# Widevine L1 – Extracting Keybox from eMMC Dump (MSTAR Devices)

This guide explains how to identify and extract a **Widevine L1 keybox** from an **eMMC dump**, commonly found on **MSTAR-based TVs and set-top boxes**.

---

## 📦 What You Need

- An **eMMC dump** (usually the largest file)
- **Windows / Linux / macOS**
- Hex editor or CLI tools:
  - `strings`
  - `grep`
  - `xxd`
- **Provisioning script** (can be used with VT)
- Basic understanding of **DRM / Widevine flows**

---

## 2️⃣ Identifying the Correct eMMC Dump

### ✔ File Size

- Usually **4–8 GB**
- Sometimes **15 GB+** (TV models)

➡️ **Always pick the largest dump file**

---

### ✔ Detecting MSTAR Devices

Open the dump and check the beginning.

If it starts with: MBOOT

➡️ The device is using an **MSTAR SoC**  
(common for TVs and set-top boxes)

---

## 3️⃣ Locating the Widevine Keybox

### ❌ What Is NOT the Keybox

Ignore files or blocks like:

- `bgroupcert.dat`
- `zgpriv.dat`
- Dumps containing **many** `MSTAR_SECURE` blocks

➡️ Most of these are **garbage / unrelated**

---

### ✅ How to Spot the Real Widevine Keybox

Search inside the dump for: MSTAR_SECURE

#### 🔑 Key Insight: **LENGTH MATTERS**

A real Widevine keybox usually contains:

- **~6 lines of HEX data immediately after `MSTAR_SECURE`**

##### Examples


3–4 lines  ❌ Not a keybox
Very large data ❌ Not a keybox
~6 lines ✅ Likely the real keybox

This is how experienced people recognize it instantly.

---

## 4️⃣ build.prop — Why It’s Needed

`build.prop` is used to generate:

device_client_id_blob
Search in the dump for: ro.build.fingerprint=

### 📋 Required Properties Mapping
device_client_id field
build.prop property
company_name
ro.product.manufacturer
model_name
ro.product.model
architecture_name
ro.product.cpu.abi
device_name
ro.product.device
product_name
ro.product.name
build_info
ro.build.fingerprint

---

### ⚠️ If build.prop Is Missing

- **L1 will still work**
- Metadata will be **generic**
- **Lifetime remains unchanged** (≈ 5 hours)

---

## 🔐 MSTAR AES KEY
0007FF4154534D92FC55AA0FFF0110E0

---

## 💬 Support & Discussion

Questions, suggestions, fixes, or issues:

👉 **DRMLab Discord Server**  
https://discord.gg/bexEz5KypW

---

## 🛠 Tools & Scripts

🔗 https://git.drmlab.io

---

## ⚠️ Disclaimer

This information is provided for **educational and research purposes only**.  
You are responsible for how you use it.