-ray player keys floating around and it's impractical to keep revoking keys for them to be stolen again, possibly from the same flawed hardware. (You can't tell me that securing every Blu-ray player since 2005 perfectly, and having no keys stolen, without a TEE, is possible. Especially not when it takes up to 90 days for discs revoking a key to roll out.)

EDIT: OK, this is insane, hilarious, and finally shows how AACS2's inner functions may have been smashed so quickly:

"Unlike for AACS 1.0, AACS-LA (the consortium which maintains AACS standards) decided to not publish any publicly-available specifications for AACS2 and typically mandates that any AACS code is obfuscated and/or encrypted in some form [...] Finally, we further analyzed the contents of CLTA_SW.dll. Remarkably, we discovered that CLTA_SW.dll contains nearly identical code, strings, and cryptographic constants as the CLTE.dll enclave. In particular, CLTA_SW.dll contained the code for the AACS2 algorithm, without any protection. The latter is significant, as it directly violates AACS-LA’s requirement to not publish AACS algorithms without obfuscation and/or encryption. We thus reaffirm our hypothesis from Section 6.1, that CLTA_SW.dll is an internal debugging module that should not have been shipped."

Well, no s***. If you ship decrypted DLLs with all the code for the DRM except the decryption key, and then allow your software to provision enclaves on out of date, known insecure devices for storing the key, what did they expect would happen... (well, obviously, they didn't realize they were doing that, but it's just so pathetic... On the upside, AACS LA might have a pretty good idea on which key they've been using now! ;) )

But seriously... I agree. I get that DRM is meant to prevent "casual copying," but right now, that's just called "Downloading from 1337x." Unfortunately, I think that the only lesson movie studios are going to learn from this... is that they should phase out physical media and use Widevine and FairPlay hardware-assisted streaming DRM for everything. Which, to be fair, has been quite more resilient than AACS... but not pirate-proof...

I think the ultimate lesson is that movie studios will never cave on DRM or Copyright. In which case, in an ideal world, we'd repeal DMCA 1201 making breaking DRM legal for private use, and we'd cut copyright to 28 years in length (the original length, and also solving the video game preservation problem). From there, we could just have a trademark protection which states that distributing expired-copyright material in its original state gets a fair-use exception to trademark use, but modifications do not, solving that issue. [I.e. If I distributed Original Super Mario Bros. without changes, it wouldn't offend Nintendo's copyright - but if I changed it, I would have to call it something else and couldn't use "Mario" as a character.]

its pretty widely available how to get around this now. I have my own implementation actually. I wont say its "easy", but it is doable. And you can get quite a lot even with just an L3 CDM. Also at least one public Widevine proxy is now available, as well as a content key database.