RAV file format

The RAV format is the encrypted audio format used by the newer tiptoi pens with a built in audio player (Ravensburger 00700, tiptoi Stift mit Player) for music and audio books.

Sample files

Free sample files can be downloaded from the Ravensburger website. If you do not have an account you can still figure out the download path from the public sample paths like this: Bla_Bla-Blub-Hoerprobe.mp3 becomes Bla_Bla-Blub.rav (books) or Bla_Bla-Blub.zip (music).

There is a free sample available here. You do not need a pen to download it, but you only get a valid (non empty) keyfile after entering a pen serial number. The keyfile is tied to that serial, which is why the keyfiles look completely different between downloads.

The short version

A .rav file is a 0x20 byte header followed by an encrypted Ogg Vorbis stream (mono, 22050 Hz).

For a long time people assumed there was serious crypto in here. Turns out it is not that bad. The whole thing was reverse engineered from the firmware itself, by disassembling the Thumb-2 code of the 3203L update, not by guessing from file pairs. It is verified byte exact against original pen files, and custom files play fine on real hardware.

Header

• magic Ravensburgerv03 (16 bytes) followed by a null byte
• LE u16 value16
• flag 0xBE
• 8 byte key blob: TABLE[value16 + 3 + i] ^ key8[i]
• trailer 4E 6C 31 F2 65

Key

• key8 = "CommonI2"
• checksum = (sum(key8) + value16) & 0xFFFF
• keystream[i] = TABLE[(checksum + i) & 0xFFF] (note: the mask applies to checksum + i only)

Body cipher

op = pos & 3: XOR with pass through rules / SUB / ADD / XOR (no pass through). The keystream index is payload relative, (pos - 0x20) & 0x1FF.

Where the table lives

The 4096 byte TABLE sits in the firmware image at file offset 0xDBADC. Decode loop at 0x8DF3B4, key generation at 0x8DF380, audio open at 0x8DFE84.

Quirks worth knowing

• Ogg page CRCs are ignored by the pen.
• Oversized Vorbis comment headers make the pen reject the file. A ~9 KB comment header from a YouTube rip was enough. Keep the metadata small or strip it.

Tools

rav-tool converts any audio to .rav, decrypts stock files, and can extract the key table from any firmware .upd, so checking a different pen generation is a 30 second job instead of a new project. Prebuilt binaries for Windows, macOS and Linux are on the releases page.

See also: the tiptoi mailing list archive and the issue thread where this was finally cracked.