diff --git a/android/app/src/main/cpp/CMakeLists.txt b/android/app/src/main/cpp/CMakeLists.txt index 127dc46..c9e36de 100644 --- a/android/app/src/main/cpp/CMakeLists.txt +++ b/android/app/src/main/cpp/CMakeLists.txt @@ -3,10 +3,32 @@ cmake_minimum_required(VERSION 3.22.1) project("l2c_fcr_hook") set(CMAKE_CXX_STANDARD 23) -add_library(${CMAKE_PROJECT_NAME} SHARED +add_library(l2c_fcr_hook SHARED l2c_fcr_hook.cpp - l2c_fcr_hook.h) -target_link_libraries(${CMAKE_PROJECT_NAME} + xz/xz_crc32.c + xz/xz_crc64.c + xz/xz_sha256.c + xz/xz_dec_stream.c + xz/xz_dec_lzma2.c + xz/xz_dec_bcj.c +) + +target_include_directories(l2c_fcr_hook PRIVATE + xz +) + +target_compile_definitions(l2c_fcr_hook PRIVATE + XZ_DEC_X86 + XZ_DEC_ARM + XZ_DEC_ARMTHUMB + XZ_DEC_ARM64 + XZ_DEC_ANY_CHECK + XZ_USE_CRC64 + XZ_USE_SHA256 + XZ_DEC_CONCATENATED +) + +target_link_libraries(l2c_fcr_hook android - log) \ No newline at end of file + log) diff --git a/android/app/src/main/cpp/l2c_fcr_hook.cpp b/android/app/src/main/cpp/l2c_fcr_hook.cpp index 80d0058..67b7228 100644 --- a/android/app/src/main/cpp/l2c_fcr_hook.cpp +++ b/android/app/src/main/cpp/l2c_fcr_hook.cpp @@ -1,417 +1,290 @@ /* - * LibrePods - AirPods liberated from Apple’s ecosystem - * - * Copyright (C) 2025 LibrePods contributors - * - * This program is free software: you can redistribute it and/or modify - * it under the terms of the GNU Affero General Public License as published - * by the Free Software Foundation, either version 3 of the License. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU Affero General Public License for more details. - * - * You should have received a copy of the GNU Affero General Public License - * along with this program. If not, see . - */ + LibrePods - AirPods liberated from Apple’s ecosystem + Copyright (C) 2025 LibrePods contributors + + This program is free software: you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation, either version 3 of the License, or + any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . +*/ -#include -#include -#include #include -#include +#include #include -#include +#include +#include +#include +#include +#include + #include "l2c_fcr_hook.h" -#define LOG_TAG "AirPodsHook" +extern "C" { + #include "xz.h" +} + +#define LOG_TAG "LibrePods" #define LOGI(...) __android_log_print(ANDROID_LOG_INFO, LOG_TAG, __VA_ARGS__) #define LOGE(...) __android_log_print(ANDROID_LOG_ERROR, LOG_TAG, __VA_ARGS__) static HookFunType hook_func = nullptr; -#define L2CEVT_L2CAP_CONFIG_REQ 4 -#define L2CEVT_L2CAP_CONFIG_RSP 15 -struct t_l2c_lcb; -typedef struct _BT_HDR { - uint16_t event; - uint16_t len; - uint16_t offset; - uint16_t layer_specific; - uint8_t data[]; -} BT_HDR; - -typedef struct { - uint8_t mode; - uint8_t tx_win_sz; - uint8_t max_transmit; - uint16_t rtrans_tout; - uint16_t mon_tout; - uint16_t mps; -} tL2CAP_FCR; - -// Flow spec structure -typedef struct { - uint8_t qos_present; - uint8_t flow_direction; - uint8_t service_type; - uint32_t token_rate; - uint32_t token_bucket_size; - uint32_t peak_bandwidth; - uint32_t latency; - uint32_t delay_variation; -} FLOW_SPEC; - -// Configuration info structure -typedef struct { - uint16_t result; - uint16_t mtu_present; - uint16_t mtu; - uint16_t flush_to_present; - uint16_t flush_to; - uint16_t qos_present; - FLOW_SPEC qos; - uint16_t fcr_present; - tL2CAP_FCR fcr; - uint16_t fcs_present; - uint16_t fcs; - uint16_t ext_flow_spec_present; - FLOW_SPEC ext_flow_spec; -} tL2CAP_CFG_INFO; - -// Basic L2CAP link control block -typedef struct { - bool wait_ack; - // Other FCR fields - not needed for our specific hook -} tL2C_FCRB; - -// Forward declarations for needed types -struct t_l2c_rcb; -struct t_l2c_lcb; - -typedef struct t_l2c_ccb { - struct t_l2c_ccb* p_next_ccb; // Next CCB in the chain - struct t_l2c_ccb* p_prev_ccb; // Previous CCB in the chain - struct t_l2c_lcb* p_lcb; // Link this CCB belongs to - struct t_l2c_rcb* p_rcb; // Registration CB for this Channel - uint16_t local_cid; // Local CID - uint16_t remote_cid; // Remote CID - uint16_t p_lcb_next; // For linking CCBs to an LCB - uint8_t ccb_priority; // Channel priority - uint16_t tx_mps; // MPS for outgoing messages - uint16_t max_rx_mtu; // Max MTU we will receive - // State variables - bool in_use; // True when channel active - uint8_t chnl_state; // Channel state - uint8_t local_id; // Transaction ID for local trans - uint8_t remote_id; // Transaction ID for remote - uint8_t timer_entry; // Timer entry - uint8_t is_flushable; // True if flushable - // Configuration variables - uint16_t our_cfg_bits; // Bitmap of local config bits - uint16_t peer_cfg_bits; // Bitmap of peer config bits - uint16_t config_done; // Configuration bitmask - uint16_t remote_config_rsp_result; // Remote config response result - tL2CAP_CFG_INFO our_cfg; // Our saved configuration options - tL2CAP_CFG_INFO peer_cfg; // Peer's saved configuration options - // Additional control fields - uint8_t remote_credit_count; // Credits sent to peer - tL2C_FCRB fcrb; // FCR info - bool ecoc; // Enhanced Credit-based mode -} tL2C_CCB; - -static uint8_t (*original_l2c_fcr_chk_chan_modes)(void* p_ccb) = nullptr; -static void (*original_l2cu_process_our_cfg_req)(tL2C_CCB* p_ccb, tL2CAP_CFG_INFO* p_cfg) = nullptr; -static void (*original_l2c_csm_config)(tL2C_CCB* p_ccb, uint8_t event, void* p_data) = nullptr; -static void (*original_l2cu_send_peer_info_req)(tL2C_LCB* p_lcb, uint16_t info_type) = nullptr; +static uint8_t (*original_l2c_fcr_chk_chan_modes)(void*) = nullptr; uint8_t fake_l2c_fcr_chk_chan_modes(void* p_ccb) { - LOGI("l2c_fcr_chk_chan_modes hooked, returning true."); + LOGI("l2c_fcr_chk_chan_modes hooked"); + uint8_t orig = 0; + if (original_l2c_fcr_chk_chan_modes) + orig = original_l2c_fcr_chk_chan_modes(p_ccb); + + LOGI("Original returned %d, forcing 1", orig); return 1; } -void fake_l2cu_process_our_cfg_req(tL2C_CCB* p_ccb, tL2CAP_CFG_INFO* p_cfg) { - original_l2cu_process_our_cfg_req(p_ccb, p_cfg); - p_ccb->our_cfg.fcr.mode = 0x00; - LOGI("Set FCR mode to Basic Mode in outgoing config request"); -} +static bool decompressXZ( + const uint8_t* input, + size_t input_size, + std::vector& output) { -void fake_l2c_csm_config(tL2C_CCB* p_ccb, uint8_t event, void* p_data) { - // Call the original function first to handle the specific code path where the FCR mode is checked - original_l2c_csm_config(p_ccb, event, p_data); + xz_crc32_init(); +#ifdef XZ_USE_CRC64 + xz_crc64_init(); +#endif - // Check if this happens during CONFIG_RSP event handling - if (event == L2CEVT_L2CAP_CONFIG_RSP) { - p_ccb->our_cfg.fcr.mode = p_ccb->peer_cfg.fcr.mode; - LOGI("Forced compatibility in l2c_csm_config: set our_mode=%d to match peer_mode=%d", - p_ccb->our_cfg.fcr.mode, p_ccb->peer_cfg.fcr.mode); - } -} + struct xz_dec* dec = xz_dec_init(XZ_DYNALLOC, 64U << 20); + if (!dec) return false; -// Replacement function that does nothing -void fake_l2cu_send_peer_info_req(tL2C_LCB* p_lcb, uint16_t info_type) { - LOGI("Intercepted l2cu_send_peer_info_req for info_type 0x%04x - doing nothing", info_type); - // Just return without doing anything - return; -} + struct xz_buf buf{}; + buf.in = input; + buf.in_pos = 0; + buf.in_size = input_size; -uintptr_t loadHookOffset([[maybe_unused]] const char* package_name) { - const char* property_name = "persist.librepods.hook_offset"; - char value[PROP_VALUE_MAX] = {0}; + output.resize(input_size * 8); - int len = __system_property_get(property_name, value); - if (len > 0) { - LOGI("Read hook offset from property: %s", value); - uintptr_t offset; - char* endptr = nullptr; + buf.out = output.data(); + buf.out_pos = 0; + buf.out_size = output.size(); - const char* parse_start = value; - if (value[0] == '0' && (value[1] == 'x' || value[1] == 'X')) { - parse_start = value + 2; + while (true) { + enum xz_ret ret = xz_dec_run(dec, &buf); + + if (ret == XZ_STREAM_END) + break; + + if (ret != XZ_OK) { + xz_dec_end(dec); + return false; } - errno = 0; - offset = strtoul(parse_start, &endptr, 16); - - if (errno == 0 && endptr != parse_start && *endptr == '\0' && offset > 0) { - LOGI("Parsed offset: 0x%x", offset); - return offset; + if (buf.out_pos == buf.out_size) { + size_t old = output.size(); + output.resize(old * 2); + buf.out = output.data(); + buf.out_size = output.size(); } - - LOGE("Failed to parse offset from property value: %s", value); } - LOGI("Using hardcoded fallback offset"); - return 0x00a55e30; + output.resize(buf.out_pos); + xz_dec_end(dec); + return true; } -uintptr_t loadL2cuProcessCfgReqOffset() { - const char* property_name = "persist.librepods.cfg_req_offset"; - char value[PROP_VALUE_MAX] = {0}; +static bool getLibraryPath(const char* name, std::string& out) { + FILE* fp = fopen("/proc/self/maps", "r"); + if (!fp) return false; - int len = __system_property_get(property_name, value); - if (len > 0) { - LOGI("Read l2cu_process_our_cfg_req offset from property: %s", value); - uintptr_t offset; - char* endptr = nullptr; - - const char* parse_start = value; - if (value[0] == '0' && (value[1] == 'x' || value[1] == 'X')) { - parse_start = value + 2; - } - - errno = 0; - offset = strtoul(parse_start, &endptr, 16); - - if (errno == 0 && endptr != parse_start && *endptr == '\0' && offset > 0) { - LOGI("Parsed l2cu_process_our_cfg_req offset: 0x%x", offset); - return offset; - } - - LOGE("Failed to parse l2cu_process_our_cfg_req offset from property value: %s", value); - } - - // Return 0 if not found - we'll skip this hook - return 0; -} - -uintptr_t loadL2cCsmConfigOffset() { - const char* property_name = "persist.librepods.csm_config_offset"; - char value[PROP_VALUE_MAX] = {0}; - - int len = __system_property_get(property_name, value); - if (len > 0) { - LOGI("Read l2c_csm_config offset from property: %s", value); - uintptr_t offset; - char* endptr = nullptr; - - const char* parse_start = value; - if (value[0] == '0' && (value[1] == 'x' || value[1] == 'X')) { - parse_start = value + 2; - } - - errno = 0; - offset = strtoul(parse_start, &endptr, 16); - - if (errno == 0 && endptr != parse_start && *endptr == '\0' && offset > 0) { - LOGI("Parsed l2c_csm_config offset: 0x%x", offset); - return offset; - } - - LOGE("Failed to parse l2c_csm_config offset from property value: %s", value); - } - - // Return 0 if not found - we'll skip this hook - return 0; -} - -uintptr_t loadL2cuSendPeerInfoReqOffset() { - const char* property_name = "persist.librepods.peer_info_req_offset"; - char value[PROP_VALUE_MAX] = {0}; - - int len = __system_property_get(property_name, value); - if (len > 0) { - LOGI("Read l2cu_send_peer_info_req offset from property: %s", value); - uintptr_t offset; - char* endptr = nullptr; - - const char* parse_start = value; - if (value[0] == '0' && (value[1] == 'x' || value[1] == 'X')) { - parse_start = value + 2; - } - - errno = 0; - offset = strtoul(parse_start, &endptr, 16); - - if (errno == 0 && endptr != parse_start && *endptr == '\0' && offset > 0) { - LOGI("Parsed l2cu_send_peer_info_req offset: 0x%x", offset); - return offset; - } - - LOGE("Failed to parse l2cu_send_peer_info_req offset from property value: %s", value); - } - - // Return 0 if not found - we'll skip this hook - return 0; -} - -uintptr_t getModuleBase(const char *module_name) { - FILE *fp; char line[1024]; - uintptr_t base_addr = 0; - - fp = fopen("/proc/self/maps", "r"); - if (!fp) { - LOGE("Failed to open /proc/self/maps"); - return 0; - } while (fgets(line, sizeof(line), fp)) { - if (strstr(line, module_name)) { - char *start_addr_str = line; - char *end_addr_str = strchr(line, '-'); - if (end_addr_str) { - *end_addr_str = '\0'; - base_addr = strtoull(start_addr_str, nullptr, 16); - break; + if (strstr(line, name)) { + char* path = strchr(line, '/'); + if (path) { + out = path; + out.erase(out.find('\n')); + fclose(fp); + return true; } } } fclose(fp); - return base_addr; + return false; } -bool findAndHookFunction([[maybe_unused]] const char *library_path) { +static uintptr_t getModuleBase(const char* name) { + FILE* fp = fopen("/proc/self/maps", "r"); + if (!fp) return 0; + + char line[1024]; + uintptr_t base = 0; + + while (fgets(line, sizeof(line), fp)) { + if (strstr(line, name)) { + base = strtoull(line, nullptr, 16); + break; + } + } + + fclose(fp); + return base; +} + +static uint64_t findSymbolOffset( + const std::vector& elf, + const char* symbol_substring) { + + auto* eh = reinterpret_cast(elf.data()); + auto* shdr = reinterpret_cast( + elf.data() + eh->e_shoff); + + const char* shstr = + reinterpret_cast( + elf.data() + shdr[eh->e_shstrndx].sh_offset); + + const Elf64_Shdr* symtab = nullptr; + const Elf64_Shdr* strtab = nullptr; + + for (int i = 0; i < eh->e_shnum; ++i) { + const char* secname = shstr + shdr[i].sh_name; + if (!strcmp(secname, ".symtab")) + symtab = &shdr[i]; + if (!strcmp(secname, ".strtab")) + strtab = &shdr[i]; + } + + if (!symtab || !strtab) + return 0; + + auto* symbols = reinterpret_cast( + elf.data() + symtab->sh_offset); + + const char* strings = + reinterpret_cast( + elf.data() + strtab->sh_offset); + + size_t count = symtab->sh_size / sizeof(Elf64_Sym); + + for (size_t i = 0; i < count; ++i) { + const char* name = strings + symbols[i].st_name; + + if (strstr(name, symbol_substring) && + ELF64_ST_TYPE(symbols[i].st_info) == STT_FUNC) { + + LOGI("Resolved %s at 0x%lx", + name, + (unsigned long)symbols[i].st_value); + + return symbols[i].st_value; + } + } + + return 0; +} + +static bool hookLibrary(const char* libname) { + if (!hook_func) { - LOGE("Hook function not initialized"); + LOGE("hook_func not initialized"); return false; } - uintptr_t base_addr = getModuleBase("libbluetooth_jni.so"); - if (!base_addr) { - LOGE("Failed to get base address of libbluetooth_jni.so"); + std::string path; + if (!getLibraryPath(libname, path)) { + LOGE("Failed to locate %s", libname); return false; } - // Load all offsets from system properties - no hardcoding - uintptr_t l2c_fcr_offset = loadHookOffset(nullptr); - uintptr_t l2cu_process_our_cfg_req_offset = loadL2cuProcessCfgReqOffset(); - uintptr_t l2c_csm_config_offset = loadL2cCsmConfigOffset(); - uintptr_t l2cu_send_peer_info_req_offset = loadL2cuSendPeerInfoReqOffset(); + int fd = open(path.c_str(), O_RDONLY); + if (fd < 0) return false; - bool success = false; - - // Hook l2c_fcr_chk_chan_modes - this is our primary hook - if (l2c_fcr_offset > 0) { - void* target = reinterpret_cast(base_addr + l2c_fcr_offset); - LOGI("Hooking l2c_fcr_chk_chan_modes at offset: 0x%x, base: %p, target: %p", - l2c_fcr_offset, (void*)base_addr, target); - - int result = hook_func(target, (void*)fake_l2c_fcr_chk_chan_modes, (void**)&original_l2c_fcr_chk_chan_modes); - if (result != 0) { - LOGE("Failed to hook l2c_fcr_chk_chan_modes, error: %d", result); - return false; - } - LOGI("Successfully hooked l2c_fcr_chk_chan_modes"); - success = true; - } else { - LOGE("No valid offset for l2c_fcr_chk_chan_modes found, cannot proceed"); + struct stat st{}; + if (fstat(fd, &st) != 0) { + close(fd); return false; } - // Hook l2cu_process_our_cfg_req if offset is available - if (l2cu_process_our_cfg_req_offset > 0) { - void* target = reinterpret_cast(base_addr + l2cu_process_our_cfg_req_offset); - LOGI("Hooking l2cu_process_our_cfg_req at offset: 0x%x, base: %p, target: %p", - l2cu_process_our_cfg_req_offset, (void*)base_addr, target); + std::vector file(st.st_size); + read(fd, file.data(), st.st_size); + close(fd); - int result = hook_func(target, (void*)fake_l2cu_process_our_cfg_req, (void**)&original_l2cu_process_our_cfg_req); - if (result != 0) { - LOGE("Failed to hook l2cu_process_our_cfg_req, error: %d", result); - // Continue even if this hook fails - } else { - LOGI("Successfully hooked l2cu_process_our_cfg_req"); + auto* eh = reinterpret_cast(file.data()); + auto* shdr = reinterpret_cast( + file.data() + eh->e_shoff); + + const char* shstr = + reinterpret_cast( + file.data() + shdr[eh->e_shstrndx].sh_offset); + + for (int i = 0; i < eh->e_shnum; ++i) { + + if (!strcmp(shstr + shdr[i].sh_name, ".gnu_debugdata")) { + + std::vector compressed( + file.begin() + shdr[i].sh_offset, + file.begin() + shdr[i].sh_offset + shdr[i].sh_size); + + std::vector decompressed; + + if (!decompressXZ( + compressed.data(), + compressed.size(), + decompressed)) + return false; + + uintptr_t base = getModuleBase(libname); + if (!base) return false; + + uint64_t chk_offset = + findSymbolOffset(decompressed, + "l2c_fcr_chk_chan_modes"); + + if (chk_offset) { + void* target = + reinterpret_cast(base + chk_offset); + + hook_func(target, + (void*)fake_l2c_fcr_chk_chan_modes, + (void**)&original_l2c_fcr_chk_chan_modes); + + LOGI("Hooked l2c_fcr_chk_chan_modes"); + } + + return true; } - } else { - LOGI("Skipping l2cu_process_our_cfg_req hook as offset is not available"); } - // Hook l2c_csm_config if offset is available - if (l2c_csm_config_offset > 0) { - void* target = reinterpret_cast(base_addr + l2c_csm_config_offset); - LOGI("Hooking l2c_csm_config at offset: 0x%x, base: %p, target: %p", - l2c_csm_config_offset, (void*)base_addr, target); - - int result = hook_func(target, (void*)fake_l2c_csm_config, (void**)&original_l2c_csm_config); - if (result != 0) { - LOGE("Failed to hook l2c_csm_config, error: %d", result); - // Continue even if this hook fails - } else { - LOGI("Successfully hooked l2c_csm_config"); - } - } else { - LOGI("Skipping l2c_csm_config hook as offset is not available"); - } - - // Hook l2cu_send_peer_info_req if offset is available - if (l2cu_send_peer_info_req_offset > 0) { - void* target = reinterpret_cast(base_addr + l2cu_send_peer_info_req_offset); - LOGI("Hooking l2cu_send_peer_info_req at offset: 0x%x, base: %p, target: %p", - l2cu_send_peer_info_req_offset, (void*)base_addr, target); - - int result = hook_func(target, (void*)fake_l2cu_send_peer_info_req, (void**)&original_l2cu_send_peer_info_req); - if (result != 0) { - LOGE("Failed to hook l2cu_send_peer_info_req, error: %d", result); - // Continue even if this hook fails - } else { - LOGI("Successfully hooked l2cu_send_peer_info_req"); - } - } else { - LOGI("Skipping l2cu_send_peer_info_req hook as offset is not available"); - } - - return success; + return false; } -void on_library_loaded(const char *name, [[maybe_unused]] void *handle) { +static void on_library_loaded(const char* name, void*) { + if (strstr(name, "libbluetooth_jni.so")) { - LOGI("Detected Bluetooth library: %s", name); + LOGI("Bluetooth JNI loaded"); + hookLibrary("libbluetooth_jni.so"); + } - bool hooked = findAndHookFunction(name); - if (!hooked) { - LOGE("Failed to hook Bluetooth library function"); - } + if (strstr(name, "libbluetooth_qti.so")) { + LOGI("Bluetooth QTI loaded"); + hookLibrary("libbluetooth_qti.so"); } } -extern "C" [[gnu::visibility("default")]] [[gnu::used]] +extern "C" +[[gnu::visibility("default")]] +[[gnu::used]] NativeOnModuleLoaded native_init(const NativeAPIEntries* entries) { - LOGI("L2C FCR Hook module initialized"); - hook_func = entries->hook_func; + LOGI("LibrePods initialized"); + + hook_func = (HookFunType)entries->hook_func; return on_library_loaded; } - diff --git a/android/app/src/main/cpp/l2c_fcr_hook.h b/android/app/src/main/cpp/l2c_fcr_hook.h index cff43d4..df7d795 100644 --- a/android/app/src/main/cpp/l2c_fcr_hook.h +++ b/android/app/src/main/cpp/l2c_fcr_hook.h @@ -1,28 +1,32 @@ -#pragma once +/* + LibrePods - AirPods liberated from Apple’s ecosystem + Copyright (C) 2025 LibrePods contributors + This program is free software: you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation, either version 3 of the License, or + any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . +*/ + +#pragma once #include -#include typedef int (*HookFunType)(void *func, void *replace, void **backup); -typedef int (*UnhookFunType)(void *func); - typedef void (*NativeOnModuleLoaded)(const char *name, void *handle); typedef struct { uint32_t version; - HookFunType hook_func; - UnhookFunType unhook_func; + void* hook_func; + void* unhook_func; } NativeAPIEntries; -[[maybe_unused]] typedef NativeOnModuleLoaded (*NativeInit)(const NativeAPIEntries *entries); - -typedef struct t_l2c_ccb tL2C_CCB; -typedef struct t_l2c_lcb tL2C_LCB; - -uintptr_t loadHookOffset(const char* package_name); -uintptr_t getModuleBase(const char *module_name); -uintptr_t loadL2cuProcessCfgReqOffset(); -uintptr_t loadL2cCsmConfigOffset(); -uintptr_t loadL2cuSendPeerInfoReqOffset(); -bool findAndHookFunction(const char *library_path); +typedef NativeOnModuleLoaded (*NativeInit)(const NativeAPIEntries *entries); diff --git a/android/app/src/main/cpp/xz/xz.h b/android/app/src/main/cpp/xz/xz.h new file mode 100644 index 0000000..c317c49 --- /dev/null +++ b/android/app/src/main/cpp/xz/xz.h @@ -0,0 +1,448 @@ +/* SPDX-License-Identifier: 0BSD */ + +/* + * XZ decompressor + * + * Authors: Lasse Collin + * Igor Pavlov + */ + +#ifndef XZ_H +#define XZ_H + +#ifdef __KERNEL__ +# include +# include +#else +# include +# include +#endif + +#ifdef __cplusplus +extern "C" { +#endif + +/* "#define XZ_EXTERN static" can be used to make extern functions static. */ +#ifndef XZ_EXTERN +# define XZ_EXTERN extern +#endif + +/** + * enum xz_mode - Operation mode + * + * @XZ_SINGLE: Single-call mode. This uses less RAM than + * multi-call modes, because the LZMA2 + * dictionary doesn't need to be allocated as + * part of the decoder state. All required data + * structures are allocated at initialization, + * so xz_dec_run() cannot return XZ_MEM_ERROR. + * @XZ_PREALLOC: Multi-call mode with preallocated LZMA2 + * dictionary buffer. All data structures are + * allocated at initialization, so xz_dec_run() + * cannot return XZ_MEM_ERROR. + * @XZ_DYNALLOC: Multi-call mode. The LZMA2 dictionary is + * allocated once the required size has been + * parsed from the stream headers. If the + * allocation fails, xz_dec_run() will return + * XZ_MEM_ERROR. + * + * It is possible to enable support only for a subset of the above + * modes at compile time by defining XZ_DEC_SINGLE, XZ_DEC_PREALLOC, + * or XZ_DEC_DYNALLOC. The xz_dec kernel module is always compiled + * with support for all operation modes, but the preboot code may + * be built with fewer features to minimize code size. + */ +enum xz_mode { + XZ_SINGLE, + XZ_PREALLOC, + XZ_DYNALLOC +}; + +/** + * enum xz_ret - Return codes + * @XZ_OK: Everything is OK so far. More input or more + * output space is required to continue. This + * return code is possible only in multi-call mode + * (XZ_PREALLOC or XZ_DYNALLOC). + * @XZ_STREAM_END: Operation finished successfully. + * @XZ_UNSUPPORTED_CHECK: Integrity check type is not supported. Decoding + * is still possible in multi-call mode by simply + * calling xz_dec_run() again. + * Note that this return value is used only if + * XZ_DEC_ANY_CHECK was defined at build time, + * which is not used in the kernel. Unsupported + * check types return XZ_OPTIONS_ERROR if + * XZ_DEC_ANY_CHECK was not defined at build time. + * @XZ_MEM_ERROR: Allocating memory failed. This return code is + * possible only if the decoder was initialized + * with XZ_DYNALLOC. The amount of memory that was + * tried to be allocated was no more than the + * dict_max argument given to xz_dec_init(). + * @XZ_MEMLIMIT_ERROR: A bigger LZMA2 dictionary would be needed than + * allowed by the dict_max argument given to + * xz_dec_init(). This return value is possible + * only in multi-call mode (XZ_PREALLOC or + * XZ_DYNALLOC); the single-call mode (XZ_SINGLE) + * ignores the dict_max argument. + * @XZ_FORMAT_ERROR: File format was not recognized (wrong magic + * bytes). + * @XZ_OPTIONS_ERROR: This implementation doesn't support the requested + * compression options. In the decoder this means + * that the header CRC32 matches, but the header + * itself specifies something that we don't support. + * @XZ_DATA_ERROR: Compressed data is corrupt. + * @XZ_BUF_ERROR: Cannot make any progress. Details are slightly + * different between multi-call and single-call + * mode; more information below. + * + * In multi-call mode, XZ_BUF_ERROR is returned when two consecutive calls + * to XZ code cannot consume any input and cannot produce any new output. + * This happens when there is no new input available, or the output buffer + * is full while at least one output byte is still pending. Assuming your + * code is not buggy, you can get this error only when decoding a compressed + * stream that is truncated or otherwise corrupt. + * + * In single-call mode, XZ_BUF_ERROR is returned only when the output buffer + * is too small or the compressed input is corrupt in a way that makes the + * decoder produce more output than the caller expected. When it is + * (relatively) clear that the compressed input is truncated, XZ_DATA_ERROR + * is used instead of XZ_BUF_ERROR. + */ +enum xz_ret { + XZ_OK, + XZ_STREAM_END, + XZ_UNSUPPORTED_CHECK, + XZ_MEM_ERROR, + XZ_MEMLIMIT_ERROR, + XZ_FORMAT_ERROR, + XZ_OPTIONS_ERROR, + XZ_DATA_ERROR, + XZ_BUF_ERROR +}; + +/** + * struct xz_buf - Passing input and output buffers to XZ code + * @in: Beginning of the input buffer. This may be NULL if and only + * if in_pos is equal to in_size. + * @in_pos: Current position in the input buffer. This must not exceed + * in_size. + * @in_size: Size of the input buffer + * @out: Beginning of the output buffer. This may be NULL if and only + * if out_pos is equal to out_size. + * @out_pos: Current position in the output buffer. This must not exceed + * out_size. + * @out_size: Size of the output buffer + * + * Only the contents of the output buffer from out[out_pos] onward, and + * the variables in_pos and out_pos are modified by the XZ code. + */ +struct xz_buf { + const uint8_t *in; + size_t in_pos; + size_t in_size; + + uint8_t *out; + size_t out_pos; + size_t out_size; +}; + +/* + * struct xz_dec - Opaque type to hold the XZ decoder state + */ +struct xz_dec; + +/** + * xz_dec_init() - Allocate and initialize a XZ decoder state + * @mode: Operation mode + * @dict_max: Maximum size of the LZMA2 dictionary (history buffer) for + * multi-call decoding. This is ignored in single-call mode + * (mode == XZ_SINGLE). LZMA2 dictionary is always 2^n bytes + * or 2^n + 2^(n-1) bytes (the latter sizes are less common + * in practice), so other values for dict_max don't make sense. + * In the kernel, dictionary sizes of 64 KiB, 128 KiB, 256 KiB, + * 512 KiB, and 1 MiB are probably the only reasonable values, + * except for kernel and initramfs images where a bigger + * dictionary can be fine and useful. + * + * Single-call mode (XZ_SINGLE): xz_dec_run() decodes the whole stream at + * once. The caller must provide enough output space or the decoding will + * fail. The output space is used as the dictionary buffer, which is why + * there is no need to allocate the dictionary as part of the decoder's + * internal state. + * + * Because the output buffer is used as the workspace, streams encoded using + * a big dictionary are not a problem in single-call mode. It is enough that + * the output buffer is big enough to hold the actual uncompressed data; it + * can be smaller than the dictionary size stored in the stream headers. + * + * Multi-call mode with preallocated dictionary (XZ_PREALLOC): dict_max bytes + * of memory is preallocated for the LZMA2 dictionary. This way there is no + * risk that xz_dec_run() could run out of memory, since xz_dec_run() will + * never allocate any memory. Instead, if the preallocated dictionary is too + * small for decoding the given input stream, xz_dec_run() will return + * XZ_MEMLIMIT_ERROR. Thus, it is important to know what kind of data will be + * decoded to avoid allocating excessive amount of memory for the dictionary. + * + * Multi-call mode with dynamically allocated dictionary (XZ_DYNALLOC): + * dict_max specifies the maximum allowed dictionary size that xz_dec_run() + * may allocate once it has parsed the dictionary size from the stream + * headers. This way excessive allocations can be avoided while still + * limiting the maximum memory usage to a sane value to prevent running the + * system out of memory when decompressing streams from untrusted sources. + * + * On success, xz_dec_init() returns a pointer to struct xz_dec, which is + * ready to be used with xz_dec_run(). If memory allocation fails, + * xz_dec_init() returns NULL. + */ +XZ_EXTERN struct xz_dec *xz_dec_init(enum xz_mode mode, uint32_t dict_max); + +/** + * xz_dec_run() - Run the XZ decoder for a single XZ stream + * @s: Decoder state allocated using xz_dec_init() + * @b: Input and output buffers + * + * The possible return values depend on build options and operation mode. + * See enum xz_ret for details. + * + * Note that if an error occurs in single-call mode (return value is not + * XZ_STREAM_END), b->in_pos and b->out_pos are not modified and the + * contents of the output buffer from b->out[b->out_pos] onward are + * undefined. This is true even after XZ_BUF_ERROR, because with some filter + * chains, there may be a second pass over the output buffer, and this pass + * cannot be properly done if the output buffer is truncated. Thus, you + * cannot give the single-call decoder a too small buffer and then expect to + * get that amount valid data from the beginning of the stream. You must use + * the multi-call decoder if you don't want to uncompress the whole stream. + * + * Use xz_dec_run() when XZ data is stored inside some other file format. + * The decoding will stop after one XZ stream has been decompressed. To + * decompress regular .xz files which might have multiple concatenated + * streams, use xz_dec_catrun() instead. + */ +XZ_EXTERN enum xz_ret xz_dec_run(struct xz_dec *s, struct xz_buf *b); + +/** + * xz_dec_catrun() - Run the XZ decoder with support for concatenated streams + * @s: Decoder state allocated using xz_dec_init() + * @b: Input and output buffers + * @finish: This is an int instead of bool to avoid requiring stdbool.h. + * As long as more input might be coming, finish must be false. + * When the caller knows that it has provided all the input to + * the decoder (some possibly still in b->in), it must set finish + * to true. Only when finish is true can this function return + * XZ_STREAM_END to indicate successful decompression of the + * file. In single-call mode (XZ_SINGLE) finish is assumed to + * always be true; the caller-provided value is ignored. + * + * This is like xz_dec_run() except that this makes it easy to decode .xz + * files with multiple streams (multiple .xz files concatenated as is). + * The rarely-used Stream Padding feature is supported too, that is, there + * can be null bytes after or between the streams. The number of null bytes + * must be a multiple of four. + * + * When finish is false and b->in_pos == b->in_size, it is possible that + * XZ_BUF_ERROR isn't returned even when no progress is possible (XZ_OK is + * returned instead). This shouldn't matter because in this situation a + * reasonable caller will attempt to provide more input or set finish to + * true for the next xz_dec_catrun() call anyway. + * + * For any struct xz_dec that has been initialized for multi-call mode: + * Once decoding has been started with xz_dec_run() or xz_dec_catrun(), + * the same function must be used until xz_dec_reset() or xz_dec_end(). + * Switching between the two decoding functions without resetting results + * in undefined behavior. + * + * xz_dec_catrun() is only available if XZ_DEC_CONCATENATED was defined + * at compile time. + */ +XZ_EXTERN enum xz_ret xz_dec_catrun(struct xz_dec *s, struct xz_buf *b, + int finish); + +/** + * xz_dec_reset() - Reset an already allocated decoder state + * @s: Decoder state allocated using xz_dec_init() + * + * This function can be used to reset the multi-call decoder state without + * freeing and reallocating memory with xz_dec_end() and xz_dec_init(). + * + * In single-call mode, xz_dec_reset() is always called in the beginning of + * xz_dec_run(). Thus, explicit call to xz_dec_reset() is useful only in + * multi-call mode. + */ +XZ_EXTERN void xz_dec_reset(struct xz_dec *s); + +/** + * xz_dec_end() - Free the memory allocated for the decoder state + * @s: Decoder state allocated using xz_dec_init(). If s is NULL, + * this function does nothing. + */ +XZ_EXTERN void xz_dec_end(struct xz_dec *s); + +/** + * DOC: MicroLZMA decompressor + * + * This MicroLZMA header format was created for use in EROFS but may be used + * by others too. **In most cases one needs the XZ APIs above instead.** + * + * The compressed format supported by this decoder is a raw LZMA stream + * whose first byte (always 0x00) has been replaced with bitwise-negation + * of the LZMA properties (lc/lp/pb) byte. For example, if lc/lp/pb is + * 3/0/2, the first byte is 0xA2. This way the first byte can never be 0x00. + * Just like with LZMA2, lc + lp <= 4 must be true. The LZMA end-of-stream + * marker must not be used. The unused values are reserved for future use. + */ + +/* + * struct xz_dec_microlzma - Opaque type to hold the MicroLZMA decoder state + */ +struct xz_dec_microlzma; + +/** + * xz_dec_microlzma_alloc() - Allocate memory for the MicroLZMA decoder + * @mode: XZ_SINGLE or XZ_PREALLOC + * @dict_size: LZMA dictionary size. This must be at least 4 KiB and + * at most 3 GiB. + * + * In contrast to xz_dec_init(), this function only allocates the memory + * and remembers the dictionary size. xz_dec_microlzma_reset() must be used + * before calling xz_dec_microlzma_run(). + * + * The amount of allocated memory is a little less than 30 KiB with XZ_SINGLE. + * With XZ_PREALLOC also a dictionary buffer of dict_size bytes is allocated. + * + * On success, xz_dec_microlzma_alloc() returns a pointer to + * struct xz_dec_microlzma. If memory allocation fails or + * dict_size is invalid, NULL is returned. + */ +XZ_EXTERN struct xz_dec_microlzma *xz_dec_microlzma_alloc(enum xz_mode mode, + uint32_t dict_size); + +/** + * xz_dec_microlzma_reset() - Reset the MicroLZMA decoder state + * @s: Decoder state allocated using xz_dec_microlzma_alloc() + * @comp_size: Compressed size of the input stream + * @uncomp_size: Uncompressed size of the input stream. A value smaller + * than the real uncompressed size of the input stream can + * be specified if uncomp_size_is_exact is set to false. + * uncomp_size can never be set to a value larger than the + * expected real uncompressed size because it would eventually + * result in XZ_DATA_ERROR. + * @uncomp_size_is_exact: This is an int instead of bool to avoid + * requiring stdbool.h. This should normally be set to true. + * When this is set to false, error detection is weaker. + */ +XZ_EXTERN void xz_dec_microlzma_reset(struct xz_dec_microlzma *s, + uint32_t comp_size, uint32_t uncomp_size, + int uncomp_size_is_exact); + +/** + * xz_dec_microlzma_run() - Run the MicroLZMA decoder + * @s: Decoder state initialized using xz_dec_microlzma_reset() + * @b: Input and output buffers + * + * This works similarly to xz_dec_run() with a few important differences. + * Only the differences are documented here. + * + * The only possible return values are XZ_OK, XZ_STREAM_END, and + * XZ_DATA_ERROR. This function cannot return XZ_BUF_ERROR: if no progress + * is possible due to lack of input data or output space, this function will + * keep returning XZ_OK. Thus, the calling code must be written so that it + * will eventually provide input and output space matching (or exceeding) + * comp_size and uncomp_size arguments given to xz_dec_microlzma_reset(). + * If the caller cannot do this (for example, if the input file is truncated + * or otherwise corrupt), the caller must detect this error by itself to + * avoid an infinite loop. + * + * If the compressed data seems to be corrupt, XZ_DATA_ERROR is returned. + * This can happen also when incorrect dictionary, uncompressed, or + * compressed sizes have been specified. + * + * With XZ_PREALLOC only: As an extra feature, b->out may be NULL to skip over + * uncompressed data. This way the caller doesn't need to provide a temporary + * output buffer for the bytes that will be ignored. + * + * With XZ_SINGLE only: In contrast to xz_dec_run(), the return value XZ_OK + * is also possible and thus XZ_SINGLE is actually a limited multi-call mode. + * After XZ_OK the bytes decoded so far may be read from the output buffer. + * It is possible to continue decoding but the variables b->out and b->out_pos + * MUST NOT be changed by the caller. Increasing the value of b->out_size is + * allowed to make more output space available; one doesn't need to provide + * space for the whole uncompressed data on the first call. The input buffer + * may be changed normally like with XZ_PREALLOC. This way input data can be + * provided from non-contiguous memory. + */ +XZ_EXTERN enum xz_ret xz_dec_microlzma_run(struct xz_dec_microlzma *s, + struct xz_buf *b); + +/** + * xz_dec_microlzma_end() - Free the memory allocated for the decoder state + * @s: Decoder state allocated using xz_dec_microlzma_alloc(). + * If s is NULL, this function does nothing. + */ +XZ_EXTERN void xz_dec_microlzma_end(struct xz_dec_microlzma *s); + +/* + * Standalone build (userspace build or in-kernel build for boot time use) + * needs a CRC32 implementation. For normal in-kernel use, kernel's own + * CRC32 module is used instead, and users of this module don't need to + * care about the functions below. + */ +#ifndef XZ_INTERNAL_CRC32 +# ifdef __KERNEL__ +# define XZ_INTERNAL_CRC32 0 +# else +# define XZ_INTERNAL_CRC32 1 +# endif +#endif + +/* + * If CRC64 support has been enabled with XZ_USE_CRC64, a CRC64 + * implementation is needed too. + */ +#ifndef XZ_USE_CRC64 +# undef XZ_INTERNAL_CRC64 +# define XZ_INTERNAL_CRC64 0 +#endif +#ifndef XZ_INTERNAL_CRC64 +# ifdef __KERNEL__ +# error Using CRC64 in the kernel has not been implemented. +# else +# define XZ_INTERNAL_CRC64 1 +# endif +#endif + +#if XZ_INTERNAL_CRC32 +/* + * This must be called before any other xz_* function to initialize + * the CRC32 lookup table. + */ +XZ_EXTERN void xz_crc32_init(void); + +/* + * Update CRC32 value using the polynomial from IEEE-802.3. To start a new + * calculation, the third argument must be zero. To continue the calculation, + * the previously returned value is passed as the third argument. + */ +XZ_EXTERN uint32_t xz_crc32(const uint8_t *buf, size_t size, uint32_t crc); +#endif + +#if XZ_INTERNAL_CRC64 +/* + * This must be called before any other xz_* function (except xz_crc32_init()) + * to initialize the CRC64 lookup table. + */ +XZ_EXTERN void xz_crc64_init(void); + +/* + * Update CRC64 value using the polynomial from ECMA-182. To start a new + * calculation, the third argument must be zero. To continue the calculation, + * the previously returned value is passed as the third argument. + */ +XZ_EXTERN uint64_t xz_crc64(const uint8_t *buf, size_t size, uint64_t crc); +#endif + +#ifdef __cplusplus +} +#endif + +#endif diff --git a/android/app/src/main/cpp/xz/xz_config.h b/android/app/src/main/cpp/xz/xz_config.h new file mode 100644 index 0000000..d7d4031 --- /dev/null +++ b/android/app/src/main/cpp/xz/xz_config.h @@ -0,0 +1,138 @@ +/* SPDX-License-Identifier: 0BSD */ + +/* + * Private includes and definitions for userspace use of XZ Embedded + * + * Author: Lasse Collin + */ + +#ifndef XZ_CONFIG_H +#define XZ_CONFIG_H + +/* Uncomment to enable building of xz_dec_catrun(). */ +/* #define XZ_DEC_CONCATENATED */ + +/* Uncomment to enable CRC64 support. */ +/* #define XZ_USE_CRC64 */ + +/* Uncomment as needed to enable BCJ filter decoders. */ +/* #define XZ_DEC_X86 */ +/* #define XZ_DEC_ARM */ +/* #define XZ_DEC_ARMTHUMB */ +/* #define XZ_DEC_ARM64 */ +/* #define XZ_DEC_RISCV */ +/* #define XZ_DEC_POWERPC */ +/* #define XZ_DEC_IA64 */ +/* #define XZ_DEC_SPARC */ + +/* + * Visual Studio 2013 update 2 supports only __inline, not inline. + * MSVC v19.0 / VS 2015 and newer support both. + */ +#if defined(_MSC_VER) && _MSC_VER < 1900 && !defined(inline) +# define inline __inline +#endif + +#include +#include +#include + +#include "xz.h" + +#define kmalloc(size, flags) malloc(size) +#define kfree(ptr) free(ptr) +#define vmalloc(size) malloc(size) +#define vfree(ptr) free(ptr) + +#define memeq(a, b, size) (memcmp(a, b, size) == 0) +#define memzero(buf, size) memset(buf, 0, size) + +#ifndef min +# define min(x, y) ((x) < (y) ? (x) : (y)) +#endif +#define min_t(type, x, y) min(x, y) + +#ifndef fallthrough +# if defined(__STDC_VERSION__) && __STDC_VERSION__ >= 202311 +# define fallthrough [[fallthrough]] +# elif (defined(__GNUC__) && __GNUC__ >= 7) \ + || (defined(__clang_major__) && __clang_major__ >= 10) +# define fallthrough __attribute__((__fallthrough__)) +# else +# define fallthrough do {} while (0) +# endif +#endif + +/* + * Some functions have been marked with __always_inline to keep the + * performance reasonable even when the compiler is optimizing for + * small code size. You may be able to save a few bytes by #defining + * __always_inline to plain inline, but don't complain if the code + * becomes slow. + * + * NOTE: System headers on GNU/Linux may #define this macro already, + * so if you want to change it, you need to #undef it first. + */ +#ifndef __always_inline +# ifdef __GNUC__ +# define __always_inline \ + inline __attribute__((__always_inline__)) +# else +# define __always_inline inline +# endif +#endif + +/* Inline functions to access unaligned unsigned 32-bit integers */ +#ifndef get_unaligned_le32 +static inline uint32_t get_unaligned_le32(const uint8_t *buf) +{ + return (uint32_t)buf[0] + | ((uint32_t)buf[1] << 8) + | ((uint32_t)buf[2] << 16) + | ((uint32_t)buf[3] << 24); +} +#endif + +#ifndef get_unaligned_be32 +static inline uint32_t get_unaligned_be32(const uint8_t *buf) +{ + return (uint32_t)((uint32_t)buf[0] << 24) + | ((uint32_t)buf[1] << 16) + | ((uint32_t)buf[2] << 8) + | (uint32_t)buf[3]; +} +#endif + +#ifndef put_unaligned_le32 +static inline void put_unaligned_le32(uint32_t val, uint8_t *buf) +{ + buf[0] = (uint8_t)val; + buf[1] = (uint8_t)(val >> 8); + buf[2] = (uint8_t)(val >> 16); + buf[3] = (uint8_t)(val >> 24); +} +#endif + +#ifndef put_unaligned_be32 +static inline void put_unaligned_be32(uint32_t val, uint8_t *buf) +{ + buf[0] = (uint8_t)(val >> 24); + buf[1] = (uint8_t)(val >> 16); + buf[2] = (uint8_t)(val >> 8); + buf[3] = (uint8_t)val; +} +#endif + +/* + * To keep things simpler, use the generic unaligned methods also for + * aligned access. The only place where performance could matter is + * SHA-256 but files using SHA-256 aren't common. + */ +#ifndef get_le32 +# define get_le32 get_unaligned_le32 +#endif +#ifndef get_be32 +# define get_be32 get_unaligned_be32 +#endif + +#endif diff --git a/android/app/src/main/cpp/xz/xz_crc32.c b/android/app/src/main/cpp/xz/xz_crc32.c new file mode 100644 index 0000000..effdf34 --- /dev/null +++ b/android/app/src/main/cpp/xz/xz_crc32.c @@ -0,0 +1,58 @@ +// SPDX-License-Identifier: 0BSD + +/* + * CRC32 using the polynomial from IEEE-802.3 + * + * Authors: Lasse Collin + * Igor Pavlov + */ + +/* + * This is not the fastest implementation, but it is pretty compact. + * The fastest versions of xz_crc32() on modern CPUs without hardware + * accelerated CRC instruction are 3-5 times as fast as this version, + * but they are bigger and use more memory for the lookup table. + */ + +#include "xz_private.h" + +/* + * STATIC_RW_DATA is used in the pre-boot environment on some architectures. + * See for details. + */ +#ifndef STATIC_RW_DATA +# define STATIC_RW_DATA static +#endif + +STATIC_RW_DATA uint32_t xz_crc32_table[256]; + +XZ_EXTERN void xz_crc32_init(void) +{ + const uint32_t poly = 0xEDB88320; + + uint32_t i; + uint32_t j; + uint32_t r; + + for (i = 0; i < 256; ++i) { + r = i; + for (j = 0; j < 8; ++j) + r = (r >> 1) ^ (poly & ~((r & 1) - 1)); + + xz_crc32_table[i] = r; + } + + return; +} + +XZ_EXTERN uint32_t xz_crc32(const uint8_t *buf, size_t size, uint32_t crc) +{ + crc = ~crc; + + while (size != 0) { + crc = xz_crc32_table[*buf++ ^ (crc & 0xFF)] ^ (crc >> 8); + --size; + } + + return ~crc; +} diff --git a/android/app/src/main/cpp/xz/xz_crc64.c b/android/app/src/main/cpp/xz/xz_crc64.c new file mode 100644 index 0000000..20049ea --- /dev/null +++ b/android/app/src/main/cpp/xz/xz_crc64.c @@ -0,0 +1,53 @@ +// SPDX-License-Identifier: 0BSD + +/* + * CRC64 using the polynomial from ECMA-182 + * + * This file is similar to xz_crc32.c. See the comments there. + * + * Authors: Lasse Collin + * Igor Pavlov + */ + +#include "xz_private.h" + +#ifndef STATIC_RW_DATA +# define STATIC_RW_DATA static +#endif + +STATIC_RW_DATA uint64_t xz_crc64_table[256]; + +XZ_EXTERN void xz_crc64_init(void) +{ + /* + * The ULL suffix is needed for -std=gnu89 compatibility + * on 32-bit platforms. + */ + const uint64_t poly = 0xC96C5795D7870F42ULL; + + uint32_t i; + uint32_t j; + uint64_t r; + + for (i = 0; i < 256; ++i) { + r = i; + for (j = 0; j < 8; ++j) + r = (r >> 1) ^ (poly & ~((r & 1) - 1)); + + xz_crc64_table[i] = r; + } + + return; +} + +XZ_EXTERN uint64_t xz_crc64(const uint8_t *buf, size_t size, uint64_t crc) +{ + crc = ~crc; + + while (size != 0) { + crc = xz_crc64_table[*buf++ ^ (crc & 0xFF)] ^ (crc >> 8); + --size; + } + + return ~crc; +} diff --git a/android/app/src/main/cpp/xz/xz_dec_bcj.c b/android/app/src/main/cpp/xz/xz_dec_bcj.c new file mode 100644 index 0000000..42d7f26 --- /dev/null +++ b/android/app/src/main/cpp/xz/xz_dec_bcj.c @@ -0,0 +1,738 @@ +// SPDX-License-Identifier: 0BSD + +/* + * Branch/Call/Jump (BCJ) filter decoders + * + * Authors: Lasse Collin + * Igor Pavlov + */ + +#include "xz_private.h" + +/* + * The rest of the file is inside this ifdef. It makes things a little more + * convenient when building without support for any BCJ filters. + */ +#ifdef XZ_DEC_BCJ + +struct xz_dec_bcj { + /* Type of the BCJ filter being used */ + enum { + BCJ_X86 = 4, /* x86 or x86-64 */ + BCJ_POWERPC = 5, /* Big endian only */ + BCJ_IA64 = 6, /* Big or little endian */ + BCJ_ARM = 7, /* Little endian only */ + BCJ_ARMTHUMB = 8, /* Little endian only */ + BCJ_SPARC = 9, /* Big or little endian */ + BCJ_ARM64 = 10, /* AArch64 */ + BCJ_RISCV = 11 /* RV32GQC_Zfh, RV64GQC_Zfh */ + } type; + + /* + * Return value of the next filter in the chain. We need to preserve + * this information across calls, because we must not call the next + * filter anymore once it has returned XZ_STREAM_END. + */ + enum xz_ret ret; + + /* True if we are operating in single-call mode. */ + bool single_call; + + /* + * Absolute position relative to the beginning of the uncompressed + * data (in a single .xz Block). We care only about the lowest 32 + * bits so this doesn't need to be uint64_t even with big files. + */ + uint32_t pos; + + /* x86 filter state */ + uint32_t x86_prev_mask; + + /* Temporary space to hold the variables from struct xz_buf */ + uint8_t *out; + size_t out_pos; + size_t out_size; + + struct { + /* Amount of already filtered data in the beginning of buf */ + size_t filtered; + + /* Total amount of data currently stored in buf */ + size_t size; + + /* + * Buffer to hold a mix of filtered and unfiltered data. This + * needs to be big enough to hold Alignment + 2 * Look-ahead: + * + * Type Alignment Look-ahead + * x86 1 4 + * PowerPC 4 0 + * IA-64 16 0 + * ARM 4 0 + * ARM-Thumb 2 2 + * SPARC 4 0 + */ + uint8_t buf[16]; + } temp; +}; + +#ifdef XZ_DEC_X86 +/* + * This is used to test the most significant byte of a memory address + * in an x86 instruction. + */ +static inline int bcj_x86_test_msbyte(uint8_t b) +{ + return b == 0x00 || b == 0xFF; +} + +static size_t bcj_x86(struct xz_dec_bcj *s, uint8_t *buf, size_t size) +{ + static const bool mask_to_allowed_status[8] + = { true, true, true, false, true, false, false, false }; + + static const uint8_t mask_to_bit_num[8] = { 0, 1, 2, 2, 3, 3, 3, 3 }; + + size_t i; + size_t prev_pos = (size_t)-1; + uint32_t prev_mask = s->x86_prev_mask; + uint32_t src; + uint32_t dest; + uint32_t j; + uint8_t b; + + if (size <= 4) + return 0; + + size -= 4; + for (i = 0; i < size; ++i) { + if ((buf[i] & 0xFE) != 0xE8) + continue; + + prev_pos = i - prev_pos; + if (prev_pos > 3) { + prev_mask = 0; + } else { + prev_mask = (prev_mask << (prev_pos - 1)) & 7; + if (prev_mask != 0) { + b = buf[i + 4 - mask_to_bit_num[prev_mask]]; + if (!mask_to_allowed_status[prev_mask] + || bcj_x86_test_msbyte(b)) { + prev_pos = i; + prev_mask = (prev_mask << 1) | 1; + continue; + } + } + } + + prev_pos = i; + + if (bcj_x86_test_msbyte(buf[i + 4])) { + src = get_unaligned_le32(buf + i + 1); + while (true) { + dest = src - (s->pos + (uint32_t)i + 5); + if (prev_mask == 0) + break; + + j = mask_to_bit_num[prev_mask] * 8; + b = (uint8_t)(dest >> (24 - j)); + if (!bcj_x86_test_msbyte(b)) + break; + + src = dest ^ (((uint32_t)1 << (32 - j)) - 1); + } + + dest &= 0x01FFFFFF; + dest |= (uint32_t)0 - (dest & 0x01000000); + put_unaligned_le32(dest, buf + i + 1); + i += 4; + } else { + prev_mask = (prev_mask << 1) | 1; + } + } + + prev_pos = i - prev_pos; + s->x86_prev_mask = prev_pos > 3 ? 0 : prev_mask << (prev_pos - 1); + return i; +} +#endif + +#ifdef XZ_DEC_POWERPC +static size_t bcj_powerpc(struct xz_dec_bcj *s, uint8_t *buf, size_t size) +{ + size_t i; + uint32_t instr; + + size &= ~(size_t)3; + + for (i = 0; i < size; i += 4) { + instr = get_unaligned_be32(buf + i); + if ((instr & 0xFC000003) == 0x48000001) { + instr &= 0x03FFFFFC; + instr -= s->pos + (uint32_t)i; + instr &= 0x03FFFFFC; + instr |= 0x48000001; + put_unaligned_be32(instr, buf + i); + } + } + + return i; +} +#endif + +#ifdef XZ_DEC_IA64 +static size_t bcj_ia64(struct xz_dec_bcj *s, uint8_t *buf, size_t size) +{ + static const uint8_t branch_table[32] = { + 0, 0, 0, 0, 0, 0, 0, 0, + 0, 0, 0, 0, 0, 0, 0, 0, + 4, 4, 6, 6, 0, 0, 7, 7, + 4, 4, 0, 0, 4, 4, 0, 0 + }; + + /* + * The local variables take a little bit stack space, but it's less + * than what LZMA2 decoder takes, so it doesn't make sense to reduce + * stack usage here without doing that for the LZMA2 decoder too. + */ + + /* Loop counters */ + size_t i; + size_t j; + + /* Instruction slot (0, 1, or 2) in the 128-bit instruction word */ + uint32_t slot; + + /* Bitwise offset of the instruction indicated by slot */ + uint32_t bit_pos; + + /* bit_pos split into byte and bit parts */ + uint32_t byte_pos; + uint32_t bit_res; + + /* Address part of an instruction */ + uint32_t addr; + + /* Mask used to detect which instructions to convert */ + uint32_t mask; + + /* 41-bit instruction stored somewhere in the lowest 48 bits */ + uint64_t instr; + + /* Instruction normalized with bit_res for easier manipulation */ + uint64_t norm; + + size &= ~(size_t)15; + + for (i = 0; i < size; i += 16) { + mask = branch_table[buf[i] & 0x1F]; + for (slot = 0, bit_pos = 5; slot < 3; ++slot, bit_pos += 41) { + if (((mask >> slot) & 1) == 0) + continue; + + byte_pos = bit_pos >> 3; + bit_res = bit_pos & 7; + instr = 0; + for (j = 0; j < 6; ++j) + instr |= (uint64_t)(buf[i + j + byte_pos]) + << (8 * j); + + norm = instr >> bit_res; + + if (((norm >> 37) & 0x0F) == 0x05 + && ((norm >> 9) & 0x07) == 0) { + addr = (norm >> 13) & 0x0FFFFF; + addr |= ((uint32_t)(norm >> 36) & 1) << 20; + addr <<= 4; + addr -= s->pos + (uint32_t)i; + addr >>= 4; + + norm &= ~((uint64_t)0x8FFFFF << 13); + norm |= (uint64_t)(addr & 0x0FFFFF) << 13; + norm |= (uint64_t)(addr & 0x100000) + << (36 - 20); + + instr &= (1 << bit_res) - 1; + instr |= norm << bit_res; + + for (j = 0; j < 6; j++) + buf[i + j + byte_pos] + = (uint8_t)(instr >> (8 * j)); + } + } + } + + return i; +} +#endif + +#ifdef XZ_DEC_ARM +static size_t bcj_arm(struct xz_dec_bcj *s, uint8_t *buf, size_t size) +{ + size_t i; + uint32_t addr; + + size &= ~(size_t)3; + + for (i = 0; i < size; i += 4) { + if (buf[i + 3] == 0xEB) { + addr = (uint32_t)buf[i] | ((uint32_t)buf[i + 1] << 8) + | ((uint32_t)buf[i + 2] << 16); + addr <<= 2; + addr -= s->pos + (uint32_t)i + 8; + addr >>= 2; + buf[i] = (uint8_t)addr; + buf[i + 1] = (uint8_t)(addr >> 8); + buf[i + 2] = (uint8_t)(addr >> 16); + } + } + + return i; +} +#endif + +#ifdef XZ_DEC_ARMTHUMB +static size_t bcj_armthumb(struct xz_dec_bcj *s, uint8_t *buf, size_t size) +{ + size_t i; + uint32_t addr; + + if (size < 4) + return 0; + + size -= 4; + + for (i = 0; i <= size; i += 2) { + if ((buf[i + 1] & 0xF8) == 0xF0 + && (buf[i + 3] & 0xF8) == 0xF8) { + addr = (((uint32_t)buf[i + 1] & 0x07) << 19) + | ((uint32_t)buf[i] << 11) + | (((uint32_t)buf[i + 3] & 0x07) << 8) + | (uint32_t)buf[i + 2]; + addr <<= 1; + addr -= s->pos + (uint32_t)i + 4; + addr >>= 1; + buf[i + 1] = (uint8_t)(0xF0 | ((addr >> 19) & 0x07)); + buf[i] = (uint8_t)(addr >> 11); + buf[i + 3] = (uint8_t)(0xF8 | ((addr >> 8) & 0x07)); + buf[i + 2] = (uint8_t)addr; + i += 2; + } + } + + return i; +} +#endif + +#ifdef XZ_DEC_SPARC +static size_t bcj_sparc(struct xz_dec_bcj *s, uint8_t *buf, size_t size) +{ + size_t i; + uint32_t instr; + + size &= ~(size_t)3; + + for (i = 0; i < size; i += 4) { + instr = get_unaligned_be32(buf + i); + if ((instr >> 22) == 0x100 || (instr >> 22) == 0x1FF) { + instr <<= 2; + instr -= s->pos + (uint32_t)i; + instr >>= 2; + instr = ((uint32_t)0x40000000 - (instr & 0x400000)) + | 0x40000000 | (instr & 0x3FFFFF); + put_unaligned_be32(instr, buf + i); + } + } + + return i; +} +#endif + +#ifdef XZ_DEC_ARM64 +static size_t bcj_arm64(struct xz_dec_bcj *s, uint8_t *buf, size_t size) +{ + size_t i; + uint32_t instr; + uint32_t addr; + + size &= ~(size_t)3; + + for (i = 0; i < size; i += 4) { + instr = get_unaligned_le32(buf + i); + + if ((instr >> 26) == 0x25) { + /* BL instruction */ + addr = instr - ((s->pos + (uint32_t)i) >> 2); + instr = 0x94000000 | (addr & 0x03FFFFFF); + put_unaligned_le32(instr, buf + i); + + } else if ((instr & 0x9F000000) == 0x90000000) { + /* ADRP instruction */ + addr = ((instr >> 29) & 3) | ((instr >> 3) & 0x1FFFFC); + + /* Only convert values in the range +/-512 MiB. */ + if ((addr + 0x020000) & 0x1C0000) + continue; + + addr -= (s->pos + (uint32_t)i) >> 12; + + instr &= 0x9000001F; + instr |= (addr & 3) << 29; + instr |= (addr & 0x03FFFC) << 3; + instr |= (0U - (addr & 0x020000)) & 0xE00000; + + put_unaligned_le32(instr, buf + i); + } + } + + return i; +} +#endif + +#ifdef XZ_DEC_RISCV +static size_t bcj_riscv(struct xz_dec_bcj *s, uint8_t *buf, size_t size) +{ + size_t i; + uint32_t b1; + uint32_t b2; + uint32_t b3; + uint32_t instr; + uint32_t instr2; + uint32_t instr2_rs1; + uint32_t addr; + + if (size < 8) + return 0; + + size -= 8; + + for (i = 0; i <= size; i += 2) { + instr = buf[i]; + + if (instr == 0xEF) { + /* JAL */ + b1 = buf[i + 1]; + if ((b1 & 0x0D) != 0) + continue; + + b2 = buf[i + 2]; + b3 = buf[i + 3]; + + addr = ((b1 & 0xF0) << 13) | (b2 << 9) | (b3 << 1); + addr -= s->pos + (uint32_t)i; + + buf[i + 1] = (uint8_t)((b1 & 0x0F) + | ((addr >> 8) & 0xF0)); + + buf[i + 2] = (uint8_t)(((addr >> 16) & 0x0F) + | ((addr >> 7) & 0x10) + | ((addr << 4) & 0xE0)); + + buf[i + 3] = (uint8_t)(((addr >> 4) & 0x7F) + | ((addr >> 13) & 0x80)); + + i += 4 - 2; + + } else if ((instr & 0x7F) == 0x17) { + /* AUIPC */ + instr |= (uint32_t)buf[i + 1] << 8; + instr |= (uint32_t)buf[i + 2] << 16; + instr |= (uint32_t)buf[i + 3] << 24; + + if (instr & 0xE80) { + /* AUIPC's rd doesn't equal x0 or x2. */ + instr2 = get_unaligned_le32(buf + i + 4); + + if (((instr << 8) ^ (instr2 - 3)) & 0xF8003) { + i += 6 - 2; + continue; + } + + addr = (instr & 0xFFFFF000) + (instr2 >> 20); + + instr = 0x17 | (2 << 7) | (instr2 << 12); + instr2 = addr; + } else { + /* AUIPC's rd equals x0 or x2. */ + instr2_rs1 = instr >> 27; + + if ((uint32_t)((instr - 0x3117) << 18) + >= (instr2_rs1 & 0x1D)) { + i += 4 - 2; + continue; + } + + addr = get_unaligned_be32(buf + i + 4); + addr -= s->pos + (uint32_t)i; + + instr2 = (instr >> 12) | (addr << 20); + + instr = 0x17 | (instr2_rs1 << 7) + | ((addr + 0x800) & 0xFFFFF000); + } + + put_unaligned_le32(instr, buf + i); + put_unaligned_le32(instr2, buf + i + 4); + + i += 8 - 2; + } + } + + return i; +} +#endif + +/* + * Apply the selected BCJ filter. Update *pos and s->pos to match the amount + * of data that got filtered. + * + * NOTE: This is implemented as a switch statement to avoid using function + * pointers, which could be problematic in the kernel boot code, which must + * avoid pointers to static data (at least on x86). + */ +static void bcj_apply(struct xz_dec_bcj *s, + uint8_t *buf, size_t *pos, size_t size) +{ + size_t filtered; + + buf += *pos; + size -= *pos; + + switch (s->type) { +#ifdef XZ_DEC_X86 + case BCJ_X86: + filtered = bcj_x86(s, buf, size); + break; +#endif +#ifdef XZ_DEC_POWERPC + case BCJ_POWERPC: + filtered = bcj_powerpc(s, buf, size); + break; +#endif +#ifdef XZ_DEC_IA64 + case BCJ_IA64: + filtered = bcj_ia64(s, buf, size); + break; +#endif +#ifdef XZ_DEC_ARM + case BCJ_ARM: + filtered = bcj_arm(s, buf, size); + break; +#endif +#ifdef XZ_DEC_ARMTHUMB + case BCJ_ARMTHUMB: + filtered = bcj_armthumb(s, buf, size); + break; +#endif +#ifdef XZ_DEC_SPARC + case BCJ_SPARC: + filtered = bcj_sparc(s, buf, size); + break; +#endif +#ifdef XZ_DEC_ARM64 + case BCJ_ARM64: + filtered = bcj_arm64(s, buf, size); + break; +#endif +#ifdef XZ_DEC_RISCV + case BCJ_RISCV: + filtered = bcj_riscv(s, buf, size); + break; +#endif + default: + /* Never reached but silence compiler warnings. */ + filtered = 0; + break; + } + + *pos += filtered; + s->pos += filtered; +} + +/* + * Flush pending filtered data from temp to the output buffer. + * Move the remaining mixture of possibly filtered and unfiltered + * data to the beginning of temp. + */ +static void bcj_flush(struct xz_dec_bcj *s, struct xz_buf *b) +{ + size_t copy_size; + + copy_size = min_t(size_t, s->temp.filtered, b->out_size - b->out_pos); + memcpy(b->out + b->out_pos, s->temp.buf, copy_size); + b->out_pos += copy_size; + + s->temp.filtered -= copy_size; + s->temp.size -= copy_size; + memmove(s->temp.buf, s->temp.buf + copy_size, s->temp.size); +} + +/* + * The BCJ filter functions are primitive in sense that they process the + * data in chunks of 1-16 bytes. To hide this issue, this function does + * some buffering. + */ +XZ_EXTERN enum xz_ret xz_dec_bcj_run(struct xz_dec_bcj *s, + struct xz_dec_lzma2 *lzma2, + struct xz_buf *b) +{ + size_t out_start; + + /* + * Flush pending already filtered data to the output buffer. Return + * immediately if we couldn't flush everything, or if the next + * filter in the chain had already returned XZ_STREAM_END. + */ + if (s->temp.filtered > 0) { + bcj_flush(s, b); + if (s->temp.filtered > 0) + return XZ_OK; + + if (s->ret == XZ_STREAM_END) + return XZ_STREAM_END; + } + + /* + * If we have more output space than what is currently pending in + * temp, copy the unfiltered data from temp to the output buffer + * and try to fill the output buffer by decoding more data from the + * next filter in the chain. Apply the BCJ filter on the new data + * in the output buffer. If everything cannot be filtered, copy it + * to temp and rewind the output buffer position accordingly. + * + * This needs to be always run when temp.size == 0 to handle a special + * case where the output buffer is full and the next filter has no + * more output coming but hasn't returned XZ_STREAM_END yet. + */ + if (s->temp.size < b->out_size - b->out_pos || s->temp.size == 0) { + out_start = b->out_pos; + memcpy(b->out + b->out_pos, s->temp.buf, s->temp.size); + b->out_pos += s->temp.size; + + s->ret = xz_dec_lzma2_run(lzma2, b); + if (s->ret != XZ_STREAM_END + && (s->ret != XZ_OK || s->single_call)) + return s->ret; + + bcj_apply(s, b->out, &out_start, b->out_pos); + + /* + * As an exception, if the next filter returned XZ_STREAM_END, + * we can do that too, since the last few bytes that remain + * unfiltered are meant to remain unfiltered. + */ + if (s->ret == XZ_STREAM_END) + return XZ_STREAM_END; + + s->temp.size = b->out_pos - out_start; + b->out_pos -= s->temp.size; + memcpy(s->temp.buf, b->out + b->out_pos, s->temp.size); + + /* + * If there wasn't enough input to the next filter to fill + * the output buffer with unfiltered data, there's no point + * to try decoding more data to temp. + */ + if (b->out_pos + s->temp.size < b->out_size) + return XZ_OK; + } + + /* + * We have unfiltered data in temp. If the output buffer isn't full + * yet, try to fill the temp buffer by decoding more data from the + * next filter. Apply the BCJ filter on temp. Then we hopefully can + * fill the actual output buffer by copying filtered data from temp. + * A mix of filtered and unfiltered data may be left in temp; it will + * be taken care on the next call to this function. + */ + if (b->out_pos < b->out_size) { + /* Make b->out{,_pos,_size} temporarily point to s->temp. */ + s->out = b->out; + s->out_pos = b->out_pos; + s->out_size = b->out_size; + b->out = s->temp.buf; + b->out_pos = s->temp.size; + b->out_size = sizeof(s->temp.buf); + + s->ret = xz_dec_lzma2_run(lzma2, b); + + s->temp.size = b->out_pos; + b->out = s->out; + b->out_pos = s->out_pos; + b->out_size = s->out_size; + + if (s->ret != XZ_OK && s->ret != XZ_STREAM_END) + return s->ret; + + bcj_apply(s, s->temp.buf, &s->temp.filtered, s->temp.size); + + /* + * If the next filter returned XZ_STREAM_END, we mark that + * everything is filtered, since the last unfiltered bytes + * of the stream are meant to be left as is. + */ + if (s->ret == XZ_STREAM_END) + s->temp.filtered = s->temp.size; + + bcj_flush(s, b); + if (s->temp.filtered > 0) + return XZ_OK; + } + + return s->ret; +} + +XZ_EXTERN struct xz_dec_bcj *xz_dec_bcj_create(bool single_call) +{ + struct xz_dec_bcj *s = kmalloc(sizeof(*s), GFP_KERNEL); + if (s != NULL) + s->single_call = single_call; + + return s; +} + +XZ_EXTERN enum xz_ret xz_dec_bcj_reset(struct xz_dec_bcj *s, uint8_t id) +{ + switch (id) { +#ifdef XZ_DEC_X86 + case BCJ_X86: +#endif +#ifdef XZ_DEC_POWERPC + case BCJ_POWERPC: +#endif +#ifdef XZ_DEC_IA64 + case BCJ_IA64: +#endif +#ifdef XZ_DEC_ARM + case BCJ_ARM: +#endif +#ifdef XZ_DEC_ARMTHUMB + case BCJ_ARMTHUMB: +#endif +#ifdef XZ_DEC_SPARC + case BCJ_SPARC: +#endif +#ifdef XZ_DEC_ARM64 + case BCJ_ARM64: +#endif +#ifdef XZ_DEC_RISCV + case BCJ_RISCV: +#endif + break; + + default: + /* Unsupported Filter ID */ + return XZ_OPTIONS_ERROR; + } + + s->type = id; + s->ret = XZ_OK; + s->pos = 0; + s->x86_prev_mask = 0; + s->temp.filtered = 0; + s->temp.size = 0; + + return XZ_OK; +} + +#endif diff --git a/android/app/src/main/cpp/xz/xz_dec_lzma2.c b/android/app/src/main/cpp/xz/xz_dec_lzma2.c new file mode 100644 index 0000000..475c378 --- /dev/null +++ b/android/app/src/main/cpp/xz/xz_dec_lzma2.c @@ -0,0 +1,1345 @@ +// SPDX-License-Identifier: 0BSD + +/* + * LZMA2 decoder + * + * Authors: Lasse Collin + * Igor Pavlov + */ + +#include "xz_private.h" +#include "xz_lzma2.h" + +/* + * Range decoder initialization eats the first five bytes of each LZMA chunk. + */ +#define RC_INIT_BYTES 5 + +/* + * Minimum number of usable input buffer to safely decode one LZMA symbol. + * The worst case is that we decode 22 bits using probabilities and 26 + * direct bits. This may decode at maximum of 20 bytes of input. However, + * lzma_main() does an extra normalization before returning, thus we + * need to put 21 here. + */ +#define LZMA_IN_REQUIRED 21 + +/* + * Dictionary (history buffer) + * + * These are always true: + * start <= pos <= full <= end + * pos <= limit <= end + * + * In multi-call mode, also these are true: + * end == size + * size <= size_max + * allocated <= size + * + * Most of these variables are size_t to support single-call mode, + * in which the dictionary variables address the actual output + * buffer directly. + */ +struct dictionary { + /* Beginning of the history buffer */ + uint8_t *buf; + + /* Old position in buf (before decoding more data) */ + size_t start; + + /* Position in buf */ + size_t pos; + + /* + * How full dictionary is. This is used to detect corrupt input that + * would read beyond the beginning of the uncompressed stream. + */ + size_t full; + + /* Write limit; we don't write to buf[limit] or later bytes. */ + size_t limit; + + /* + * End of the dictionary buffer. In multi-call mode, this is + * the same as the dictionary size. In single-call mode, this + * indicates the size of the output buffer. + */ + size_t end; + + /* + * Size of the dictionary as specified in Block Header. This is used + * together with "full" to detect corrupt input that would make us + * read beyond the beginning of the uncompressed stream. + */ + uint32_t size; + + /* + * Maximum allowed dictionary size in multi-call mode. + * This is ignored in single-call mode. + */ + uint32_t size_max; + + /* + * Amount of memory currently allocated for the dictionary. + * This is used only with XZ_DYNALLOC. (With XZ_PREALLOC, + * size_max is always the same as the allocated size.) + */ + uint32_t allocated; + + /* Operation mode */ + enum xz_mode mode; +}; + +/* Range decoder */ +struct rc_dec { + uint32_t range; + uint32_t code; + + /* + * Number of initializing bytes remaining to be read + * by rc_read_init(). + */ + uint32_t init_bytes_left; + + /* + * Buffer from which we read our input. It can be either + * temp.buf or the caller-provided input buffer. + */ + const uint8_t *in; + size_t in_pos; + size_t in_limit; +}; + +/* Probabilities for a length decoder. */ +struct lzma_len_dec { + /* Probability of match length being at least 10 */ + uint16_t choice; + + /* Probability of match length being at least 18 */ + uint16_t choice2; + + /* Probabilities for match lengths 2-9 */ + uint16_t low[POS_STATES_MAX][LEN_LOW_SYMBOLS]; + + /* Probabilities for match lengths 10-17 */ + uint16_t mid[POS_STATES_MAX][LEN_MID_SYMBOLS]; + + /* Probabilities for match lengths 18-273 */ + uint16_t high[LEN_HIGH_SYMBOLS]; +}; + +struct lzma_dec { + /* Distances of latest four matches */ + uint32_t rep0; + uint32_t rep1; + uint32_t rep2; + uint32_t rep3; + + /* Types of the most recently seen LZMA symbols */ + enum lzma_state state; + + /* + * Length of a match. This is updated so that dict_repeat can + * be called again to finish repeating the whole match. + */ + uint32_t len; + + /* + * LZMA properties or related bit masks (number of literal + * context bits, a mask derived from the number of literal + * position bits, and a mask derived from the number + * position bits) + */ + uint32_t lc; + uint32_t literal_pos_mask; /* (1 << lp) - 1 */ + uint32_t pos_mask; /* (1 << pb) - 1 */ + + /* If 1, it's a match. Otherwise it's a single 8-bit literal. */ + uint16_t is_match[STATES][POS_STATES_MAX]; + + /* If 1, it's a repeated match. The distance is one of rep0 .. rep3. */ + uint16_t is_rep[STATES]; + + /* + * If 0, distance of a repeated match is rep0. + * Otherwise check is_rep1. + */ + uint16_t is_rep0[STATES]; + + /* + * If 0, distance of a repeated match is rep1. + * Otherwise check is_rep2. + */ + uint16_t is_rep1[STATES]; + + /* If 0, distance of a repeated match is rep2. Otherwise it is rep3. */ + uint16_t is_rep2[STATES]; + + /* + * If 1, the repeated match has length of one byte. Otherwise + * the length is decoded from rep_len_decoder. + */ + uint16_t is_rep0_long[STATES][POS_STATES_MAX]; + + /* + * Probability tree for the highest two bits of the match + * distance. There is a separate probability tree for match + * lengths of 2 (i.e. MATCH_LEN_MIN), 3, 4, and [5, 273]. + */ + uint16_t dist_slot[DIST_STATES][DIST_SLOTS]; + + /* + * Probability trees for additional bits for match distance + * when the distance is in the range [4, 127]. + */ + uint16_t dist_special[FULL_DISTANCES - DIST_MODEL_END]; + + /* + * Probability tree for the lowest four bits of a match + * distance that is equal to or greater than 128. + */ + uint16_t dist_align[ALIGN_SIZE]; + + /* Length of a normal match */ + struct lzma_len_dec match_len_dec; + + /* Length of a repeated match */ + struct lzma_len_dec rep_len_dec; + + /* Probabilities of literals */ + uint16_t literal[LITERAL_CODERS_MAX][LITERAL_CODER_SIZE]; +}; + +struct lzma2_dec { + /* Position in xz_dec_lzma2_run(). */ + enum lzma2_seq { + SEQ_CONTROL, + SEQ_UNCOMPRESSED_1, + SEQ_UNCOMPRESSED_2, + SEQ_COMPRESSED_0, + SEQ_COMPRESSED_1, + SEQ_PROPERTIES, + SEQ_LZMA_PREPARE, + SEQ_LZMA_RUN, + SEQ_COPY + } sequence; + + /* Next position after decoding the compressed size of the chunk. */ + enum lzma2_seq next_sequence; + + /* Uncompressed size of LZMA chunk (2 MiB at maximum) */ + uint32_t uncompressed; + + /* + * Compressed size of LZMA chunk or compressed/uncompressed + * size of uncompressed chunk (64 KiB at maximum) + */ + uint32_t compressed; + + /* + * True if dictionary reset is needed. This is false before + * the first chunk (LZMA or uncompressed). + */ + bool need_dict_reset; + + /* + * True if new LZMA properties are needed. This is false + * before the first LZMA chunk. + */ + bool need_props; + +#ifdef XZ_DEC_MICROLZMA + bool pedantic_microlzma; +#endif +}; + +struct xz_dec_lzma2 { + /* + * The order below is important on x86 to reduce code size and + * it shouldn't hurt on other platforms. Everything up to and + * including lzma.pos_mask are in the first 128 bytes on x86-32, + * which allows using smaller instructions to access those + * variables. On x86-64, fewer variables fit into the first 128 + * bytes, but this is still the best order without sacrificing + * the readability by splitting the structures. + */ + struct rc_dec rc; + struct dictionary dict; + struct lzma2_dec lzma2; + struct lzma_dec lzma; + + /* + * Temporary buffer which holds small number of input bytes between + * decoder calls. See lzma2_lzma() for details. + */ + struct { + uint32_t size; + uint8_t buf[3 * LZMA_IN_REQUIRED]; + } temp; +}; + +/************** + * Dictionary * + **************/ + +/* + * Reset the dictionary state. When in single-call mode, set up the beginning + * of the dictionary to point to the actual output buffer. + */ +static void dict_reset(struct dictionary *dict, struct xz_buf *b) +{ + if (DEC_IS_SINGLE(dict->mode)) { + dict->buf = b->out + b->out_pos; + dict->end = b->out_size - b->out_pos; + } + + dict->start = 0; + dict->pos = 0; + dict->limit = 0; + dict->full = 0; +} + +/* Set dictionary write limit */ +static void dict_limit(struct dictionary *dict, size_t out_max) +{ + if (dict->end - dict->pos <= out_max) + dict->limit = dict->end; + else + dict->limit = dict->pos + out_max; +} + +/* Return true if at least one byte can be written into the dictionary. */ +static inline bool dict_has_space(const struct dictionary *dict) +{ + return dict->pos < dict->limit; +} + +/* + * Get a byte from the dictionary at the given distance. The distance is + * assumed to valid, or as a special case, zero when the dictionary is + * still empty. This special case is needed for single-call decoding to + * avoid writing a '\0' to the end of the destination buffer. + */ +static inline uint32_t dict_get(const struct dictionary *dict, uint32_t dist) +{ + size_t offset = dict->pos - dist - 1; + + if (dist >= dict->pos) + offset += dict->end; + + return dict->full > 0 ? dict->buf[offset] : 0; +} + +/* + * Put one byte into the dictionary. It is assumed that there is space for it. + */ +static inline void dict_put(struct dictionary *dict, uint8_t byte) +{ + dict->buf[dict->pos++] = byte; + + if (dict->full < dict->pos) + dict->full = dict->pos; +} + +/* + * Repeat given number of bytes from the given distance. If the distance is + * invalid, false is returned. On success, true is returned and *len is + * updated to indicate how many bytes were left to be repeated. + */ +static bool dict_repeat(struct dictionary *dict, uint32_t *len, uint32_t dist) +{ + size_t back; + uint32_t left; + + if (dist >= dict->full || dist >= dict->size) + return false; + + left = min_t(size_t, dict->limit - dict->pos, *len); + *len -= left; + + back = dict->pos - dist - 1; + if (dist >= dict->pos) + back += dict->end; + + do { + dict->buf[dict->pos++] = dict->buf[back++]; + if (back == dict->end) + back = 0; + } while (--left > 0); + + if (dict->full < dict->pos) + dict->full = dict->pos; + + return true; +} + +/* Copy uncompressed data as is from input to dictionary and output buffers. */ +static void dict_uncompressed(struct dictionary *dict, struct xz_buf *b, + uint32_t *left) +{ + size_t copy_size; + + while (*left > 0 && b->in_pos < b->in_size + && b->out_pos < b->out_size) { + copy_size = min(b->in_size - b->in_pos, + b->out_size - b->out_pos); + if (copy_size > dict->end - dict->pos) + copy_size = dict->end - dict->pos; + if (copy_size > *left) + copy_size = *left; + + *left -= copy_size; + + /* + * If doing in-place decompression in single-call mode and the + * uncompressed size of the file is larger than the caller + * thought (i.e. it is invalid input!), the buffers below may + * overlap and cause undefined behavior with memcpy(). + * With valid inputs memcpy() would be fine here. + */ + memmove(dict->buf + dict->pos, b->in + b->in_pos, copy_size); + dict->pos += copy_size; + + if (dict->full < dict->pos) + dict->full = dict->pos; + + if (DEC_IS_MULTI(dict->mode)) { + if (dict->pos == dict->end) + dict->pos = 0; + + /* + * Like above but for multi-call mode: use memmove() + * to avoid undefined behavior with invalid input. + */ + memmove(b->out + b->out_pos, b->in + b->in_pos, + copy_size); + } + + dict->start = dict->pos; + + b->out_pos += copy_size; + b->in_pos += copy_size; + } +} + +#ifdef XZ_DEC_MICROLZMA +# define DICT_FLUSH_SUPPORTS_SKIPPING true +#else +# define DICT_FLUSH_SUPPORTS_SKIPPING false +#endif + +/* + * Flush pending data from dictionary to b->out. It is assumed that there is + * enough space in b->out. This is guaranteed because caller uses dict_limit() + * before decoding data into the dictionary. + */ +static uint32_t dict_flush(struct dictionary *dict, struct xz_buf *b) +{ + size_t copy_size = dict->pos - dict->start; + + if (DEC_IS_MULTI(dict->mode)) { + if (dict->pos == dict->end) + dict->pos = 0; + + /* + * These buffers cannot overlap even if doing in-place + * decompression because in multi-call mode dict->buf + * has been allocated by us in this file; it's not + * provided by the caller like in single-call mode. + * + * With MicroLZMA, b->out can be NULL to skip bytes that + * the caller doesn't need. This cannot be done with XZ + * because it would break BCJ filters. + */ + if (!DICT_FLUSH_SUPPORTS_SKIPPING || b->out != NULL) + memcpy(b->out + b->out_pos, dict->buf + dict->start, + copy_size); + } + + dict->start = dict->pos; + b->out_pos += copy_size; + return copy_size; +} + +/***************** + * Range decoder * + *****************/ + +/* Reset the range decoder. */ +static void rc_reset(struct rc_dec *rc) +{ + rc->range = (uint32_t)-1; + rc->code = 0; + rc->init_bytes_left = RC_INIT_BYTES; +} + +/* + * Read the first five initial bytes into rc->code if they haven't been + * read already. (Yes, the first byte gets completely ignored.) + */ +static bool rc_read_init(struct rc_dec *rc, struct xz_buf *b) +{ + while (rc->init_bytes_left > 0) { + if (b->in_pos == b->in_size) + return false; + + rc->code = (rc->code << 8) + b->in[b->in_pos++]; + --rc->init_bytes_left; + } + + return true; +} + +/* Return true if there may not be enough input for the next decoding loop. */ +static inline bool rc_limit_exceeded(const struct rc_dec *rc) +{ + return rc->in_pos > rc->in_limit; +} + +/* + * Return true if it is possible (from point of view of range decoder) that + * we have reached the end of the LZMA chunk. + */ +static inline bool rc_is_finished(const struct rc_dec *rc) +{ + return rc->code == 0; +} + +/* Read the next input byte if needed. */ +static __always_inline void rc_normalize(struct rc_dec *rc) +{ + if (rc->range < RC_TOP_VALUE) { + rc->range <<= RC_SHIFT_BITS; + rc->code = (rc->code << RC_SHIFT_BITS) + rc->in[rc->in_pos++]; + } +} + +/* + * Decode one bit. In some versions, this function has been split in three + * functions so that the compiler is supposed to be able to more easily avoid + * an extra branch. In this particular version of the LZMA decoder, this + * doesn't seem to be a good idea (tested with GCC 3.3.6, 3.4.6, and 4.3.3 + * on x86). Using a non-split version results in nicer looking code too. + * + * NOTE: This must return an int. Do not make it return a bool or the speed + * of the code generated by GCC 3.x decreases 10-15 %. (GCC 4.3 doesn't care, + * and it generates 10-20 % faster code than GCC 3.x from this file anyway.) + */ +static __always_inline int rc_bit(struct rc_dec *rc, uint16_t *prob) +{ + uint32_t bound; + int bit; + + rc_normalize(rc); + bound = (rc->range >> RC_BIT_MODEL_TOTAL_BITS) * *prob; + if (rc->code < bound) { + rc->range = bound; + *prob += (RC_BIT_MODEL_TOTAL - *prob) >> RC_MOVE_BITS; + bit = 0; + } else { + rc->range -= bound; + rc->code -= bound; + *prob -= *prob >> RC_MOVE_BITS; + bit = 1; + } + + return bit; +} + +/* Decode a bittree starting from the most significant bit. */ +static __always_inline uint32_t rc_bittree(struct rc_dec *rc, + uint16_t *probs, uint32_t limit) +{ + uint32_t symbol = 1; + + do { + if (rc_bit(rc, &probs[symbol])) + symbol = (symbol << 1) + 1; + else + symbol <<= 1; + } while (symbol < limit); + + return symbol; +} + +/* Decode a bittree starting from the least significant bit. */ +static __always_inline void rc_bittree_reverse(struct rc_dec *rc, + uint16_t *probs, + uint32_t *dest, uint32_t limit) +{ + uint32_t symbol = 1; + uint32_t i = 0; + + do { + if (rc_bit(rc, &probs[symbol])) { + symbol = (symbol << 1) + 1; + *dest += 1 << i; + } else { + symbol <<= 1; + } + } while (++i < limit); +} + +/* Decode direct bits (fixed fifty-fifty probability) */ +static inline void rc_direct(struct rc_dec *rc, uint32_t *dest, uint32_t limit) +{ + uint32_t mask; + + do { + rc_normalize(rc); + rc->range >>= 1; + rc->code -= rc->range; + mask = (uint32_t)0 - (rc->code >> 31); + rc->code += rc->range & mask; + *dest = (*dest << 1) + (mask + 1); + } while (--limit > 0); +} + +/******** + * LZMA * + ********/ + +/* Get pointer to literal coder probability array. */ +static uint16_t *lzma_literal_probs(struct xz_dec_lzma2 *s) +{ + uint32_t prev_byte = dict_get(&s->dict, 0); + uint32_t low = prev_byte >> (8 - s->lzma.lc); + uint32_t high = (s->dict.pos & s->lzma.literal_pos_mask) << s->lzma.lc; + return s->lzma.literal[low + high]; +} + +/* Decode a literal (one 8-bit byte) */ +static void lzma_literal(struct xz_dec_lzma2 *s) +{ + uint16_t *probs; + uint32_t symbol; + uint32_t match_byte; + uint32_t match_bit; + uint32_t offset; + uint32_t i; + + probs = lzma_literal_probs(s); + + if (lzma_state_is_literal(s->lzma.state)) { + symbol = rc_bittree(&s->rc, probs, 0x100); + } else { + symbol = 1; + match_byte = dict_get(&s->dict, s->lzma.rep0) << 1; + offset = 0x100; + + do { + match_bit = match_byte & offset; + match_byte <<= 1; + i = offset + match_bit + symbol; + + if (rc_bit(&s->rc, &probs[i])) { + symbol = (symbol << 1) + 1; + offset &= match_bit; + } else { + symbol <<= 1; + offset &= ~match_bit; + } + } while (symbol < 0x100); + } + + dict_put(&s->dict, (uint8_t)symbol); + lzma_state_literal(&s->lzma.state); +} + +/* Decode the length of the match into s->lzma.len. */ +static void lzma_len(struct xz_dec_lzma2 *s, struct lzma_len_dec *l, + uint32_t pos_state) +{ + uint16_t *probs; + uint32_t limit; + + if (!rc_bit(&s->rc, &l->choice)) { + probs = l->low[pos_state]; + limit = LEN_LOW_SYMBOLS; + s->lzma.len = MATCH_LEN_MIN; + } else { + if (!rc_bit(&s->rc, &l->choice2)) { + probs = l->mid[pos_state]; + limit = LEN_MID_SYMBOLS; + s->lzma.len = MATCH_LEN_MIN + LEN_LOW_SYMBOLS; + } else { + probs = l->high; + limit = LEN_HIGH_SYMBOLS; + s->lzma.len = MATCH_LEN_MIN + LEN_LOW_SYMBOLS + + LEN_MID_SYMBOLS; + } + } + + s->lzma.len += rc_bittree(&s->rc, probs, limit) - limit; +} + +/* Decode a match. The distance will be stored in s->lzma.rep0. */ +static void lzma_match(struct xz_dec_lzma2 *s, uint32_t pos_state) +{ + uint16_t *probs; + uint32_t dist_slot; + uint32_t limit; + + lzma_state_match(&s->lzma.state); + + s->lzma.rep3 = s->lzma.rep2; + s->lzma.rep2 = s->lzma.rep1; + s->lzma.rep1 = s->lzma.rep0; + + lzma_len(s, &s->lzma.match_len_dec, pos_state); + + probs = s->lzma.dist_slot[lzma_get_dist_state(s->lzma.len)]; + dist_slot = rc_bittree(&s->rc, probs, DIST_SLOTS) - DIST_SLOTS; + + if (dist_slot < DIST_MODEL_START) { + s->lzma.rep0 = dist_slot; + } else { + limit = (dist_slot >> 1) - 1; + s->lzma.rep0 = 2 + (dist_slot & 1); + + if (dist_slot < DIST_MODEL_END) { + s->lzma.rep0 <<= limit; + probs = s->lzma.dist_special + s->lzma.rep0 + - dist_slot - 1; + rc_bittree_reverse(&s->rc, probs, + &s->lzma.rep0, limit); + } else { + rc_direct(&s->rc, &s->lzma.rep0, limit - ALIGN_BITS); + s->lzma.rep0 <<= ALIGN_BITS; + rc_bittree_reverse(&s->rc, s->lzma.dist_align, + &s->lzma.rep0, ALIGN_BITS); + } + } +} + +/* + * Decode a repeated match. The distance is one of the four most recently + * seen matches. The distance will be stored in s->lzma.rep0. + */ +static void lzma_rep_match(struct xz_dec_lzma2 *s, uint32_t pos_state) +{ + uint32_t tmp; + + if (!rc_bit(&s->rc, &s->lzma.is_rep0[s->lzma.state])) { + if (!rc_bit(&s->rc, &s->lzma.is_rep0_long[ + s->lzma.state][pos_state])) { + lzma_state_short_rep(&s->lzma.state); + s->lzma.len = 1; + return; + } + } else { + if (!rc_bit(&s->rc, &s->lzma.is_rep1[s->lzma.state])) { + tmp = s->lzma.rep1; + } else { + if (!rc_bit(&s->rc, &s->lzma.is_rep2[s->lzma.state])) { + tmp = s->lzma.rep2; + } else { + tmp = s->lzma.rep3; + s->lzma.rep3 = s->lzma.rep2; + } + + s->lzma.rep2 = s->lzma.rep1; + } + + s->lzma.rep1 = s->lzma.rep0; + s->lzma.rep0 = tmp; + } + + lzma_state_long_rep(&s->lzma.state); + lzma_len(s, &s->lzma.rep_len_dec, pos_state); +} + +/* LZMA decoder core */ +static bool lzma_main(struct xz_dec_lzma2 *s) +{ + uint32_t pos_state; + + /* + * If the dictionary was reached during the previous call, try to + * finish the possibly pending repeat in the dictionary. + */ + if (dict_has_space(&s->dict) && s->lzma.len > 0) + dict_repeat(&s->dict, &s->lzma.len, s->lzma.rep0); + + /* + * Decode more LZMA symbols. One iteration may consume up to + * LZMA_IN_REQUIRED - 1 bytes. + */ + while (dict_has_space(&s->dict) && !rc_limit_exceeded(&s->rc)) { + pos_state = s->dict.pos & s->lzma.pos_mask; + + if (!rc_bit(&s->rc, &s->lzma.is_match[ + s->lzma.state][pos_state])) { + lzma_literal(s); + } else { + if (rc_bit(&s->rc, &s->lzma.is_rep[s->lzma.state])) + lzma_rep_match(s, pos_state); + else + lzma_match(s, pos_state); + + if (!dict_repeat(&s->dict, &s->lzma.len, s->lzma.rep0)) + return false; + } + } + + /* + * Having the range decoder always normalized when we are outside + * this function makes it easier to correctly handle end of the chunk. + */ + rc_normalize(&s->rc); + + return true; +} + +/* + * Reset the LZMA decoder and range decoder state. Dictionary is not reset + * here, because LZMA state may be reset without resetting the dictionary. + */ +static void lzma_reset(struct xz_dec_lzma2 *s) +{ + uint16_t *probs; + size_t i; + + s->lzma.state = STATE_LIT_LIT; + s->lzma.rep0 = 0; + s->lzma.rep1 = 0; + s->lzma.rep2 = 0; + s->lzma.rep3 = 0; + s->lzma.len = 0; + + /* + * All probabilities are initialized to the same value. This hack + * makes the code smaller by avoiding a separate loop for each + * probability array. + * + * This could be optimized so that only that part of literal + * probabilities that are actually required. In the common case + * we would write 12 KiB less. + */ + probs = s->lzma.is_match[0]; + for (i = 0; i < PROBS_TOTAL; ++i) + probs[i] = RC_BIT_MODEL_TOTAL / 2; + + rc_reset(&s->rc); +} + +/* + * Decode and validate LZMA properties (lc/lp/pb) and calculate the bit masks + * from the decoded lp and pb values. On success, the LZMA decoder state is + * reset and true is returned. + */ +static bool lzma_props(struct xz_dec_lzma2 *s, uint8_t props) +{ + if (props > (4 * 5 + 4) * 9 + 8) + return false; + + s->lzma.pos_mask = 0; + while (props >= 9 * 5) { + props -= 9 * 5; + ++s->lzma.pos_mask; + } + + s->lzma.pos_mask = (1 << s->lzma.pos_mask) - 1; + + s->lzma.literal_pos_mask = 0; + while (props >= 9) { + props -= 9; + ++s->lzma.literal_pos_mask; + } + + s->lzma.lc = props; + + if (s->lzma.lc + s->lzma.literal_pos_mask > 4) + return false; + + s->lzma.literal_pos_mask = (1 << s->lzma.literal_pos_mask) - 1; + + lzma_reset(s); + + return true; +} + +/********* + * LZMA2 * + *********/ + +/* + * The LZMA decoder assumes that if the input limit (s->rc.in_limit) hasn't + * been exceeded, it is safe to read up to LZMA_IN_REQUIRED bytes. This + * wrapper function takes care of making the LZMA decoder's assumption safe. + * + * As long as there is plenty of input left to be decoded in the current LZMA + * chunk, we decode directly from the caller-supplied input buffer until + * there's LZMA_IN_REQUIRED bytes left. Those remaining bytes are copied into + * s->temp.buf, which (hopefully) gets filled on the next call to this + * function. We decode a few bytes from the temporary buffer so that we can + * continue decoding from the caller-supplied input buffer again. + */ +static bool lzma2_lzma(struct xz_dec_lzma2 *s, struct xz_buf *b) +{ + size_t in_avail; + uint32_t tmp; + + in_avail = b->in_size - b->in_pos; + if (s->temp.size > 0 || s->lzma2.compressed == 0) { + tmp = 2 * LZMA_IN_REQUIRED - s->temp.size; + if (tmp > s->lzma2.compressed - s->temp.size) + tmp = s->lzma2.compressed - s->temp.size; + if (tmp > in_avail) + tmp = in_avail; + + memcpy(s->temp.buf + s->temp.size, b->in + b->in_pos, tmp); + + if (s->temp.size + tmp == s->lzma2.compressed) { + memzero(s->temp.buf + s->temp.size + tmp, + sizeof(s->temp.buf) + - s->temp.size - tmp); + s->rc.in_limit = s->temp.size + tmp; + } else if (s->temp.size + tmp < LZMA_IN_REQUIRED) { + s->temp.size += tmp; + b->in_pos += tmp; + return true; + } else { + s->rc.in_limit = s->temp.size + tmp - LZMA_IN_REQUIRED; + } + + s->rc.in = s->temp.buf; + s->rc.in_pos = 0; + + if (!lzma_main(s) || s->rc.in_pos > s->temp.size + tmp) + return false; + + s->lzma2.compressed -= s->rc.in_pos; + + if (s->rc.in_pos < s->temp.size) { + s->temp.size -= s->rc.in_pos; + memmove(s->temp.buf, s->temp.buf + s->rc.in_pos, + s->temp.size); + return true; + } + + b->in_pos += s->rc.in_pos - s->temp.size; + s->temp.size = 0; + } + + in_avail = b->in_size - b->in_pos; + if (in_avail >= LZMA_IN_REQUIRED) { + s->rc.in = b->in; + s->rc.in_pos = b->in_pos; + + if (in_avail >= s->lzma2.compressed + LZMA_IN_REQUIRED) + s->rc.in_limit = b->in_pos + s->lzma2.compressed; + else + s->rc.in_limit = b->in_size - LZMA_IN_REQUIRED; + + if (!lzma_main(s)) + return false; + + in_avail = s->rc.in_pos - b->in_pos; + if (in_avail > s->lzma2.compressed) + return false; + + s->lzma2.compressed -= in_avail; + b->in_pos = s->rc.in_pos; + } + + in_avail = b->in_size - b->in_pos; + if (in_avail < LZMA_IN_REQUIRED) { + if (in_avail > s->lzma2.compressed) + in_avail = s->lzma2.compressed; + + memcpy(s->temp.buf, b->in + b->in_pos, in_avail); + s->temp.size = in_avail; + b->in_pos += in_avail; + } + + return true; +} + +/* + * Take care of the LZMA2 control layer, and forward the job of actual LZMA + * decoding or copying of uncompressed chunks to other functions. + */ +XZ_EXTERN enum xz_ret xz_dec_lzma2_run(struct xz_dec_lzma2 *s, + struct xz_buf *b) +{ + uint32_t tmp; + + while (b->in_pos < b->in_size || s->lzma2.sequence == SEQ_LZMA_RUN) { + switch (s->lzma2.sequence) { + case SEQ_CONTROL: + /* + * LZMA2 control byte + * + * Exact values: + * 0x00 End marker + * 0x01 Dictionary reset followed by + * an uncompressed chunk + * 0x02 Uncompressed chunk (no dictionary reset) + * + * Highest three bits (s->control & 0xE0): + * 0xE0 Dictionary reset, new properties and state + * reset, followed by LZMA compressed chunk + * 0xC0 New properties and state reset, followed + * by LZMA compressed chunk (no dictionary + * reset) + * 0xA0 State reset using old properties, + * followed by LZMA compressed chunk (no + * dictionary reset) + * 0x80 LZMA chunk (no dictionary or state reset) + * + * For LZMA compressed chunks, the lowest five bits + * (s->control & 1F) are the highest bits of the + * uncompressed size (bits 16-20). + * + * A new LZMA2 stream must begin with a dictionary + * reset. The first LZMA chunk must set new + * properties and reset the LZMA state. + * + * Values that don't match anything described above + * are invalid and we return XZ_DATA_ERROR. + */ + tmp = b->in[b->in_pos++]; + + if (tmp == 0x00) + return XZ_STREAM_END; + + if (tmp >= 0xE0 || tmp == 0x01) { + s->lzma2.need_props = true; + s->lzma2.need_dict_reset = false; + dict_reset(&s->dict, b); + } else if (s->lzma2.need_dict_reset) { + return XZ_DATA_ERROR; + } + + if (tmp >= 0x80) { + s->lzma2.uncompressed = (tmp & 0x1F) << 16; + s->lzma2.sequence = SEQ_UNCOMPRESSED_1; + + if (tmp >= 0xC0) { + /* + * When there are new properties, + * state reset is done at + * SEQ_PROPERTIES. + */ + s->lzma2.need_props = false; + s->lzma2.next_sequence + = SEQ_PROPERTIES; + + } else if (s->lzma2.need_props) { + return XZ_DATA_ERROR; + + } else { + s->lzma2.next_sequence + = SEQ_LZMA_PREPARE; + if (tmp >= 0xA0) + lzma_reset(s); + } + } else { + if (tmp > 0x02) + return XZ_DATA_ERROR; + + s->lzma2.sequence = SEQ_COMPRESSED_0; + s->lzma2.next_sequence = SEQ_COPY; + } + + break; + + case SEQ_UNCOMPRESSED_1: + s->lzma2.uncompressed + += (uint32_t)b->in[b->in_pos++] << 8; + s->lzma2.sequence = SEQ_UNCOMPRESSED_2; + break; + + case SEQ_UNCOMPRESSED_2: + s->lzma2.uncompressed + += (uint32_t)b->in[b->in_pos++] + 1; + s->lzma2.sequence = SEQ_COMPRESSED_0; + break; + + case SEQ_COMPRESSED_0: + s->lzma2.compressed + = (uint32_t)b->in[b->in_pos++] << 8; + s->lzma2.sequence = SEQ_COMPRESSED_1; + break; + + case SEQ_COMPRESSED_1: + s->lzma2.compressed + += (uint32_t)b->in[b->in_pos++] + 1; + s->lzma2.sequence = s->lzma2.next_sequence; + break; + + case SEQ_PROPERTIES: + if (!lzma_props(s, b->in[b->in_pos++])) + return XZ_DATA_ERROR; + + s->lzma2.sequence = SEQ_LZMA_PREPARE; + + fallthrough; + + case SEQ_LZMA_PREPARE: + if (s->lzma2.compressed < RC_INIT_BYTES) + return XZ_DATA_ERROR; + + if (!rc_read_init(&s->rc, b)) + return XZ_OK; + + s->lzma2.compressed -= RC_INIT_BYTES; + s->lzma2.sequence = SEQ_LZMA_RUN; + + fallthrough; + + case SEQ_LZMA_RUN: + /* + * Set dictionary limit to indicate how much we want + * to be encoded at maximum. Decode new data into the + * dictionary. Flush the new data from dictionary to + * b->out. Check if we finished decoding this chunk. + * In case the dictionary got full but we didn't fill + * the output buffer yet, we may run this loop + * multiple times without changing s->lzma2.sequence. + */ + dict_limit(&s->dict, min_t(size_t, + b->out_size - b->out_pos, + s->lzma2.uncompressed)); + if (!lzma2_lzma(s, b)) + return XZ_DATA_ERROR; + + s->lzma2.uncompressed -= dict_flush(&s->dict, b); + + if (s->lzma2.uncompressed == 0) { + if (s->lzma2.compressed > 0 || s->lzma.len > 0 + || !rc_is_finished(&s->rc)) + return XZ_DATA_ERROR; + + rc_reset(&s->rc); + s->lzma2.sequence = SEQ_CONTROL; + + } else if (b->out_pos == b->out_size + || (b->in_pos == b->in_size + && s->temp.size + < s->lzma2.compressed)) { + return XZ_OK; + } + + break; + + case SEQ_COPY: + dict_uncompressed(&s->dict, b, &s->lzma2.compressed); + if (s->lzma2.compressed > 0) + return XZ_OK; + + s->lzma2.sequence = SEQ_CONTROL; + break; + } + } + + return XZ_OK; +} + +XZ_EXTERN struct xz_dec_lzma2 *xz_dec_lzma2_create(enum xz_mode mode, + uint32_t dict_max) +{ + struct xz_dec_lzma2 *s = kmalloc(sizeof(*s), GFP_KERNEL); + if (s == NULL) + return NULL; + + s->dict.mode = mode; + s->dict.size_max = dict_max; + + if (DEC_IS_PREALLOC(mode)) { + s->dict.buf = vmalloc(dict_max); + if (s->dict.buf == NULL) { + kfree(s); + return NULL; + } + } else if (DEC_IS_DYNALLOC(mode)) { + s->dict.buf = NULL; + s->dict.allocated = 0; + } + + return s; +} + +XZ_EXTERN enum xz_ret xz_dec_lzma2_reset(struct xz_dec_lzma2 *s, uint8_t props) +{ + /* This limits dictionary size to 3 GiB to keep parsing simpler. */ + if (props > 39) + return XZ_OPTIONS_ERROR; + + s->dict.size = 2 + (props & 1); + s->dict.size <<= (props >> 1) + 11; + + if (DEC_IS_MULTI(s->dict.mode)) { + if (s->dict.size > s->dict.size_max) + return XZ_MEMLIMIT_ERROR; + + s->dict.end = s->dict.size; + + if (DEC_IS_DYNALLOC(s->dict.mode)) { + if (s->dict.allocated < s->dict.size) { + s->dict.allocated = s->dict.size; + vfree(s->dict.buf); + s->dict.buf = vmalloc(s->dict.size); + if (s->dict.buf == NULL) { + s->dict.allocated = 0; + return XZ_MEM_ERROR; + } + } + } + } + + s->lzma2.sequence = SEQ_CONTROL; + s->lzma2.need_dict_reset = true; + + s->temp.size = 0; + + return XZ_OK; +} + +XZ_EXTERN void xz_dec_lzma2_end(struct xz_dec_lzma2 *s) +{ + if (DEC_IS_MULTI(s->dict.mode)) + vfree(s->dict.buf); + + kfree(s); +} + +#ifdef XZ_DEC_MICROLZMA +/* This is a wrapper struct to have a nice struct name in the public API. */ +struct xz_dec_microlzma { + struct xz_dec_lzma2 s; +}; + +XZ_EXTERN enum xz_ret xz_dec_microlzma_run(struct xz_dec_microlzma *s_ptr, + struct xz_buf *b) +{ + struct xz_dec_lzma2 *s = &s_ptr->s; + + /* + * sequence is SEQ_PROPERTIES before the first input byte, + * SEQ_LZMA_PREPARE until a total of five bytes have been read, + * and SEQ_LZMA_RUN for the rest of the input stream. + */ + if (s->lzma2.sequence != SEQ_LZMA_RUN) { + if (s->lzma2.sequence == SEQ_PROPERTIES) { + /* One byte is needed for the props. */ + if (b->in_pos >= b->in_size) + return XZ_OK; + + /* + * Don't increment b->in_pos here. The same byte is + * also passed to rc_read_init() which will ignore it. + */ + if (!lzma_props(s, ~b->in[b->in_pos])) + return XZ_DATA_ERROR; + + s->lzma2.sequence = SEQ_LZMA_PREPARE; + } + + /* + * xz_dec_microlzma_reset() doesn't validate the compressed + * size so we do it here. We have to limit the maximum size + * to avoid integer overflows in lzma2_lzma(). 3 GiB is a nice + * round number and much more than users of this code should + * ever need. + */ + if (s->lzma2.compressed < RC_INIT_BYTES + || s->lzma2.compressed > (3U << 30)) + return XZ_DATA_ERROR; + + if (!rc_read_init(&s->rc, b)) + return XZ_OK; + + s->lzma2.compressed -= RC_INIT_BYTES; + s->lzma2.sequence = SEQ_LZMA_RUN; + + dict_reset(&s->dict, b); + } + + /* This is to allow increasing b->out_size between calls. */ + if (DEC_IS_SINGLE(s->dict.mode)) + s->dict.end = b->out_size - b->out_pos; + + while (true) { + dict_limit(&s->dict, min_t(size_t, b->out_size - b->out_pos, + s->lzma2.uncompressed)); + + if (!lzma2_lzma(s, b)) + return XZ_DATA_ERROR; + + s->lzma2.uncompressed -= dict_flush(&s->dict, b); + + if (s->lzma2.uncompressed == 0) { + if (s->lzma2.pedantic_microlzma) { + if (s->lzma2.compressed > 0 || s->lzma.len > 0 + || !rc_is_finished(&s->rc)) + return XZ_DATA_ERROR; + } + + return XZ_STREAM_END; + } + + if (b->out_pos == b->out_size) + return XZ_OK; + + if (b->in_pos == b->in_size + && s->temp.size < s->lzma2.compressed) + return XZ_OK; + } +} + +XZ_EXTERN struct xz_dec_microlzma *xz_dec_microlzma_alloc(enum xz_mode mode, + uint32_t dict_size) +{ + struct xz_dec_microlzma *s; + + /* Restrict dict_size to the same range as in the LZMA2 code. */ + if (dict_size < 4096 || dict_size > (3U << 30)) + return NULL; + + s = kmalloc(sizeof(*s), GFP_KERNEL); + if (s == NULL) + return NULL; + + s->s.dict.mode = mode; + s->s.dict.size = dict_size; + + if (DEC_IS_MULTI(mode)) { + s->s.dict.end = dict_size; + + s->s.dict.buf = vmalloc(dict_size); + if (s->s.dict.buf == NULL) { + kfree(s); + return NULL; + } + } + + return s; +} + +XZ_EXTERN void xz_dec_microlzma_reset(struct xz_dec_microlzma *s, + uint32_t comp_size, + uint32_t uncomp_size, + int uncomp_size_is_exact) +{ + /* + * comp_size is validated in xz_dec_microlzma_run(). + * uncomp_size can safely be anything. + */ + s->s.lzma2.compressed = comp_size; + s->s.lzma2.uncompressed = uncomp_size; + s->s.lzma2.pedantic_microlzma = uncomp_size_is_exact; + + s->s.lzma2.sequence = SEQ_PROPERTIES; + s->s.temp.size = 0; +} + +XZ_EXTERN void xz_dec_microlzma_end(struct xz_dec_microlzma *s) +{ + if (DEC_IS_MULTI(s->s.dict.mode)) + vfree(s->s.dict.buf); + + kfree(s); +} +#endif diff --git a/android/app/src/main/cpp/xz/xz_dec_stream.c b/android/app/src/main/cpp/xz/xz_dec_stream.c new file mode 100644 index 0000000..33927e8 --- /dev/null +++ b/android/app/src/main/cpp/xz/xz_dec_stream.c @@ -0,0 +1,984 @@ +// SPDX-License-Identifier: 0BSD + +/* + * .xz Stream decoder + * + * Author: Lasse Collin + */ + +#include "xz_private.h" +#include "xz_stream.h" + +#ifdef XZ_USE_CRC64 +# define IS_CRC64(check_type) ((check_type) == XZ_CHECK_CRC64) +#else +# define IS_CRC64(check_type) false +#endif + +#ifdef XZ_USE_SHA256 +# define IS_SHA256(check_type) ((check_type) == XZ_CHECK_SHA256) +#else +# define IS_SHA256(check_type) false +#endif + +/* Hash used to validate the Index field */ +struct xz_dec_hash { + vli_type unpadded; + vli_type uncompressed; + uint32_t crc32; +}; + +struct xz_dec { + /* Position in dec_main() */ + enum { + SEQ_STREAM_HEADER, + SEQ_BLOCK_START, + SEQ_BLOCK_HEADER, + SEQ_BLOCK_UNCOMPRESS, + SEQ_BLOCK_PADDING, + SEQ_BLOCK_CHECK, + SEQ_INDEX, + SEQ_INDEX_PADDING, + SEQ_INDEX_CRC32, + SEQ_STREAM_FOOTER, + SEQ_STREAM_PADDING + } sequence; + + /* Position in variable-length integers and Check fields */ + uint32_t pos; + + /* Variable-length integer decoded by dec_vli() */ + vli_type vli; + + /* Saved in_pos and out_pos */ + size_t in_start; + size_t out_start; + +#ifdef XZ_USE_CRC64 + /* CRC32 or CRC64 value in Block or CRC32 value in Index */ + uint64_t crc; +#else + /* CRC32 value in Block or Index */ + uint32_t crc; +#endif + + /* Type of the integrity check calculated from uncompressed data */ + enum xz_check check_type; + + /* Operation mode */ + enum xz_mode mode; + + /* + * True if the next call to xz_dec_run() is allowed to return + * XZ_BUF_ERROR. + */ + bool allow_buf_error; + + /* Information stored in Block Header */ + struct { + /* + * Value stored in the Compressed Size field, or + * VLI_UNKNOWN if Compressed Size is not present. + */ + vli_type compressed; + + /* + * Value stored in the Uncompressed Size field, or + * VLI_UNKNOWN if Uncompressed Size is not present. + */ + vli_type uncompressed; + + /* Size of the Block Header field */ + uint32_t size; + } block_header; + + /* Information collected when decoding Blocks */ + struct { + /* Observed compressed size of the current Block */ + vli_type compressed; + + /* Observed uncompressed size of the current Block */ + vli_type uncompressed; + + /* Number of Blocks decoded so far */ + vli_type count; + + /* + * Hash calculated from the Block sizes. This is used to + * validate the Index field. + */ + struct xz_dec_hash hash; + } block; + + /* Variables needed when verifying the Index field */ + struct { + /* Position in dec_index() */ + enum { + SEQ_INDEX_COUNT, + SEQ_INDEX_UNPADDED, + SEQ_INDEX_UNCOMPRESSED + } sequence; + + /* Size of the Index in bytes */ + vli_type size; + + /* Number of Records (matches block.count in valid files) */ + vli_type count; + + /* + * Hash calculated from the Records (matches block.hash in + * valid files). + */ + struct xz_dec_hash hash; + } index; + + /* + * Temporary buffer needed to hold Stream Header, Block Header, + * and Stream Footer. The Block Header is the biggest (1 KiB) + * so we reserve space according to that. buf[] has to be aligned + * to a multiple of four bytes; the size_t variables before it + * should guarantee this. + */ + struct { + size_t pos; + size_t size; + uint8_t buf[1024]; + } temp; + + struct xz_dec_lzma2 *lzma2; + +#ifdef XZ_DEC_BCJ + struct xz_dec_bcj *bcj; + bool bcj_active; +#endif + +#ifdef XZ_USE_SHA256 + /* + * SHA-256 value in Block + * + * struct xz_sha256 is over a hundred bytes and it's only accessed + * from a few places. By putting the SHA-256 state near the end + * of struct xz_dec (somewhere after the "index" member) reduces + * code size at least on x86 and RISC-V. It's because the first bytes + * of the struct can be accessed with smaller instructions; the + * members that are accessed from many places should be at the top. + */ + struct xz_sha256 sha256; +#endif +}; + +#if defined(XZ_DEC_ANY_CHECK) || defined(XZ_USE_SHA256) +/* Sizes of the Check field with different Check IDs */ +static const uint8_t check_sizes[16] = { + 0, + 4, 4, 4, + 8, 8, 8, + 16, 16, 16, + 32, 32, 32, + 64, 64, 64 +}; +#endif + +/* + * Fill s->temp by copying data starting from b->in[b->in_pos]. Caller + * must have set s->temp.pos and s->temp.size to indicate how much data + * we are supposed to copy into s->temp.buf. Return true once s->temp.pos + * has reached s->temp.size. + */ +static bool fill_temp(struct xz_dec *s, struct xz_buf *b) +{ + size_t copy_size = min_t(size_t, + b->in_size - b->in_pos, s->temp.size - s->temp.pos); + + memcpy(s->temp.buf + s->temp.pos, b->in + b->in_pos, copy_size); + b->in_pos += copy_size; + s->temp.pos += copy_size; + + if (s->temp.pos == s->temp.size) { + s->temp.pos = 0; + return true; + } + + return false; +} + +/* Decode a variable-length integer (little-endian base-128 encoding) */ +static enum xz_ret dec_vli(struct xz_dec *s, const uint8_t *in, + size_t *in_pos, size_t in_size) +{ + uint8_t byte; + + if (s->pos == 0) + s->vli = 0; + + while (*in_pos < in_size) { + byte = in[*in_pos]; + ++*in_pos; + + s->vli |= (vli_type)(byte & 0x7F) << s->pos; + + if ((byte & 0x80) == 0) { + /* Don't allow non-minimal encodings. */ + if (byte == 0 && s->pos != 0) + return XZ_DATA_ERROR; + + s->pos = 0; + return XZ_STREAM_END; + } + + s->pos += 7; + if (s->pos == 7 * VLI_BYTES_MAX) + return XZ_DATA_ERROR; + } + + return XZ_OK; +} + +/* + * Decode the Compressed Data field from a Block. Update and validate + * the observed compressed and uncompressed sizes of the Block so that + * they don't exceed the values possibly stored in the Block Header + * (validation assumes that no integer overflow occurs, since vli_type + * is normally uint64_t). Update the CRC32 or CRC64 value if presence of + * the CRC32 or CRC64 field was indicated in Stream Header. + * + * Once the decoding is finished, validate that the observed sizes match + * the sizes possibly stored in the Block Header. Update the hash and + * Block count, which are later used to validate the Index field. + */ +static enum xz_ret dec_block(struct xz_dec *s, struct xz_buf *b) +{ + enum xz_ret ret; + + s->in_start = b->in_pos; + s->out_start = b->out_pos; + +#ifdef XZ_DEC_BCJ + if (s->bcj_active) + ret = xz_dec_bcj_run(s->bcj, s->lzma2, b); + else +#endif + ret = xz_dec_lzma2_run(s->lzma2, b); + + s->block.compressed += b->in_pos - s->in_start; + s->block.uncompressed += b->out_pos - s->out_start; + + /* + * There is no need to separately check for VLI_UNKNOWN, since + * the observed sizes are always smaller than VLI_UNKNOWN. + */ + if (s->block.compressed > s->block_header.compressed + || s->block.uncompressed + > s->block_header.uncompressed) + return XZ_DATA_ERROR; + + if (s->check_type == XZ_CHECK_CRC32) + s->crc = xz_crc32(b->out + s->out_start, + b->out_pos - s->out_start, s->crc); +#ifdef XZ_USE_CRC64 + else if (s->check_type == XZ_CHECK_CRC64) + s->crc = xz_crc64(b->out + s->out_start, + b->out_pos - s->out_start, s->crc); +#endif +#ifdef XZ_USE_SHA256 + else if (s->check_type == XZ_CHECK_SHA256) + xz_sha256_update(b->out + s->out_start, + b->out_pos - s->out_start, &s->sha256); +#endif + + if (ret == XZ_STREAM_END) { + if (s->block_header.compressed != VLI_UNKNOWN + && s->block_header.compressed + != s->block.compressed) + return XZ_DATA_ERROR; + + if (s->block_header.uncompressed != VLI_UNKNOWN + && s->block_header.uncompressed + != s->block.uncompressed) + return XZ_DATA_ERROR; + + s->block.hash.unpadded += s->block_header.size + + s->block.compressed; + +#if defined(XZ_DEC_ANY_CHECK) || defined(XZ_USE_SHA256) + s->block.hash.unpadded += check_sizes[s->check_type]; +#else + if (s->check_type == XZ_CHECK_CRC32) + s->block.hash.unpadded += 4; + else if (IS_CRC64(s->check_type)) + s->block.hash.unpadded += 8; +#endif + + s->block.hash.uncompressed += s->block.uncompressed; + s->block.hash.crc32 = xz_crc32( + (const uint8_t *)&s->block.hash, + sizeof(s->block.hash), s->block.hash.crc32); + + ++s->block.count; + } + + return ret; +} + +/* Update the Index size and the CRC32 value. */ +static void index_update(struct xz_dec *s, const struct xz_buf *b) +{ + size_t in_used = b->in_pos - s->in_start; + s->index.size += in_used; + s->crc = xz_crc32(b->in + s->in_start, in_used, s->crc); +} + +/* + * Decode the Number of Records, Unpadded Size, and Uncompressed Size + * fields from the Index field. That is, Index Padding and CRC32 are not + * decoded by this function. + * + * This can return XZ_OK (more input needed), XZ_STREAM_END (everything + * successfully decoded), or XZ_DATA_ERROR (input is corrupt). + */ +static enum xz_ret dec_index(struct xz_dec *s, struct xz_buf *b) +{ + enum xz_ret ret; + + do { + ret = dec_vli(s, b->in, &b->in_pos, b->in_size); + if (ret != XZ_STREAM_END) { + index_update(s, b); + return ret; + } + + switch (s->index.sequence) { + case SEQ_INDEX_COUNT: + s->index.count = s->vli; + + /* + * Validate that the Number of Records field + * indicates the same number of Records as + * there were Blocks in the Stream. + */ + if (s->index.count != s->block.count) + return XZ_DATA_ERROR; + + s->index.sequence = SEQ_INDEX_UNPADDED; + break; + + case SEQ_INDEX_UNPADDED: + s->index.hash.unpadded += s->vli; + s->index.sequence = SEQ_INDEX_UNCOMPRESSED; + break; + + case SEQ_INDEX_UNCOMPRESSED: + s->index.hash.uncompressed += s->vli; + s->index.hash.crc32 = xz_crc32( + (const uint8_t *)&s->index.hash, + sizeof(s->index.hash), + s->index.hash.crc32); + --s->index.count; + s->index.sequence = SEQ_INDEX_UNPADDED; + break; + } + } while (s->index.count > 0); + + return XZ_STREAM_END; +} + +/* + * Validate that the next four or eight input bytes match the value + * of s->crc. s->pos must be zero when starting to validate the first byte. + * The "bits" argument allows using the same code for both CRC32 and CRC64. + */ +static enum xz_ret crc_validate(struct xz_dec *s, struct xz_buf *b, + uint32_t bits) +{ + do { + if (b->in_pos == b->in_size) + return XZ_OK; + + if (((s->crc >> s->pos) & 0xFF) != b->in[b->in_pos++]) + return XZ_DATA_ERROR; + + s->pos += 8; + + } while (s->pos < bits); + + s->crc = 0; + s->pos = 0; + + return XZ_STREAM_END; +} + +#ifdef XZ_DEC_ANY_CHECK +/* + * Skip over the Check field when the Check ID is not supported. + * Returns true once the whole Check field has been skipped over. + */ +static bool check_skip(struct xz_dec *s, struct xz_buf *b) +{ + while (s->pos < check_sizes[s->check_type]) { + if (b->in_pos == b->in_size) + return false; + + ++b->in_pos; + ++s->pos; + } + + s->pos = 0; + + return true; +} +#endif + +/* Decode the Stream Header field (the first 12 bytes of the .xz Stream). */ +static enum xz_ret dec_stream_header(struct xz_dec *s) +{ + if (!memeq(s->temp.buf, HEADER_MAGIC, HEADER_MAGIC_SIZE)) + return XZ_FORMAT_ERROR; + + if (xz_crc32(s->temp.buf + HEADER_MAGIC_SIZE, 2, 0) + != get_le32(s->temp.buf + HEADER_MAGIC_SIZE + 2)) + return XZ_DATA_ERROR; + + if (s->temp.buf[HEADER_MAGIC_SIZE] != 0) + return XZ_OPTIONS_ERROR; + + /* + * Of integrity checks, we support none (Check ID = 0), + * CRC32 (Check ID = 1), and optionally CRC64 (Check ID = 4). + * However, if XZ_DEC_ANY_CHECK is defined, we will accept other + * check types too, but then the check won't be verified and + * a warning (XZ_UNSUPPORTED_CHECK) will be given. + */ + if (s->temp.buf[HEADER_MAGIC_SIZE + 1] > XZ_CHECK_MAX) + return XZ_OPTIONS_ERROR; + + s->check_type = s->temp.buf[HEADER_MAGIC_SIZE + 1]; + + if (s->check_type > XZ_CHECK_CRC32 && !IS_CRC64(s->check_type) + && !IS_SHA256(s->check_type)) { +#ifdef XZ_DEC_ANY_CHECK + return XZ_UNSUPPORTED_CHECK; +#else + return XZ_OPTIONS_ERROR; +#endif + } + + return XZ_OK; +} + +/* Decode the Stream Footer field (the last 12 bytes of the .xz Stream) */ +static enum xz_ret dec_stream_footer(struct xz_dec *s) +{ + if (!memeq(s->temp.buf + 10, FOOTER_MAGIC, FOOTER_MAGIC_SIZE)) + return XZ_DATA_ERROR; + + if (xz_crc32(s->temp.buf + 4, 6, 0) != get_le32(s->temp.buf)) + return XZ_DATA_ERROR; + + /* + * Validate Backward Size. Note that we never added the size of the + * Index CRC32 field to s->index.size, thus we use s->index.size / 4 + * instead of s->index.size / 4 - 1. + */ + if ((s->index.size >> 2) != get_le32(s->temp.buf + 4)) + return XZ_DATA_ERROR; + + if (s->temp.buf[8] != 0 || s->temp.buf[9] != s->check_type) + return XZ_DATA_ERROR; + + /* + * Use XZ_STREAM_END instead of XZ_OK to be more convenient + * for the caller. + */ + return XZ_STREAM_END; +} + +/* Decode the Block Header and initialize the filter chain. */ +static enum xz_ret dec_block_header(struct xz_dec *s) +{ + enum xz_ret ret; + + /* + * Validate the CRC32. We know that the temp buffer is at least + * eight bytes so this is safe. + */ + s->temp.size -= 4; + if (xz_crc32(s->temp.buf, s->temp.size, 0) + != get_le32(s->temp.buf + s->temp.size)) + return XZ_DATA_ERROR; + + s->temp.pos = 2; + + /* + * Catch unsupported Block Flags. We support only one or two filters + * in the chain, so we catch that with the same test. + */ +#ifdef XZ_DEC_BCJ + if (s->temp.buf[1] & 0x3E) +#else + if (s->temp.buf[1] & 0x3F) +#endif + return XZ_OPTIONS_ERROR; + + /* Compressed Size */ + if (s->temp.buf[1] & 0x40) { + if (dec_vli(s, s->temp.buf, &s->temp.pos, s->temp.size) + != XZ_STREAM_END) + return XZ_DATA_ERROR; + + s->block_header.compressed = s->vli; + } else { + s->block_header.compressed = VLI_UNKNOWN; + } + + /* Uncompressed Size */ + if (s->temp.buf[1] & 0x80) { + if (dec_vli(s, s->temp.buf, &s->temp.pos, s->temp.size) + != XZ_STREAM_END) + return XZ_DATA_ERROR; + + s->block_header.uncompressed = s->vli; + } else { + s->block_header.uncompressed = VLI_UNKNOWN; + } + +#ifdef XZ_DEC_BCJ + /* If there are two filters, the first one must be a BCJ filter. */ + s->bcj_active = s->temp.buf[1] & 0x01; + if (s->bcj_active) { + if (s->temp.size - s->temp.pos < 2) + return XZ_OPTIONS_ERROR; + + ret = xz_dec_bcj_reset(s->bcj, s->temp.buf[s->temp.pos++]); + if (ret != XZ_OK) + return ret; + + /* + * We don't support custom start offset, + * so Size of Properties must be zero. + */ + if (s->temp.buf[s->temp.pos++] != 0x00) + return XZ_OPTIONS_ERROR; + } +#endif + + /* Valid Filter Flags always take at least two bytes. */ + if (s->temp.size - s->temp.pos < 2) + return XZ_DATA_ERROR; + + /* Filter ID = LZMA2 */ + if (s->temp.buf[s->temp.pos++] != 0x21) + return XZ_OPTIONS_ERROR; + + /* Size of Properties = 1-byte Filter Properties */ + if (s->temp.buf[s->temp.pos++] != 0x01) + return XZ_OPTIONS_ERROR; + + /* Filter Properties contains LZMA2 dictionary size. */ + if (s->temp.size - s->temp.pos < 1) + return XZ_DATA_ERROR; + + ret = xz_dec_lzma2_reset(s->lzma2, s->temp.buf[s->temp.pos++]); + if (ret != XZ_OK) + return ret; + + /* The rest must be Header Padding. */ + while (s->temp.pos < s->temp.size) + if (s->temp.buf[s->temp.pos++] != 0x00) + return XZ_OPTIONS_ERROR; + + s->temp.pos = 0; + s->block.compressed = 0; + s->block.uncompressed = 0; + + return XZ_OK; +} + +static enum xz_ret dec_main(struct xz_dec *s, struct xz_buf *b) +{ + enum xz_ret ret; + + /* + * Store the start position for the case when we are in the middle + * of the Index field. + */ + s->in_start = b->in_pos; + + while (true) { + switch (s->sequence) { + case SEQ_STREAM_HEADER: + /* + * Stream Header is copied to s->temp, and then + * decoded from there. This way if the caller + * gives us only little input at a time, we can + * still keep the Stream Header decoding code + * simple. Similar approach is used in many places + * in this file. + */ + if (!fill_temp(s, b)) + return XZ_OK; + + /* + * If dec_stream_header() returns + * XZ_UNSUPPORTED_CHECK, it is still possible + * to continue decoding if working in multi-call + * mode. Thus, update s->sequence before calling + * dec_stream_header(). + */ + s->sequence = SEQ_BLOCK_START; + + ret = dec_stream_header(s); + if (ret != XZ_OK) + return ret; + + fallthrough; + + case SEQ_BLOCK_START: + /* We need one byte of input to continue. */ + if (b->in_pos == b->in_size) + return XZ_OK; + + /* See if this is the beginning of the Index field. */ + if (b->in[b->in_pos] == 0) { + s->in_start = b->in_pos++; + s->sequence = SEQ_INDEX; + break; + } + + /* + * Calculate the size of the Block Header and + * prepare to decode it. + */ + s->block_header.size + = ((uint32_t)b->in[b->in_pos] + 1) * 4; + + s->temp.size = s->block_header.size; + s->temp.pos = 0; + s->sequence = SEQ_BLOCK_HEADER; + + fallthrough; + + case SEQ_BLOCK_HEADER: + if (!fill_temp(s, b)) + return XZ_OK; + + ret = dec_block_header(s); + if (ret != XZ_OK) + return ret; + +#ifdef XZ_USE_SHA256 + if (s->check_type == XZ_CHECK_SHA256) + xz_sha256_reset(&s->sha256); +#endif + + s->sequence = SEQ_BLOCK_UNCOMPRESS; + + fallthrough; + + case SEQ_BLOCK_UNCOMPRESS: + ret = dec_block(s, b); + if (ret != XZ_STREAM_END) + return ret; + + s->sequence = SEQ_BLOCK_PADDING; + + fallthrough; + + case SEQ_BLOCK_PADDING: + /* + * Size of Compressed Data + Block Padding + * must be a multiple of four. We don't need + * s->block.compressed for anything else + * anymore, so we use it here to test the size + * of the Block Padding field. + */ + while (s->block.compressed & 3) { + if (b->in_pos == b->in_size) + return XZ_OK; + + if (b->in[b->in_pos++] != 0) + return XZ_DATA_ERROR; + + ++s->block.compressed; + } + + s->sequence = SEQ_BLOCK_CHECK; + + fallthrough; + + case SEQ_BLOCK_CHECK: + if (s->check_type == XZ_CHECK_CRC32) { + ret = crc_validate(s, b, 32); + if (ret != XZ_STREAM_END) + return ret; + } + else if (IS_CRC64(s->check_type)) { + ret = crc_validate(s, b, 64); + if (ret != XZ_STREAM_END) + return ret; + } +#ifdef XZ_USE_SHA256 + else if (s->check_type == XZ_CHECK_SHA256) { + s->temp.size = 32; + if (!fill_temp(s, b)) + return XZ_OK; + + if (!xz_sha256_validate(s->temp.buf, + &s->sha256)) + return XZ_DATA_ERROR; + + s->pos = 0; + } +#endif +#ifdef XZ_DEC_ANY_CHECK + else if (!check_skip(s, b)) { + return XZ_OK; + } +#endif + + s->sequence = SEQ_BLOCK_START; + break; + + case SEQ_INDEX: + ret = dec_index(s, b); + if (ret != XZ_STREAM_END) + return ret; + + s->sequence = SEQ_INDEX_PADDING; + + fallthrough; + + case SEQ_INDEX_PADDING: + while ((s->index.size + (b->in_pos - s->in_start)) + & 3) { + if (b->in_pos == b->in_size) { + index_update(s, b); + return XZ_OK; + } + + if (b->in[b->in_pos++] != 0) + return XZ_DATA_ERROR; + } + + /* Finish the CRC32 value and Index size. */ + index_update(s, b); + + /* Compare the hashes to validate the Index field. */ + if (!memeq(&s->block.hash, &s->index.hash, + sizeof(s->block.hash))) + return XZ_DATA_ERROR; + + s->sequence = SEQ_INDEX_CRC32; + + fallthrough; + + case SEQ_INDEX_CRC32: + ret = crc_validate(s, b, 32); + if (ret != XZ_STREAM_END) + return ret; + + s->temp.size = STREAM_HEADER_SIZE; + s->sequence = SEQ_STREAM_FOOTER; + + fallthrough; + + case SEQ_STREAM_FOOTER: + if (!fill_temp(s, b)) + return XZ_OK; + + return dec_stream_footer(s); + + case SEQ_STREAM_PADDING: + /* Never reached, only silencing a warning */ + break; + } + } + + /* Never reached */ +} + +/* + * xz_dec_run() is a wrapper for dec_main() to handle some special cases in + * multi-call and single-call decoding. + * + * In multi-call mode, we must return XZ_BUF_ERROR when it seems clear that we + * are not going to make any progress anymore. This is to prevent the caller + * from calling us infinitely when the input file is truncated or otherwise + * corrupt. Since zlib-style API allows that the caller fills the input buffer + * only when the decoder doesn't produce any new output, we have to be careful + * to avoid returning XZ_BUF_ERROR too easily: XZ_BUF_ERROR is returned only + * after the second consecutive call to xz_dec_run() that makes no progress. + * + * In single-call mode, if we couldn't decode everything and no error + * occurred, either the input is truncated or the output buffer is too small. + * Since we know that the last input byte never produces any output, we know + * that if all the input was consumed and decoding wasn't finished, the file + * must be corrupt. Otherwise the output buffer has to be too small or the + * file is corrupt in a way that decoding it produces too big output. + * + * If single-call decoding fails, we reset b->in_pos and b->out_pos back to + * their original values. This is because with some filter chains there won't + * be any valid uncompressed data in the output buffer unless the decoding + * actually succeeds (that's the price to pay of using the output buffer as + * the workspace). + */ +XZ_EXTERN enum xz_ret xz_dec_run(struct xz_dec *s, struct xz_buf *b) +{ + size_t in_start; + size_t out_start; + enum xz_ret ret; + + if (DEC_IS_SINGLE(s->mode)) + xz_dec_reset(s); + + in_start = b->in_pos; + out_start = b->out_pos; + ret = dec_main(s, b); + + if (DEC_IS_SINGLE(s->mode)) { + if (ret == XZ_OK) + ret = b->in_pos == b->in_size + ? XZ_DATA_ERROR : XZ_BUF_ERROR; + + if (ret != XZ_STREAM_END) { + b->in_pos = in_start; + b->out_pos = out_start; + } + + } else if (ret == XZ_OK && in_start == b->in_pos + && out_start == b->out_pos) { + if (s->allow_buf_error) + ret = XZ_BUF_ERROR; + + s->allow_buf_error = true; + } else { + s->allow_buf_error = false; + } + + return ret; +} + +#ifdef XZ_DEC_CONCATENATED +XZ_EXTERN enum xz_ret xz_dec_catrun(struct xz_dec *s, struct xz_buf *b, + int finish) +{ + enum xz_ret ret; + + if (DEC_IS_SINGLE(s->mode)) { + xz_dec_reset(s); + finish = true; + } + + while (true) { + if (s->sequence == SEQ_STREAM_PADDING) { + /* + * Skip Stream Padding. Its size must be a multiple + * of four bytes which is tracked with s->pos. + */ + while (true) { + if (b->in_pos == b->in_size) { + /* + * Note that if we are repeatedly + * given no input and finish is false, + * we will keep returning XZ_OK even + * though no progress is being made. + * The lack of XZ_BUF_ERROR support + * isn't a problem here because a + * reasonable caller will eventually + * provide more input or set finish + * to true. + */ + if (!finish) + return XZ_OK; + + if (s->pos != 0) + return XZ_DATA_ERROR; + + return XZ_STREAM_END; + } + + if (b->in[b->in_pos] != 0x00) { + if (s->pos != 0) + return XZ_DATA_ERROR; + + break; + } + + ++b->in_pos; + s->pos = (s->pos + 1) & 3; + } + + /* + * More input remains. It should be a new Stream. + * + * In single-call mode xz_dec_run() will always call + * xz_dec_reset(). Thus, we need to do it here only + * in multi-call mode. + */ + if (DEC_IS_MULTI(s->mode)) + xz_dec_reset(s); + } + + ret = xz_dec_run(s, b); + + if (ret != XZ_STREAM_END) + break; + + s->sequence = SEQ_STREAM_PADDING; + } + + return ret; +} +#endif + +XZ_EXTERN struct xz_dec *xz_dec_init(enum xz_mode mode, uint32_t dict_max) +{ + struct xz_dec *s = kmalloc(sizeof(*s), GFP_KERNEL); + if (s == NULL) + return NULL; + + s->mode = mode; + +#ifdef XZ_DEC_BCJ + s->bcj = xz_dec_bcj_create(DEC_IS_SINGLE(mode)); + if (s->bcj == NULL) + goto error_bcj; +#endif + + s->lzma2 = xz_dec_lzma2_create(mode, dict_max); + if (s->lzma2 == NULL) + goto error_lzma2; + + xz_dec_reset(s); + return s; + +error_lzma2: +#ifdef XZ_DEC_BCJ + xz_dec_bcj_end(s->bcj); +error_bcj: +#endif + kfree(s); + return NULL; +} + +XZ_EXTERN void xz_dec_reset(struct xz_dec *s) +{ + s->sequence = SEQ_STREAM_HEADER; + s->allow_buf_error = false; + s->pos = 0; + s->crc = 0; + memzero(&s->block, sizeof(s->block)); + memzero(&s->index, sizeof(s->index)); + s->temp.pos = 0; + s->temp.size = STREAM_HEADER_SIZE; +} + +XZ_EXTERN void xz_dec_end(struct xz_dec *s) +{ + if (s != NULL) { + xz_dec_lzma2_end(s->lzma2); +#ifdef XZ_DEC_BCJ + xz_dec_bcj_end(s->bcj); +#endif + kfree(s); + } +} diff --git a/android/app/src/main/cpp/xz/xz_lzma2.h b/android/app/src/main/cpp/xz/xz_lzma2.h new file mode 100644 index 0000000..d2632b7 --- /dev/null +++ b/android/app/src/main/cpp/xz/xz_lzma2.h @@ -0,0 +1,203 @@ +/* SPDX-License-Identifier: 0BSD */ + +/* + * LZMA2 definitions + * + * Authors: Lasse Collin + * Igor Pavlov + */ + +#ifndef XZ_LZMA2_H +#define XZ_LZMA2_H + +/* Range coder constants */ +#define RC_SHIFT_BITS 8 +#define RC_TOP_BITS 24 +#define RC_TOP_VALUE (1 << RC_TOP_BITS) +#define RC_BIT_MODEL_TOTAL_BITS 11 +#define RC_BIT_MODEL_TOTAL (1 << RC_BIT_MODEL_TOTAL_BITS) +#define RC_MOVE_BITS 5 + +/* + * Maximum number of position states. A position state is the lowest pb + * number of bits of the current uncompressed offset. In some places there + * are different sets of probabilities for different position states. + */ +#define POS_STATES_MAX (1 << 4) + +/* + * This enum is used to track which LZMA symbols have occurred most recently + * and in which order. This information is used to predict the next symbol. + * + * Symbols: + * - Literal: One 8-bit byte + * - Match: Repeat a chunk of data at some distance + * - Long repeat: Multi-byte match at a recently seen distance + * - Short repeat: One-byte repeat at a recently seen distance + * + * The symbol names are in from STATE_oldest_older_previous. REP means + * either short or long repeated match, and NONLIT means any non-literal. + */ +enum lzma_state { + STATE_LIT_LIT, + STATE_MATCH_LIT_LIT, + STATE_REP_LIT_LIT, + STATE_SHORTREP_LIT_LIT, + STATE_MATCH_LIT, + STATE_REP_LIT, + STATE_SHORTREP_LIT, + STATE_LIT_MATCH, + STATE_LIT_LONGREP, + STATE_LIT_SHORTREP, + STATE_NONLIT_MATCH, + STATE_NONLIT_REP +}; + +/* Total number of states */ +#define STATES 12 + +/* The lowest 7 states indicate that the previous state was a literal. */ +#define LIT_STATES 7 + +/* Indicate that the latest symbol was a literal. */ +static inline void lzma_state_literal(enum lzma_state *state) +{ + if (*state <= STATE_SHORTREP_LIT_LIT) + *state = STATE_LIT_LIT; + else if (*state <= STATE_LIT_SHORTREP) + *state -= 3; + else + *state -= 6; +} + +/* Indicate that the latest symbol was a match. */ +static inline void lzma_state_match(enum lzma_state *state) +{ + *state = *state < LIT_STATES ? STATE_LIT_MATCH : STATE_NONLIT_MATCH; +} + +/* Indicate that the latest state was a long repeated match. */ +static inline void lzma_state_long_rep(enum lzma_state *state) +{ + *state = *state < LIT_STATES ? STATE_LIT_LONGREP : STATE_NONLIT_REP; +} + +/* Indicate that the latest symbol was a short match. */ +static inline void lzma_state_short_rep(enum lzma_state *state) +{ + *state = *state < LIT_STATES ? STATE_LIT_SHORTREP : STATE_NONLIT_REP; +} + +/* Test if the previous symbol was a literal. */ +static inline bool lzma_state_is_literal(enum lzma_state state) +{ + return state < LIT_STATES; +} + +/* Each literal coder is divided in three sections: + * - 0x001-0x0FF: Without match byte + * - 0x101-0x1FF: With match byte; match bit is 0 + * - 0x201-0x2FF: With match byte; match bit is 1 + * + * Match byte is used when the previous LZMA symbol was something else than + * a literal (that is, it was some kind of match). + */ +#define LITERAL_CODER_SIZE 0x300 + +/* Maximum number of literal coders */ +#define LITERAL_CODERS_MAX (1 << 4) + +/* Minimum length of a match is two bytes. */ +#define MATCH_LEN_MIN 2 + +/* Match length is encoded with 4, 5, or 10 bits. + * + * Length Bits + * 2-9 4 = Choice=0 + 3 bits + * 10-17 5 = Choice=1 + Choice2=0 + 3 bits + * 18-273 10 = Choice=1 + Choice2=1 + 8 bits + */ +#define LEN_LOW_BITS 3 +#define LEN_LOW_SYMBOLS (1 << LEN_LOW_BITS) +#define LEN_MID_BITS 3 +#define LEN_MID_SYMBOLS (1 << LEN_MID_BITS) +#define LEN_HIGH_BITS 8 +#define LEN_HIGH_SYMBOLS (1 << LEN_HIGH_BITS) +#define LEN_SYMBOLS (LEN_LOW_SYMBOLS + LEN_MID_SYMBOLS + LEN_HIGH_SYMBOLS) + +/* + * Maximum length of a match is 273 which is a result of the encoding + * described above. + */ +#define MATCH_LEN_MAX (MATCH_LEN_MIN + LEN_SYMBOLS - 1) + +/* + * Different sets of probabilities are used for match distances that have + * very short match length: Lengths of 2, 3, and 4 bytes have a separate + * set of probabilities for each length. The matches with longer length + * use a shared set of probabilities. + */ +#define DIST_STATES 4 + +/* + * Get the index of the appropriate probability array for decoding + * the distance slot. + */ +static inline uint32_t lzma_get_dist_state(uint32_t len) +{ + return len < DIST_STATES + MATCH_LEN_MIN + ? len - MATCH_LEN_MIN : DIST_STATES - 1; +} + +/* + * The highest two bits of a 32-bit match distance are encoded using six bits. + * This six-bit value is called a distance slot. This way encoding a 32-bit + * value takes 6-36 bits, larger values taking more bits. + */ +#define DIST_SLOT_BITS 6 +#define DIST_SLOTS (1 << DIST_SLOT_BITS) + +/* Match distances up to 127 are fully encoded using probabilities. Since + * the highest two bits (distance slot) are always encoded using six bits, + * the distances 0-3 don't need any additional bits to encode, since the + * distance slot itself is the same as the actual distance. DIST_MODEL_START + * indicates the first distance slot where at least one additional bit is + * needed. + */ +#define DIST_MODEL_START 4 + +/* + * Match distances greater than 127 are encoded in three pieces: + * - distance slot: the highest two bits + * - direct bits: 2-26 bits below the highest two bits + * - alignment bits: four lowest bits + * + * Direct bits don't use any probabilities. + * + * The distance slot value of 14 is for distances 128-191. + */ +#define DIST_MODEL_END 14 + +/* Distance slots that indicate a distance <= 127. */ +#define FULL_DISTANCES_BITS (DIST_MODEL_END / 2) +#define FULL_DISTANCES (1 << FULL_DISTANCES_BITS) + +/* + * For match distances greater than 127, only the highest two bits and the + * lowest four bits (alignment) is encoded using probabilities. + */ +#define ALIGN_BITS 4 +#define ALIGN_SIZE (1 << ALIGN_BITS) +#define ALIGN_MASK (ALIGN_SIZE - 1) + +/* Total number of all probability variables */ +#define PROBS_TOTAL (1846 + LITERAL_CODERS_MAX * LITERAL_CODER_SIZE) + +/* + * LZMA remembers the four most recent match distances. Reusing these + * distances tends to take less space than re-encoding the actual + * distance value. + */ +#define REPS 4 + +#endif diff --git a/android/app/src/main/cpp/xz/xz_private.h b/android/app/src/main/cpp/xz/xz_private.h new file mode 100644 index 0000000..7387401 --- /dev/null +++ b/android/app/src/main/cpp/xz/xz_private.h @@ -0,0 +1,189 @@ +/* SPDX-License-Identifier: 0BSD */ + +/* + * Private includes and definitions + * + * Author: Lasse Collin + */ + +#ifndef XZ_PRIVATE_H +#define XZ_PRIVATE_H + +#ifdef __KERNEL__ +# include +# include +# include + /* XZ_PREBOOT may be defined only via decompress_unxz.c. */ +# ifndef XZ_PREBOOT +# include +# include +# include +# ifdef CONFIG_XZ_DEC_X86 +# define XZ_DEC_X86 +# endif +# ifdef CONFIG_XZ_DEC_POWERPC +# define XZ_DEC_POWERPC +# endif +# ifdef CONFIG_XZ_DEC_IA64 +# define XZ_DEC_IA64 +# endif +# ifdef CONFIG_XZ_DEC_ARM +# define XZ_DEC_ARM +# endif +# ifdef CONFIG_XZ_DEC_ARMTHUMB +# define XZ_DEC_ARMTHUMB +# endif +# ifdef CONFIG_XZ_DEC_SPARC +# define XZ_DEC_SPARC +# endif +# ifdef CONFIG_XZ_DEC_ARM64 +# define XZ_DEC_ARM64 +# endif +# ifdef CONFIG_XZ_DEC_RISCV +# define XZ_DEC_RISCV +# endif +# ifdef CONFIG_XZ_DEC_MICROLZMA +# define XZ_DEC_MICROLZMA +# endif +# define memeq(a, b, size) (memcmp(a, b, size) == 0) +# define memzero(buf, size) memset(buf, 0, size) +# endif +# define get_le32(p) le32_to_cpup((const uint32_t *)(p)) +#else + /* + * For userspace builds, use a separate header to define the required + * macros and functions. This makes it easier to adapt the code into + * different environments and avoids clutter in the Linux kernel tree. + */ +# include "xz_config.h" +#endif + +/* If no specific decoding mode is requested, enable support for all modes. */ +#if !defined(XZ_DEC_SINGLE) && !defined(XZ_DEC_PREALLOC) \ + && !defined(XZ_DEC_DYNALLOC) +# define XZ_DEC_SINGLE +# define XZ_DEC_PREALLOC +# define XZ_DEC_DYNALLOC +#endif + +/* + * The DEC_IS_foo(mode) macros are used in "if" statements. If only some + * of the supported modes are enabled, these macros will evaluate to true or + * false at compile time and thus allow the compiler to omit unneeded code. + */ +#ifdef XZ_DEC_SINGLE +# define DEC_IS_SINGLE(mode) ((mode) == XZ_SINGLE) +#else +# define DEC_IS_SINGLE(mode) (false) +#endif + +#ifdef XZ_DEC_PREALLOC +# define DEC_IS_PREALLOC(mode) ((mode) == XZ_PREALLOC) +#else +# define DEC_IS_PREALLOC(mode) (false) +#endif + +#ifdef XZ_DEC_DYNALLOC +# define DEC_IS_DYNALLOC(mode) ((mode) == XZ_DYNALLOC) +#else +# define DEC_IS_DYNALLOC(mode) (false) +#endif + +#if !defined(XZ_DEC_SINGLE) +# define DEC_IS_MULTI(mode) (true) +#elif defined(XZ_DEC_PREALLOC) || defined(XZ_DEC_DYNALLOC) +# define DEC_IS_MULTI(mode) ((mode) != XZ_SINGLE) +#else +# define DEC_IS_MULTI(mode) (false) +#endif + +/* + * If any of the BCJ filter decoders are wanted, define XZ_DEC_BCJ. + * XZ_DEC_BCJ is used to enable generic support for BCJ decoders. + */ +#ifndef XZ_DEC_BCJ +# if defined(XZ_DEC_X86) || defined(XZ_DEC_POWERPC) \ + || defined(XZ_DEC_IA64) \ + || defined(XZ_DEC_ARM) || defined(XZ_DEC_ARMTHUMB) \ + || defined(XZ_DEC_SPARC) || defined(XZ_DEC_ARM64) \ + || defined(XZ_DEC_RISCV) +# define XZ_DEC_BCJ +# endif +#endif + +struct xz_sha256 { + /* Buffered input data */ + uint8_t data[64]; + + /* Internal state and the final hash value */ + uint32_t state[8]; + + /* Size of the input data */ + uint64_t size; +}; + +/* Reset the SHA-256 state to prepare for a new calculation. */ +XZ_EXTERN void xz_sha256_reset(struct xz_sha256 *s); + +/* Update the SHA-256 state with new data. */ +XZ_EXTERN void xz_sha256_update(const uint8_t *buf, size_t size, + struct xz_sha256 *s); + +/* + * Finish the SHA-256 calculation. Compare the result with the first 32 bytes + * from buf. Return true if the values are equal and false if they aren't. + */ +XZ_EXTERN bool xz_sha256_validate(const uint8_t *buf, struct xz_sha256 *s); + +/* + * Allocate memory for LZMA2 decoder. xz_dec_lzma2_reset() must be used + * before calling xz_dec_lzma2_run(). + */ +XZ_EXTERN struct xz_dec_lzma2 *xz_dec_lzma2_create(enum xz_mode mode, + uint32_t dict_max); + +/* + * Decode the LZMA2 properties (one byte) and reset the decoder. Return + * XZ_OK on success, XZ_MEMLIMIT_ERROR if the preallocated dictionary is not + * big enough, and XZ_OPTIONS_ERROR if props indicates something that this + * decoder doesn't support. + */ +XZ_EXTERN enum xz_ret xz_dec_lzma2_reset(struct xz_dec_lzma2 *s, + uint8_t props); + +/* Decode raw LZMA2 stream from b->in to b->out. */ +XZ_EXTERN enum xz_ret xz_dec_lzma2_run(struct xz_dec_lzma2 *s, + struct xz_buf *b); + +/* Free the memory allocated for the LZMA2 decoder. */ +XZ_EXTERN void xz_dec_lzma2_end(struct xz_dec_lzma2 *s); + +#ifdef XZ_DEC_BCJ +/* + * Allocate memory for BCJ decoders. xz_dec_bcj_reset() must be used before + * calling xz_dec_bcj_run(). + */ +XZ_EXTERN struct xz_dec_bcj *xz_dec_bcj_create(bool single_call); + +/* + * Decode the Filter ID of a BCJ filter. This implementation doesn't + * support custom start offsets, so no decoding of Filter Properties + * is needed. Returns XZ_OK if the given Filter ID is supported. + * Otherwise XZ_OPTIONS_ERROR is returned. + */ +XZ_EXTERN enum xz_ret xz_dec_bcj_reset(struct xz_dec_bcj *s, uint8_t id); + +/* + * Decode raw BCJ + LZMA2 stream. This must be used only if there actually is + * a BCJ filter in the chain. If the chain has only LZMA2, xz_dec_lzma2_run() + * must be called directly. + */ +XZ_EXTERN enum xz_ret xz_dec_bcj_run(struct xz_dec_bcj *s, + struct xz_dec_lzma2 *lzma2, + struct xz_buf *b); + +/* Free the memory allocated for the BCJ filters. */ +#define xz_dec_bcj_end(s) kfree(s) +#endif + +#endif diff --git a/android/app/src/main/cpp/xz/xz_sha256.c b/android/app/src/main/cpp/xz/xz_sha256.c new file mode 100644 index 0000000..078cad2 --- /dev/null +++ b/android/app/src/main/cpp/xz/xz_sha256.c @@ -0,0 +1,182 @@ +// SPDX-License-Identifier: 0BSD + +/* + * SHA-256 + * + * This is based on the XZ Utils version which is based public domain code + * from Crypto++ Library 5.5.1 released in 2007: https://www.cryptopp.com/ + * + * Authors: Wei Dai + * Lasse Collin + */ + +#include "xz_private.h" + +static inline uint32_t +rotr_32(uint32_t num, unsigned amount) +{ + return (num >> amount) | (num << (32 - amount)); +} + +#define blk0(i) (W[i] = get_be32(&data[4 * i])) +#define blk2(i) (W[i & 15] += s1(W[(i - 2) & 15]) + W[(i - 7) & 15] \ + + s0(W[(i - 15) & 15])) + +#define Ch(x, y, z) (z ^ (x & (y ^ z))) +#define Maj(x, y, z) ((x & (y ^ z)) + (y & z)) + +#define a(i) T[(0 - i) & 7] +#define b(i) T[(1 - i) & 7] +#define c(i) T[(2 - i) & 7] +#define d(i) T[(3 - i) & 7] +#define e(i) T[(4 - i) & 7] +#define f(i) T[(5 - i) & 7] +#define g(i) T[(6 - i) & 7] +#define h(i) T[(7 - i) & 7] + +#define R(i, j, blk) \ + h(i) += S1(e(i)) + Ch(e(i), f(i), g(i)) + SHA256_K[i + j] + blk; \ + d(i) += h(i); \ + h(i) += S0(a(i)) + Maj(a(i), b(i), c(i)) +#define R0(i) R(i, 0, blk0(i)) +#define R2(i) R(i, j, blk2(i)) + +#define S0(x) rotr_32(x ^ rotr_32(x ^ rotr_32(x, 9), 11), 2) +#define S1(x) rotr_32(x ^ rotr_32(x ^ rotr_32(x, 14), 5), 6) +#define s0(x) (rotr_32(x ^ rotr_32(x, 11), 7) ^ (x >> 3)) +#define s1(x) (rotr_32(x ^ rotr_32(x, 2), 17) ^ (x >> 10)) + +static const uint32_t SHA256_K[64] = { + 0x428A2F98, 0x71374491, 0xB5C0FBCF, 0xE9B5DBA5, + 0x3956C25B, 0x59F111F1, 0x923F82A4, 0xAB1C5ED5, + 0xD807AA98, 0x12835B01, 0x243185BE, 0x550C7DC3, + 0x72BE5D74, 0x80DEB1FE, 0x9BDC06A7, 0xC19BF174, + 0xE49B69C1, 0xEFBE4786, 0x0FC19DC6, 0x240CA1CC, + 0x2DE92C6F, 0x4A7484AA, 0x5CB0A9DC, 0x76F988DA, + 0x983E5152, 0xA831C66D, 0xB00327C8, 0xBF597FC7, + 0xC6E00BF3, 0xD5A79147, 0x06CA6351, 0x14292967, + 0x27B70A85, 0x2E1B2138, 0x4D2C6DFC, 0x53380D13, + 0x650A7354, 0x766A0ABB, 0x81C2C92E, 0x92722C85, + 0xA2BFE8A1, 0xA81A664B, 0xC24B8B70, 0xC76C51A3, + 0xD192E819, 0xD6990624, 0xF40E3585, 0x106AA070, + 0x19A4C116, 0x1E376C08, 0x2748774C, 0x34B0BCB5, + 0x391C0CB3, 0x4ED8AA4A, 0x5B9CCA4F, 0x682E6FF3, + 0x748F82EE, 0x78A5636F, 0x84C87814, 0x8CC70208, + 0x90BEFFFA, 0xA4506CEB, 0xBEF9A3F7, 0xC67178F2 +}; + +static void +transform(uint32_t state[8], const uint8_t data[64]) +{ + uint32_t W[16]; + uint32_t T[8]; + unsigned int j; + + /* Copy state[] to working vars. */ + memcpy(T, state, sizeof(T)); + + /* The first 16 operations unrolled */ + R0( 0); R0( 1); R0( 2); R0( 3); + R0( 4); R0( 5); R0( 6); R0( 7); + R0( 8); R0( 9); R0(10); R0(11); + R0(12); R0(13); R0(14); R0(15); + + /* The remaining 48 operations partially unrolled */ + for (j = 16; j < 64; j += 16) { + R2( 0); R2( 1); R2( 2); R2( 3); + R2( 4); R2( 5); R2( 6); R2( 7); + R2( 8); R2( 9); R2(10); R2(11); + R2(12); R2(13); R2(14); R2(15); + } + + /* Add the working vars back into state[]. */ + state[0] += a(0); + state[1] += b(0); + state[2] += c(0); + state[3] += d(0); + state[4] += e(0); + state[5] += f(0); + state[6] += g(0); + state[7] += h(0); +} + +XZ_EXTERN void xz_sha256_reset(struct xz_sha256 *s) +{ + static const uint32_t initial_state[8] = { + 0x6A09E667, 0xBB67AE85, 0x3C6EF372, 0xA54FF53A, + 0x510E527F, 0x9B05688C, 0x1F83D9AB, 0x5BE0CD19 + }; + + memcpy(s->state, initial_state, sizeof(initial_state)); + s->size = 0; +} + +XZ_EXTERN void xz_sha256_update(const uint8_t *buf, size_t size, + struct xz_sha256 *s) +{ + size_t copy_start; + size_t copy_size; + + /* + * Copy the input data into a properly aligned temporary buffer. + * This way we can be called with arbitrarily sized buffers + * (no need to be a multiple of 64 bytes). + * + * Full 64-byte chunks could be processed directly from buf with + * unaligned access. It seemed to make very little difference in + * speed on x86-64 though. Thus it was omitted. + */ + while (size > 0) { + copy_start = s->size & 0x3F; + copy_size = 64 - copy_start; + if (copy_size > size) + copy_size = size; + + memcpy(s->data + copy_start, buf, copy_size); + + buf += copy_size; + size -= copy_size; + s->size += copy_size; + + if ((s->size & 0x3F) == 0) + transform(s->state, s->data); + } +} + +XZ_EXTERN bool xz_sha256_validate(const uint8_t *buf, struct xz_sha256 *s) +{ + /* + * Add padding as described in RFC 3174 (it describes SHA-1 but + * the same padding style is used for SHA-256 too). + */ + size_t i = s->size & 0x3F; + s->data[i++] = 0x80; + + while (i != 64 - 8) { + if (i == 64) { + transform(s->state, s->data); + i = 0; + } + + s->data[i++] = 0x00; + } + + /* Convert the message size from bytes to bits. */ + s->size *= 8; + + /* + * Store the message size in big endian byte order and + * calculate the final hash value. + */ + for (i = 0; i < 8; ++i) + s->data[64 - 8 + i] = (uint8_t)(s->size >> ((7 - i) * 8)); + + transform(s->state, s->data); + + /* Compare if the hash value matches the first 32 bytes in buf. */ + for (i = 0; i < 8; ++i) + if (get_unaligned_be32(buf + 4 * i) != s->state[i]) + return false; + + return true; +} diff --git a/android/app/src/main/cpp/xz/xz_stream.h b/android/app/src/main/cpp/xz/xz_stream.h new file mode 100644 index 0000000..55f9f6f --- /dev/null +++ b/android/app/src/main/cpp/xz/xz_stream.h @@ -0,0 +1,61 @@ +/* SPDX-License-Identifier: 0BSD */ + +/* + * Definitions for handling the .xz file format + * + * Author: Lasse Collin + */ + +#ifndef XZ_STREAM_H +#define XZ_STREAM_H + +#if defined(__KERNEL__) && !XZ_INTERNAL_CRC32 +# include +# undef crc32 +# define xz_crc32(buf, size, crc) \ + (~crc32_le(~(uint32_t)(crc), buf, size)) +#endif + +/* + * See the .xz file format specification at + * https://tukaani.org/xz/xz-file-format.txt + * to understand the container format. + */ + +#define STREAM_HEADER_SIZE 12 + +#define HEADER_MAGIC "\3757zXZ" +#define HEADER_MAGIC_SIZE 6 + +#define FOOTER_MAGIC "YZ" +#define FOOTER_MAGIC_SIZE 2 + +/* + * Variable-length integer can hold a 63-bit unsigned integer or a special + * value indicating that the value is unknown. + * + * Experimental: vli_type can be defined to uint32_t to save a few bytes + * in code size (no effect on speed). Doing so limits the uncompressed and + * compressed size of the file to less than 256 MiB and may also weaken + * error detection slightly. + */ +typedef uint64_t vli_type; + +#define VLI_MAX ((vli_type)-1 / 2) +#define VLI_UNKNOWN ((vli_type)-1) + +/* Maximum encoded size of a VLI */ +#define VLI_BYTES_MAX (sizeof(vli_type) * 8 / 7) + +/* Integrity Check types */ +enum xz_check { + XZ_CHECK_NONE = 0, + XZ_CHECK_CRC32 = 1, + XZ_CHECK_CRC64 = 4, + XZ_CHECK_SHA256 = 10 +}; + +/* Maximum possible Check ID */ +#define XZ_CHECK_MAX 15 + +#endif diff --git a/android/app/src/main/java/me/kavishdevar/librepods/MainActivity.kt b/android/app/src/main/java/me/kavishdevar/librepods/MainActivity.kt index 8313a6c..5229113 100644 --- a/android/app/src/main/java/me/kavishdevar/librepods/MainActivity.kt +++ b/android/app/src/main/java/me/kavishdevar/librepods/MainActivity.kt @@ -108,14 +108,14 @@ import me.kavishdevar.librepods.screens.AppSettingsScreen import me.kavishdevar.librepods.screens.DebugScreen import me.kavishdevar.librepods.screens.HeadTrackingScreen import me.kavishdevar.librepods.screens.LongPress -import me.kavishdevar.librepods.screens.Onboarding +// import me.kavishdevar.librepods.screens.Onboarding import me.kavishdevar.librepods.screens.RenameScreen import me.kavishdevar.librepods.screens.TroubleshootingScreen import me.kavishdevar.librepods.services.AirPodsService import me.kavishdevar.librepods.ui.theme.LibrePodsTheme import me.kavishdevar.librepods.utils.AirPodsNotifications import me.kavishdevar.librepods.utils.CrossDevice -import me.kavishdevar.librepods.utils.RadareOffsetFinder +// import me.kavishdevar.librepods.utils.RadareOffsetFinder import kotlin.io.encoding.ExperimentalEncodingApi lateinit var serviceConnection: ServiceConnection @@ -182,7 +182,7 @@ class MainActivity : ComponentActivity() { fun Main() { val isConnected = remember { mutableStateOf(false) } val isRemotelyConnected = remember { mutableStateOf(false) } - val hookAvailable = RadareOffsetFinder(LocalContext.current).isHookOffsetAvailable() +// val hookAvailable = RadareOffsetFinder(LocalContext.current).isHookOffsetAvailable() val context = LocalContext.current var canDrawOverlays by remember { mutableStateOf(Settings.canDrawOverlays(context)) } val overlaySkipped = remember { mutableStateOf(context.getSharedPreferences("settings", MODE_PRIVATE).getBoolean("overlay_permission_skipped", false)) } @@ -243,7 +243,7 @@ fun Main() { ) { NavHost( navController = navController, - startDestination = if (hookAvailable) "settings" else "onboarding", + startDestination = "settings", // if (hookAvailable) "settings" else "onboarding", enterTransition = { slideInHorizontally( initialOffsetX = { it }, @@ -301,9 +301,9 @@ fun Main() { composable("head_tracking") { HeadTrackingScreen(navController) } - composable("onboarding") { - Onboarding(navController, context) - } +// composable("onboarding") { +// Onboarding(navController, context) +// } } } diff --git a/android/app/src/main/java/me/kavishdevar/librepods/screens/AppSettingsScreen.kt b/android/app/src/main/java/me/kavishdevar/librepods/screens/AppSettingsScreen.kt index 06949ad..e5fb521 100644 --- a/android/app/src/main/java/me/kavishdevar/librepods/screens/AppSettingsScreen.kt +++ b/android/app/src/main/java/me/kavishdevar/librepods/screens/AppSettingsScreen.kt @@ -96,7 +96,7 @@ import dev.chrisbanes.haze.materials.ExperimentalHazeMaterialsApi import me.kavishdevar.librepods.R import me.kavishdevar.librepods.composables.StyledSwitch import me.kavishdevar.librepods.utils.AACPManager -import me.kavishdevar.librepods.utils.RadareOffsetFinder +//import me.kavishdevar.librepods.utils.RadareOffsetFinder import kotlin.io.encoding.Base64 import kotlin.io.encoding.ExperimentalEncodingApi import kotlin.math.roundToInt @@ -1107,68 +1107,68 @@ fun AppSettingsScreen(navController: NavController) { Spacer(modifier = Modifier.height(32.dp)) - if (showResetDialog) { - AlertDialog( - onDismissRequest = { showResetDialog = false }, - title = { - Text( - "Reset Hook Offset", - fontFamily = FontFamily(Font(R.font.sf_pro)), - fontWeight = FontWeight.Medium - ) - }, - text = { - Text( - "This will clear the current hook offset and require you to go through the setup process again. Are you sure you want to continue?", - fontFamily = FontFamily(Font(R.font.sf_pro)) - ) - }, - confirmButton = { - TextButton( - onClick = { - if (RadareOffsetFinder.clearHookOffsets()) { - Toast.makeText( - context, - "Hook offset has been reset. Redirecting to setup...", - Toast.LENGTH_LONG - ).show() - - navController.navigate("onboarding") { - popUpTo("settings") { inclusive = true } - } - } else { - Toast.makeText( - context, - "Failed to reset hook offset", - Toast.LENGTH_SHORT - ).show() - } - showResetDialog = false - }, - colors = ButtonDefaults.textButtonColors( - contentColor = MaterialTheme.colorScheme.error - ) - ) { - Text( - "Reset", - fontFamily = FontFamily(Font(R.font.sf_pro)), - fontWeight = FontWeight.Medium - ) - } - }, - dismissButton = { - TextButton( - onClick = { showResetDialog = false } - ) { - Text( - "Cancel", - fontFamily = FontFamily(Font(R.font.sf_pro)), - fontWeight = FontWeight.Medium - ) - } - } - ) - } +// if (showResetDialog) { +// AlertDialog( +// onDismissRequest = { showResetDialog = false }, +// title = { +// Text( +// "Reset Hook Offset", +// fontFamily = FontFamily(Font(R.font.sf_pro)), +// fontWeight = FontWeight.Medium +// ) +// }, +// text = { +// Text( +// "This will clear the current hook offset and require you to go through the setup process again. Are you sure you want to continue?", +// fontFamily = FontFamily(Font(R.font.sf_pro)) +// ) +// }, +// confirmButton = { +// TextButton( +// onClick = { +// if (RadareOffsetFinder.clearHookOffsets()) { +// Toast.makeText( +// context, +// "Hook offset has been reset. Redirecting to setup...", +// Toast.LENGTH_LONG +// ).show() +// +// navController.navigate("onboarding") { +// popUpTo("settings") { inclusive = true } +// } +// } else { +// Toast.makeText( +// context, +// "Failed to reset hook offset", +// Toast.LENGTH_SHORT +// ).show() +// } +// showResetDialog = false +// }, +// colors = ButtonDefaults.textButtonColors( +// contentColor = MaterialTheme.colorScheme.error +// ) +// ) { +// Text( +// "Reset", +// fontFamily = FontFamily(Font(R.font.sf_pro)), +// fontWeight = FontWeight.Medium +// ) +// } +// }, +// dismissButton = { +// TextButton( +// onClick = { showResetDialog = false } +// ) { +// Text( +// "Cancel", +// fontFamily = FontFamily(Font(R.font.sf_pro)), +// fontWeight = FontWeight.Medium +// ) +// } +// } +// ) +// } if (showIrkDialog) { AlertDialog( diff --git a/android/app/src/main/java/me/kavishdevar/librepods/screens/Onboarding.kt b/android/app/src/main/java/me/kavishdevar/librepods/screens/Onboarding.kt deleted file mode 100644 index dc7a540..0000000 --- a/android/app/src/main/java/me/kavishdevar/librepods/screens/Onboarding.kt +++ /dev/null @@ -1,670 +0,0 @@ -/* - * LibrePods - AirPods liberated from Apple’s ecosystem - * - * Copyright (C) 2025 LibrePods contributors - * - * This program is free software: you can redistribute it and/or modify - * it under the terms of the GNU Affero General Public License as published - * by the Free Software Foundation, either version 3 of the License. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU Affero General Public License for more details. - * - * You should have received a copy of the GNU Affero General Public License - * along with this program. If not, see . - */ - -package me.kavishdevar.librepods.screens - -import android.content.Context -import android.util.Log -import androidx.compose.animation.AnimatedContent -import androidx.compose.animation.core.animateFloatAsState -import androidx.compose.animation.fadeIn -import androidx.compose.animation.fadeOut -import androidx.compose.animation.togetherWith -import androidx.compose.foundation.isSystemInDarkTheme -import androidx.compose.foundation.layout.Arrangement -import androidx.compose.foundation.layout.Box -import androidx.compose.foundation.layout.Column -import androidx.compose.foundation.layout.Spacer -import androidx.compose.foundation.layout.fillMaxSize -import androidx.compose.foundation.layout.fillMaxWidth -import androidx.compose.foundation.layout.height -import androidx.compose.foundation.layout.padding -import androidx.compose.foundation.layout.size -import androidx.compose.foundation.shape.RoundedCornerShape -import androidx.compose.material.icons.Icons -import androidx.compose.material.icons.filled.Check -import androidx.compose.material.icons.filled.Clear -import androidx.compose.material.icons.filled.MoreVert -import androidx.compose.material.icons.filled.Settings -import androidx.compose.material3.AlertDialog -import androidx.compose.material3.Button -import androidx.compose.material3.ButtonDefaults -import androidx.compose.material3.Card -import androidx.compose.material3.CardDefaults -import androidx.compose.material3.CenterAlignedTopAppBar -import androidx.compose.material3.CircularProgressIndicator -import androidx.compose.material3.DropdownMenu -import androidx.compose.material3.DropdownMenuItem -import androidx.compose.material3.ExperimentalMaterial3Api -import androidx.compose.material3.Icon -import androidx.compose.material3.IconButton -import androidx.compose.material3.LinearProgressIndicator -import androidx.compose.material3.Scaffold -import androidx.compose.material3.Text -import androidx.compose.material3.TextButton -import androidx.compose.material3.TopAppBarDefaults -import androidx.compose.runtime.Composable -import androidx.compose.runtime.LaunchedEffect -import androidx.compose.runtime.collectAsState -import androidx.compose.runtime.getValue -import androidx.compose.runtime.mutableStateOf -import androidx.compose.runtime.remember -import androidx.compose.runtime.setValue -import androidx.compose.ui.Alignment -import androidx.compose.ui.Modifier -import androidx.compose.ui.graphics.Color -import androidx.compose.ui.graphics.StrokeCap -import androidx.compose.ui.platform.LocalContext -import androidx.compose.ui.text.TextStyle -import androidx.compose.ui.text.font.Font -import androidx.compose.ui.text.font.FontFamily -import androidx.compose.ui.text.font.FontWeight -import androidx.compose.ui.text.style.TextAlign -import androidx.compose.ui.tooling.preview.Preview -import androidx.compose.ui.unit.dp -import androidx.compose.ui.unit.sp -import androidx.navigation.NavController -import kotlinx.coroutines.Dispatchers -import kotlinx.coroutines.launch -import kotlinx.coroutines.withContext -import me.kavishdevar.librepods.R -import me.kavishdevar.librepods.utils.RadareOffsetFinder - -@OptIn(ExperimentalMaterial3Api::class) -@Composable -fun Onboarding(navController: NavController, activityContext: Context) { - val isDarkTheme = isSystemInDarkTheme() - val backgroundColor = if (isDarkTheme) Color(0xFF1C1C1E) else Color.White - val textColor = if (isDarkTheme) Color.White else Color.Black - val accentColor = if (isDarkTheme) Color(0xFF007AFF) else Color(0xFF3C6DF5) - - val radareOffsetFinder = remember { RadareOffsetFinder(activityContext) } - val progressState by radareOffsetFinder.progressState.collectAsState() - var isComplete by remember { mutableStateOf(false) } - var hasStarted by remember { mutableStateOf(false) } - var rootCheckPassed by remember { mutableStateOf(false) } - var checkingRoot by remember { mutableStateOf(false) } - var rootCheckFailed by remember { mutableStateOf(false) } - var moduleEnabled by remember { mutableStateOf(false) } - var bluetoothToggled by remember { mutableStateOf(false) } - - var showMenu by remember { mutableStateOf(false) } - var showSkipDialog by remember { mutableStateOf(false) } - - fun checkRootAccess() { - checkingRoot = true - rootCheckFailed = false - kotlinx.coroutines.MainScope().launch { - withContext(Dispatchers.IO) { - try { - val process = Runtime.getRuntime().exec("su -c id") - val exitValue = process.waitFor() - withContext(Dispatchers.Main) { - rootCheckPassed = (exitValue == 0) - rootCheckFailed = (exitValue != 0) - checkingRoot = false - } - } catch (e: Exception) { - Log.e("Onboarding", "Root check failed", e) - withContext(Dispatchers.Main) { - rootCheckPassed = false - rootCheckFailed = true - checkingRoot = false - } - } - } - } - } - - LaunchedEffect(hasStarted) { - if (hasStarted && rootCheckPassed) { - Log.d("Onboarding", "Checking if hook offset is available...") - val isHookReady = radareOffsetFinder.isHookOffsetAvailable() - Log.d("Onboarding", "Hook offset ready: $isHookReady") - - if (isHookReady) { - Log.d("Onboarding", "Hook is ready") - isComplete = true - } else { - Log.d("Onboarding", "Hook not ready, starting setup process...") - withContext(Dispatchers.IO) { - radareOffsetFinder.setupAndFindOffset() - } - } - } - } - - LaunchedEffect(progressState) { - if (progressState is RadareOffsetFinder.ProgressState.Success) { - isComplete = true - } - } - - Scaffold( - topBar = { - CenterAlignedTopAppBar( - title = { - Text( - "Setting Up", - fontFamily = FontFamily(Font(R.font.sf_pro)), - fontWeight = FontWeight.Medium - ) - }, - colors = TopAppBarDefaults.topAppBarColors( - containerColor = Color.Transparent - ), - actions = { - Box { - IconButton(onClick = { showMenu = true }) { - Icon( - imageVector = Icons.Default.MoreVert, - contentDescription = "More Options" - ) - } - DropdownMenu( - expanded = showMenu, - onDismissRequest = { showMenu = false } - ) { - DropdownMenuItem( - text = { Text("Skip Setup") }, - onClick = { - showMenu = false - showSkipDialog = true - } - ) - } - } - } - ) - }, - containerColor = if (isDarkTheme) Color(0xFF000000) else Color(0xFFF2F2F7) - ) { paddingValues -> - Column( - modifier = Modifier - .fillMaxSize() - .padding(paddingValues) - .padding(16.dp), - horizontalAlignment = Alignment.CenterHorizontally, - verticalArrangement = Arrangement.spacedBy(16.dp) - ) { - Spacer(modifier = Modifier.height(16.dp)) - - Card( - modifier = Modifier.fillMaxWidth(), - colors = CardDefaults.cardColors(containerColor = backgroundColor), - shape = RoundedCornerShape(12.dp) - ) { - Column( - modifier = Modifier - .fillMaxWidth() - .padding(24.dp), - horizontalAlignment = Alignment.CenterHorizontally - ) { - if (!rootCheckPassed && !hasStarted) { - Icon( - imageVector = Icons.Default.Settings, - contentDescription = "Root Access", - tint = accentColor, - modifier = Modifier.size(50.dp) - ) - - Spacer(modifier = Modifier.height(24.dp)) - - Text( - text = "Root Access Required", - style = TextStyle( - fontSize = 22.sp, - fontWeight = FontWeight.Bold, - textAlign = TextAlign.Center, - fontFamily = FontFamily(Font(R.font.sf_pro)), - color = textColor - ) - ) - - Spacer(modifier = Modifier.height(8.dp)) - - Text( - text = "This app needs root access to hook onto the Bluetooth library", - style = TextStyle( - fontSize = 16.sp, - fontWeight = FontWeight.Normal, - textAlign = TextAlign.Center, - fontFamily = FontFamily(Font(R.font.sf_pro)), - color = textColor.copy(alpha = 0.7f) - ) - ) - - if (rootCheckFailed) { - Spacer(modifier = Modifier.height(8.dp)) - Text( - text = "Root access was denied. Please grant root permissions.", - style = TextStyle( - fontSize = 14.sp, - fontWeight = FontWeight.Normal, - textAlign = TextAlign.Center, - fontFamily = FontFamily(Font(R.font.sf_pro)), - color = Color(0xFFFF453A) - ) - ) - } - - Spacer(modifier = Modifier.height(24.dp)) - - Button( - onClick = { checkRootAccess() }, - modifier = Modifier - .fillMaxWidth() - .height(50.dp), - colors = ButtonDefaults.buttonColors( - containerColor = accentColor - ), - shape = RoundedCornerShape(8.dp), - enabled = !checkingRoot - ) { - if (checkingRoot) { - CircularProgressIndicator( - modifier = Modifier.size(24.dp), - color = Color.White, - strokeWidth = 2.dp - ) - } else { - Text( - "Check Root Access", - style = TextStyle( - fontSize = 16.sp, - fontWeight = FontWeight.Medium, - fontFamily = FontFamily(Font(R.font.sf_pro)) - ), - ) - } - } - } else { - StatusIcon(if (hasStarted) progressState else RadareOffsetFinder.ProgressState.Idle, isDarkTheme) - - Spacer(modifier = Modifier.height(24.dp)) - - AnimatedContent( - targetState = if (hasStarted) getStatusTitle(progressState, isComplete, moduleEnabled, bluetoothToggled) else "Setup Required", - transitionSpec = { fadeIn() togetherWith fadeOut() } - ) { text -> - Text( - text = text, - style = TextStyle( - fontSize = 22.sp, - fontWeight = FontWeight.Bold, - textAlign = TextAlign.Center, - fontFamily = FontFamily(Font(R.font.sf_pro)), - color = textColor - ) - ) - } - - Spacer(modifier = Modifier.height(8.dp)) - - AnimatedContent( - targetState = if (hasStarted) - getStatusDescription(progressState, isComplete, moduleEnabled, bluetoothToggled) - else - "AirPods functionality requires one-time setup for hooking into Bluetooth library", - transitionSpec = { fadeIn() togetherWith fadeOut() } - ) { text -> - Text( - text = text, - style = TextStyle( - fontSize = 16.sp, - fontWeight = FontWeight.Normal, - textAlign = TextAlign.Center, - fontFamily = FontFamily(Font(R.font.sf_pro)), - color = textColor.copy(alpha = 0.7f) - ) - ) - } - - Spacer(modifier = Modifier.height(24.dp)) - - if (!hasStarted) { - Button( - onClick = { hasStarted = true }, - modifier = Modifier - .fillMaxWidth() - .height(50.dp), - colors = ButtonDefaults.buttonColors( - containerColor = accentColor - ), - shape = RoundedCornerShape(8.dp) - ) { - Text( - "Start Setup", - style = TextStyle( - fontSize = 16.sp, - fontWeight = FontWeight.Medium, - fontFamily = FontFamily(Font(R.font.sf_pro)) - ), - ) - } - } else { - when (progressState) { - is RadareOffsetFinder.ProgressState.DownloadProgress -> { - val progress = (progressState as RadareOffsetFinder.ProgressState.DownloadProgress).progress - val animatedProgress by animateFloatAsState( - targetValue = progress, - label = "Download Progress" - ) - Column( - modifier = Modifier.fillMaxWidth(), - horizontalAlignment = Alignment.CenterHorizontally - ) { - LinearProgressIndicator( - progress = { animatedProgress }, - modifier = Modifier - .fillMaxWidth() - .height(8.dp), - strokeCap = StrokeCap.Round, - color = accentColor - ) - - Spacer(modifier = Modifier.height(8.dp)) - - Text( - text = "${(progress * 100).toInt()}%", - style = TextStyle( - fontSize = 14.sp, - fontWeight = FontWeight.Medium, - fontFamily = FontFamily(Font(R.font.sf_pro)), - color = textColor.copy(alpha = 0.6f) - ) - ) - } - } - is RadareOffsetFinder.ProgressState.Success -> { - if (!moduleEnabled) { - Button( - onClick = { moduleEnabled = true }, - modifier = Modifier - .fillMaxWidth() - .height(50.dp), - colors = ButtonDefaults.buttonColors( - containerColor = accentColor - ), - shape = RoundedCornerShape(8.dp) - ) { - Text( - "I've Enabled/Reactivated the Module", - style = TextStyle( - fontSize = 16.sp, - fontWeight = FontWeight.Medium, - fontFamily = FontFamily(Font(R.font.sf_pro)) - ), - ) - } - } else if (!bluetoothToggled) { - Button( - onClick = { bluetoothToggled = true }, - modifier = Modifier - .fillMaxWidth() - .height(50.dp), - colors = ButtonDefaults.buttonColors( - containerColor = accentColor - ), - shape = RoundedCornerShape(8.dp) - ) { - Text( - "I've Toggled Bluetooth", - style = TextStyle( - fontSize = 16.sp, - fontWeight = FontWeight.Medium, - fontFamily = FontFamily(Font(R.font.sf_pro)) - ), - ) - } - } else { - Button( - onClick = { - navController.navigate("settings") { - popUpTo("onboarding") { inclusive = true } - } - }, - modifier = Modifier - .fillMaxWidth() - .height(50.dp), - colors = ButtonDefaults.buttonColors( - containerColor = accentColor - ), - shape = RoundedCornerShape(8.dp) - ) { - Text( - "Continue to Settings", - style = TextStyle( - fontSize = 16.sp, - fontWeight = FontWeight.Medium, - fontFamily = FontFamily(Font(R.font.sf_pro)) - ), - ) - } - } - } - is RadareOffsetFinder.ProgressState.Idle, - is RadareOffsetFinder.ProgressState.Error -> { - // No specific UI for these states - } - else -> { - LinearProgressIndicator( - modifier = Modifier - .fillMaxWidth() - .height(8.dp), - strokeCap = StrokeCap.Round, - color = accentColor - ) - } - } - } - } - } - } - - Spacer(modifier = Modifier.weight(1f)) - - if (progressState is RadareOffsetFinder.ProgressState.Error && !isComplete && hasStarted) { - Button( - onClick = { - Log.d("Onboarding", "Trying to find offset again...") - kotlinx.coroutines.MainScope().launch { - withContext(Dispatchers.IO) { - radareOffsetFinder.setupAndFindOffset() - } - } - }, - modifier = Modifier - .fillMaxWidth() - .height(55.dp), - colors = ButtonDefaults.buttonColors( - containerColor = accentColor - ), - shape = RoundedCornerShape(8.dp) - ) { - Text( - "Try Again", - style = TextStyle( - fontSize = 16.sp, - fontWeight = FontWeight.Medium, - fontFamily = FontFamily(Font(R.font.sf_pro)) - ), - ) - } - } - } - - if (showSkipDialog) { - AlertDialog( - onDismissRequest = { showSkipDialog = false }, - title = { Text("Skip Setup") }, - text = { - Text( - "Have you installed the root module that patches the Bluetooth library directly? This option is for users who have manually patched their system instead of using the dynamic hook.", - style = TextStyle( - fontSize = 16.sp, - fontFamily = FontFamily(Font(R.font.sf_pro)) - ) - ) - }, - confirmButton = { - val sharedPreferences = activityContext.getSharedPreferences("settings", Context.MODE_PRIVATE) - TextButton( - onClick = { - showSkipDialog = false - RadareOffsetFinder.clearHookOffsets() - sharedPreferences.edit().putBoolean("skip_setup", true).apply() - navController.navigate("settings") { - popUpTo("onboarding") { inclusive = true } - } - } - ) { - Text( - "Yes, Skip Setup", - color = accentColor, - fontWeight = FontWeight.Bold - ) - } - }, - dismissButton = { - TextButton( - onClick = { showSkipDialog = false } - ) { - Text("Cancel") - } - }, - containerColor = backgroundColor, - textContentColor = textColor, - titleContentColor = textColor - ) - } - } -} - -@Composable -private fun StatusIcon( - progressState: RadareOffsetFinder.ProgressState, - isDarkTheme: Boolean -) { - val accentColor = if (isDarkTheme) Color(0xFF007AFF) else Color(0xFF3C6DF5) - val errorColor = if (isDarkTheme) Color(0xFFFF453A) else Color(0xFFFF3B30) - val successColor = if (isDarkTheme) Color(0xFF30D158) else Color(0xFF34C759) - - Box( - modifier = Modifier.size(80.dp), - contentAlignment = Alignment.Center - ) { - when (progressState) { - is RadareOffsetFinder.ProgressState.Error -> { - Icon( - imageVector = Icons.Default.Clear, - contentDescription = "Error", - tint = errorColor, - modifier = Modifier.size(50.dp) - ) - } - is RadareOffsetFinder.ProgressState.Success -> { - Icon( - imageVector = Icons.Default.Check, - contentDescription = "Success", - tint = successColor, - modifier = Modifier.size(50.dp) - ) - } - is RadareOffsetFinder.ProgressState.Idle -> { - Icon( - imageVector = Icons.Default.Settings, - contentDescription = "Settings", - tint = accentColor, - modifier = Modifier.size(50.dp) - ) - } - else -> { - CircularProgressIndicator( - modifier = Modifier.size(50.dp), - color = accentColor, - strokeWidth = 4.dp - ) - } - } - } -} - -private fun getStatusTitle( - state: RadareOffsetFinder.ProgressState, - isComplete: Boolean, - moduleEnabled: Boolean, - bluetoothToggled: Boolean -): String { - return when (state) { - is RadareOffsetFinder.ProgressState.Success -> { - when { - !moduleEnabled -> "Enable Xposed Module" - !bluetoothToggled -> "Toggle Bluetooth" - else -> "Setup Complete" - } - } - is RadareOffsetFinder.ProgressState.Idle -> "Getting Ready" - is RadareOffsetFinder.ProgressState.CheckingExisting -> "Checking if radare2 already downloaded" - is RadareOffsetFinder.ProgressState.Downloading -> "Downloading radare2" - is RadareOffsetFinder.ProgressState.DownloadProgress -> "Downloading radare2" - is RadareOffsetFinder.ProgressState.Extracting -> "Extracting radare2" - is RadareOffsetFinder.ProgressState.MakingExecutable -> "Setting executable permissions" - is RadareOffsetFinder.ProgressState.FindingOffset -> "Finding function offset" - is RadareOffsetFinder.ProgressState.SavingOffset -> "Saving offset" - is RadareOffsetFinder.ProgressState.Cleaning -> "Cleaning Up" - is RadareOffsetFinder.ProgressState.Error -> "Setup Failed" - } -} - -private fun getStatusDescription( - state: RadareOffsetFinder.ProgressState, - isComplete: Boolean, - moduleEnabled: Boolean, - bluetoothToggled: Boolean -): String { - return when (state) { - is RadareOffsetFinder.ProgressState.Success -> { - when { - !moduleEnabled -> "Please enable the LibrePods Xposed module in your Xposed manager (e.g. LSPosed). If already enabled, disable and re-enable it." - !bluetoothToggled -> "Please turn off and then turn on Bluetooth to apply the changes." - else -> "All set! You can now use your AirPods with enhanced functionality." - } - } - is RadareOffsetFinder.ProgressState.Idle -> "Preparing" - is RadareOffsetFinder.ProgressState.CheckingExisting -> "Checking if radare2 are already installed" - is RadareOffsetFinder.ProgressState.Downloading -> "Starting radare2 download" - is RadareOffsetFinder.ProgressState.DownloadProgress -> "Downloading radare2" - is RadareOffsetFinder.ProgressState.Extracting -> "Extracting radare2" - is RadareOffsetFinder.ProgressState.MakingExecutable -> "Setting executable permissions on radare2 binaries" - is RadareOffsetFinder.ProgressState.FindingOffset -> "Looking for the required Bluetooth function in system libraries" - is RadareOffsetFinder.ProgressState.SavingOffset -> "Saving the function offset" - is RadareOffsetFinder.ProgressState.Cleaning -> "Removing temporary extracted files" - is RadareOffsetFinder.ProgressState.Error -> state.message - } -} - -@Preview -@Composable -fun OnboardingPreview() { - Onboarding(navController = NavController(LocalContext.current), activityContext = LocalContext.current) -} - -private suspend fun delay(timeMillis: Long) { - kotlinx.coroutines.delay(timeMillis) -} diff --git a/android/app/src/main/java/me/kavishdevar/librepods/utils/RadareOffsetFinder.kt b/android/app/src/main/java/me/kavishdevar/librepods/utils/RadareOffsetFinder.kt deleted file mode 100644 index e6a28e8..0000000 --- a/android/app/src/main/java/me/kavishdevar/librepods/utils/RadareOffsetFinder.kt +++ /dev/null @@ -1,616 +0,0 @@ -/* - * LibrePods - AirPods liberated from Apple’s ecosystem - * - * Copyright (C) 2025 LibrePods contributors - * - * This program is free software: you can redistribute it and/or modify - * it under the terms of the GNU Affero General Public License as published - * by the Free Software Foundation, either version 3 of the License. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU Affero General Public License for more details. - * - * You should have received a copy of the GNU Affero General Public License - * along with this program. If not, see . - */ - -@file:OptIn(ExperimentalEncodingApi::class) - -package me.kavishdevar.librepods.utils - -import android.content.Context -import android.util.Log -import androidx.compose.runtime.NoLiveLiterals -import kotlinx.coroutines.Dispatchers -import kotlinx.coroutines.flow.MutableStateFlow -import kotlinx.coroutines.flow.StateFlow -import kotlinx.coroutines.withContext -import me.kavishdevar.librepods.services.ServiceManager -import java.io.BufferedReader -import java.io.File -import java.io.FileOutputStream -import java.io.InputStreamReader -import java.net.HttpURLConnection -import java.net.URL -import kotlin.io.encoding.ExperimentalEncodingApi - -@NoLiveLiterals -class RadareOffsetFinder(context: Context) { - companion object { - private const val TAG = "RadareOffsetFinder" - private const val RADARE2_URL = "https://hc-cdn.hel1.your-objectstorage.com/s/v3/c9898243c42c0d3d1387de9a37d57ce9df77f9c9_radare2-5.9.9-android-aarch64.tar.gz" - private const val HOOK_OFFSET_PROP = "persist.librepods.hook_offset" - private const val CFG_REQ_OFFSET_PROP = "persist.librepods.cfg_req_offset" - private const val CSM_CONFIG_OFFSET_PROP = "persist.librepods.csm_config_offset" - private const val PEER_INFO_REQ_OFFSET_PROP = "persist.librepods.peer_info_req_offset" - private const val EXTRACT_DIR = "/" - - private const val RADARE2_BIN_PATH = "$EXTRACT_DIR/data/local/tmp/aln_unzip/org.radare.radare2installer/radare2/bin" - private const val RADARE2_LIB_PATH = "$EXTRACT_DIR/data/local/tmp/aln_unzip/org.radare.radare2installer/radare2/lib" - private const val BUSYBOX_PATH = "$EXTRACT_DIR/data/local/tmp/aln_unzip/busybox" - - private val LIBRARY_PATHS = listOf( - "/apex/com.android.bt/lib64/libbluetooth_jni.so", - "/apex/com.android.btservices/lib64/libbluetooth_jni.so", - "/system/lib64/libbluetooth_jni.so", - "/system/lib64/libbluetooth_qti.so", - "/system_ext/lib64/libbluetooth_qti.so" - ) - - fun findBluetoothLibraryPath(): String? { - for (path in LIBRARY_PATHS) { - if (File(path).exists()) { - Log.d(TAG, "Found Bluetooth library at $path") - return path - } - } - Log.e(TAG, "Could not find Bluetooth library") - return null - } - - fun clearHookOffsets(): Boolean { - try { - val process = Runtime.getRuntime().exec(arrayOf( - "su", "-c", - "setprop $HOOK_OFFSET_PROP '' && " + - "setprop $CFG_REQ_OFFSET_PROP '' && " + - "setprop $CSM_CONFIG_OFFSET_PROP '' && " + - "setprop $PEER_INFO_REQ_OFFSET_PROP ''" - )) - val exitCode = process.waitFor() - - if (exitCode == 0) { - Log.d(TAG, "Successfully cleared hook offset properties") - return true - } else { - Log.e(TAG, "Failed to clear hook offset properties, exit code: $exitCode") - } - } catch (e: Exception) { - Log.e(TAG, "Error clearing hook offset properties", e) - } - return false - } - } - - private val radare2TarballFile = File(context.cacheDir, "radare2.tar.gz") - - private val _progressState = MutableStateFlow(ProgressState.Idle) - val progressState: StateFlow = _progressState - - sealed class ProgressState { - object Idle : ProgressState() - object CheckingExisting : ProgressState() - object Downloading : ProgressState() - data class DownloadProgress(val progress: Float) : ProgressState() - object Extracting : ProgressState() - object MakingExecutable : ProgressState() - object FindingOffset : ProgressState() - object SavingOffset : ProgressState() - object Cleaning : ProgressState() - data class Error(val message: String) : ProgressState() - data class Success(val offset: Long) : ProgressState() - } - - - fun isHookOffsetAvailable(): Boolean { - Log.d(TAG, "Setup Skipped? " + ServiceManager.getService()?.applicationContext?.getSharedPreferences("settings", Context.MODE_PRIVATE)?.getBoolean("skip_setup", false).toString()) - if (ServiceManager.getService()?.applicationContext?.getSharedPreferences("settings", Context.MODE_PRIVATE)?.getBoolean("skip_setup", false) == true) { - Log.d(TAG, "Setup skipped, returning true.") - return true - } - _progressState.value = ProgressState.CheckingExisting - try { - val process = Runtime.getRuntime().exec(arrayOf("getprop", HOOK_OFFSET_PROP)) - val reader = BufferedReader(InputStreamReader(process.inputStream)) - val propValue = reader.readLine() - process.waitFor() - - if (propValue != null && propValue.isNotEmpty()) { - Log.d(TAG, "Hook offset property exists: $propValue") - _progressState.value = ProgressState.Idle - return true - } - } catch (e: Exception) { - Log.e(TAG, "Error checking if offset property exists", e) - _progressState.value = ProgressState.Error("Failed to check if offset property exists: ${e.message}") - } - - Log.d(TAG, "No hook offset available") - _progressState.value = ProgressState.Idle - return false - } - - suspend fun setupAndFindOffset(): Boolean { - val offset = findOffset() - return offset > 0 - } - - suspend fun findOffset(): Long = withContext(Dispatchers.IO) { - try { - _progressState.value = ProgressState.Downloading - if (!downloadRadare2TarballIfNeeded()) { - _progressState.value = ProgressState.Error("Failed to download radare2 tarball") - Log.e(TAG, "Failed to download radare2 tarball") - return@withContext 0L - } - - _progressState.value = ProgressState.Extracting - if (!extractRadare2Tarball()) { - _progressState.value = ProgressState.Error("Failed to extract radare2 tarball") - Log.e(TAG, "Failed to extract radare2 tarball") - return@withContext 0L - } - - _progressState.value = ProgressState.MakingExecutable - if (!makeExecutable()) { - _progressState.value = ProgressState.Error("Failed to make binaries executable") - Log.e(TAG, "Failed to make binaries executable") - return@withContext 0L - } - - _progressState.value = ProgressState.FindingOffset - val offset = findFunctionOffset() - if (offset == 0L) { - _progressState.value = ProgressState.Error("Failed to find function offset") - Log.e(TAG, "Failed to find function offset") - return@withContext 0L - } - - _progressState.value = ProgressState.SavingOffset - if (!saveOffset(offset)) { - _progressState.value = ProgressState.Error("Failed to save offset") - Log.e(TAG, "Failed to save offset") - return@withContext 0L - } - - _progressState.value = ProgressState.Cleaning - cleanupExtractedFiles() - - _progressState.value = ProgressState.Success(offset) - return@withContext offset - - } catch (e: Exception) { - _progressState.value = ProgressState.Error("Error: ${e.message}") - Log.e(TAG, "Error in findOffset", e) - return@withContext 0L - } - } - - private suspend fun downloadRadare2TarballIfNeeded(): Boolean = withContext(Dispatchers.IO) { - if (radare2TarballFile.exists() && radare2TarballFile.length() > 0) { - Log.d(TAG, "Radare2 tarball already downloaded to ${radare2TarballFile.absolutePath}") - return@withContext true - } - - try { - val url = URL(RADARE2_URL) - val connection = url.openConnection() as HttpURLConnection - connection.connectTimeout = 60000 - connection.readTimeout = 60000 - - val contentLength = connection.contentLength.toFloat() - val inputStream = connection.inputStream - val outputStream = FileOutputStream(radare2TarballFile) - - val buffer = ByteArray(4096) - var bytesRead: Int - var totalBytesRead = 0L - - while (inputStream.read(buffer).also { bytesRead = it } != -1) { - outputStream.write(buffer, 0, bytesRead) - totalBytesRead += bytesRead - if (contentLength > 0) { - val progress = totalBytesRead.toFloat() / contentLength - _progressState.value = ProgressState.DownloadProgress(progress) - } - } - - outputStream.close() - inputStream.close() - - Log.d(TAG, "Download successful to ${radare2TarballFile.absolutePath}") - return@withContext true - } catch (e: Exception) { - Log.e(TAG, "Failed to download radare2 tarball", e) - return@withContext false - } - } - - private suspend fun extractRadare2Tarball(): Boolean = withContext(Dispatchers.IO) { - try { - val isAlreadyExtracted = checkIfAlreadyExtracted() - - if (isAlreadyExtracted) { - Log.d(TAG, "Radare2 files already extracted correctly, skipping extraction") - return@withContext true - } - - Log.d(TAG, "Removing existing extract directory") - Runtime.getRuntime().exec(arrayOf("su", "-c", "rm -rf $EXTRACT_DIR/data/local/tmp/aln_unzip")).waitFor() - - Runtime.getRuntime().exec(arrayOf("su", "-c", "mkdir -p $EXTRACT_DIR/data/local/tmp/aln_unzip")).waitFor() - - Log.d(TAG, "Extracting ${radare2TarballFile.absolutePath} to $EXTRACT_DIR") - - val process = Runtime.getRuntime().exec( - arrayOf("su", "-c", "tar xvf ${radare2TarballFile.absolutePath} -C $EXTRACT_DIR") - ) - - val reader = BufferedReader(InputStreamReader(process.inputStream)) - val errorReader = BufferedReader(InputStreamReader(process.errorStream)) - - var line: String? - while (reader.readLine().also { line = it } != null) { - Log.d(TAG, "Extract output: $line") - } - - while (errorReader.readLine().also { line = it } != null) { - Log.e(TAG, "Extract error: $line") - } - - val exitCode = process.waitFor() - if (exitCode == 0) { - Log.d(TAG, "Extraction completed successfully") - return@withContext true - } else { - Log.e(TAG, "Extraction failed with exit code $exitCode") - return@withContext false - } - } catch (e: Exception) { - Log.e(TAG, "Failed to extract radare2", e) - return@withContext false - } - } - - private suspend fun checkIfAlreadyExtracted(): Boolean = withContext(Dispatchers.IO) { - try { - val checkDirProcess = Runtime.getRuntime().exec( - arrayOf("su", "-c", "[ -d $EXTRACT_DIR/data/local/tmp/aln_unzip ] && echo 'exists'") - ) - val dirExists = BufferedReader(InputStreamReader(checkDirProcess.inputStream)).readLine() == "exists" - checkDirProcess.waitFor() - - if (!dirExists) { - Log.d(TAG, "Extract directory doesn't exist, need to extract") - return@withContext false - } - - val tarProcess = Runtime.getRuntime().exec( - arrayOf("su", "-c", "tar tf ${radare2TarballFile.absolutePath}") - ) - val tarFiles = BufferedReader(InputStreamReader(tarProcess.inputStream)).readLines() - .filter { it.isNotEmpty() } - .map { it.trim() } - .toSet() - tarProcess.waitFor() - - if (tarFiles.isEmpty()) { - Log.e(TAG, "Failed to get file list from tarball") - return@withContext false - } - - val findProcess = Runtime.getRuntime().exec( - arrayOf("su", "-c", "find $EXTRACT_DIR/data/local/tmp/aln_unzip -type f | sort") - ) - val extractedFiles = BufferedReader(InputStreamReader(findProcess.inputStream)).readLines() - .filter { it.isNotEmpty() } - .map { it.trim() } - .toSet() - findProcess.waitFor() - - if (extractedFiles.isEmpty()) { - Log.d(TAG, "No files found in extract directory, need to extract") - return@withContext false - } - - for (tarFile in tarFiles) { - if (tarFile.endsWith("/")) continue - - val filePathInExtractDir = "$EXTRACT_DIR/$tarFile" - val fileCheckProcess = Runtime.getRuntime().exec( - arrayOf("su", "-c", "[ -f $filePathInExtractDir ] && echo 'exists'") - ) - val fileExists = BufferedReader(InputStreamReader(fileCheckProcess.inputStream)).readLine() == "exists" - fileCheckProcess.waitFor() - - if (!fileExists) { - Log.d(TAG, "File $filePathInExtractDir from tarball missing in extract directory") - Runtime.getRuntime().exec(arrayOf("su", "-c", "rm -rf $EXTRACT_DIR/data/local/tmp/aln_unzip")).waitFor() - return@withContext false - } - } - - Log.d(TAG, "All ${tarFiles.size} files from tarball exist in extract directory") - return@withContext true - } catch (e: Exception) { - Log.e(TAG, "Error checking extraction status", e) - return@withContext false - } - } - - private suspend fun makeExecutable(): Boolean = withContext(Dispatchers.IO) { - try { - Log.d(TAG, "Making binaries executable in $RADARE2_BIN_PATH") - val chmod1Result = Runtime.getRuntime().exec( - arrayOf("su", "-c", "chmod -R 755 $RADARE2_BIN_PATH") - ).waitFor() - - Log.d(TAG, "Making binaries executable in $BUSYBOX_PATH") - - val chmod2Result = Runtime.getRuntime().exec( - arrayOf("su", "-c", "chmod -R 755 $BUSYBOX_PATH") - ).waitFor() - - if (chmod1Result == 0 && chmod2Result == 0) { - Log.d(TAG, "Successfully made binaries executable") - return@withContext true - } else { - Log.e(TAG, "Failed to make binaries executable, exit codes: $chmod1Result, $chmod2Result") - return@withContext false - } - } catch (e: Exception) { - Log.e(TAG, "Error making binaries executable", e) - return@withContext false - } - } - - private suspend fun findFunctionOffset(): Long = withContext(Dispatchers.IO) { - val libraryPath = findBluetoothLibraryPath() ?: return@withContext 0L - var offset = 0L - - try { - @Suppress("LocalVariableName") val currentLD_LIBRARY_PATH = ProcessBuilder().command("su", "-c", "printenv LD_LIBRARY_PATH").start().inputStream.bufferedReader().readText().trim() - val currentPATH = ProcessBuilder().command("su", "-c", "printenv PATH").start().inputStream.bufferedReader().readText().trim() - val envSetup = """ - export LD_LIBRARY_PATH="$RADARE2_LIB_PATH:$currentLD_LIBRARY_PATH" - export PATH="$BUSYBOX_PATH:$RADARE2_BIN_PATH:$currentPATH" - """.trimIndent() - - val command = "$envSetup && $RADARE2_BIN_PATH/rabin2 -q -E $libraryPath | grep fcr_chk_chan" - Log.d(TAG, "Running command: $command") - - val process = Runtime.getRuntime().exec(arrayOf("su", "-c", command)) - - val reader = BufferedReader(InputStreamReader(process.inputStream)) - val errorReader = BufferedReader(InputStreamReader(process.errorStream)) - - var line: String? - - while (reader.readLine().also { line = it } != null) { - Log.d(TAG, "rabin2 output: $line") - if (line?.contains("fcr_chk_chan") == true) { - val parts = line.split(" ") - if (parts.isNotEmpty() && parts[0].startsWith("0x")) { - offset = parts[0].substring(2).toLong(16) - Log.d(TAG, "Found offset at ${parts[0]}") - break - } - } - } - - while (errorReader.readLine().also { line = it } != null) { - Log.d(TAG, "rabin2 error: $line") - } - - val exitCode = process.waitFor() - if (exitCode != 0) { - Log.e(TAG, "rabin2 command failed with exit code $exitCode") - } - -// findAndSaveL2cuProcessCfgReqOffset(libraryPath, envSetup) -// findAndSaveL2cCsmConfigOffset(libraryPath, envSetup) -// findAndSaveL2cuSendPeerInfoReqOffset(libraryPath, envSetup) - - } catch (e: Exception) { - Log.e(TAG, "Failed to find function offset", e) - return@withContext 0L - } - - if (offset == 0L) { - Log.e(TAG, "Failed to extract function offset from output, aborting") - return@withContext 0L - } - - Log.d(TAG, "Successfully found offset: 0x${offset.toString(16)}") - return@withContext offset - } - - private suspend fun findAndSaveL2cuProcessCfgReqOffset(libraryPath: String, envSetup: String) = withContext(Dispatchers.IO) { - try { - val command = "$envSetup && $RADARE2_BIN_PATH/rabin2 -q -E $libraryPath | grep l2cu_process_our_cfg_req" - Log.d(TAG, "Running command: $command") - - val process = Runtime.getRuntime().exec(arrayOf("su", "-c", command)) - val reader = BufferedReader(InputStreamReader(process.inputStream)) - val errorReader = BufferedReader(InputStreamReader(process.errorStream)) - - var line: String? - var offset = 0L - - while (reader.readLine().also { line = it } != null) { - Log.d(TAG, "rabin2 output: $line") - if (line?.contains("l2cu_process_our_cfg_req") == true) { - val parts = line.split(" ") - if (parts.isNotEmpty() && parts[0].startsWith("0x")) { - offset = parts[0].substring(2).toLong(16) - Log.d(TAG, "Found l2cu_process_our_cfg_req offset at ${parts[0]}") - break - } - } - } - - while (errorReader.readLine().also { line = it } != null) { - Log.d(TAG, "rabin2 error: $line") - } - - val exitCode = process.waitFor() - if (exitCode != 0) { - Log.e(TAG, "rabin2 command failed with exit code $exitCode") - } - - if (offset > 0L) { - val hexString = "0x${offset.toString(16)}" - Runtime.getRuntime().exec(arrayOf( - "su", "-c", "setprop $CFG_REQ_OFFSET_PROP $hexString" - )).waitFor() - Log.d(TAG, "Saved l2cu_process_our_cfg_req offset: $hexString") - } - } catch (e: Exception) { - Log.e(TAG, "Failed to find or save l2cu_process_our_cfg_req offset", e) - } - } - - private suspend fun findAndSaveL2cCsmConfigOffset(libraryPath: String, envSetup: String) = withContext(Dispatchers.IO) { - try { - val command = "$envSetup && $RADARE2_BIN_PATH/rabin2 -q -E $libraryPath | grep l2c_csm_config" - Log.d(TAG, "Running command: $command") - - val process = Runtime.getRuntime().exec(arrayOf("su", "-c", command)) - val reader = BufferedReader(InputStreamReader(process.inputStream)) - val errorReader = BufferedReader(InputStreamReader(process.errorStream)) - - var line: String? - var offset = 0L - - while (reader.readLine().also { line = it } != null) { - Log.d(TAG, "rabin2 output: $line") - if (line?.contains("l2c_csm_config") == true) { - val parts = line.split(" ") - if (parts.isNotEmpty() && parts[0].startsWith("0x")) { - offset = parts[0].substring(2).toLong(16) - Log.d(TAG, "Found l2c_csm_config offset at ${parts[0]}") - break - } - } - } - - while (errorReader.readLine().also { line = it } != null) { - Log.d(TAG, "rabin2 error: $line") - } - - val exitCode = process.waitFor() - if (exitCode != 0) { - Log.e(TAG, "rabin2 command failed with exit code $exitCode") - } - - if (offset > 0L) { - val hexString = "0x${offset.toString(16)}" - Runtime.getRuntime().exec(arrayOf( - "su", "-c", "setprop $CSM_CONFIG_OFFSET_PROP $hexString" - )).waitFor() - Log.d(TAG, "Saved l2c_csm_config offset: $hexString") - } - } catch (e: Exception) { - Log.e(TAG, "Failed to find or save l2c_csm_config offset", e) - } - } - - private suspend fun findAndSaveL2cuSendPeerInfoReqOffset(libraryPath: String, envSetup: String) = withContext(Dispatchers.IO) { - try { - val command = "$envSetup && $RADARE2_BIN_PATH/rabin2 -q -E $libraryPath | grep l2cu_send_peer_info_req" - Log.d(TAG, "Running command: $command") - - val process = Runtime.getRuntime().exec(arrayOf("su", "-c", command)) - val reader = BufferedReader(InputStreamReader(process.inputStream)) - val errorReader = BufferedReader(InputStreamReader(process.errorStream)) - - var line: String? - var offset = 0L - - while (reader.readLine().also { line = it } != null) { - Log.d(TAG, "rabin2 output: $line") - if (line?.contains("l2cu_send_peer_info_req") == true) { - val parts = line.split(" ") - if (parts.isNotEmpty() && parts[0].startsWith("0x")) { - offset = parts[0].substring(2).toLong(16) - Log.d(TAG, "Found l2cu_send_peer_info_req offset at ${parts[0]}") - break - } - } - } - - while (errorReader.readLine().also { line = it } != null) { - Log.d(TAG, "rabin2 error: $line") - } - - val exitCode = process.waitFor() - if (exitCode != 0) { - Log.e(TAG, "rabin2 command failed with exit code $exitCode") - } - - if (offset > 0L) { - val hexString = "0x${offset.toString(16)}" - Runtime.getRuntime().exec(arrayOf( - "su", "-c", "setprop $PEER_INFO_REQ_OFFSET_PROP $hexString" - )).waitFor() - Log.d(TAG, "Saved l2cu_send_peer_info_req offset: $hexString") - } - } catch (e: Exception) { - Log.e(TAG, "Failed to find or save l2cu_send_peer_info_req offset", e) - } - } - - private suspend fun saveOffset(offset: Long): Boolean = withContext(Dispatchers.IO) { - try { - val hexString = "0x${offset.toString(16)}" - Log.d(TAG, "Saving offset to system property: $hexString") - - val process = Runtime.getRuntime().exec(arrayOf( - "su", "-c", "setprop $HOOK_OFFSET_PROP $hexString" - )) - - val exitCode = process.waitFor() - if (exitCode == 0) { - val verifyProcess = Runtime.getRuntime().exec(arrayOf( - "getprop", HOOK_OFFSET_PROP - )) - val propValue = BufferedReader(InputStreamReader(verifyProcess.inputStream)).readLine() - verifyProcess.waitFor() - - if (propValue != null && propValue.isNotEmpty()) { - Log.d(TAG, "Successfully saved offset to system property: $propValue") - return@withContext true - } else { - Log.e(TAG, "Property was set but couldn't be verified") - } - } else { - Log.e(TAG, "Failed to set property, exit code: $exitCode") - } - return@withContext false - } catch (e: Exception) { - Log.e(TAG, "Failed to save offset", e) - return@withContext false - } - } - - private fun cleanupExtractedFiles() { - try { - Runtime.getRuntime().exec(arrayOf("su", "-c", "rm -rf $EXTRACT_DIR/data/local/tmp/aln_unzip")).waitFor() - Log.d(TAG, "Cleaned up extracted files at $EXTRACT_DIR/data/local/tmp/aln_unzip") - } catch (e: Exception) { - Log.e(TAG, "Failed to cleanup extracted files", e) - } - } -}