please read this quite terse commented log together with the more detailed explanations of the commands at atracdownload-wiki
Log of the upload of a short track that is saved as DRM'ed OMA on the PC. Content ID: 010F50000004000000B792F6F9318C20FFF1AAD8 DES encryption key: 3E8AB6C3C32C35EB DES encryption IV: 4CAD6BD3BD7BBEE5 The encrypted music data is not reencrypted before transfer. 6.737139 => 00180008 0046f003 010380ff 8.101696 <= 09180008 0046f003 01038000 80 -> Start NetMD session 8.117905 => 00180008 0046f003 010311ff 8.180608 <= 09180008 0046f003 01031100 01000009 c7160000 11 -> Get leaf ID -> 01000009c7160000 8.193922 => 00180008 0046f003 010312ff 00380000 00380000 00010000 00090001 000a0000 00002545 064deaca 14f996bd c8a406c2 2b816886 9089b724 181ee860 041d2eb3 fddbe74c 7ccdb1e3 06c0 8.242539 <= 09180008 0046f003 01031201 00380000 0038 12 -> Transfer EKB (EKB 0001000a; root key 7F38BCB0A80795C134F9DCAA8CE415B8 known) 8.470557 => 00180008 0046f003 010320ff 000000eb 03ac802b 632d98 8.539199 <= 09180008 0046f003 01032000 00000023 a360239f 2d445a 20 -> Nonce exchange. Catenated nonces: eb03ac802b632d9823a360239f2d445a Generate key (using "Retail MAC") from that: `echo eb03ac802b632d9823a360239f2d445a | xxd -r -p | openssl enc -des-cbc -K 7F38BCB0A80795C1 -iv 0 -nopad | tail -c 8 | openssl enc -d -des -K 34F9DCAA8CE415B8 -iv 0 -nopad |openssl enc -des-cbc -K 7F38BCB0A80795C1 -iv 0 -nopad |xxd -p | tr [a-z] [A-Z]` D1260009CE8B3EEB 8.584921 => 00180008 0046f003 010322ff 0000b71b abc29aee f9d21e7e a1f1e191 9f44e6c8 18ef0994 c910df57 4c4bc96d 7d31 8.632089 <= 09180008 0046f003 01032200 0000 22 -> Transfer content ID & encryption key Decrypting that stuff: `echo b71babc29aeef9d21e7ea1f1e1919f44e6c818ef0994c910df574c4bc96d7d31 | xxd -r -p | openssl enc -d -nopad -des-cbc -K D1260009CE8B3EEB -iv 0 | xxd -p | tr [a-z] [A-Z]` magic -> 01010101 content ID -> 010F50000004000000B792F6F9318C20FFF1AAD8 DES key encryption key -> 3E8AB6C3C32C35EB 8.645355 <= 00180008 0046f003 010328ff 00010010 01ffff00 94020000 00ac0000 8148 10.883583 => 0f180008 0046f003 01032800 00010010 01000400 94020000 00ac0000 8148 28 -> Do download 9402 -> LP2; 000000ac frames; 00008148 bytes in packet stream 10.941276 BULK=> 00000000 00003f00 cfce9591 d055b35b e784ba61 e5797640 4cad6bd3 bd7bbee5 first 8 bytes: length next 8 bytes: DES block key `echo cfce9591 d055b35b | xxd -r -p | openssl enc -nopad -des-cbc -K 3E8AB6C3C32C35EB -iv 0 | xxd -p` 3e8ab6c3c32c35eb (equals KEK here) third 8 bytes: IV from OMG file encrypted content follows. `echo 4cad6bd3bd7bbee5 | xxd -r -p | openssl enc -d -nopad -des-cbc -K 3E8AB6C3C32C35EB -iv e784ba61e5797640 | xxd -p` a15646328329c1a6 - this is correct. [...] 11.243738 BULK=> [...] 20f8d28b 14c4cb9a 00000000 00003f00 cfce9591 d055b35b 20f8d28b 14c4cb9a e86161b1 a8d840c2 e18df0d8 fc5edfd2 Block transition shown here, starting with the encrypted last 8 bytes from the previous block. No footer present. Next block starts with 64 bit length, encrypted block key and IV. As this is stream-cbc, the IV for the next block is just the last encrypted 8 bytes from the previous block. [...] 14.570476 <= 09180008 0046f003 01032800 00010010 01000400 94020000 00ac0000 814845f8 50f15fad 0546bb6c 3a7a9bde cdbcb7ca 031b0bc9 0685f29e 550676fe f5d6 final reply, includes an encrypted status info: `echo 45f850f15fad0546bb6c3a7a9bdecdbcb7ca031b0bc90685f29e550676fef5d6 | xxd -r -p | openssl enc -d -nopad -des-cbc -K D1260009CE8B3EEB -iv 0 | xxd -p | tr [a-z] [A-Z]` 88318AACF80DF7FB - Track UUID/MAC 01010101 - padding? Has also been observed as 00000000 on a different device 010F50000004000000B792F6F9318C20FFF1AAD8 14.585337 => 00180810 18020300 14.617410 <= 09180810 18020300 Start titling 14.628425 => 00180702 20180200 0430000a 00500000 04000000 00746164 61 14.710323 <= 09180702 20180200 0430000a 00500000 04000000 00 Set title "tada" 14.723417 => 00180810 18020000 14.758251 <= 09180810 18020000 End titling 15.213829 => 00180008 0046f003 010348ff 00100100 04726a2e 3f11b8c7 16 23.007058 <= 09180008 0046f003 01034800 00100100 04 48 -> Commit track 4. Last 8 bytes are authorization: `echo 0000000000000000 | xxd -r -p | openssl enc -des -nopad -K D1260009CE8B3EEB -iv 0 | xxd -p | tr [a-z] [A-Z]` 726A2E3F11B8C716 23.017410 <= 00180008 0046f003 010321ff 000000 23.055991 => 09180008 0046f003 01032100 000000 21 -> Forget key 23.417116 <= 00180008 0046f003 010381ff 23.477526 => 09180008 0046f003 01038100 81 -> Terminate session