Fun with Sony BMG & MP3 metadata


Finnish Eurovision entry and WINNER for 2006, Lordi, has a small website 
at http://eurovision.lordi.org/ with some interesting info. The site is 
probably run by Sony BMG given the logos and the contact address at the 
bottom. Nice part is the "Video&Music" department. Direct link to audio 
player is

  http://eurovision.lordi.org/main.site?action=siteupdate/view&id=8

or later on, after Lordi won the competition,  

  http://lorditmp.sitefactory.fi/music.htm

Link for only the SWF part of the player

  http://sitefactory.epte.fi/flash/lordi_mediaplayer.swf   

(if the links above do not work, they should be resolved by going through 
the main site http://eurovision.lordi.org/ and clicking the relevant 
links)

First thing to impress me was the good quality of sound right from the 
beginning. Usually one can hear at best only low-quality 96/128kbps MP3 or 
WMA samples from official sources. I noticed that my browser of choice, 
Opera, created a real MP3 file to its cache directory when the first song 
started (192kbps MP3 file for "Hard Rock Hallelujah"). Nice, I thought, 
one could easily copy the few files to hard drive/MP3 player. Just for 
future reference, I wanted to dig up the complete URL of the downloaded 
song. Opera or Firefox didn't show this info easily, so I quickly checked 
the SWF file, no metadata in plaintext. A little googling revealed that 
there exists some kind of SWF extractors/decoders. I tried out "Action 
Script Viewer" demo from

  http://www.buraks.com/asv/1.html

which could extract the SWF file to some extent (after several complaints, 
though). ASV demo spitted out SWF action script lines as below:

    stage.showmenu = false;
    mp3player = new Mp3Player ();
    mp3player.setVol(0);
    mp3player.setMaxVol(30);
    mp3player.setLooping(true);
    mp3player.setAutoplay(true);
    mp3player.setFadeIn(true);
    volslider.hslider._x = mp3player.getVol();
    cb_songlist.addItem("Hard Rock Hallelujah", "/flash/hard_rock_hallelujah.mp3");
    mp3player.addSong("/flash/hard_rock_hallelujah.mp3", 0);
    cb_songlist.addItem("Devil Is a Loser", "/flash/devil_is_a_loser.mp3");
    mp3player.addSong("/flash/devil_is_a_loser.mp3", 0);
    cb_songlist.addItem("Would You Love a Monsterman", "/flash/would_you_love_a_monsterman.mp3");
    mp3player.addSong("/flash/would_you_love_a_monsterman.mp3", 0);
    cb_songlist.addItem("Devil Is a Loser.mp3", "/flash/devil_is_a_loser.mp3");
    mp3player.addSong("/flash/devil_is_a_loser.mp3", 0);
    cb_songlist.addItem("Blood Red Sandman", "/flash/blood_red_sandman.mp3");
    mp3player.addSong("/flash/blood_red_sandman.mp3", 0);

So, the URLs were not encrypted or obfuscated in any way. One could save 
the songs easily with e.g. browser or wget as below, using the complete 
URLs (links updated May 23rd)

	wget http://sitefactory.epte.fi/flash/hard_rock_hallelujah.mp3
	wget http://sitefactory.epte.fi/flash/devil_is_a_loser.mp3
	wget http://sitefactory.epte.fi/flash/would_you_love_a_monsterman.mp3
	wget http://sitefactory.epte.fi/flash/blood_red_sandman.mp3

The metadata for the songs are as below

blood_red_sandman.mp3 [3 897 344 bytes, 128kbps MP3]
	GENRE = Other
	TRACKNUMBER = 03
	TITLE = lordi-bloodredsandman

devil_is_a_loser.mp3 [6 769 523 bytes, 256kbps MP3]
	TITLE = Devil Is A Loser
	ARTIST = Lordi
	ALBUM = The Monster Show
	COMMENT = www.GrupoeMusica.com
	TRACKNUMBER = 6
	GENRE = Hard Rock
  
hard_rock_hallelujah.mp3 [5 942 418 bytes, 192kbps MP3]
	TITLE = hard r hallelujah
	ALBUM = 3rd lopullinen masteri
	ARTIST = LODRI
	TRACKNUMBER = 7/12
	ENCODERSETTINGS = Audiograbber 1.83.01, LAME dll 3.93, 192 Kbit/s, Stereo, High quality

would_you_love_a_monsterman.mp3 [2 956 643 bytes, 128kbps MP3]
	TITLE = 06
	GENRE = Blues


Hmm. Nice, free MP3s, no DRM crap, unfortunately 2 MP3s out of 4 were of 
inferior quality. And they can't spell LORDI correctly, have to fix the 
tags for own use. And.. what's that.. the best-quality file 
"devil_is_a_loser.mp3" has comment field "www.GrupoeMusica.com". Let's 
check.. a P2P music site? [speechless] Yep. Spanish site offering direct 
ed2k-links to full songs, albums, etc.

Shame on you, Sony BMG. Still, I guess downloading your artists' own music 
from P2P networks is better than creating and planning some 
rootkit-type-of-installers to audio cds. But to offer the downloaded files 
to public.. even though probably not illegal (as you own the rights) 
that's embarrassing.



May 19th, 2006
jaakko.kauramaki@gmail.com

Some minor updates May 23rd, 2006 (Lordi is now WINNER and the URLs 
changed to newer ones)