[Replicant] PROBING AUDIO LINES ON THE i9305 Samsung Galaxy SIII LTE
J05HYYY
lovell.joshyyy at gmail.com
Mon Jul 24 22:07:01 UTC 2023
CCed to the mailing list.
https://redmine.replicant.us/boards/21/topics/15964?r=15971
#==About==
I traced the error about dbus not finding
org.ofono.QualcommCoreSoundDriver_Beta1 to the file:
https://git.replicant.us/contrib/scintill/frameworks_opt_telephony_ril_ofono/tree/src/c/libcsd-client.c?h=replicant-6.0
As ofono does not have that interface, it looks to me like we have to
hook up audio routing judging by the arguments in
csd_client_start_voice(int rx_dev_id, int tx_dev_id, int
keep_previous_handles) function
typically when we route audio, we hook up input to output, source to
sync, mic to speaker by the looks of things there is a tx device id and
an rx device id
I'm guessing the device ids refer to audio lines on the modem
probably then this means we hook up tx to rx line
and rx to tx line
(though I may be incorrect on this)
either way, we need to know some information about the i9305's audio
capabilities. for this we can use alsa tools to probe for audio lines
we can also try initiate a call and record some sound on the device
and we can also try initiate a call and play some audio on the device
down the phone line to another device we can also check for speaker and
microphone lines on the device
#==Methodology==
0) Download android-ndk-r8b-linux-x86.tar.bz2 and place in the same
directory as the script at the end of this doc 1) Run the script to
download the replicant 4.2 toolchain and compile tinyalsa. [The
required commands for checking the modem lines were not on the device
so need to be compiled.] 2) Plug in the device to the computer, turn on
USB debugging 3) Copy the tinyalsa commands to the device using adb
shell mkdir /data/local/tinyalsa adb push tinyalsa/utils/tinypcminfo
/data/local/tinyalsa/tinypcminfo adb push tinyalsa/examples/pcm-readi
/data/local/tinyalsa/pcm-readi adb push tinyalsa/examples/pcm-writei
/data/local/tinyalsa/pcm-writei adb push tinyalsa/utils/tinycap
/data/local/tinyalsa/tinycap adb push tinyalsa/utils/tinymix
/data/local/tinyalsa/tinymix adb push tinyalsa/utils/tinyplay
/data/local/tinyalsa/tinyplay 4.1) Connect the device and sudo adb
shell (you should allow this and root access via adb in device
settings) 4.2) cd to /data/local/tinyalsa and mark each file
transferred as executable 4.3) run tinypcminfo on different cards and
devices 4.4) run tinycap and tinyplay on different cards and devices
#==RESULTS==
I tried running tinycap on some of card 0: Devices 1,2,3 and 4.
I managed to record something WITHOUT dialing in a call on card 0,
device 3, however, the recorded audio was unaudiable/static sounding.
I managed to play back the file on card 0, device 3, WITHOUT dialing in
a call, however the audio played back was unaudiable/static sounding.
When I dialed a call, nothing changed, ie. I was still UNable to open
devices 1,2 and 4 either by using tinyplay or by using tinycap. It
simply wouldn't work, additional devices were not opened due to the
call being connected.
#==DATA==
#tinypcminfo CARD 0, DEVICE 0
./tinypcminfo -D 0 -d 0
WARNING: linker: ./tinypcminfo has text relocations. This is wasting
memory and prevents security hardening. Please fix. Info for card 0,
device 0:
PCM out:
Access: 0x000009
Format[0]: 0x000044
Format[1]: 00000000
Format Name: S16_LE, S24_LE
Subformat: 0x000001
Rate: min=8000Hz max=96000Hz
Channels: min=2 max=6
Sample bits: min=16 max=32
Period size: min=43 max=2048
Period count: min=2 max=128
PCM in:
cannot open card(0) device (0): Invalid argument
Device does not exist.
#CARD 0, DEVICE 1
./tinypcminfo -D 0 -d 1
WARNING: linker: ./tinypcminfo has text relocations. This is wasting
memory and prevents security hardening. Please fix. Info for card 0,
device 1:
PCM out:
Access: 0x000008
Format[0]: 0x000004
Format[1]: 00000000
Format Name: S16_LE
Subformat: 0x000001
Rate: min=8000Hz max=16000Hz
Channels: min=1 max=2
Sample bits: min=16 max=16
Period size: min=1024 max=4096
Period count: min=2 max=64
PCM in:
Access: 0x000008
Format[0]: 0x000004
Format[1]: 00000000
Format Name: S16_LE
Subformat: 0x000001
Rate: min=8000Hz max=16000Hz
Channels: min=1 max=2
Sample bits: min=16 max=16
Period size: min=1024 max=4096
Period count: min=2 max=64
#CARD 0, DEVICE 2
./tinypcminfo -D 0 -d 2
WARNING: linker: ./tinypcminfo has text relocations. This is wasting
memory and prevents security hardening. Please fix. Info for card 0,
device 2:
PCM out:
Access: 0x000008
Format[0]: 0x000004
Format[1]: 00000000
Format Name: S16_LE
Subformat: 0x000001
Rate: min=8000Hz max=16000Hz
Channels: min=1 max=2
Sample bits: min=16 max=16
Period size: min=1024 max=4096
Period count: min=2 max=64
PCM in:
Access: 0x000008
Format[0]: 0x000004
Format[1]: 00000000
Format Name: S16_LE
Subformat: 0x000001
Rate: min=8000Hz max=16000Hz
Channels: min=1 max=2
Sample bits: min=16 max=16
Period size: min=1024 max=4096
Period count: min=2 max=64
#CARD 0, DEVICE 3
./tinypcminfo -D 0 -d 3
WARNING: linker: ./tinypcminfo has text relocations. This is wasting
memory and prevents security hardening. Please fix. Info for card 0,
device 3:
PCM out:
Access: 0x000009
Format[0]: 0x000044
Format[1]: 00000000
Format Name: S16_LE, S24_LE
Subformat: 0x000001
Rate: min=8000Hz max=96000Hz
Channels: min=2 max=6
Sample bits: min=16 max=32
Period size: min=171 max=8192
Period count: min=2 max=128
PCM in:
Access: 0x000009
Format[0]: 0x000044
Format[1]: 00000000
Format Name: S16_LE, S24_LE
Subformat: 0x000001
Rate: min=8000Hz max=96000Hz
Channels: min=1 max=2
Sample bits: min=16 max=32
Period size: min=512 max=16384
Period count: min=2 max=128
#
# NON-HITS
#
./tinypcminfo -D 0 -d 4
WARNING: linker: ./tinypcminfo has text relocations. This is wasting
memory and prevents security hardening. Please fix. Info for card 0,
device 4:
PCM out:
cannot open card(0) device (4): No such file or directory
Device does not exist.
PCM in:
cannot open card(0) device (4): No such file or directory
Device does not exist.
./tinypcminfo -D 1 -d 0
WARNING: linker: ./tinypcminfo has text relocations. This is wasting
memory and prevents security hardening. Please fix. Info for card 1,
device 0:
PCM out:
cannot open card(1) device (0): No such file or directory
Device does not exist.
PCM in:
cannot open card(1) device (0): No such file or directory
Device does not exist.
./tinypcminfo -D 1 -d 2
WARNING: linker: ./tinypcminfo has text relocations. This is wasting
memory and prevents security hardening. Please fix. Info for card 1,
device 2:
PCM out:
cannot open card(1) device (2): No such file or directory
Device does not exist.
PCM in:
cannot open card(1) device (2): No such file or directory
Device does not exist.
./tinypcminfo -D 2 -d 1
WARNING: linker: ./tinypcminfo has text relocations. This is wasting
memory and prevents security hardening. Please fix. Info for card 2,
device 1:
PCM out:
cannot open card(2) device (1): No such file or directory
Device does not exist.
PCM in:
cannot open card(2) device (1): No such file or directory
Device does not exist.
#
#I also tried making a call and running tinypcminfo (on -D 1 -d 0)
again (and -D 0 -d 4) and neither got additional hits when call was
made #
#
# tinymix controls
#
./tinymix -D 0 controls
WARNING: linker: ./tinymix has text relocations. This is wasting memory
and prevents security hardening. Please fix. Number of controls: 257
ctl type num name 0 ENUM 1
AIF1DRC1 Mode 1 ENUM 1 AIF1DRC2 Mode 2
ENUM 1 AIF2DRC Mode 3 INT 1 AIF1DAC1
EQ1 Volume 4 INT 1 AIF1DAC1 EQ2 Volume 5
INT 1 AIF1DAC1 EQ3 Volume 6 INT 1
AIF1DAC1 EQ4 Volume 7 INT 1 AIF1DAC1 EQ5 Volume
8 INT 1 AIF1DAC2 EQ1 Volume 9 INT
1 AIF1DAC2 EQ2 Volume 10 INT 1 AIF1DAC2 EQ3
Volume 11 INT 1 AIF1DAC2 EQ4 Volume 12
INT 1 AIF1DAC2 EQ5 Volume 13 INT 1
AIF2 EQ1 Volume 14 INT 1 AIF2 EQ2 Volume 15
INT 1 AIF2 EQ3 Volume 16 INT 1 AIF2
EQ4 Volume 17 INT 1 AIF2 EQ5 Volume 18
INT 1 IN1L Volume 19 BOOL 1 IN1L
Switch 20 BOOL 1 IN1L ZC Switch 21
INT 1 IN1R Volume 22 BOOL 1 IN1R
Switch 23 BOOL 1 IN1R ZC Switch 24
INT 1 IN2L Volume 25 BOOL 1 IN2L
Switch 26 BOOL 1 IN2L ZC Switch 27
INT 1 IN2R Volume 28 BOOL 1 IN2R
Switch 29 BOOL 1 IN2R ZC Switch 30
INT 1 MIXINL IN2L Volume 31 INT 1
MIXINL IN1L Volume 32 INT 1 MIXINL Output Record
Volume 33 INT 1 MIXINL IN1LP Volume 34
INT 1 MIXINL Direct Voice Volume 35 INT
1 MIXINR IN2R Volume 36 INT 1 MIXINR IN1R
Volume 37 INT 1 MIXINR Output Record Volume
38 INT 1 MIXINR IN1RP Volume 39 INT
1 MIXINR Direct Voice Volume 40 INT 1 Left
Output Mixer IN2RN Volume 41 INT 1 Left Output
Mixer IN2LN Volume 42 INT 1 Left Output Mixer
IN2LP Volume 43 INT 1 Left Output Mixer IN1L
Volume 44 INT 1 Left Output Mixer IN1R Volume
45 INT 1 Left Output Mixer Right Input Volume
46 INT 1 Left Output Mixer Left Input Volume
47 INT 1 Left Output Mixer DAC Volume 48
INT 1 Right Output Mixer IN2LN Volume 49
INT 1 Right Output Mixer IN2RN Volume 50
INT 1 Right Output Mixer IN1L Volume 51 INT
1 Right Output Mixer IN1R Volume 52 INT 1
Right Output Mixer IN2RP Volume 53 INT 1 Right
Output Mixer Left Input Volume 54 INT 1 Right
Output Mixer Right Input Volume 55 INT 1 Right
Output Mixer DAC Volume 56 INT 2 Output Volume
57 BOOL 2 Output Switch 58 BOOL
2 Output ZC Switch 59 BOOL 1 Earpiece
Switch 60 INT 1 Earpiece Volume 61
INT 1 SPKL Input Volume 62 INT 1
SPKL IN1LP Volume 63 INT 1 SPKL Output Volume
64 INT 1 SPKR Input Volume 65 INT
1 SPKR IN1RP Volume 66 INT 1 SPKR Output
Volume 67 INT 2 Speaker Mixer Volume 68
INT 2 Speaker Volume 69 BOOL 2
Speaker Switch 70 BOOL 2 Speaker ZC Switch
71 INT 2 Speaker Boost Volume 72
ENUM 1 Speaker Reference 73 ENUM 1
Speaker Mode 74 INT 2 Headphone Volume 75
BOOL 2 Headphone Switch 76 BOOL 2
Headphone ZC Switch 77 BOOL 1 LINEOUT1N Switch
78 BOOL 1 LINEOUT1P Switch 79 INT
1 LINEOUT1 Volume 80 BOOL 1 LINEOUT2N
Switch 81 BOOL 1 LINEOUT2P Switch 82
INT 1 LINEOUT2 Volume 83 INT 2
AIF1ADC1 Volume 84 INT 2 AIF1ADC2 Volume 85
INT 2 AIF2ADC Volume 86 ENUM 1
AIF1ADCL Source 87 ENUM 1 AIF1ADCR Source
88 ENUM 1 AIF2ADCL Source 89 ENUM
1 AIF2ADCR Source 90 ENUM 1 AIF1DACL Source
91 ENUM 1 AIF1DACR Source 92 ENUM
1 AIF2DACL Source 93 ENUM 1 AIF2DACR Source
94 INT 2 AIF1DAC1 Volume 95 INT
2 AIF1DAC2 Volume 96 INT 2 AIF2DAC Volume
97 INT 1 AIF1 Boost Volume 98 INT
1 AIF2 Boost Volume 99 BOOL 1 AIF1DAC1 EQ
Switch 100 BOOL 1 AIF1DAC2 EQ Switch 101
BOOL 1 AIF2 EQ Switch 102 BOOL 1
AIF1DAC1 DRC Switch 103 BOOL 1 AIF1ADC1L DRC
Switch 104 BOOL 1 AIF1ADC1R DRC Switch 105
BOOL 1 AIF1DAC2 DRC Switch 106 BOOL
1 AIF1ADC2L DRC Switch 107 BOOL 1 AIF1ADC2R
DRC Switch 108 BOOL 1 AIF2DAC DRC Switch
109 BOOL 1 AIF2ADCL DRC Switch 110
BOOL 1 AIF2ADCR DRC Switch 111 INT 1
DAC1 Right Sidetone Volume 112 INT 1 DAC1 Left
Sidetone Volume 113 INT 1 DAC2 Right Sidetone
Volume 114 INT 1 DAC2 Left Sidetone Volume
115 ENUM 1 Sidetone HPF Mux 116 BOOL
1 Sidetone HPF Switch 117 ENUM 1 AIF1ADC1
HPF Mode 118 BOOL 2 AIF1ADC1 HPF Switch 119
ENUM 1 AIF1ADC2 HPF Mode 120 BOOL 2
AIF1ADC2 HPF Switch 121 ENUM 1 AIF2ADC HPF Mode
122 BOOL 2 AIF2ADC HPF Switch 123
ENUM 1 ADC OSR 124 ENUM 1 DAC OSR
125 INT 2 DAC1 Volume 126 BOOL
2 DAC1 Switch 127 INT 2 DAC2 Volume
128 BOOL 2 DAC2 Switch 129 INT
1 SPKL DAC2 Volume 130 INT 1 SPKL DAC1
Volume 131 INT 1 SPKR DAC2 Volume 132
INT 1 SPKR DAC1 Volume 133 INT 1
AIF1DAC1 3D Stereo Volume 134 BOOL 1 AIF1DAC1 3D
Stereo Switch 135 INT 1 AIF1DAC2 3D Stereo Volume
136 BOOL 1 AIF1DAC2 3D Stereo Switch 137
INT 1 AIF2DAC 3D Stereo Volume 138 BOOL
1 AIF2DAC 3D Stereo Switch 139 INT 1 AIF3
Boost Volume 140 BOOL 1 AIF1DAC1 Noise Gate Switch
141 ENUM 1 AIF1DAC1 Noise Gate Hold Time
142 INT 1 AIF1DAC1 Noise Gate Threshold Volume
143 BOOL 1 AIF1DAC2 Noise Gate Switch 144
ENUM 1 AIF1DAC2 Noise Gate Hold Time 145
INT 1 AIF1DAC2 Noise Gate Threshold Volume 146
BOOL 1 AIF2DAC Noise Gate Switch 147 ENUM
1 AIF2DAC Noise Gate Hold Time 148 INT 1
AIF2DAC Noise Gate Threshold Volume 149 BOOL 1
AIF2ADCL DAT Invert 150 BOOL 1 AIF2ADCR DAT Invert
151 BOOL 1 HP Switch 152 BOOL
1 SPK Switch 153 BOOL 1 RCV Switch
154 BOOL 1 FM In Switch 155 BOOL
1 LINE Switch 156 BOOL 1 HDMI Switch
157 BOOL 1 Main Mic Switch 158 BOOL
1 Sub Mic Switch 159 BOOL 1 Headset Mic
Switch 160 ENUM 1 AIF2 Mode 161 ENUM
1 Input Clamp 162 ENUM 1 LineoutSwitch Mode
163 ENUM 1 ADCR Mux 164 ENUM
1 ADCL Mux 165 ENUM 1 Right Headphone Mux
166 ENUM 1 Left Headphone Mux 167
BOOL 1 SPKR DAC2 Switch 168 BOOL 1
SPKR Input Switch 169 BOOL 1 SPKR IN1RP Switch
170 BOOL 1 SPKR Output Switch 171
BOOL 1 SPKR DAC1 Switch 172 BOOL 1
SPKL DAC2 Switch 173 BOOL 1 SPKL Input Switch
174 BOOL 1 SPKL IN1LP Switch 175
BOOL 1 SPKL Output Switch 176 BOOL 1
SPKL DAC1 Switch 177 ENUM 1 AIF3ADC Mux 178
ENUM 1 AIF2DACR Mux 179 ENUM 1
AIF2DACL Mux 180 ENUM 1 Mono PCM Out Mux
181 ENUM 1 AIF2ADC Mux 182 ENUM
1 AIF2DAC Mux 183 ENUM 1 AIF1DAC Mux
184 BOOL 1 DAC1R Mixer Right Sidetone Switch
185 BOOL 1 DAC1R Mixer Left Sidetone Switch
186 BOOL 1 DAC1R Mixer AIF2 Switch 187
BOOL 1 DAC1R Mixer AIF1.2 Switch 188 BOOL
1 DAC1R Mixer AIF1.1 Switch 189 BOOL 1
DAC1L Mixer Right Sidetone Switch 190 BOOL 1 DAC1L
Mixer Left Sidetone Switch 191 BOOL 1 DAC1L Mixer
AIF2 Switch 192 BOOL 1 DAC1L Mixer AIF1.2 Switch
193 BOOL 1 DAC1L Mixer AIF1.1 Switch 194
ENUM 1 Right Sidetone 195 ENUM 1
Left Sidetone 196 BOOL 1 AIF2DAC2R Mixer Right
Sidetone Switch 197 BOOL 1 AIF2DAC2R Mixer Left
Sidetone Switch 198 BOOL 1 AIF2DAC2R Mixer AIF2
Switch 199 BOOL 1 AIF2DAC2R Mixer AIF1.2 Switch
200 BOOL 1 AIF2DAC2R Mixer AIF1.1 Switch
201 BOOL 1 AIF2DAC2L Mixer Right Sidetone Switch
202 BOOL 1 AIF2DAC2L Mixer Left Sidetone Switch
203 BOOL 1 AIF2DAC2L Mixer AIF2 Switch 204
BOOL 1 AIF2DAC2L Mixer AIF1.2 Switch 205
BOOL 1 AIF2DAC2L Mixer AIF1.1 Switch 206
BOOL 1 AIF1ADC2R Mixer DMIC Switch 207 BOOL
1 AIF1ADC2R Mixer AIF2 Switch 208 BOOL 1
AIF1ADC2L Mixer DMIC Switch 209 BOOL 1 AIF1ADC2L
Mixer AIF2 Switch 210 BOOL 1 AIF1ADC1R Mixer
ADC/DMIC Switch 211 BOOL 1 AIF1ADC1R Mixer AIF2
Switch 212 BOOL 1 AIF1ADC1L Mixer ADC/DMIC Switch
213 BOOL 1 AIF1ADC1L Mixer AIF2 Switch 214
BOOL 1 LINEOUT2P Mixer Right Output Switch 215
BOOL 1 LINEOUT2N Mixer Left Output Switch 216
BOOL 1 LINEOUT2N Mixer Right Output Switch 217
BOOL 1 LINEOUT1P Mixer Left Output Switch 218
BOOL 1 LINEOUT1N Mixer Left Output Switch 219
BOOL 1 LINEOUT1N Mixer Right Output Switch 220
BOOL 1 SPKR Boost Direct Voice Switch 221
BOOL 1 SPKR Boost SPKL Switch 222 BOOL
1 SPKR Boost SPKR Switch 223 BOOL 1 SPKL
Boost Direct Voice Switch 224 BOOL 1 SPKL Boost
SPKL Switch 225 BOOL 1 SPKL Boost SPKR Switch
226 BOOL 1 Earpiece Mixer Direct Voice Switch
227 BOOL 1 Earpiece Mixer Left Output Switch
228 BOOL 1 Earpiece Mixer Right Output Switch
229 BOOL 1 Right Output Mixer Left Input Switch
230 BOOL 1 Right Output Mixer Right Input Switch
231 BOOL 1 Right Output Mixer IN2LN Switch
232 BOOL 1 Right Output Mixer IN2RN Switch
233 BOOL 1 Right Output Mixer IN1L Switch
234 BOOL 1 Right Output Mixer IN1R Switch
235 BOOL 1 Right Output Mixer IN2RP Switch
236 BOOL 1 Right Output Mixer DAC Switch
237 BOOL 1 Left Output Mixer Right Input Switch
238 BOOL 1 Left Output Mixer Left Input Switch
239 BOOL 1 Left Output Mixer IN2RN Switch
240 BOOL 1 Left Output Mixer IN2LN Switch
241 BOOL 1 Left Output Mixer IN2LP Switch
242 BOOL 1 Left Output Mixer IN1R Switch
243 BOOL 1 Left Output Mixer IN1L Switch
244 BOOL 1 Left Output Mixer DAC Switch 245
BOOL 1 MIXINR IN2R Switch 246 BOOL 1
MIXINR IN1R Switch 247 BOOL 1 MIXINL IN2L Switch
248 BOOL 1 MIXINL IN1L Switch 249
BOOL 1 IN2R PGA IN2RP Switch 250 BOOL
1 IN2R PGA IN2RN Switch 251 BOOL 1 IN2L PGA
IN2LP Switch 252 BOOL 1 IN2L PGA IN2LN Switch
253 BOOL 1 IN1R PGA IN1RP Switch 254
BOOL 1 IN1R PGA IN1RN Switch 255 BOOL
1 IN1L PGA IN1LP Switch 256 BOOL 1 IN1L PGA
IN1LN Switch
#==CONCLUSION==
I had hoped to use a library like libcmtspeechdata to route the audio
for the modem as this would have been a good candidate. Unfortunately I
could not open any additional audio devices when the call was
connected, although I managed to find out that card 0 is the only
active card on the phone, with devices 1 to 4 being used somehow.
#==SCRIPT TO BUILD TINYALSA TOOLS STARTS HERE==
#!/bin/sh
thepwd="${PWD}"
git clone https://github.com/tinyalsa/tinyalsa
wget
https://ftp-osl.osuosl.org/pub/replicant/sdk/replicant-4.2/0001/sdk/replicant-sdk_linux-x86.zip
unzip replicant-sdk_linux-x86.zip
tar -xf android-ndk-r8b-linux-x86.tar.bz2
cd tinyalsa
mkdir include/sound
wget
"https://raw.githubusercontent.com/broonie/tinyalsa/648e14a421f1795006f770de8c57602366b20c24/include/sound/asound.h"
-O include/sound/asound.h
#tell src/Makefile to use sysroot
sed -i "s#CC = \$(CROSS_COMPILE)gcc#CC = \$(CROSS_COMPILE)gcc
--sysroot=\"${thepwd}/android-ndk-r8b/platforms/android-9/arch-arm/\"
-std=c99#g" src/Makefile sed -i "s#LD = \$(CROSS_COMPILE)gcc#LD =
\$(CROSS_COMPILE)gcc
--sysroot=\"${thepwd}/android-ndk-r8b/platforms/android-9/arch-arm/\"#g"
src/Makefile
#tell utils/Makefile to use sysroot
sed -i "s#CC = \$(CROSS_COMPILE)gcc#CC = \$(CROSS_COMPILE)gcc
--sysroot=\"${thepwd}/android-ndk-r8b/platforms/android-9/arch-arm/\"
-std=c99#g" utils/Makefile
#tell tinyalsa/examples to use sysroot
sed -i "s#CC = \$(CROSS_COMPILE)gcc#CC = \$(CROSS_COMPILE)gcc
--sysroot=\"${thepwd}/android-ndk-r8b/platforms/android-9/arch-arm/\"
-std=c99#g" examples/Makefile
export
PATH="${thepwd}/android-ndk-r8b/toolchains/arm-linux-androideabi-4.4.3/prebuilt/linux-x86/bin/:$PATH"
CROSS_COMPILE="arm-linux-androideabi-" make
#==SCRIPT TO BUILD TINYALSA TOOLS ENDS HERE==
More information about the Replicant
mailing list