135 lines
2.4 KiB
Markdown
135 lines
2.4 KiB
Markdown
# Widevine L1 – Extracting Keybox from eMMC Dump (MSTAR Devices)
|
||
|
||
This guide explains how to identify and extract a **Widevine L1 keybox** from an **eMMC dump**, commonly found on **MSTAR-based TVs and set-top boxes**.
|
||
|
||
---
|
||
|
||
## 📦 What You Need
|
||
|
||
- An **eMMC dump** (usually the largest file)
|
||
- **Windows / Linux / macOS**
|
||
- Hex editor or CLI tools:
|
||
- `strings`
|
||
- `grep`
|
||
- `xxd`
|
||
- **Provisioning script** (can be used with VT)
|
||
- Basic understanding of **DRM / Widevine flows**
|
||
|
||
---
|
||
|
||
## 2. Identifying the Correct eMMC Dump
|
||
|
||
### ✔ File Size
|
||
|
||
- Usually **4–8 GB**
|
||
- Sometimes **15 GB+** (TV models)
|
||
|
||
➡️ **Always pick the largest dump file**
|
||
|
||
---
|
||
|
||
### ✔ Detecting MSTAR Devices
|
||
|
||
Open the dump and check the beginning.
|
||
|
||
If it starts with: MBOOT
|
||
|
||
➡️ The device is using an **MSTAR SoC**
|
||
(common for TVs and set-top boxes)
|
||
|
||
---
|
||
|
||
## 3. Locating the Widevine Keybox
|
||
|
||
### ❌ What Is NOT the Keybox
|
||
|
||
Ignore files or blocks like:
|
||
|
||
- `bgroupcert.dat`
|
||
- `zgpriv.dat`
|
||
- Dumps containing **many** `MSTAR_SECURE` blocks
|
||
|
||
➡️ Most of these are **garbage / unrelated**
|
||
|
||
---
|
||
|
||
### ✅ How to Spot the Real Widevine Keybox
|
||
|
||
Search inside the dump for: MSTAR_SECURE
|
||
|
||
#### 🔑 Key Insight: **LENGTH MATTERS**
|
||
|
||
A real Widevine keybox usually contains:
|
||
|
||
- **~6 lines of HEX data immediately after `MSTAR_SECURE`**
|
||
|
||
##### Examples
|
||
|
||
|
||
3–4 lines ❌ Not a keybox
|
||
Very large data ❌ Not a keybox
|
||
~6 lines ✅ Likely the real keybox
|
||
|
||
This is how experienced people recognize it instantly.
|
||
|
||
---
|
||
|
||
## 4. build.prop — Why It’s Needed
|
||
|
||
`build.prop` is used to generate:
|
||
|
||
device_client_id_blob
|
||
Search in the dump for: ro.build.fingerprint=
|
||
|
||
### 📋 Required Properties Mapping
|
||
device_client_id field
|
||
build.prop property
|
||
company_name
|
||
ro.product.manufacturer
|
||
model_name
|
||
ro.product.model
|
||
architecture_name
|
||
ro.product.cpu.abi
|
||
device_name
|
||
ro.product.device
|
||
product_name
|
||
ro.product.name
|
||
build_info
|
||
ro.build.fingerprint
|
||
|
||
---
|
||
|
||
### ⚠️ If build.prop Is Missing
|
||
|
||
- **L1 will still work**
|
||
- Metadata will be **generic**
|
||
- **Lifetime remains unchanged** (≈ 5 hours)
|
||
|
||
---
|
||
|
||
## 🔐 MSTAR AES KEY
|
||
0007FF4154534D92FC55AA0FFF0110E0
|
||
|
||
---
|
||
|
||
## 💬 Support & Discussion
|
||
|
||
Questions, suggestions, fixes, or issues:
|
||
|
||
👉 **DRMLab Discord Server**
|
||
https://discord.gg/bexEz5KypW
|
||
|
||
---
|
||
|
||
## 🛠 Tools & Scripts
|
||
|
||
🔗 https://git.drmlab.io
|
||
|
||
---
|
||
|
||
## ⚠️ Disclaimer
|
||
|
||
This information is provided for **educational and research purposes only**.
|
||
You are responsible for how you use it.
|
||
|