Understanding the HOTDOG files on DVD of California electronics

[openkaraoke]

This is the website for encrypted midi karaoke:
http://www.soncamedia.com/

In Vietnam, there are several brands for Karaoke Midi (Arirang,TienDat,Caifornia Electronics) but sonca launches their new products with USB support and they encryt midi karaoke song. Thay call them "SUPERMIDI". I dump the file and find that it is more complicated than the classical midi karaoke players. They make the updated midi karaoke songs available online!!!  Obviously it will nice if we can manage to decryp them.

This is why I didn't want to publish my result on the next post last year. I make public only the standard midi karaoke songs that I extracted on my website. The reason is like you, i like very much midi karaoke and adraid that the producers will follow soncamedia and crypt also the midi part. Obviously they have to upgrade the firmware and our old players will be outdated again. (However, there will be an utimate solution, I found that in China they sell the integrated board with MPEG,DIVX and Midi karaoke Codec, these cards are widely used in the karaoke players. Consequently, with some electronics knowledge we can capture the Midi event through the Midi interface on the board!!, But we are not still there).

As far as the Unicode lyric editor concerned, although a lot of players claim that they suport Unicode but most of them don't work. It is the same for Unicode lyric editor. At the beginning, I looked for Unicode lyric editors but I didn't find any. So I developped myself the tool. It's simpler than I can image. In fact, with this script I can insert the lyrics (in Unicode) into 300 midi songs in 1 minutes. In order to synchronize, just add +1or +n before the words. The idea is when you decrypt the midi file, each time you find a Note ON with channel 1 (Melody channel) you create a Mtrk for lyrics (Melody Track) with the corresponding tick (time code), the lyric is still dummy at this period. When you have a text file with lyrics (even in Unicode) the script will replace (and adjust) the words into Melody Track.

The most difficult problem is getting the lyrics. As I say befaore, feeding the lyrics into 300 song takes 1 minute but finding 300 songs takes ...a lot of times!. Fortunately new songs are not unlimited (about 300 new songs in each volume) and most of them can be cut and paste (in Unicode) from different forums. So it's not a bad idea to insert ourself the lyrics while the lyric decryption is still unknown.

As far as the lyrics available on my website, the old one comme CAVS DVD and the new one come from Calfornia DVD. The one come  from CAVS have been exactly extracted  from the DVD. The new one have been fed by the above script (one pass only because I didn't have time to listen and adjust words).
But there is one remark:

In 02.DAT, the Vietnamese song titles are encoded with the same font as CAVS DVD. One day when we arrive to decrypt the lyric parts, probably the same font is used. The difference is CAVS uses bot upper and lower for lyric display while California uses only upper case.

By the way, did you find the same tempo problem with my extrated midi?

[bigboss97]

I've tried to google encoding algorithm. All I found are more security stuff which I don't believe is used in this place.

Many years ago, I've decoded key words in a game where you have to answer questions according to a story (hardcopy). They used a mask based on the position. I can't remember that exactly. btw, it was a CGA (graphic) game hahaha...
But I do remember which way I took. In that case it was easy I simply used a disk editor to modify the bytes and tried to understand the mask. Which means... if we don't have other way, we have to do similar things. We patch the code (where we believe a letter) and see what the player will display.

Maybe we can try with this song because there are so many recurring letters.

[bigboss97]

Still not all MIDI events are handled correctly.
dvd2midi.zip

[woid]

I also tried to google on some encoding algorithms but couldnt find anything to help us.

I wonder what the purpose of the encoding is?
To make it unreadable (cipher) or to save storage (zip/packing)?
A song with about 900 letters result in about 4000 bytes in the lyrics part. Assuming 4 bytes for each letter (2 for unicode, 2 for time code) we end up with reasonable numbers. So I dont think we are dealing with a packing algorithm.

Next question is if they use a standard algorithm or if they came up with something themselves. I would have used a standard algorithm, but that is just me. Given the bad performance of the algorithm (first letters in plain text and the patterns you found) maybe they have a proprietary algorithm.

If it is the proper cipher, how can we find the key? In worst case it is hardcoded in the dvd player hardware. Or maybe the key is hidden somewhere on the disc?

[bigboss97]

I guess that they want to keep competitors away. Else, I can't see any point not to allow users to create their own disk. The more songs available the more people will buy their players.

The first 2 letters (SW), I guess that they are used to refer back to HD20 in order to find the complete song title in a sorted list.
Let's say the complete title is also stored in HD00. Then the following bytes should represent "EET". But if you look at the sequence. It reoccurs very soon. But the word "SWEET" doen't occur so soon in the song.

I also agree with you about unicode and the 4x length. But based on this song I will GUESS that unicode is not used everywhere (there's a language indicator anyway). The repeating sequence might represent "LA ".

I don't think there's a key on the player. I would guess there's a key for each song (maybe hiding in the first 2 letters). The key is "shifted" (whatever this means) for each byte and it restarts after certain times. That's the reason you won't see the same code for "LA ". But it comes back after a while (speculation only).

If "LA " is only stored in 3 bytes. Then we need the length. Is there a bit indicating the last byte?

I think that we have no choice. Back to the lab, we have to do some experiments. We have to patch the ISO (uncompressed) image. I hope that it reads WR-DVD.

woid wrote

I wonder what the purpose of the encoding is?
To make it unreadable (cipher) or to save storage (zip/packing)?
A song with about 900 letters result in about 4000 bytes in the lyrics part. Assuming 4 bytes for each letter (2 for unicode, 2 for time code) we end up with reasonable numbers. So I dont think we are dealing with a packing algorithm.

Next question is if they use a standard algorithm or if they came up with something themselves. I would have used a standard algorithm, but that is just me. Given the bad performance of the algorithm (first letters in plain text and the patterns you found) maybe they have a proprietary algorithm.

If it is the proper cipher, how can we find the key? In worst case it is hardcoded in the dvd player hardware. Or maybe the key is hidden somewhere on the disc?

[bigboss97]

The first working version of DVD2MIDI:
http://www.nabble.com/forum/ViewPost.jtp?post=11520529&framed=y

[woid]

Between: When I play "SWEET (A LA LA LA LA LONG)" (and some other songs too) on my California dvd player the lyrics and the music is not in sync. Do you get that too?

[openkaraoke]

I think the reason to push them to hide the lyrics (california)and midi (soncamedia) data is to prevent people from hacking the DVD and hence develop softwares to play directly their DVD! Their bussiness will reduce to only karaoke salon!  When i deoded completely the CAVS DVD last year and I thought that we could develop some kind of generic software player to play these DVDs and evcen customize ourselve the DVD, but when i discovered that the lyrics are hidden now and midi as well (soncamedia), I think that ill will be harder in the future to extract them.

As far as the lyrics are concerned, i have just some remarks:

1) It seems that the lyrics part are not encoded with same content in different version. I have the dump of the SWEAT song extracted from the volume 7:

0e75407c - BLK 31 -> 0e83a550(243508560)
0e83a550 - MIDI - size 0000b760(46944) lyric 9324 - Midi 37595) - 0001b00740
0e83a550 - MIDI - size 0000b760(46944) lyric 9324 -KEY : 00530057 -

e911bb337c6dcbd6afd8cbd4afd8eeb9915b95dbd5074c6d6dadc040af09a934ff1ec704817e2e3caeb9d4c2aacbd7aec122e38860985212ace9f4519911bb331b6dcbd6dad8cbd4ded8eeb9f45b95dbf80d4c

The lyrics part is different from your dump (i think that your files come from the volume 8). Coumd you please confirm that? If it is true (needed to be checked), the lyrics could be encoded differently in different versions.

2) I found that for several songs, the bytes coming after 4 initital bytes ( xx xx xx xx, it could be the offset to the lyrics part, 0053 0057) are very often the same. At the begiining I thought that it should be the data related to Song writer, Song Composer, Singer but nothing at all . Here are some examples :

THANG_CUOI:

28261 ,110, 101, THANG_CUOI1a4a1800 1a772450
1a772450 - MIDI - size 000049f0(18928) lyric 3344 - Midi 15565) - 00ffc002ff
1a772450 - MIDI - size 000049f0(18928) lyric 3344 -KEY : 00540048 -
KEY2 : 835b9c6563b27f41b98669aaa5dc535ce20446a95294a05ba43e7f41f1987a567182b064ded46d92086fd4c2dbcbd7ae915b9c6506b27f418c8c69aad5dc535c860446a92a94a05b18347f41ff987a560782b064

LEN_DANG:

28264 ,110, 104, LEN_DANG1a4a1800 1a784ff0
1a784ff0 - MIDI - size 00003d40(15680) lyric 3328 - Midi 12330) - 00ffc015ff
1a784ff0 - MIDI - size 00003d40(15680) lyric 3328 -KEY : 004c00fe -
KEY2 : 835b9c6563b27f41b98669aaa5dc535ce20446a95294a05ba43e7f41f1987a567182b064ded46d92086fd4c2dbcbd7ae915b9c6506b27f418c8c69aad5dc535c9e0446a99c94a05be7347f41

TINH_TRONG_LA_THIEP

28277 ,110, 117, TINH_TRONG_LA_THIEP1a4a1800 1a7c3400
1a7c3400 - MIDI - size 00003d30(15664) lyric 3664 - Midi 11985) - 00ffc018ff
1a7c3400 - MIDI - size 00003d30(15664) lyric 3664 -KEY : 005400bf -
KEY2 : 835b9c6563b27f41b98669aaa5dc535ce20446a95294a05ba43e7f41f1987a567182b064ded46d92086fd4c2dbcbd7aec222e388935b9c6538b87f41c18669aac1dc535c6d0446a92c94a05be1347f4191987a56

and many others ,etc..

It means that the begiining of the lyric part contains common pattern for songs. The real lyrics should be far after the beginning the this block, probably the initial 4 bytes(0053 0057) are two offsets to other parts in this block.

3) Unicode (UTF-8) can be 1, 2 or 3 bytes. I think that they are using their own fonts and not Unicode as the language indicator must be used. Furthermore, ss I discovered before, the font used in the title (02.DAT file) is the same used in CAVS. CAVS synchronize letter by letter (not word by word) so each letter is represented by 4 bytes (2 bytes for a letter, in upper case at the beginning of the phrase, 2 bytes for the tick- the tick is not relative but absolute, so this information must have an increasing value). It seems that Calfornia is using a slightly different way, because it displays all in UPPER CASE and sometimes the words are not sync! I don't have time to chcek but it is interesting to check if the player displays letter by letter or word by word.

It 's a cheap decoding board (the price for the whole device is less than 60 USD) so I don't think it used advanced encryption methods as AES, DES,.., the processor cannot have the power to decrypt these algorithms. It's rather a combination o a rudimentarty encryption and compression. I found that the size of the lyric part is similar to the one contained in the CAVS DVD.

For the same song, i took a lyric part from CAVS and tried to compress with different algorithms (zip,gzip,lha..) but the layout doesn't look like the same.

I have investigated this problem last year without success. While waiting for a solution, I develop the script to insert the lyrics to the mid part. I am looking a solution to grab automatically lyrics from the forum. So the most difficult task is to adjust slightly the words.

[woid]

1)
I think we might have different versions of the DVD. The beginning of SWEAT looks like this on my dvd:
00000000: 0000 b760 0000 246c 0053 0057 23dd 407e  ...`..$l.S.W#.@~
00000010: 887c 2581 136d 9b62 deb9 5898 4d2b 0a00  .|%..m.b..X.M+..
00000020: 240a a54e a267 ca94 6b39 225f ac8d 5104  $..N.g..k9"_..Q.
00000030: 3370 6b49 4015 fb5a 1a39 01ae fbb5 175f  3pkI@..Z.9....._
00000040: 343f fd8b 0de1 8bb5 53dd 407e ef7c 2581  4?......S.@~.|%.

2)
I didnt follow everything you wrote in the previous message. Where do you find the similarities?
What you write as "-KEY", I interpret as the first 2 letters of the title of the song.
Eg:
SWEAT: -KEY : 00530057 - = 00 'S' 00 'W'
THANG_CUOI:-KEY : 00540048 - = 00 'T' 00 'H'

3)
I am no expert at unicode. What I meant was each letter encode as 2 bytes. First byte is language plane, second byte is the character code. For the latin alphabet, language plane = 0, character code = ASCII code. Again, I am no unicode expert, this simplification works for me (though it is probably wrong in many ways).

[woid]

I dont buy your explaination why the first 2 letters are in plain text. Why would you need to refer back to HD20? And the first 2 letters are not unique so it is not possible to refer back anyway.

I have looked at the song "Hey Jude". In the end the following lyrics is repeated:
Da da da da da da da
Da da da da Hey Jude

In the end of the lyrics part of the song entry for "Hey Jude" in HD00 I find the following (X is 2 "random" bytes. Timecode?):

3133 X 7127 X 288b X
0ada X
4612 X 6eda X e33f X ab94 X 036d X 8621 X 3c22 X 977a X 3133 X 7527 X 0581 X 2ada X
4612 X 6eda X e33f X ab94 X 036d X 8621 X 3c22 X ba70 X 1133 X 7527 X 0581 X 2ada X
4612 X 6eda X e33f X ab94 X 036d X 8621 X 3c22 X 977a X 1d33 X 7127 X 5c81 X 6eda X
6d12 X 3bda X e33f X af94 X 2e67 X a621 X 3c22 X 977a X 3133 X 7527 X 0581 X 2ada X
4612 X 6eda X e33f X ab94 X 036d X 8621 X 3c22 X 977a X 3133 X 7527 X 0581 X 2ada X
4612 X 43d0 X c33f X ab94 X 036d X 8621 X 3c22 X 977a X 3133 X 7527 X 0581 X 2ada X
4612 X 6eda X cf3f X af94 X 5a6d X c221 X 1722 X c27a X 3133 X 7127 X 288b X 0ada X
4612 X 6eda X e33f X ab94 X 036d X 8621 X 3c22 X 977a X 3133 X 7527 X 0581 X 2ada X
4612 X 6eda X e33f X ab94 X 036d X 8621 X 3c22 X 977a X 1d33 X 7127 X 5c81 X 6eda X
6d12 X 3bda X e33f X af94

[bigboss97]

Haven't tried that song yet. But in some songs, there are some sections which are totally out of sync.

woid wrote

Between: When I play "SWEET (A LA LA LA LA LONG)" (and some other songs too) on my California dvd player the lyrics and the music is not in sync. Do you get that too?

[bigboss97]

It was a guess only  :-) They don't need to be unique if they are a kind of hash information. Since the list is sorted the 2 letters could be used to isolate a part of the list to run a quick search (against song ID). This was based on the assumption that the title is not stored in HD00.

"Hey Jude" is a good example. Any other similar kind of song? How about something with dot dot, i.e. "ah...."
What's the name of the song: na na na na hey hey hey goodbye...
Is that on the disk?

I'm going to get a DVD-WR and patch the bytes. Do you know whether it plays WR?

woid wrote

I dont buy your explaination why the first 2 letters are in plain text. Why would you need to refer back to HD20? And the first 2 letters are not unique so it is not possible to refer back anyway.

I have looked at the song "Hey Jude". In the end the following lyrics is repeated:
Da da da da da da da
Da da da da Hey Jude

[bigboss97]

I'm not very familiar with that notation. Can you give me a MIDI file with that single track?
I want to get the right header and tempo for my converter, thanks.
Btw, where can I learn more about that notation?

openkaraoke wrote

   printf FILEOUT ("MTrk\n");
   printf FILEOUT ("0 TimeSig 4/4 24 8\n");
   printf FILEOUT ("0 Tempo 500000\n");
   printf FILEOUT ("0 Meta 0x21 00\n");
   print FILEOUT @DATA;
   printf FILEOUT ("TrkEnd\n");
   close FILEOUT;

[woid]

3)

Ok, I think I understand what you mean by similarities.
The beginning of each song entry looks like this:

xxxx xxxx yyyy yyyy 00 zz 00 zz aaaa...aaaa

where:
xxxx xxxx = Length of song entry
yyyy yyyy = Offset to midi part
00 zz 00 zz = First 2 letters of the title
aaaa...aaaa = block of 48-80 bytes with same content for some songs

First I thought that aaaa...aaaa was just the rest of the letters in the title scrambled by some algorithm. But then I discovered (with the help from openkaraoke) that some songs have the same aaaa....aaaa sequence. Songs with completely different title, singer etc.
So I tried to sort the aaaa...aaaa parts for all 256 songs in superblock 0x39.

For instance I found that:
39 03 :  PROMISE OF A NEW DAY
39 2C :  ELEANOR RIGBY
39 F8 :  STAND BY ME
all have the same 52 first bytes of aaaa...aaaa.

The longest common sequence I was able to find was:
39 35 :  MEMORIES
39 B7 :  MEMORY
which have the same 80 first bytes of aaaa...aaaa. (These 2 songs also had many bytes in common in the rest of the lyrics part also)

Maybe aaaa...aaaa could be the key used in the encryption algorithm? Maybe even something as simple a as a XOR mask or somthing...

If it is the key, how long is the key? The shortest common sequence I was able to find in 0x39 was 48 bytes which is also a multiple of the repeated sequence I found in "Hey Jude".

I think this is something worth investigating futher.

[bigboss97]

I would guess with mask. It will be a waste to use complex algorithm to scramble text. That's the reason I'm trying to find the bytes which I can patch on the disk. So, we can the result on the screen. Of course, we need to patch the right one. If it's a length or a time code it might lead to a player crash.

woid wrote

Maybe aaaa...aaaa could be the key used in the encryption algorithm? Maybe even something as simple a as a XOR mask or somthing...

[woid]

I think I am close to a breakthrough with the lyrics.
I have discovered that aaaa...aaaa (see previous message) seems to be a XOR mask.

The length of the mask seems to be different for different songs. E.g. Hey Jude has mask length 12*4 bytes, Sweat has mask length 15*4 bytes. Visually it is easy to find the length since there are many 00 bytes in the decode dump and x XOR x = 0. The 2nd, 3rd and 4th bytes repeates after about 12*4-15*4 bytes so that is the length.

When the mask have been applied the result looks like this (block of 4 bytes):
zz xx cc vv
where:
zz = some sort of encoding of a charater?
xx = 00 or 0a (maybe newline or space indicator)
vvcc = time code (little endian)

Remaining:
+ The zz does not map to ASCII. Mapping have to be found. Maybe some additional transformations are needed.
+ The length of the mask. Where can the length be found?

[woid]

I have started to make a mapping table for "zz" (see previous message).
There is a good news and a bad news.
The good news it that the same table seems to be valid for all songs. I tried to make a table from one song and apply it on another and it seems to be the same.
The bad news is that the mapping is not unique. E.g. Sometimes 0x51='r' and somtimes 0x51='a' (within the same song).

Here is the beginning of the table:
  chMap[0x6c] = 'O';
  chMap[0x5f] = 'o';
  chMap[0x58] = 'h';
  chMap[0x11] = ' ';
  chMap[0x44] = 'I';//problem 3
  chMap[0x60] = ' ';
  chMap[0x2e] = 'n';
  chMap[0x55] = 'e';
  chMap[0x55] = 'e';
  chMap[0x24] = 'd';
  chMap[0x3c] = ' ';
  chMap[0x4b] = 'y';
  chMap[0x62] = 'o';//0a
  chMap[0x35] = 'u';
  chMap[0x51] = 'r';//problem 1
  chMap[0x10] = ' ';
  chMap[0x5c] = 'l';
  chMap[0x5f] = 'o';//dup
  chMap[0x47] = 'v';
  chMap[0x68] = 'e';//0a
  chMap[0x60] = ' ';//dup
  chMap[0x22] = 'b';
  chMap[0x51] = 'a';//problem 1
  chMap[0x52] = 'b';
  chMap[0x25] = 'e';
  chMap[0x3c] = ' '; //0a, dup
  chMap[0x75] = 'G';
  chMap[0x78] = 'u';
  chMap[0x25] = 'e'; //dup
  chMap[0x50] = 's';
  chMap[0x43] = 's';
  chMap[0x10] = ' '; //dup
  chMap[0x49] = 'y';
  chMap[0x5e] = 'o'; //problem 2
  chMap[0x78] = 'u'; //dup
  chMap[0x60] = ' '; //dup
  chMap[0x2b] = 'k';
  chMap[0x5e] = 'n'; //problem 2
  chMap[0x5f] = 'o'; //dup
  chMap[0x37] = 'w';
  chMap[0x11] = ' ';
  chMap[0x5b] = 'i';
  chMap[0x79] = 't'; //0a
  chMap[0x67] = '\'';
  chMap[0x50] = 's';//dup
  chMap[0x10] = ' ';//dup
  chMap[0x44] = 't';//problem 3
  chMap[0x42] = 'r';
  chMap[0x44] = 'u';//problem 3
  chMap[0x68] = 'e';//0a

Eg1: Lyrics for "Eight days a week" with mask above:
.t.u...... ........ ...G....n.Oooh u need youa love babe Guess ynu know it's urue..o.e you.neee... l.v..brbe..u.. l......neee......nn. .e ln.e .e.t..d..e .o.e .e ....n.u ... n....n..b......e ...enG...t day. ..w.ei..o.e y.u.e..ry.s. ..r. ..wrys n. .y .hl..One ...n. . aOn.say ...l..nue .o. s.. uhe .....uo.. .e .nue .e.un.d .e ...e..e.u...n.. eo..nou..n'.bu....ee bs.e.G.....drys s.weei..i... .a.. ..ve.....lo........he....ayr.. vee.....nou en.... .o shov u .are .o.y t oeed.y.u.....e .Obe..u... .o. ...w ......a.e.to.e y.u..e.........e ...en..s....ie u..e.. ynu..old oe .o.e  e.uo.e. e.lo....e.t si.'. .o..n.uh.o..b.u ln.e bab....uhu eO.. a ..eknG...t day. ..w.ei u....e ..u....h..d.ys s..e.i..r.n.u eo.u.y.uo ...v . aO....ove .o. .ue...ay ...l....O.s on  . ..ne.rn. uhh.. t .sl..ry .h....o...... al....e .hoe..ol.  e lo... enuole..e l.v.....t s.n'u .n..n.uh.o. b.u ...e.bab.....h. .O.s a .eek.G...t vays O week ...yu .s.. a w....n.. .............. ...................................................................................................................................................................................................................................................................................................

Eg2: Lyrics for "Hey Jude" with (same) mask above:
 ..u.. .... .........G. .ey .ude...o.u .s.e .u .r...s.e a .sv soo...n. lrie ht beu..a.oele.ber .. le...er .o.o.ynu. he.s...h.. .o. brn s.O...u. .aie .. be...r.u.. ...e von...be a.sr...eou ve....a..... .. ..u.s.d .e. yer...e ..nu.e ynu .eu ..r..o.e. y.ua sih...hen .o. .e..n..n..ai.... be..er...d an....e .ou .ee.nuhe ...n ... ..ee .e..s.n..n.'. ..say u.e wor.en..oo....r ryo.lee.....s.vel..... ko.v.u.O. .u'r.a .no..'h. .layr... ..n..by  .k.n. y.s .o..... ..uu.e .old.a..a .. .a er .a ....a er .a ...ue. ...e ..n.u .. .e ..wn..n. have .o.ne.her ..w .. rn. .e. he. .e.el.e. u. .eu .e...n.n.yo.s..ear. .hen ..u ..o.suast..o .s.e ...beuuesn.o .e. .u n.u ao. .eu.h. .n .e. .ue. be..n..ou.ae vs...n. ..r.sn e.ne .. .es.... wh.h..o. don'..yo. .n.v ..ru..... .....yo. .e. .ue. you... .. .he lo.e.en..yo. .ee...r.on .ou. s.n.l.es... .. va .s.d. .. va .s.d. .. .ey .ude...o.u .s.e .u .r...s.e a .sv soo...n. lrie ht beu..a.oele.ber .. le...er.uover .ou. skh...h.. .o.'.. be..n.uo lrie ht beu..a.be.te. be..er .e..er...uues.beuuesn.h.GO da ds..a eO da dsn.a eO da ds.uey vude..s..a eO da ds..a eO..a ds..a eO .ey ...e.GO da ds..a eO da dsn.a eO da ds.uey vude..s..a eO da ds..a eO..a ds..a eO .ey ...e.GO da ds..a eO da dsn.a eO da ds.uey vude.....l.

[bigboss97]

I burnt a RW with following 3 byte patches (added 1):
00 53 00 57 23 DD<41>7E 88 7C 25<82>13 6D 9B 62 DE B9 58 98 4D 2B
0A 00 24 0A A5 4E A2 67 CA 94 6B 39<23>5F AC 8D 51 04 33 70 6B 49

I can't see any any effect on the screen, conclusion:
1) Lyrics have not started at this point (as have been already mentioned).
2) If this is the encoding information for the following lyrics I should see many incorrect characters in the song.
3) Unless... all 3 bytes are exactly fallen into time code which doesn't affect any visual differences with that minimal value increase.

[bigboss97]

Following patches were done:
1) HD20: "HOUSE OF THE RISING SUN" ==> "HOOXE OF..."
2) HD00: The first 2 readable letters (4 bytes)
   LO ==> KO (Love Me Tender)
3) HD00: Change following values by adding 1
(with consideration of 15*4 byte mask http://www.nabble.com/Re%3A-Lyrics-%28A-LA-LA-LA-LA-LONG%29-p11577679.html)
FB B5 17 5F 34 3F FD 8B 0D
E1 8B<B6>53 DD 40 7E EF 7C 25<82>66 6D 9B 62 AF B9 58 98 28 2B 0A 00<0A>00 A5 4E CA 67 CA 94 6A 39 22 5F BC
8D 51 04 4F 70 6B 49 41 15 FB 5A 0B 39 01 AE 85 B5 17 5F 78 35 FD 8B 6D
E1 8B B5 4C DD 40 7E F9 7C 25 81 03 6D 9B 62 A2 B9 58 98 3D 2B 0A 00 09 00 A5 4E AE 67 CA 94 64 39 22 5F D2

Results:
1) The incorrect title appears after entering song ID. But the correct title appears when the song starts.
2) Player hangs.
3) Original display "SWEAT (A LA LA LA LA LONG", new display "SWEAT#(A LA LA LA LA<line break>LONG)"

Conclusion:
1) HD20 is used when you enter the song ID. Another title is stored in the song in HD00 (see also 3)
2) Obviously, the system needs the first 2 (readable) letters to read the song data in HD00. They might be used as key mask. If length information is interpreted incorrectly system will crash.
3) The 15*4 seems to make sense now. That's where the title starts, honestly I don't know how this (15*4) was found.
Since there are 14 characters between the two visible changes I assume that <82> has no effect.
I changed B5 to B6 and it changes from ' ' to '#'.
B5 XOR 95=' '
B6 XOR 95='#'
This is speculation only. I need to have a closer look.

[woid]

I have updated dvd2Midi to also apply the XOR mask (output to a *.dat file) and map the characters to ascii (output to a *.txt file). The mapping still needs some work.

Dvd2Midi.zip