1/*
2 * Sony OpenMG (OMA) demuxer
3 *
4 * Copyright (c) 2008, 2013 Maxim Poliakovski
5 *               2008 Benjamin Larsson
6 *               2011 David Goldwich
7 *
8 * This file is part of FFmpeg.
9 *
10 * FFmpeg is free software; you can redistribute it and/or
11 * modify it under the terms of the GNU Lesser General Public
12 * License as published by the Free Software Foundation; either
13 * version 2.1 of the License, or (at your option) any later version.
14 *
15 * FFmpeg is distributed in the hope that it will be useful,
16 * but WITHOUT ANY WARRANTY; without even the implied warranty of
17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
18 * Lesser General Public License for more details.
19 *
20 * You should have received a copy of the GNU Lesser General Public
21 * License along with FFmpeg; if not, write to the Free Software
22 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
23 */
24
25/**
26 * @file
27 * This is a demuxer for Sony OpenMG Music files
28 *
29 * Known file extensions: ".oma", "aa3"
30 * The format of such files consists of three parts:
31 * - "ea3" header carrying overall info and metadata. Except for starting with
32 *   "ea" instead of "ID", it's an ID3v2 header.
33 * - "EA3" header is a Sony-specific header containing information about
34 *   the OpenMG file: codec type (usually ATRAC, can also be MP3 or WMA),
35 *   codec specific info (packet size, sample rate, channels and so on)
36 *   and DRM related info (file encryption, content id).
37 * - Sound data organized in packets follow the EA3 header
38 *   (can be encrypted using the Sony DRM!).
39 *
40 * Supported decoders: ATRAC3, ATRAC3+, MP3, LPCM
41 */
42
43#include <inttypes.h>
44
45#include "libavutil/channel_layout.h"
46#include "avformat.h"
47#include "internal.h"
48#include "libavutil/intreadwrite.h"
49#include "libavutil/des.h"
50#include "oma.h"
51#include "pcm.h"
52#include "id3v2.h"
53
54
55static const uint64_t leaf_table[] = {
56    0xd79e8283acea4620, 0x7a9762f445afd0d8,
57    0x354d60a60b8c79f1, 0x584e1cde00b07aee,
58    0x1573cd93da7df623, 0x47f98d79620dd535
59};
60
61typedef struct OMAContext {
62    uint64_t content_start;
63    int encrypted;
64    uint16_t k_size;
65    uint16_t e_size;
66    uint16_t i_size;
67    uint16_t s_size;
68    uint32_t rid;
69    uint8_t r_val[24];
70    uint8_t n_val[24];
71    uint8_t m_val[8];
72    uint8_t s_val[8];
73    uint8_t sm_val[8];
74    uint8_t e_val[8];
75    uint8_t iv[8];
76    struct AVDES av_des;
77} OMAContext;
78
79static void hex_log(AVFormatContext *s, int level,
80                    const char *name, const uint8_t *value, int len)
81{
82    char buf[33];
83    len = FFMIN(len, 16);
84    if (av_log_get_level() < level)
85        return;
86    ff_data_to_hex(buf, value, len, 1);
87    buf[len << 1] = '\0';
88    av_log(s, level, "%s: %s\n", name, buf);
89}
90
91static int kset(AVFormatContext *s, const uint8_t *r_val, const uint8_t *n_val,
92                int len)
93{
94    OMAContext *oc = s->priv_data;
95
96    if (!r_val && !n_val)
97        return -1;
98
99    len = FFMIN(len, 16);
100
101    /* use first 64 bits in the third round again */
102    if (r_val) {
103        if (r_val != oc->r_val) {
104            memset(oc->r_val, 0, 24);
105            memcpy(oc->r_val, r_val, len);
106        }
107        memcpy(&oc->r_val[16], r_val, 8);
108    }
109    if (n_val) {
110        if (n_val != oc->n_val) {
111            memset(oc->n_val, 0, 24);
112            memcpy(oc->n_val, n_val, len);
113        }
114        memcpy(&oc->n_val[16], n_val, 8);
115    }
116
117    return 0;
118}
119
120#define OMA_RPROBE_M_VAL 48 + 1
121
122static int rprobe(AVFormatContext *s, uint8_t *enc_header, unsigned size,
123                  const uint8_t *r_val)
124{
125    OMAContext *oc = s->priv_data;
126    unsigned int pos;
127    struct AVDES av_des;
128
129    if (!enc_header || !r_val ||
130        size < OMA_ENC_HEADER_SIZE + oc->k_size + oc->e_size + oc->i_size ||
131        size < OMA_RPROBE_M_VAL)
132        return -1;
133
134    /* m_val */
135    av_des_init(&av_des, r_val, 192, 1);
136    av_des_crypt(&av_des, oc->m_val, &enc_header[48], 1, NULL, 1);
137
138    /* s_val */
139    av_des_init(&av_des, oc->m_val, 64, 0);
140    av_des_crypt(&av_des, oc->s_val, NULL, 1, NULL, 0);
141
142    /* sm_val */
143    pos = OMA_ENC_HEADER_SIZE + oc->k_size + oc->e_size;
144    av_des_init(&av_des, oc->s_val, 64, 0);
145    av_des_mac(&av_des, oc->sm_val, &enc_header[pos], (oc->i_size >> 3));
146
147    pos += oc->i_size;
148
149    return memcmp(&enc_header[pos], oc->sm_val, 8) ? -1 : 0;
150}
151
152static int nprobe(AVFormatContext *s, uint8_t *enc_header, unsigned size,
153                  const uint8_t *n_val)
154{
155    OMAContext *oc = s->priv_data;
156    uint64_t pos;
157    uint32_t taglen, datalen;
158    struct AVDES av_des;
159
160    if (!enc_header || !n_val ||
161        size < OMA_ENC_HEADER_SIZE + oc->k_size + 4)
162        return -1;
163
164    pos = OMA_ENC_HEADER_SIZE + oc->k_size;
165    if (!memcmp(&enc_header[pos], "EKB ", 4))
166        pos += 32;
167
168    if (size < pos + 44)
169        return -1;
170
171    if (AV_RB32(&enc_header[pos]) != oc->rid)
172        av_log(s, AV_LOG_DEBUG, "Mismatching RID\n");
173
174    taglen  = AV_RB32(&enc_header[pos + 32]);
175    datalen = AV_RB32(&enc_header[pos + 36]) >> 4;
176
177    pos += 44L + taglen;
178
179    if (pos + (((uint64_t)datalen) << 4) > size)
180        return -1;
181
182    av_des_init(&av_des, n_val, 192, 1);
183    while (datalen-- > 0) {
184        av_des_crypt(&av_des, oc->r_val, &enc_header[pos], 2, NULL, 1);
185        kset(s, oc->r_val, NULL, 16);
186        if (!rprobe(s, enc_header, size, oc->r_val))
187            return 0;
188        pos += 16;
189    }
190
191    return -1;
192}
193
194static int decrypt_init(AVFormatContext *s, ID3v2ExtraMeta *em, uint8_t *header)
195{
196    OMAContext *oc = s->priv_data;
197    ID3v2ExtraMetaGEOB *geob = NULL;
198    uint8_t *gdata;
199
200    oc->encrypted = 1;
201    av_log(s, AV_LOG_INFO, "File is encrypted\n");
202
203    /* find GEOB metadata */
204    while (em) {
205        if (!strcmp(em->tag, "GEOB") &&
206            (geob = em->data) &&
207            (!strcmp(geob->description, "OMG_LSI") ||
208             !strcmp(geob->description, "OMG_BKLSI"))) {
209            break;
210        }
211        em = em->next;
212    }
213    if (!em) {
214        av_log(s, AV_LOG_ERROR, "No encryption header found\n");
215        return AVERROR_INVALIDDATA;
216    }
217
218    if (geob->datasize < 64) {
219        av_log(s, AV_LOG_ERROR,
220               "Invalid GEOB data size: %"PRIu32"\n", geob->datasize);
221        return AVERROR_INVALIDDATA;
222    }
223
224    gdata = geob->data;
225
226    if (AV_RB16(gdata) != 1)
227        av_log(s, AV_LOG_WARNING, "Unknown version in encryption header\n");
228
229    oc->k_size = AV_RB16(&gdata[2]);
230    oc->e_size = AV_RB16(&gdata[4]);
231    oc->i_size = AV_RB16(&gdata[6]);
232    oc->s_size = AV_RB16(&gdata[8]);
233
234    if (memcmp(&gdata[OMA_ENC_HEADER_SIZE], "KEYRING     ", 12)) {
235        av_log(s, AV_LOG_ERROR, "Invalid encryption header\n");
236        return AVERROR_INVALIDDATA;
237    }
238    if (OMA_ENC_HEADER_SIZE + oc->k_size + oc->e_size + oc->i_size + 8 > geob->datasize ||
239        OMA_ENC_HEADER_SIZE + 48 > geob->datasize) {
240        av_log(s, AV_LOG_ERROR, "Too little GEOB data\n");
241        return AVERROR_INVALIDDATA;
242    }
243    oc->rid = AV_RB32(&gdata[OMA_ENC_HEADER_SIZE + 28]);
244    av_log(s, AV_LOG_DEBUG, "RID: %.8"PRIx32"\n", oc->rid);
245
246    memcpy(oc->iv, &header[0x58], 8);
247    hex_log(s, AV_LOG_DEBUG, "IV", oc->iv, 8);
248
249    hex_log(s, AV_LOG_DEBUG, "CBC-MAC",
250            &gdata[OMA_ENC_HEADER_SIZE + oc->k_size + oc->e_size + oc->i_size],
251            8);
252
253    if (s->keylen > 0) {
254        kset(s, s->key, s->key, s->keylen);
255    }
256    if (!memcmp(oc->r_val, (const uint8_t[8]){0}, 8) ||
257        rprobe(s, gdata, geob->datasize, oc->r_val) < 0 &&
258        nprobe(s, gdata, geob->datasize, oc->n_val) < 0) {
259        int i;
260        for (i = 0; i < FF_ARRAY_ELEMS(leaf_table); i += 2) {
261            uint8_t buf[16];
262            AV_WL64(buf,     leaf_table[i]);
263            AV_WL64(&buf[8], leaf_table[i + 1]);
264            kset(s, buf, buf, 16);
265            if (!rprobe(s, gdata, geob->datasize, oc->r_val) ||
266                !nprobe(s, gdata, geob->datasize, oc->n_val))
267                break;
268        }
269        if (i >= FF_ARRAY_ELEMS(leaf_table)) {
270            av_log(s, AV_LOG_ERROR, "Invalid key\n");
271            return AVERROR_INVALIDDATA;
272        }
273    }
274
275    /* e_val */
276    av_des_init(&oc->av_des, oc->m_val, 64, 0);
277    av_des_crypt(&oc->av_des, oc->e_val,
278                 &gdata[OMA_ENC_HEADER_SIZE + 40], 1, NULL, 0);
279    hex_log(s, AV_LOG_DEBUG, "EK", oc->e_val, 8);
280
281    /* init e_val */
282    av_des_init(&oc->av_des, oc->e_val, 64, 1);
283
284    return 0;
285}
286
287static int oma_read_header(AVFormatContext *s)
288{
289    int     ret, framesize, jsflag, samplerate;
290    uint32_t codec_params, channel_id;
291    int16_t eid;
292    uint8_t buf[EA3_HEADER_SIZE];
293    uint8_t *edata;
294    AVStream *st;
295    ID3v2ExtraMeta *extra_meta = NULL;
296    OMAContext *oc = s->priv_data;
297
298    ff_id3v2_read(s, ID3v2_EA3_MAGIC, &extra_meta, 0);
299    ret = avio_read(s->pb, buf, EA3_HEADER_SIZE);
300    if (ret < EA3_HEADER_SIZE)
301        return -1;
302
303    if (memcmp(buf, ((const uint8_t[]){'E', 'A', '3'}), 3) ||
304        buf[4] != 0 || buf[5] != EA3_HEADER_SIZE) {
305        av_log(s, AV_LOG_ERROR, "Couldn't find the EA3 header !\n");
306        return AVERROR_INVALIDDATA;
307    }
308
309    oc->content_start = avio_tell(s->pb);
310
311    /* encrypted file */
312    eid = AV_RB16(&buf[6]);
313    if (eid != -1 && eid != -128 && decrypt_init(s, extra_meta, buf) < 0) {
314        ff_id3v2_free_extra_meta(&extra_meta);
315        return -1;
316    }
317
318    ff_id3v2_free_extra_meta(&extra_meta);
319
320    codec_params = AV_RB24(&buf[33]);
321
322    st = avformat_new_stream(s, NULL);
323    if (!st)
324        return AVERROR(ENOMEM);
325
326    st->start_time = 0;
327    st->codec->codec_type = AVMEDIA_TYPE_AUDIO;
328    st->codec->codec_tag  = buf[32];
329    st->codec->codec_id   = ff_codec_get_id(ff_oma_codec_tags,
330                                            st->codec->codec_tag);
331
332    switch (buf[32]) {
333    case OMA_CODECID_ATRAC3:
334        samplerate = ff_oma_srate_tab[(codec_params >> 13) & 7] * 100;
335        if (!samplerate) {
336            av_log(s, AV_LOG_ERROR, "Unsupported sample rate\n");
337            return AVERROR_INVALIDDATA;
338        }
339        if (samplerate != 44100)
340            avpriv_request_sample(s, "Sample rate %d", samplerate);
341
342        framesize = (codec_params & 0x3FF) * 8;
343
344        /* get stereo coding mode, 1 for joint-stereo */
345        jsflag = (codec_params >> 17) & 1;
346
347        st->codec->channels    = 2;
348        st->codec->channel_layout = AV_CH_LAYOUT_STEREO;
349        st->codec->sample_rate = samplerate;
350        st->codec->bit_rate    = st->codec->sample_rate * framesize * 8 / 1024;
351
352        /* fake the ATRAC3 extradata
353         * (wav format, makes stream copy to wav work) */
354        if (ff_alloc_extradata(st->codec, 14))
355            return AVERROR(ENOMEM);
356
357        edata = st->codec->extradata;
358        AV_WL16(&edata[0],  1);             // always 1
359        AV_WL32(&edata[2],  samplerate);    // samples rate
360        AV_WL16(&edata[6],  jsflag);        // coding mode
361        AV_WL16(&edata[8],  jsflag);        // coding mode
362        AV_WL16(&edata[10], 1);             // always 1
363        // AV_WL16(&edata[12], 0);          // always 0
364
365        avpriv_set_pts_info(st, 64, 1, st->codec->sample_rate);
366        break;
367    case OMA_CODECID_ATRAC3P:
368        channel_id = (codec_params >> 10) & 7;
369        if (!channel_id) {
370            av_log(s, AV_LOG_ERROR,
371                   "Invalid ATRAC-X channel id: %"PRIu32"\n", channel_id);
372            return AVERROR_INVALIDDATA;
373        }
374        st->codec->channel_layout = ff_oma_chid_to_native_layout[channel_id - 1];
375        st->codec->channels       = ff_oma_chid_to_num_channels[channel_id - 1];
376        framesize = ((codec_params & 0x3FF) * 8) + 8;
377        samplerate = ff_oma_srate_tab[(codec_params >> 13) & 7] * 100;
378        if (!samplerate) {
379            av_log(s, AV_LOG_ERROR, "Unsupported sample rate\n");
380            return AVERROR_INVALIDDATA;
381        }
382        st->codec->sample_rate = samplerate;
383        st->codec->bit_rate    = samplerate * framesize * 8 / 2048;
384        avpriv_set_pts_info(st, 64, 1, samplerate);
385        break;
386    case OMA_CODECID_MP3:
387        st->need_parsing = AVSTREAM_PARSE_FULL_RAW;
388        framesize = 1024;
389        break;
390    case OMA_CODECID_LPCM:
391        /* PCM 44.1 kHz 16 bit stereo big-endian */
392        st->codec->channels = 2;
393        st->codec->channel_layout = AV_CH_LAYOUT_STEREO;
394        st->codec->sample_rate = 44100;
395        framesize = 1024;
396        /* bit rate = sample rate x PCM block align (= 4) x 8 */
397        st->codec->bit_rate = st->codec->sample_rate * 32;
398        st->codec->bits_per_coded_sample =
399            av_get_bits_per_sample(st->codec->codec_id);
400        avpriv_set_pts_info(st, 64, 1, st->codec->sample_rate);
401        break;
402    default:
403        av_log(s, AV_LOG_ERROR, "Unsupported codec %d!\n", buf[32]);
404        return AVERROR(ENOSYS);
405    }
406
407    st->codec->block_align = framesize;
408
409    return 0;
410}
411
412
413static int oma_read_packet(AVFormatContext *s, AVPacket *pkt)
414{
415    OMAContext *oc = s->priv_data;
416    int packet_size = s->streams[0]->codec->block_align;
417    int ret = av_get_packet(s->pb, pkt, packet_size);
418
419    if (ret < packet_size)
420        pkt->flags |= AV_PKT_FLAG_CORRUPT;
421
422    if (ret < 0)
423        return ret;
424    if (!ret)
425        return AVERROR_EOF;
426
427    pkt->stream_index = 0;
428
429    if (oc->encrypted) {
430        /* previous unencrypted block saved in IV for
431         * the next packet (CBC mode) */
432        if (ret == packet_size)
433            av_des_crypt(&oc->av_des, pkt->data, pkt->data,
434                         (packet_size >> 3), oc->iv, 1);
435        else
436            memset(oc->iv, 0, 8);
437    }
438
439    return ret;
440}
441
442static int oma_read_probe(AVProbeData *p)
443{
444    const uint8_t *buf = p->buf;
445    unsigned tag_len = 0;
446
447    if (p->buf_size >= ID3v2_HEADER_SIZE && ff_id3v2_match(buf, ID3v2_EA3_MAGIC))
448        tag_len = ff_id3v2_tag_len(buf);
449
450    /* This check cannot overflow as tag_len has at most 28 bits */
451    if (p->buf_size < tag_len + 5)
452        /* EA3 header comes late, might be outside of the probe buffer */
453        return tag_len ? AVPROBE_SCORE_EXTENSION/2 : 0;
454
455    buf += tag_len;
456
457    if (!memcmp(buf, "EA3", 3) && !buf[4] && buf[5] == EA3_HEADER_SIZE)
458        return AVPROBE_SCORE_MAX;
459    else
460        return 0;
461}
462
463static int oma_read_seek(struct AVFormatContext *s,
464                         int stream_index, int64_t timestamp, int flags)
465{
466    OMAContext *oc = s->priv_data;
467    int err = ff_pcm_read_seek(s, stream_index, timestamp, flags);
468
469    if (!oc->encrypted)
470        return err;
471
472    /* readjust IV for CBC */
473    if (err || avio_tell(s->pb) < oc->content_start)
474        goto wipe;
475    if ((err = avio_seek(s->pb, -8, SEEK_CUR)) < 0)
476        goto wipe;
477    if ((err = avio_read(s->pb, oc->iv, 8)) < 8) {
478        if (err >= 0)
479            err = AVERROR_EOF;
480        goto wipe;
481    }
482
483    return 0;
484wipe:
485    memset(oc->iv, 0, 8);
486    return err;
487}
488
489AVInputFormat ff_oma_demuxer = {
490    .name           = "oma",
491    .long_name      = NULL_IF_CONFIG_SMALL("Sony OpenMG audio"),
492    .priv_data_size = sizeof(OMAContext),
493    .read_probe     = oma_read_probe,
494    .read_header    = oma_read_header,
495    .read_packet    = oma_read_packet,
496    .read_seek      = oma_read_seek,
497    .flags          = AVFMT_GENERIC_INDEX,
498    .extensions     = "oma,omg,aa3",
499    .codec_tag      = (const AVCodecTag* const []){ff_oma_codec_tags, 0},
500};
501