ZaiRoN
January 13th, 2008, 07:32
I like to go to the cinema, I adore movies. I have a lot of dvd movies at home. Special features included in almost all dvd are something I like particularly. What I dislike are the easter eggs included in the disc. There are often small and stupid clips behind easter eggs. They are nowadays documented everywhere around the net, but the question is: how did they find them?
The common way is trying to push every buttons on your remote control hoping to see something strange around the dvd menu. This is the most easiest way, you have only to spend some time with a remote control in your hand. Otherwise, you can try inspecting the files stored inside the dvd. I don’t have any experience with this kind of things so I did some searches on the net. From all the programs I tried I was impressed by one: PgcEdit. As stated in the documentation “PgcEdit offers an easy to understand view of the DVD’s programming. It allows you to edit, via easy to use GUIs, all the DVD’s commands with their legal values, without any limitations except those imposed by the DVD standard. “
There’s a little problem, I have no idea about the dvd standard… Anyway, I gave it a try.
When you open a disc PcgEdit extracts all the necessary information filling two edit boxes. The image below represents a snippet taken from one of the two boxes.
http://zairon.files.wordpress.com/2008/01/pgcedit_left_panel.jpg
Don’t know what you think but these are only some meaningless items for me. When you click on an item the other box is filled with some other information which are much more understandable. Here are some of them:
http://zairon.files.wordpress.com/2008/01/pgcedit_right_panel.jpg
I’m not able to fully understand the instructions above, but I can get the general meaning of each line. It’s like a dead list produced by a disassembler, a series of commands.
Reading through the help I’ve found something interesting, PgcEdit has a debugger inside; it lets you see what happens when a dvd is launched. I don’t know the meaning of the information retrieved by PgcEdit, but I do know how to use a debugger, and this one seems to be really simple. I’ll try to find out an easter egg using PgcEdit’s debugger. I only spent some time on this debugger and I don’t know anything about dvd standard, anyway I’ll try to explain my adventure using the right words.
The dvd film I’m going to inspect is titled Big fish, aTim Burton’s movie. An easter egg could be everywhere inside the dvd, I’ll try to find something inside the main menu title which is showed in the next image:
http://zairon.files.wordpress.com/2008/01/big_fish_menu.jpg
It’s an animated menu and you can navigate through the 6 options, from “Play movie” to “Trailers”, seems like you can’t move the cursor outside these items.
To start a debugging session you have to select “Trace mode” from one of the PgcEdit’s menu items (using Ctrl-T is much more easy). The debugger is really simple but it has almost everything. It’s possible to set a breakpoint on GPRM (Global Parameter Registers), on SPRM (System Parameter Registers), pre/post PGC (Program Chain), all menus and all titles. It’s possible to watch all the registers and log almost everything. It’s the only dvd debugger I have tried so far, but it seems to be quite complete.
When you are in Trace mode the debugger is stopped at the first instruction:
1 (JumpSS) Jump to VMGM PGC 1
which is inside “VMG, First Play PGC” item. VMGM stands for Video Manager Menu.
The dvd video structure is divided into some levels, I’m at the the first one and it’s used to play an introductive video or some preliminary information. After that the main menu appears. In this case there is nothing before the main menu and the instruction (it’s clearly a jump instruction to “VMGM PGC 1″
will bring me to the dvd main menu.
http://zairon.files.wordpress.com/2008/01/pgcedit_first_unit.jpg
LU should be Language Unit and I think the number inside brackets represents the item’s length, 14 seconds.
How to proceed? I tried stepping some commands but it’s not so interesting so it’s better if you use some clever breakpoints. Right click on an item from the left box and a popup menu will appear. From this popup menu it’s possible to set a breakpoint on the selected item. When the program flow reaches the item the debugger should break. There are many items inside the box, they are divided into 3 groups:
- VMGM
- VTSM
- VTST
How to identify the right item? The main menu’s length is 52 seconds so I did a scan over the items trying to locate the one with length equals to 52. There are some items with the same length (52 seconds); I’m not totally sure about the meaning of the 0:52 value so I decided to take another way. Spying through the debugger’s menu I found an interesting option: “Break at all menus”. When you set this option the debugger will break every time it encounters a menu. I had 3 breaks and then a new box appeared (it doesn’t mean that there are 3 menu to be shown). The box contains the information about the main menu. The breaks occurred on these items:
- VMGM LU 1 (en), 1 (0:14)
- VTSM 4, LU 1 (en), 1 (dummy) RootM
- VTSM 4, LU 1 (en), 6 (0:52) 16b.
VTSM stands for Video Title Set Menu and it contains all the information about a specific menu. This one seems to be the menu I was looking for and now I’m pretty sure about the fact that 52 is the length (in seconds) of the animated menu. When the time reaches 52 the animated menu starts again, like an infinite loop. So, I’m interested in the last entry, if you click on this item you’ll see the commands inside the dead list box. There are some pre and post commands; pre commands are executed before the reproduction (post commands are executed after…):
http://zairon.files.wordpress.com/2008/01/pgcedit_instructions.jpg
“gprm(i)” refers to a register, there are 16 Global Parameter Registers and they can contain a value in the 0/65535 range. From what I have seen they are often filled with SPRM values; there are 24 System Parameter Registers and they contain the current player settings. That’s why gprm registers get information from sprm registers, the dvd internal programming code needs to know where is running on.
The words inside brackets (mov, and, or) define the operation. i.e.: Instruction number 2 is used to store 0 into register 8, pretty simple. Ok, back to the box now:
http://zairon.files.wordpress.com/2008/01/pgcedit_menu_buttons.jpg
This is the box that is shown, it’s the main menu (I edited the image adding the text). As you can see it shows the *gui* without pictures of course. It’s pretty easy to identify the buttons at the bottom of the image, they represent the 6 options. There are two more buttons (7 and 8) at the top of the picture, btw. You can navigate through the buttons using the keyboard or mouse, the highlighted button is the current selected one. When you switch from a button to another PgcEdit’s debugger is able to show what kind of commands will be executed, you can see the next instruction that will be performed. After some tries I understood how to reach button number 8, just click on keyboard’s key-up from button 5. When you switch to button number 8 nothing is shown; some commands are executed but I had the impression that it’s only a check routine used to see which kind of button has been pressed. Button 7 is another story because when you press it the current post commands are executed. Anyway, without looking at the post commands it’s obvious that there’s something behind button number 7, which is our easter egg for sure!
Why did they (dvd’s authors) use button number 8? As far as I know there aren’t dvd player with a mouse control, if you want to move through the menu you can only use your remote control. With a remote control you have 4 direction’s buttons and you can move the pointer from a voice to another using them. Button number 8 is a bridge from button number 5 to 7. I think it’s used because they wanted to hide the easter egg a little bit more.
It’s time to see the hidden feature, load the film with your preferred player. Move the pointer over the hat and a red star magically appears. Click and enjoy the clip (nothing special btw).
My dvd adventure ends here, It was a nice unusual debugging session. Is there another way to discover an easter egg? Don’t know and I don’t care about it, I think I’ll check for easter eggs browsing the net in the future… haha!
The common way is trying to push every buttons on your remote control hoping to see something strange around the dvd menu. This is the most easiest way, you have only to spend some time with a remote control in your hand. Otherwise, you can try inspecting the files stored inside the dvd. I don’t have any experience with this kind of things so I did some searches on the net. From all the programs I tried I was impressed by one: PgcEdit. As stated in the documentation “PgcEdit offers an easy to understand view of the DVD’s programming. It allows you to edit, via easy to use GUIs, all the DVD’s commands with their legal values, without any limitations except those imposed by the DVD standard. “
There’s a little problem, I have no idea about the dvd standard… Anyway, I gave it a try.
When you open a disc PcgEdit extracts all the necessary information filling two edit boxes. The image below represents a snippet taken from one of the two boxes.
http://zairon.files.wordpress.com/2008/01/pgcedit_left_panel.jpg
Don’t know what you think but these are only some meaningless items for me. When you click on an item the other box is filled with some other information which are much more understandable. Here are some of them:
http://zairon.files.wordpress.com/2008/01/pgcedit_right_panel.jpg
I’m not able to fully understand the instructions above, but I can get the general meaning of each line. It’s like a dead list produced by a disassembler, a series of commands.
Reading through the help I’ve found something interesting, PgcEdit has a debugger inside; it lets you see what happens when a dvd is launched. I don’t know the meaning of the information retrieved by PgcEdit, but I do know how to use a debugger, and this one seems to be really simple. I’ll try to find out an easter egg using PgcEdit’s debugger. I only spent some time on this debugger and I don’t know anything about dvd standard, anyway I’ll try to explain my adventure using the right words.
The dvd film I’m going to inspect is titled Big fish, aTim Burton’s movie. An easter egg could be everywhere inside the dvd, I’ll try to find something inside the main menu title which is showed in the next image:
http://zairon.files.wordpress.com/2008/01/big_fish_menu.jpg
It’s an animated menu and you can navigate through the 6 options, from “Play movie” to “Trailers”, seems like you can’t move the cursor outside these items.
To start a debugging session you have to select “Trace mode” from one of the PgcEdit’s menu items (using Ctrl-T is much more easy). The debugger is really simple but it has almost everything. It’s possible to set a breakpoint on GPRM (Global Parameter Registers), on SPRM (System Parameter Registers), pre/post PGC (Program Chain), all menus and all titles. It’s possible to watch all the registers and log almost everything. It’s the only dvd debugger I have tried so far, but it seems to be quite complete.
When you are in Trace mode the debugger is stopped at the first instruction:
1 (JumpSS) Jump to VMGM PGC 1
which is inside “VMG, First Play PGC” item. VMGM stands for Video Manager Menu.
The dvd video structure is divided into some levels, I’m at the the first one and it’s used to play an introductive video or some preliminary information. After that the main menu appears. In this case there is nothing before the main menu and the instruction (it’s clearly a jump instruction to “VMGM PGC 1″
will bring me to the dvd main menu.http://zairon.files.wordpress.com/2008/01/pgcedit_first_unit.jpg
LU should be Language Unit and I think the number inside brackets represents the item’s length, 14 seconds.
How to proceed? I tried stepping some commands but it’s not so interesting so it’s better if you use some clever breakpoints. Right click on an item from the left box and a popup menu will appear. From this popup menu it’s possible to set a breakpoint on the selected item. When the program flow reaches the item the debugger should break. There are many items inside the box, they are divided into 3 groups:
- VMGM
- VTSM
- VTST
How to identify the right item? The main menu’s length is 52 seconds so I did a scan over the items trying to locate the one with length equals to 52. There are some items with the same length (52 seconds); I’m not totally sure about the meaning of the 0:52 value so I decided to take another way. Spying through the debugger’s menu I found an interesting option: “Break at all menus”. When you set this option the debugger will break every time it encounters a menu. I had 3 breaks and then a new box appeared (it doesn’t mean that there are 3 menu to be shown). The box contains the information about the main menu. The breaks occurred on these items:
- VMGM LU 1 (en), 1 (0:14)
- VTSM 4, LU 1 (en), 1 (dummy) RootM
- VTSM 4, LU 1 (en), 6 (0:52) 16b.
VTSM stands for Video Title Set Menu and it contains all the information about a specific menu. This one seems to be the menu I was looking for and now I’m pretty sure about the fact that 52 is the length (in seconds) of the animated menu. When the time reaches 52 the animated menu starts again, like an infinite loop. So, I’m interested in the last entry, if you click on this item you’ll see the commands inside the dead list box. There are some pre and post commands; pre commands are executed before the reproduction (post commands are executed after…):
http://zairon.files.wordpress.com/2008/01/pgcedit_instructions.jpg
“gprm(i)” refers to a register, there are 16 Global Parameter Registers and they can contain a value in the 0/65535 range. From what I have seen they are often filled with SPRM values; there are 24 System Parameter Registers and they contain the current player settings. That’s why gprm registers get information from sprm registers, the dvd internal programming code needs to know where is running on.
The words inside brackets (mov, and, or) define the operation. i.e.: Instruction number 2 is used to store 0 into register 8, pretty simple. Ok, back to the box now:
http://zairon.files.wordpress.com/2008/01/pgcedit_menu_buttons.jpg
This is the box that is shown, it’s the main menu (I edited the image adding the text). As you can see it shows the *gui* without pictures of course. It’s pretty easy to identify the buttons at the bottom of the image, they represent the 6 options. There are two more buttons (7 and 8) at the top of the picture, btw. You can navigate through the buttons using the keyboard or mouse, the highlighted button is the current selected one. When you switch from a button to another PgcEdit’s debugger is able to show what kind of commands will be executed, you can see the next instruction that will be performed. After some tries I understood how to reach button number 8, just click on keyboard’s key-up from button 5. When you switch to button number 8 nothing is shown; some commands are executed but I had the impression that it’s only a check routine used to see which kind of button has been pressed. Button 7 is another story because when you press it the current post commands are executed. Anyway, without looking at the post commands it’s obvious that there’s something behind button number 7, which is our easter egg for sure!
Why did they (dvd’s authors) use button number 8? As far as I know there aren’t dvd player with a mouse control, if you want to move through the menu you can only use your remote control. With a remote control you have 4 direction’s buttons and you can move the pointer from a voice to another using them. Button number 8 is a bridge from button number 5 to 7. I think it’s used because they wanted to hide the easter egg a little bit more.
It’s time to see the hidden feature, load the film with your preferred player. Move the pointer over the hat and a red star magically appears. Click and enjoy the clip (nothing special btw).
My dvd adventure ends here, It was a nice unusual debugging session. Is there another way to discover an easter egg? Don’t know and I don’t care about it, I think I’ll check for easter eggs browsing the net in the future… haha!
Always nice to have gained the knowledge and power to reverse yet another field. 
