3 * Copyright (c) 2015 Vesselin Bontchev
5 * Header parsing is borrowed from https://github.com/jteeuwen/audible project.
6 * Copyright (c) 2001-2014, Jim Teeuwen
8 * Redistribution and use in source and binary forms, with or without modification,
9 * are permitted provided that the following conditions are met:
11 * 1. Redistributions of source code must retain the above copyright notice, this
12 * list of conditions and the following disclaimer.
14 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
15 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
16 * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
17 * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR
18 * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
19 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
20 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
21 * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
23 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
28 #include "libavutil/dict.h"
29 #include "libavutil/intreadwrite.h"
30 #include "libavutil/tea.h"
31 #include "libavutil/opt.h"
33 #define AA_MAGIC 1469084982 /* this identifies an audible .aa file */
34 #define MAX_CODEC_SECOND_SIZE 3982
35 #define MAX_TOC_ENTRIES 16
36 #define MAX_DICTIONARY_ENTRIES 128
37 #define TEA_BLOCK_SIZE 8
39 typedef struct AADemuxContext {
41 uint8_t *aa_fixed_key;
43 int codec_second_size;
44 int current_codec_second_size;
46 struct AVTEA *tea_ctx;
48 int64_t current_chapter_size;
51 static int get_second_size(char *codec_name)
55 if (!strcmp(codec_name, "mp332")) {
57 } else if (!strcmp(codec_name, "acelp16")) {
59 } else if (!strcmp(codec_name, "acelp85")) {
66 static int aa_read_header(AVFormatContext *s)
68 int i, j, idx, largest_idx = -1;
69 uint32_t nkey, nval, toc_size, npairs, header_seed = 0, start;
70 char key[128], val[128], codec_name[64] = {0};
71 uint8_t output[24], dst[8], src[8];
72 int64_t largest_size = -1, current_size = -1;
76 } TOC[MAX_TOC_ENTRIES];
77 uint32_t header_key_part[4];
78 uint8_t header_key[16] = {0};
79 AADemuxContext *c = s->priv_data;
80 AVIOContext *pb = s->pb;
83 /* parse .aa header */
84 avio_skip(pb, 4); // file size
85 avio_skip(pb, 4); // magic string
86 toc_size = avio_rb32(pb); // TOC size
87 avio_skip(pb, 4); // unidentified integer
88 if (toc_size > MAX_TOC_ENTRIES)
89 return AVERROR_INVALIDDATA;
90 for (i = 0; i < toc_size; i++) { // read TOC
91 avio_skip(pb, 4); // TOC entry index
92 TOC[i].offset = avio_rb32(pb); // block offset
93 TOC[i].size = avio_rb32(pb); // block size
95 avio_skip(pb, 24); // header termination block (ignored)
96 npairs = avio_rb32(pb); // read dictionary entries
97 if (npairs > MAX_DICTIONARY_ENTRIES)
98 return AVERROR_INVALIDDATA;
99 for (i = 0; i < npairs; i++) {
100 memset(val, 0, sizeof(val));
101 memset(key, 0, sizeof(key));
102 avio_skip(pb, 1); // unidentified integer
103 nkey = avio_rb32(pb); // key string length
104 nval = avio_rb32(pb); // value string length
105 avio_get_str(pb, nkey, key, sizeof(key));
106 avio_get_str(pb, nval, val, sizeof(val));
107 if (!strcmp(key, "codec")) {
108 av_log(s, AV_LOG_DEBUG, "Codec is <%s>\n", val);
109 strncpy(codec_name, val, sizeof(codec_name) - 1);
110 } else if (!strcmp(key, "HeaderSeed")) {
111 av_log(s, AV_LOG_DEBUG, "HeaderSeed is <%s>\n", val);
112 header_seed = atoi(val);
113 } else if (!strcmp(key, "HeaderKey")) { // this looks like "1234567890 1234567890 1234567890 1234567890"
114 av_log(s, AV_LOG_DEBUG, "HeaderKey is <%s>\n", val);
115 sscanf(val, "%u%u%u%u", &header_key_part[0], &header_key_part[1], &header_key_part[2], &header_key_part[3]);
116 for (idx = 0; idx < 4; idx++) {
117 AV_WB32(&header_key[idx * 4], header_key_part[idx]); // convert each part to BE!
119 av_log(s, AV_LOG_DEBUG, "Processed HeaderKey is ");
120 for (i = 0; i < 16; i++)
121 av_log(s, AV_LOG_DEBUG, "%02x", header_key[i]);
122 av_log(s, AV_LOG_DEBUG, "\n");
124 av_dict_set(&s->metadata, key, val, 0);
128 /* verify fixed key */
129 if (c->aa_fixed_key_len != 16) {
130 av_log(s, AV_LOG_ERROR, "aa_fixed_key value needs to be 16 bytes!\n");
131 return AVERROR(EINVAL);
135 if ((c->codec_second_size = get_second_size(codec_name)) == -1) {
136 av_log(s, AV_LOG_ERROR, "unknown codec <%s>!\n", codec_name);
137 return AVERROR(EINVAL);
140 /* decryption key derivation */
141 c->tea_ctx = av_tea_alloc();
143 return AVERROR(ENOMEM);
144 av_tea_init(c->tea_ctx, c->aa_fixed_key, 16);
145 output[0] = output[1] = 0; // purely for padding purposes
146 memcpy(output + 2, header_key, 16);
148 for (i = 0; i < 3; i++) { // TEA CBC with weird mixed endianness
149 AV_WB32(src, header_seed);
150 AV_WB32(src + 4, header_seed + 1);
152 av_tea_crypt(c->tea_ctx, dst, src, 1, NULL, 0); // TEA ECB encrypt
153 for (j = 0; j < TEA_BLOCK_SIZE && idx < 18; j+=1, idx+=1) {
154 output[idx] = output[idx] ^ dst[j];
157 memcpy(c->file_key, output + 2, 16); // skip first 2 bytes of output
158 av_log(s, AV_LOG_DEBUG, "File key is ");
159 for (i = 0; i < 16; i++)
160 av_log(s, AV_LOG_DEBUG, "%02x", c->file_key[i]);
161 av_log(s, AV_LOG_DEBUG, "\n");
164 st = avformat_new_stream(s, NULL);
166 av_freep(&c->tea_ctx);
167 return AVERROR(ENOMEM);
169 st->codecpar->codec_type = AVMEDIA_TYPE_AUDIO;
170 if (!strcmp(codec_name, "mp332")) {
171 st->codecpar->codec_id = AV_CODEC_ID_MP3;
172 st->codecpar->sample_rate = 22050;
173 st->need_parsing = AVSTREAM_PARSE_FULL_RAW;
175 } else if (!strcmp(codec_name, "acelp85")) {
176 st->codecpar->codec_id = AV_CODEC_ID_SIPR;
177 st->codecpar->block_align = 19;
178 st->codecpar->channels = 1;
179 st->codecpar->sample_rate = 8500;
180 st->need_parsing = AVSTREAM_PARSE_FULL_RAW;
181 } else if (!strcmp(codec_name, "acelp16")) {
182 st->codecpar->codec_id = AV_CODEC_ID_SIPR;
183 st->codecpar->block_align = 20;
184 st->codecpar->channels = 1;
185 st->codecpar->sample_rate = 16000;
186 st->need_parsing = AVSTREAM_PARSE_FULL_RAW;
189 /* determine, and jump to audio start offset */
190 for (i = 1; i < toc_size; i++) { // skip the first entry!
191 current_size = TOC[i].size;
192 if (current_size > largest_size) {
194 largest_size = current_size;
197 start = TOC[largest_idx].offset;
198 avio_seek(pb, start, SEEK_SET);
199 c->current_chapter_size = 0;
204 static int aa_read_packet(AVFormatContext *s, AVPacket *pkt)
206 uint8_t dst[TEA_BLOCK_SIZE];
207 uint8_t src[TEA_BLOCK_SIZE];
211 uint8_t buf[MAX_CODEC_SECOND_SIZE * 2];
214 AADemuxContext *c = s->priv_data;
216 // are we at the start of a chapter?
217 if (c->current_chapter_size == 0) {
218 c->current_chapter_size = avio_rb32(s->pb);
219 if (c->current_chapter_size == 0) {
222 av_log(s, AV_LOG_DEBUG, "Chapter %d (%" PRId64 " bytes)\n", c->chapter_idx, c->current_chapter_size);
223 c->chapter_idx = c->chapter_idx + 1;
224 avio_skip(s->pb, 4); // data start offset
225 c->current_codec_second_size = c->codec_second_size;
228 // is this the last block in this chapter?
229 if (c->current_chapter_size / c->current_codec_second_size == 0) {
230 c->current_codec_second_size = c->current_chapter_size % c->current_codec_second_size;
233 // decrypt c->current_codec_second_size bytes
234 blocks = c->current_codec_second_size / TEA_BLOCK_SIZE;
235 for (i = 0; i < blocks; i++) {
236 avio_read(s->pb, src, TEA_BLOCK_SIZE);
237 av_tea_init(c->tea_ctx, c->file_key, 16);
238 av_tea_crypt(c->tea_ctx, dst, src, 1, NULL, 1);
239 memcpy(buf + written, dst, TEA_BLOCK_SIZE);
240 written = written + TEA_BLOCK_SIZE;
242 trailing_bytes = c->current_codec_second_size % TEA_BLOCK_SIZE;
243 if (trailing_bytes != 0) { // trailing bytes are left unencrypted!
244 avio_read(s->pb, src, trailing_bytes);
245 memcpy(buf + written, src, trailing_bytes);
246 written = written + trailing_bytes;
250 c->current_chapter_size = c->current_chapter_size - c->current_codec_second_size;
251 if (c->current_chapter_size <= 0)
252 c->current_chapter_size = 0;
254 ret = av_new_packet(pkt, written);
257 memcpy(pkt->data, buf, written);
262 static int aa_probe(AVProbeData *p)
264 uint8_t *buf = p->buf;
266 // first 4 bytes are file size, next 4 bytes are the magic
267 if (AV_RB32(buf+4) != AA_MAGIC)
270 return AVPROBE_SCORE_MAX / 2;
273 static int aa_read_close(AVFormatContext *s)
275 AADemuxContext *c = s->priv_data;
277 av_freep(&c->tea_ctx);
282 #define OFFSET(x) offsetof(AADemuxContext, x)
283 static const AVOption aa_options[] = {
284 { "aa_fixed_key", // extracted from libAAX_SDK.so and AAXSDKWin.dll files!
285 "Fixed key used for handling Audible AA files", OFFSET(aa_fixed_key),
286 AV_OPT_TYPE_BINARY, {.str="77214d4b196a87cd520045fd2a51d673"},
287 .flags = AV_OPT_FLAG_DECODING_PARAM },
291 static const AVClass aa_class = {
293 .item_name = av_default_item_name,
294 .option = aa_options,
295 .version = LIBAVUTIL_VERSION_INT,
298 AVInputFormat ff_aa_demuxer = {
300 .long_name = NULL_IF_CONFIG_SMALL("Audible AA format files"),
301 .priv_class = &aa_class,
302 .priv_data_size = sizeof(AADemuxContext),
304 .read_probe = aa_probe,
305 .read_header = aa_read_header,
306 .read_packet = aa_read_packet,
307 .read_close = aa_read_close,
308 .flags = AVFMT_GENERIC_INDEX,