1 /*
2 * Audible AA demuxer
3 * Copyright (c) 2015 Vesselin Bontchev
4 *
5 * Header parsing is borrowed from https://github.com/jteeuwen/audible project.
6 * Copyright (c) 2001-2014, Jim Teeuwen
7 *
8 * Redistribution and use in source and binary forms, with or without modification,
9 * are permitted provided that the following conditions are met:
10 *
11 * 1. Redistributions of source code must retain the above copyright notice, this
12 * list of conditions and the following disclaimer.
13 *
14 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
15 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
16 * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
17 * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR
18 * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
19 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
20 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
21 * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
23 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
24 */
25
26 #include "avformat.h"
27 #include "internal.h"
28 #include "libavutil/dict.h"
29 #include "libavutil/intreadwrite.h"
30 #include "libavutil/tea.h"
31 #include "libavutil/opt.h"
32
33 #define AA_MAGIC 1469084982 /* this identifies an audible .aa file */
34 #define MAX_CODEC_SECOND_SIZE 3982
35 #define MAX_TOC_ENTRIES 16
36 #define MAX_DICTIONARY_ENTRIES 128
37 #define TEA_BLOCK_SIZE 8
38 #define CHAPTER_HEADER_SIZE 8
39 #define TIMEPREC 1000
40 #define MP3_FRAME_SIZE 104
41
42 typedef struct AADemuxContext {
43 AVClass *class;
44 uint8_t *aa_fixed_key;
45 int aa_fixed_key_len;
46 int codec_second_size;
47 int current_codec_second_size;
48 int chapter_idx;
49 struct AVTEA *tea_ctx;
50 uint8_t file_key[16];
51 int64_t current_chapter_size;
52 int64_t content_start;
53 int64_t content_end;
54 int seek_offset;
55 } AADemuxContext;
56
get_second_size(char * codec_name)57 static int get_second_size(char *codec_name)
58 {
59 int result = -1;
60
61 if (!strcmp(codec_name, "mp332")) {
62 result = 3982;
63 } else if (!strcmp(codec_name, "acelp16")) {
64 result = 2000;
65 } else if (!strcmp(codec_name, "acelp85")) {
66 result = 1045;
67 }
68
69 return result;
70 }
71
aa_read_header(AVFormatContext * s)72 static int aa_read_header(AVFormatContext *s)
73 {
74 int i, j, idx, largest_idx = -1;
75 uint32_t toc_size, npairs, header_seed = 0, start;
76 char codec_name[64] = {0};
77 uint8_t output[24], dst[8], src[8];
78 int64_t largest_size = -1, current_size = -1, chapter_pos;
79 struct toc_entry {
80 uint32_t offset;
81 uint32_t size;
82 } TOC[MAX_TOC_ENTRIES];
83 uint32_t header_key_part[4];
84 uint8_t header_key[16] = {0};
85 AADemuxContext *c = s->priv_data;
86 AVIOContext *pb = s->pb;
87 AVStream *st;
88 int ret;
89
90 /* parse .aa header */
91 avio_skip(pb, 4); // file size
92 avio_skip(pb, 4); // magic string
93 toc_size = avio_rb32(pb); // TOC size
94 avio_skip(pb, 4); // unidentified integer
95 if (toc_size > MAX_TOC_ENTRIES || toc_size < 2)
96 return AVERROR_INVALIDDATA;
97 for (i = 0; i < toc_size; i++) { // read TOC
98 avio_skip(pb, 4); // TOC entry index
99 TOC[i].offset = avio_rb32(pb); // block offset
100 TOC[i].size = avio_rb32(pb); // block size
101 }
102 avio_skip(pb, 24); // header termination block (ignored)
103 npairs = avio_rb32(pb); // read dictionary entries
104 if (npairs > MAX_DICTIONARY_ENTRIES)
105 return AVERROR_INVALIDDATA;
106 for (i = 0; i < npairs; i++) {
107 char key[128], val[128];
108 uint32_t nkey, nval;
109
110 avio_skip(pb, 1); // unidentified integer
111 nkey = avio_rb32(pb); // key string length
112 nval = avio_rb32(pb); // value string length
113 avio_get_str(pb, nkey, key, sizeof(key));
114 avio_get_str(pb, nval, val, sizeof(val));
115 if (!strcmp(key, "codec")) {
116 av_log(s, AV_LOG_DEBUG, "Codec is <%s>\n", val);
117 av_strlcpy(codec_name, val, sizeof(codec_name));
118 } else if (!strcmp(key, "HeaderSeed")) {
119 av_log(s, AV_LOG_DEBUG, "HeaderSeed is <%s>\n", val);
120 header_seed = atoi(val);
121 } else if (!strcmp(key, "HeaderKey")) { // this looks like "1234567890 1234567890 1234567890 1234567890"
122 av_log(s, AV_LOG_DEBUG, "HeaderKey is <%s>\n", val);
123
124 ret = sscanf(val, "%"SCNu32"%"SCNu32"%"SCNu32"%"SCNu32,
125 &header_key_part[0], &header_key_part[1], &header_key_part[2], &header_key_part[3]);
126 if (ret != 4)
127 return AVERROR_INVALIDDATA;
128
129 for (idx = 0; idx < 4; idx++) {
130 AV_WB32(&header_key[idx * 4], header_key_part[idx]); // convert each part to BE!
131 }
132 av_log(s, AV_LOG_DEBUG, "Processed HeaderKey is ");
133 for (i = 0; i < 16; i++)
134 av_log(s, AV_LOG_DEBUG, "%02x", header_key[i]);
135 av_log(s, AV_LOG_DEBUG, "\n");
136 } else {
137 av_dict_set(&s->metadata, key, val, 0);
138 }
139 }
140
141 /* verify fixed key */
142 if (c->aa_fixed_key_len != 16) {
143 av_log(s, AV_LOG_ERROR, "aa_fixed_key value needs to be 16 bytes!\n");
144 return AVERROR(EINVAL);
145 }
146
147 /* verify codec */
148 if ((c->codec_second_size = get_second_size(codec_name)) == -1) {
149 av_log(s, AV_LOG_ERROR, "unknown codec <%s>!\n", codec_name);
150 return AVERROR(EINVAL);
151 }
152
153 /* decryption key derivation */
154 c->tea_ctx = av_tea_alloc();
155 if (!c->tea_ctx)
156 return AVERROR(ENOMEM);
157 av_tea_init(c->tea_ctx, c->aa_fixed_key, 16);
158 output[0] = output[1] = 0; // purely for padding purposes
159 memcpy(output + 2, header_key, 16);
160 idx = 0;
161 for (i = 0; i < 3; i++) { // TEA CBC with weird mixed endianness
162 AV_WB32(src, header_seed);
163 AV_WB32(src + 4, header_seed + 1);
164 header_seed += 2;
165 av_tea_crypt(c->tea_ctx, dst, src, 1, NULL, 0); // TEA ECB encrypt
166 for (j = 0; j < TEA_BLOCK_SIZE && idx < 18; j+=1, idx+=1) {
167 output[idx] = output[idx] ^ dst[j];
168 }
169 }
170 memcpy(c->file_key, output + 2, 16); // skip first 2 bytes of output
171 av_log(s, AV_LOG_DEBUG, "File key is ");
172 for (i = 0; i < 16; i++)
173 av_log(s, AV_LOG_DEBUG, "%02x", c->file_key[i]);
174 av_log(s, AV_LOG_DEBUG, "\n");
175
176 /* decoder setup */
177 st = avformat_new_stream(s, NULL);
178 if (!st) {
179 av_freep(&c->tea_ctx);
180 return AVERROR(ENOMEM);
181 }
182 st->codecpar->codec_type = AVMEDIA_TYPE_AUDIO;
183 if (!strcmp(codec_name, "mp332")) {
184 st->codecpar->codec_id = AV_CODEC_ID_MP3;
185 st->codecpar->sample_rate = 22050;
186 st->need_parsing = AVSTREAM_PARSE_FULL_RAW;
187 avpriv_set_pts_info(st, 64, 8, 32000 * TIMEPREC);
188 // encoded audio frame is MP3_FRAME_SIZE bytes (+1 with padding, unlikely)
189 } else if (!strcmp(codec_name, "acelp85")) {
190 st->codecpar->codec_id = AV_CODEC_ID_SIPR;
191 st->codecpar->block_align = 19;
192 st->codecpar->channels = 1;
193 st->codecpar->sample_rate = 8500;
194 st->codecpar->bit_rate = 8500;
195 st->need_parsing = AVSTREAM_PARSE_FULL_RAW;
196 avpriv_set_pts_info(st, 64, 8, 8500 * TIMEPREC);
197 } else if (!strcmp(codec_name, "acelp16")) {
198 st->codecpar->codec_id = AV_CODEC_ID_SIPR;
199 st->codecpar->block_align = 20;
200 st->codecpar->channels = 1;
201 st->codecpar->sample_rate = 16000;
202 st->codecpar->bit_rate = 16000;
203 st->need_parsing = AVSTREAM_PARSE_FULL_RAW;
204 avpriv_set_pts_info(st, 64, 8, 16000 * TIMEPREC);
205 }
206
207 /* determine, and jump to audio start offset */
208 for (i = 1; i < toc_size; i++) { // skip the first entry!
209 current_size = TOC[i].size;
210 if (current_size > largest_size) {
211 largest_idx = i;
212 largest_size = current_size;
213 }
214 }
215 start = TOC[largest_idx].offset;
216 avio_seek(pb, start, SEEK_SET);
217
218 // extract chapter positions. since all formats have constant bit rate, use it
219 // as time base in bytes/s, for easy stream position <-> timestamp conversion
220 st->start_time = 0;
221 c->content_start = start;
222 c->content_end = start + largest_size;
223
224 while ((chapter_pos = avio_tell(pb)) >= 0 && chapter_pos < c->content_end) {
225 unsigned chapter_idx = s->nb_chapters;
226 uint32_t chapter_size = avio_rb32(pb);
227 if (chapter_size == 0 || avio_feof(pb))
228 break;
229 chapter_pos -= start + CHAPTER_HEADER_SIZE * chapter_idx;
230 avio_skip(pb, 4 + chapter_size);
231 if (!avpriv_new_chapter(s, chapter_idx, st->time_base,
232 chapter_pos * TIMEPREC,
233 (chapter_pos + chapter_size) * TIMEPREC, NULL)) {
234 av_freep(&c->tea_ctx);
235 return AVERROR(ENOMEM);
236 }
237 }
238
239 st->duration = (largest_size - CHAPTER_HEADER_SIZE * s->nb_chapters) * TIMEPREC;
240
241 ff_update_cur_dts(s, st, 0);
242 avio_seek(pb, start, SEEK_SET);
243 c->current_chapter_size = 0;
244 c->seek_offset = 0;
245
246 return 0;
247 }
248
aa_read_packet(AVFormatContext * s,AVPacket * pkt)249 static int aa_read_packet(AVFormatContext *s, AVPacket *pkt)
250 {
251 uint8_t dst[TEA_BLOCK_SIZE];
252 uint8_t src[TEA_BLOCK_SIZE];
253 int i;
254 int trailing_bytes;
255 int blocks;
256 uint8_t buf[MAX_CODEC_SECOND_SIZE * 2];
257 int written = 0;
258 int ret;
259 AADemuxContext *c = s->priv_data;
260 uint64_t pos = avio_tell(s->pb);
261
262 // are we at the end of the audio content?
263 if (pos >= c->content_end) {
264 return AVERROR_EOF;
265 }
266
267 // are we at the start of a chapter?
268 if (c->current_chapter_size == 0) {
269 c->current_chapter_size = avio_rb32(s->pb);
270 if (c->current_chapter_size == 0) {
271 return AVERROR_EOF;
272 }
273 av_log(s, AV_LOG_DEBUG, "Chapter %d (%" PRId64 " bytes)\n", c->chapter_idx, c->current_chapter_size);
274 c->chapter_idx = c->chapter_idx + 1;
275 avio_skip(s->pb, 4); // data start offset
276 pos += 8;
277 c->current_codec_second_size = c->codec_second_size;
278 }
279
280 // is this the last block in this chapter?
281 if (c->current_chapter_size / c->current_codec_second_size == 0) {
282 c->current_codec_second_size = c->current_chapter_size % c->current_codec_second_size;
283 }
284
285 // decrypt c->current_codec_second_size bytes
286 blocks = c->current_codec_second_size / TEA_BLOCK_SIZE;
287 for (i = 0; i < blocks; i++) {
288 ret = avio_read(s->pb, src, TEA_BLOCK_SIZE);
289 if (ret != TEA_BLOCK_SIZE)
290 return (ret < 0) ? ret : AVERROR_EOF;
291 av_tea_init(c->tea_ctx, c->file_key, 16);
292 av_tea_crypt(c->tea_ctx, dst, src, 1, NULL, 1);
293 memcpy(buf + written, dst, TEA_BLOCK_SIZE);
294 written = written + TEA_BLOCK_SIZE;
295 }
296 trailing_bytes = c->current_codec_second_size % TEA_BLOCK_SIZE;
297 if (trailing_bytes != 0) { // trailing bytes are left unencrypted!
298 ret = avio_read(s->pb, src, trailing_bytes);
299 if (ret != trailing_bytes)
300 return (ret < 0) ? ret : AVERROR_EOF;
301 memcpy(buf + written, src, trailing_bytes);
302 written = written + trailing_bytes;
303 }
304
305 // update state
306 c->current_chapter_size = c->current_chapter_size - c->current_codec_second_size;
307 if (c->current_chapter_size <= 0)
308 c->current_chapter_size = 0;
309
310 if (c->seek_offset > written)
311 c->seek_offset = 0; // ignore wrong estimate
312
313 ret = av_new_packet(pkt, written - c->seek_offset);
314 if (ret < 0)
315 return ret;
316 memcpy(pkt->data, buf + c->seek_offset, written - c->seek_offset);
317 pkt->pos = pos;
318
319 c->seek_offset = 0;
320 return 0;
321 }
322
aa_read_seek(AVFormatContext * s,int stream_index,int64_t timestamp,int flags)323 static int aa_read_seek(AVFormatContext *s,
324 int stream_index, int64_t timestamp, int flags)
325 {
326 AADemuxContext *c = s->priv_data;
327 AVChapter *ch;
328 int64_t chapter_pos, chapter_start, chapter_size;
329 int chapter_idx = 0;
330
331 // find chapter containing seek timestamp
332 if (timestamp < 0)
333 timestamp = 0;
334
335 while (chapter_idx < s->nb_chapters && timestamp >= s->chapters[chapter_idx]->end) {
336 ++chapter_idx;
337 }
338
339 if (chapter_idx >= s->nb_chapters) {
340 chapter_idx = s->nb_chapters - 1;
341 if (chapter_idx < 0) return -1; // there is no chapter.
342 timestamp = s->chapters[chapter_idx]->end;
343 }
344
345 ch = s->chapters[chapter_idx];
346
347 // sync by clamping timestamp to nearest valid block position in its chapter
348 chapter_size = ch->end / TIMEPREC - ch->start / TIMEPREC;
349 chapter_pos = av_rescale_rnd((timestamp - ch->start) / TIMEPREC,
350 1, c->codec_second_size,
351 (flags & AVSEEK_FLAG_BACKWARD) ? AV_ROUND_DOWN : AV_ROUND_UP)
352 * c->codec_second_size;
353 if (chapter_pos >= chapter_size)
354 chapter_pos = chapter_size;
355 chapter_start = c->content_start + (ch->start / TIMEPREC) + CHAPTER_HEADER_SIZE * (1 + chapter_idx);
356
357 // reinit read state
358 avio_seek(s->pb, chapter_start + chapter_pos, SEEK_SET);
359 c->current_codec_second_size = c->codec_second_size;
360 c->current_chapter_size = chapter_size - chapter_pos;
361 c->chapter_idx = 1 + chapter_idx;
362
363 // for unaligned frames, estimate offset of first frame in block (assume no padding)
364 if (s->streams[0]->codecpar->codec_id == AV_CODEC_ID_MP3) {
365 c->seek_offset = (MP3_FRAME_SIZE - chapter_pos % MP3_FRAME_SIZE) % MP3_FRAME_SIZE;
366 }
367
368 ff_update_cur_dts(s, s->streams[0], ch->start + (chapter_pos + c->seek_offset) * TIMEPREC);
369
370 return 1;
371 }
372
aa_probe(const AVProbeData * p)373 static int aa_probe(const AVProbeData *p)
374 {
375 uint8_t *buf = p->buf;
376
377 // first 4 bytes are file size, next 4 bytes are the magic
378 if (AV_RB32(buf+4) != AA_MAGIC)
379 return 0;
380
381 return AVPROBE_SCORE_MAX / 2;
382 }
383
aa_read_close(AVFormatContext * s)384 static int aa_read_close(AVFormatContext *s)
385 {
386 AADemuxContext *c = s->priv_data;
387
388 av_freep(&c->tea_ctx);
389
390 return 0;
391 }
392
393 #define OFFSET(x) offsetof(AADemuxContext, x)
394 static const AVOption aa_options[] = {
395 { "aa_fixed_key", // extracted from libAAX_SDK.so and AAXSDKWin.dll files!
396 "Fixed key used for handling Audible AA files", OFFSET(aa_fixed_key),
397 AV_OPT_TYPE_BINARY, {.str="77214d4b196a87cd520045fd2a51d673"},
398 .flags = AV_OPT_FLAG_DECODING_PARAM },
399 { NULL },
400 };
401
402 static const AVClass aa_class = {
403 .class_name = "aa",
404 .item_name = av_default_item_name,
405 .option = aa_options,
406 .version = LIBAVUTIL_VERSION_INT,
407 };
408
409 AVInputFormat ff_aa_demuxer = {
410 .name = "aa",
411 .long_name = NULL_IF_CONFIG_SMALL("Audible AA format files"),
412 .priv_class = &aa_class,
413 .priv_data_size = sizeof(AADemuxContext),
414 .extensions = "aa",
415 .read_probe = aa_probe,
416 .read_header = aa_read_header,
417 .read_packet = aa_read_packet,
418 .read_seek = aa_read_seek,
419 .read_close = aa_read_close,
420 .flags = AVFMT_NO_BYTE_SEEK | AVFMT_NOGENSEARCH,
421 };
422