Reverse-engineering efforts to generate license keys for Raspberry Pi hardware video decoding
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
nucular df4a522dbc
Merge pull request #2 from gnafuthegreat/patch-1
1 year ago
assets Add information about the patch 2 years ago
.gitignore Started reverse-engineering 2 years ago
LICENSE Initial commit 2 years ago Change references to "VP1" to the correct "VC-1" 1 year ago
is_licensed.asm Started reverse-engineering 2 years ago
sub_EC96290.asm Started reverse-engineering 2 years ago


This is an effort to reverse-engineer the Raspberry Pi license key check for MPEG-2 and VC-1 hardware video encoding.


A patch for start.elf, a firmwware blob for the VideoCore IV processor used by all Raspberry Pi models, was posted to reddit by /u/fuck_the_mpeg_la on 03-03-2017:

cd /boot
cp start.elf start.elf_backup && \
 perl -pne 's/\x47\xE9362H\x3C\x18/\x47\xE9362H\x3C\x1F/g' < start.elf_backup > start.elf

Applying it to a 4.14.44 start.elf (latest as of time of writing) results in the following diff:

$ diff <(xxd -e start.elf_backup) <(xxd -e start.elf)
< 00095c30: 400703a4 40161799 3633e947 183c4832  ...@...@G.362H<.
> 00095c30: 400703a4 40161799 3633e947 1f3c4832  ...@...@G.362H<.
$ md5sum start.elf_backup start.elf
8327a0720f806814b677efaeb94a7671  start.elf_backup
fe55537c71b22e8f8c1a92257da2c45b  start.elf

Some initial analysis was done by q3k on Hacker News:

Yes, it seems to patch a licensing function at 0xEC95FD4 [1] to always return 1, by patching the jump at 0xEC95FE2 (that should be only taken for the always-allowed H263 codec) to always be taken, thus always allowing all codecs.

Mirrored from


The initial entry point is disassembled using the VideoCore IV plugin for IDA Pro 6 by hermanhermitage.

After loading and analyzing start.elf, we can find the is_licensed routine at address 0xEC96290 by jumping to the file offset given to us by xxd beforehand. The relevant code sections are available in sub_EC96290.asm and is_licensed.asm.

not_WMV9:				; CODE XREF: is_licensed+56j
		cmp	r7, 'MPG2'
		cmpeq	r6, 0
		bne	not_MPG2
		ld	r1, 0x1DC0(gp) ; XREF 0xEE86680	dword_EE86680
		addcmpbne r1, 0, 0, return_1

not_MPG2:				; CODE XREF: is_licensed+68j
		cmp	r7, 'WVC1'
		cmpeq	r6, 0
		bne	deny
		ld	r2, 0x2120(gp) ; XREF 0xEE869E0	dword_EE869E0
		addcmpbeq r2, 0, 0, deny

Here, two memory locations (0xEE86680 for MPEG-2 and 0xEE869E0 for VC-1) that point to the .bss segment are checked to determine the return value of is_licensed. There are no other obvious references to these locations in start.elf, so memory-breakpoint debugging (TBD) is probably needed.