Editing Serial Number

Question

On the official raspberrypi.org forum, "Dom" - a moderator wrote:

I've fudged my board to have your serial number

How do I edit the serial number of a Raspberry Pi?

Firstly why? Secondly I don't think it is possible. If it was possible then you could steal someone else's licence for mpeg2 playback. Granted Dom did do it, but he is magical. — Vincent P, Jan 08 '13 at 10:44
Well I have replied in the thread and I'll PM Dom to ask how he did. Will keep you updated. — Vincent P, Jan 08 '13 at 12:59
The question is likely to be fobbed off with a wink there. That is why I asked here. — Another Simon, Jan 08 '13 at 21:52

Vincent P · Answer 1 · 2013-01-09T05:46:55.603

10

I'm copying this from this forum thread.

Dom has access to all the source code, the Videocore debugger and many closed VC specific tools. And releasing any information to allow you to change the serial number would break the mechanism for codec licencing, so will never happen.

Additionally as posted in the thread. The only reason for changing the serial would be to copy someone else's MP4 licence and use it. As that is the security around the licensing. Your unique serial is linked to the MP4 licence, so even if someone got your licence key, they will be unable to do anything with it (unless they could change the Raspberry Pi's serial number.

UPDATE: To answer the actual question. I'd say that as Dom has the source for the actual low level firmware. I'd imagine that he is really just changing the source code that reads the serial and forcing it to return a different value. I honestly doubt that it was actually changed (on the CPU I mean), more like he changed some of the firmware code to return a different serial. Also apologies to the asker, we all just gave you a "Why? Thats not nice. Your stealing" instead of answering the question. My bad.

edited Jan 09 '13 at 05:46

answered Jan 09 '13 at 05:07

Vincent P

2,210
15
24

2

Thank you for your apologies and your attempt at answering the question. "I'd imagine that he is ..." type answers are great for discussion purposes, but the accepted answer will hopefully be in the form of "It is done via the xyz utility which is only available to Broadcom employees..." etc. – Another Simon Jan 09 '13 at 06:27
3

I'm a little surprised that the assumption that the serial number would only be changed for nefarious purposes is so prevalent on a Linux device. I'd like to switch it around to "why should I allow a 3rd party to identify my system uniquely"? I see it as, among other things, a privacy issue. Why? That's my business. – bobstro Jun 25 '15 at 02:37
@bobstro Checking the serial only becomes a privacy issue if (a) the results of the check are transmitted to a third party and processed to build a user profile, or (b) personal information such as the user's name were also collected and tied to the serial number, perhaps at the time of purchase. But in general I agree: changing any part of a free software is a basic freedom of GPL users which is not conditional on having a "good reason" to do so. – Dmitry Grigoryev Oct 18 '21 at 08:17
If I had to guess, I'd say the serial is hardwired within the CPU. That would imply the serial can never be modified. This answer explains exactly what Dom did, and nobody with the factual information will verify it due to the NDA'd nature of the chipset (Broadcom protecting its IP), and the closed-source nature of the low level firmware that handles it (for License protection). – Juan Carlos Dec 04 '21 at 22:06

Dmitry Grigoryev · Answer 2 · 2021-10-18T08:02:51.323

As far as userspace programs are concerned, it's pretty easy to fool them and fake the contents of just about any file. For example, suppose a C program is using /proc/cpuinfo file to verify the serial number. The program is copy-protected and tied to the serial, and I don't have the source code. However, I can still run strace program 2>&1 | grep cpuinfo, which will reveal something like:

open("/proc/cpuinfo", O_RDONLY) = 3

At this point, I can create a small library, cpuinfo.so with the following function:

int open(const char *file, int flags) {
    static int (*real_open)(const char *file, int flags);
    if(!real_open) real_open = dlsym(RTLD_NEXT, "open");
    if(!strcmp(file, "/proc/cpuinfo")) file = "/tmp/cpuinfo";
    return real_open(file, flags);
}

As you can see, I'm checking if the user of the library tries to open /proc/cpuinfo, in which case I open /tmp/cpuinfo instead.

Then I will run the original copy-protected program as LD_PRELOAD=/path/to/cpuinfo.so program, and it will happily read my fake file thinking it's /proc/cpuinfo, while working correctly with the rest of the files.

Note that if the copy-protected software includes kernel objects, it will be much harder to fool, as it could access hardware directly. However, such software will also only work with the kernel for which it was built, making it quite impractical to distribute.

Editing Serial Number

2 Answers2

Linked