1/*
2 * Sony OpenMG (OMA) demuxer
3 *
4 * Copyright (c) 2008 Maxim Poliakovski
5 *               2008 Benjamin Larsson
6 *               2011 David Goldwich
7 *
8 * This file is part of Libav.
9 *
10 * Libav is free software; you can redistribute it and/or
11 * modify it under the terms of the GNU Lesser General Public
12 * License as published by the Free Software Foundation; either
13 * version 2.1 of the License, or (at your option) any later version.
14 *
15 * Libav is distributed in the hope that it will be useful,
16 * but WITHOUT ANY WARRANTY; without even the implied warranty of
17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
18 * Lesser General Public License for more details.
19 *
20 * You should have received a copy of the GNU Lesser General Public
21 * License along with Libav; if not, write to the Free Software
22 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
23 */
24
25/**
26 * @file
27 * This is a demuxer for Sony OpenMG Music files
28 *
29 * Known file extensions: ".oma", "aa3"
30 * The format of such files consists of three parts:
31 * - "ea3" header carrying overall info and metadata. Except for starting with
32 *   "ea" instead of "ID", it's an ID3v2 header.
33 * - "EA3" header is a Sony-specific header containing information about
34 *   the OpenMG file: codec type (usually ATRAC, can also be MP3 or WMA),
35 *   codec specific info (packet size, sample rate, channels and so on)
36 *   and DRM related info (file encryption, content id).
37 * - Sound data organized in packets follow the EA3 header
38 *   (can be encrypted using the Sony DRM!).
39 *
40 * CODEC SUPPORT: Only ATRAC3 codec is currently supported!
41 */
42
43#include "avformat.h"
44#include "internal.h"
45#include "libavutil/intreadwrite.h"
46#include "libavutil/des.h"
47#include "oma.h"
48#include "pcm.h"
49#include "riff.h"
50#include "id3v2.h"
51
52
53static const uint64_t leaf_table[] = {
54    0xd79e8283acea4620, 0x7a9762f445afd0d8,
55    0x354d60a60b8c79f1, 0x584e1cde00b07aee,
56    0x1573cd93da7df623, 0x47f98d79620dd535
57};
58
59typedef struct OMAContext {
60    uint64_t content_start;
61    int encrypted;
62    uint16_t k_size;
63    uint16_t e_size;
64    uint16_t i_size;
65    uint16_t s_size;
66    uint32_t rid;
67    uint8_t r_val[24];
68    uint8_t n_val[24];
69    uint8_t m_val[8];
70    uint8_t s_val[8];
71    uint8_t sm_val[8];
72    uint8_t e_val[8];
73    uint8_t iv[8];
74    struct AVDES av_des;
75} OMAContext;
76
77static void hex_log(AVFormatContext *s, int level, const char *name, const uint8_t *value, int len)
78{
79    char buf[33];
80    len = FFMIN(len, 16);
81    if (av_log_get_level() < level)
82        return;
83    ff_data_to_hex(buf, value, len, 1);
84    buf[len<<1] = '\0';
85    av_log(s, level, "%s: %s\n", name, buf);
86}
87
88static int kset(AVFormatContext *s, const uint8_t *r_val, const uint8_t *n_val, int len)
89{
90    OMAContext *oc = s->priv_data;
91
92    if (!r_val && !n_val)
93        return -1;
94
95    len = FFMIN(len, 16);
96
97    /* use first 64 bits in the third round again */
98    if (r_val) {
99        if (r_val != oc->r_val) {
100            memset(oc->r_val, 0, 24);
101            memcpy(oc->r_val, r_val, len);
102        }
103        memcpy(&oc->r_val[16], r_val, 8);
104    }
105    if (n_val) {
106        if (n_val != oc->n_val) {
107            memset(oc->n_val, 0, 24);
108            memcpy(oc->n_val, n_val, len);
109        }
110        memcpy(&oc->n_val[16], n_val, 8);
111    }
112
113    return 0;
114}
115
116static int rprobe(AVFormatContext *s, uint8_t *enc_header, const uint8_t *r_val)
117{
118    OMAContext *oc = s->priv_data;
119    unsigned int pos;
120    struct AVDES av_des;
121
122    if (!enc_header || !r_val)
123        return -1;
124
125    /* m_val */
126    av_des_init(&av_des, r_val, 192, 1);
127    av_des_crypt(&av_des, oc->m_val, &enc_header[48], 1, NULL, 1);
128
129    /* s_val */
130    av_des_init(&av_des, oc->m_val, 64, 0);
131    av_des_crypt(&av_des, oc->s_val, NULL, 1, NULL, 0);
132
133    /* sm_val */
134    pos = OMA_ENC_HEADER_SIZE + oc->k_size + oc->e_size;
135    av_des_init(&av_des, oc->s_val, 64, 0);
136    av_des_mac(&av_des, oc->sm_val, &enc_header[pos], (oc->i_size >> 3));
137
138    pos += oc->i_size;
139
140    return memcmp(&enc_header[pos], oc->sm_val, 8) ? -1 : 0;
141}
142
143static int nprobe(AVFormatContext *s, uint8_t *enc_header, const uint8_t *n_val)
144{
145    OMAContext *oc = s->priv_data;
146    uint32_t pos, taglen, datalen;
147    struct AVDES av_des;
148
149    if (!enc_header || !n_val)
150        return -1;
151
152    pos = OMA_ENC_HEADER_SIZE + oc->k_size;
153    if (!memcmp(&enc_header[pos], "EKB ", 4))
154        pos += 32;
155
156    if (AV_RB32(&enc_header[pos]) != oc->rid)
157        av_log(s, AV_LOG_DEBUG, "Mismatching RID\n");
158
159    taglen = AV_RB32(&enc_header[pos+32]);
160    datalen = AV_RB32(&enc_header[pos+36]) >> 4;
161
162    pos += 44 + taglen;
163
164    av_des_init(&av_des, n_val, 192, 1);
165    while (datalen-- > 0) {
166        av_des_crypt(&av_des, oc->r_val, &enc_header[pos], 2, NULL, 1);
167        kset(s, oc->r_val, NULL, 16);
168        if (!rprobe(s, enc_header, oc->r_val))
169            return 0;
170        pos += 16;
171    }
172
173    return -1;
174}
175
176static int decrypt_init(AVFormatContext *s, ID3v2ExtraMeta *em, uint8_t *header)
177{
178    OMAContext *oc = s->priv_data;
179    ID3v2ExtraMetaGEOB *geob = NULL;
180    uint8_t *gdata;
181
182    oc->encrypted = 1;
183    av_log(s, AV_LOG_INFO, "File is encrypted\n");
184
185    /* find GEOB metadata */
186    while (em) {
187        if (!strcmp(em->tag, "GEOB") &&
188            (geob = em->data) &&
189            (!strcmp(geob->description, "OMG_LSI") ||
190             !strcmp(geob->description, "OMG_BKLSI"))) {
191            break;
192        }
193        em = em->next;
194    }
195    if (!em) {
196        av_log(s, AV_LOG_ERROR, "No encryption header found\n");
197        return -1;
198    }
199
200    if (geob->datasize < 64) {
201        av_log(s, AV_LOG_ERROR, "Invalid GEOB data size: %u\n", geob->datasize);
202        return -1;
203    }
204
205    gdata = geob->data;
206
207    if (AV_RB16(gdata) != 1)
208        av_log(s, AV_LOG_WARNING, "Unknown version in encryption header\n");
209
210    oc->k_size = AV_RB16(&gdata[2]);
211    oc->e_size = AV_RB16(&gdata[4]);
212    oc->i_size = AV_RB16(&gdata[6]);
213    oc->s_size = AV_RB16(&gdata[8]);
214
215    if (memcmp(&gdata[OMA_ENC_HEADER_SIZE], "KEYRING     ", 12)) {
216        av_log(s, AV_LOG_ERROR, "Invalid encryption header\n");
217        return -1;
218    }
219    oc->rid = AV_RB32(&gdata[OMA_ENC_HEADER_SIZE + 28]);
220    av_log(s, AV_LOG_DEBUG, "RID: %.8x\n", oc->rid);
221
222    memcpy(oc->iv, &header[0x58], 8);
223    hex_log(s, AV_LOG_DEBUG, "IV", oc->iv, 8);
224
225    hex_log(s, AV_LOG_DEBUG, "CBC-MAC", &gdata[OMA_ENC_HEADER_SIZE+oc->k_size+oc->e_size+oc->i_size], 8);
226
227    if (s->keylen > 0) {
228        kset(s, s->key, s->key, s->keylen);
229    }
230    if (!memcmp(oc->r_val, (const uint8_t[8]){0}, 8) ||
231        rprobe(s, gdata, oc->r_val) < 0 &&
232        nprobe(s, gdata, oc->n_val) < 0) {
233        int i;
234        for (i = 0; i < FF_ARRAY_ELEMS(leaf_table); i += 2) {
235            uint8_t buf[16];
236            AV_WL64(buf, leaf_table[i]);
237            AV_WL64(&buf[8], leaf_table[i+1]);
238            kset(s, buf, buf, 16);
239            if (!rprobe(s, gdata, oc->r_val) || !nprobe(s, gdata, oc->n_val))
240                break;
241        }
242        if (i >= sizeof(leaf_table)) {
243            av_log(s, AV_LOG_ERROR, "Invalid key\n");
244            return -1;
245        }
246    }
247
248    /* e_val */
249    av_des_init(&oc->av_des, oc->m_val, 64, 0);
250    av_des_crypt(&oc->av_des, oc->e_val, &gdata[OMA_ENC_HEADER_SIZE + 40], 1, NULL, 0);
251    hex_log(s, AV_LOG_DEBUG, "EK", oc->e_val, 8);
252
253    /* init e_val */
254    av_des_init(&oc->av_des, oc->e_val, 64, 1);
255
256    return 0;
257}
258
259static int oma_read_header(AVFormatContext *s,
260                           AVFormatParameters *ap)
261{
262    int     ret, framesize, jsflag, samplerate;
263    uint32_t codec_params;
264    int16_t eid;
265    uint8_t buf[EA3_HEADER_SIZE];
266    uint8_t *edata;
267    AVStream *st;
268    ID3v2ExtraMeta *extra_meta = NULL;
269    OMAContext *oc = s->priv_data;
270
271    ff_id3v2_read_all(s, ID3v2_EA3_MAGIC, &extra_meta);
272    ret = avio_read(s->pb, buf, EA3_HEADER_SIZE);
273    if (ret < EA3_HEADER_SIZE)
274        return -1;
275
276    if (memcmp(buf, ((const uint8_t[]){'E', 'A', '3'}),3) || buf[4] != 0 || buf[5] != EA3_HEADER_SIZE) {
277        av_log(s, AV_LOG_ERROR, "Couldn't find the EA3 header !\n");
278        return -1;
279    }
280
281    oc->content_start = avio_tell(s->pb);
282
283    /* encrypted file */
284    eid = AV_RB16(&buf[6]);
285    if (eid != -1 && eid != -128 && decrypt_init(s, extra_meta, buf) < 0) {
286        ff_id3v2_free_extra_meta(&extra_meta);
287        return -1;
288    }
289
290    ff_id3v2_free_extra_meta(&extra_meta);
291
292    codec_params = AV_RB24(&buf[33]);
293
294    st = avformat_new_stream(s, NULL);
295    if (!st)
296        return AVERROR(ENOMEM);
297
298    st->start_time = 0;
299    st->codec->codec_type  = AVMEDIA_TYPE_AUDIO;
300    st->codec->codec_tag   = buf[32];
301    st->codec->codec_id    = ff_codec_get_id(ff_oma_codec_tags, st->codec->codec_tag);
302
303    switch (buf[32]) {
304        case OMA_CODECID_ATRAC3:
305            samplerate = ff_oma_srate_tab[(codec_params >> 13) & 7] * 100;
306            if (!samplerate) {
307                av_log(s, AV_LOG_ERROR, "Unsupported sample rate\n");
308                return AVERROR_INVALIDDATA;
309            }
310            if (samplerate != 44100)
311                av_log_ask_for_sample(s, "Unsupported sample rate: %d\n",
312                                      samplerate);
313
314            framesize = (codec_params & 0x3FF) * 8;
315            jsflag = (codec_params >> 17) & 1; /* get stereo coding mode, 1 for joint-stereo */
316            st->codec->channels    = 2;
317            st->codec->sample_rate = samplerate;
318            st->codec->bit_rate    = st->codec->sample_rate * framesize * 8 / 1024;
319
320            /* fake the atrac3 extradata (wav format, makes stream copy to wav work) */
321            st->codec->extradata_size = 14;
322            edata = av_mallocz(14 + FF_INPUT_BUFFER_PADDING_SIZE);
323            if (!edata)
324                return AVERROR(ENOMEM);
325
326            st->codec->extradata = edata;
327            AV_WL16(&edata[0],  1);             // always 1
328            AV_WL32(&edata[2],  samplerate);    // samples rate
329            AV_WL16(&edata[6],  jsflag);        // coding mode
330            AV_WL16(&edata[8],  jsflag);        // coding mode
331            AV_WL16(&edata[10], 1);             // always 1
332            // AV_WL16(&edata[12], 0);          // always 0
333
334            avpriv_set_pts_info(st, 64, 1, st->codec->sample_rate);
335            break;
336        case OMA_CODECID_ATRAC3P:
337            st->codec->channels = (codec_params >> 10) & 7;
338            framesize = ((codec_params & 0x3FF) * 8) + 8;
339            samplerate = ff_oma_srate_tab[(codec_params >> 13) & 7] * 100;
340            if (!samplerate) {
341                av_log(s, AV_LOG_ERROR, "Unsupported sample rate\n");
342                return AVERROR_INVALIDDATA;
343            }
344            st->codec->sample_rate = samplerate;
345            st->codec->bit_rate    = samplerate * framesize * 8 / 1024;
346            avpriv_set_pts_info(st, 64, 1, samplerate);
347            av_log(s, AV_LOG_ERROR, "Unsupported codec ATRAC3+!\n");
348            break;
349        case OMA_CODECID_MP3:
350            st->need_parsing = AVSTREAM_PARSE_FULL;
351            framesize = 1024;
352            break;
353        case OMA_CODECID_LPCM:
354            /* PCM 44.1 kHz 16 bit stereo big-endian */
355            st->codec->channels = 2;
356            st->codec->sample_rate = 44100;
357            framesize = 1024;
358            /* bit rate = sample rate x PCM block align (= 4) x 8 */
359            st->codec->bit_rate = st->codec->sample_rate * 32;
360            st->codec->bits_per_coded_sample = av_get_bits_per_sample(st->codec->codec_id);
361            avpriv_set_pts_info(st, 64, 1, st->codec->sample_rate);
362            break;
363        default:
364            av_log(s, AV_LOG_ERROR, "Unsupported codec %d!\n",buf[32]);
365            return -1;
366    }
367
368    st->codec->block_align = framesize;
369
370    return 0;
371}
372
373
374static int oma_read_packet(AVFormatContext *s, AVPacket *pkt)
375{
376    OMAContext *oc = s->priv_data;
377    int packet_size = s->streams[0]->codec->block_align;
378    int ret = av_get_packet(s->pb, pkt, packet_size);
379
380    if (ret <= 0)
381        return AVERROR(EIO);
382
383    pkt->stream_index = 0;
384
385    if (oc->encrypted) {
386        /* previous unencrypted block saved in IV for the next packet (CBC mode) */
387        av_des_crypt(&oc->av_des, pkt->data, pkt->data, (packet_size >> 3), oc->iv, 1);
388    }
389
390    return ret;
391}
392
393static int oma_read_probe(AVProbeData *p)
394{
395    const uint8_t *buf;
396    unsigned tag_len = 0;
397
398    buf = p->buf;
399
400    if (p->buf_size < ID3v2_HEADER_SIZE ||
401        !ff_id3v2_match(buf, ID3v2_EA3_MAGIC) ||
402        buf[3] != 3 || // version must be 3
403        buf[4]) // flags byte zero
404        return 0;
405
406    tag_len = ff_id3v2_tag_len(buf);
407
408    /* This check cannot overflow as tag_len has at most 28 bits */
409    if (p->buf_size < tag_len + 5)
410        /* EA3 header comes late, might be outside of the probe buffer */
411        return AVPROBE_SCORE_MAX / 2;
412
413    buf += tag_len;
414
415    if (!memcmp(buf, "EA3", 3) && !buf[4] && buf[5] == EA3_HEADER_SIZE)
416        return AVPROBE_SCORE_MAX;
417    else
418        return 0;
419}
420
421static int oma_read_seek(struct AVFormatContext *s, int stream_index, int64_t timestamp, int flags)
422{
423    OMAContext *oc = s->priv_data;
424
425    pcm_read_seek(s, stream_index, timestamp, flags);
426
427    if (oc->encrypted) {
428        /* readjust IV for CBC */
429        int64_t pos = avio_tell(s->pb);
430        if (pos < oc->content_start)
431            memset(oc->iv, 0, 8);
432        else {
433            if (avio_seek(s->pb, -8, SEEK_CUR) < 0 || avio_read(s->pb, oc->iv, 8) < 8) {
434                memset(oc->iv, 0, 8);
435                return -1;
436            }
437        }
438    }
439
440    return 0;
441}
442
443AVInputFormat ff_oma_demuxer = {
444    .name           = "oma",
445    .long_name      = NULL_IF_CONFIG_SMALL("Sony OpenMG audio"),
446    .priv_data_size = sizeof(OMAContext),
447    .read_probe     = oma_read_probe,
448    .read_header    = oma_read_header,
449    .read_packet    = oma_read_packet,
450    .read_seek      = oma_read_seek,
451    .flags          = AVFMT_GENERIC_INDEX,
452    .extensions     = "oma,omg,aa3",
453    .codec_tag      = (const AVCodecTag* const []){ff_oma_codec_tags, 0},
454};
455
456