Attend XDA's Second Annual Developer Conference, XDA:DevCon 2014!
5,780,834 Members 50,901 Now Online
XDA Developers Android and Mobile Development Forum

Getting AllShare Cast working on modified devices

Tip us?
 
MohammadAG
Old
(Last edited by MohammadAG; 7th November 2013 at 01:32 PM.)
#1  
Recognized Developer - OP
Thanks Meter 4,852
Posts: 1,071
Join Date: Sep 2009
Location: Jerusalem

 
DONATE TO ME
Default Getting AllShare Cast working on modified devices

Solutions for devices:
Installation:
  • Using a root-enabled file explorer, like Root Explorer, make a backup of /system/lib/libWFD_ENGINE.so
  • Download the file corresponding to your device from above, unzip the zip file, and copy the so file to /system/lib, replacing the one already there (again, make a backup).
  • Set permissions to 644 / -rw-r--r-- and reboot.

Old post:
AllShare Cast is Samsung's implementation of Screen Mirroring. It refuses to work on a modified device:

Logcat of where the error occurs:
[CODE]I/WFD_Rtsp( 2483): content protection info found!!!
I/WFD_Rtsp( 2483): HDCP is supported by sink
I/WFD_Rtsp( 2483): HDCP port is 1189
I/WFD_Rtsp( 2483): HDCP2 init failed:-650. time: 4155
I/WFD_Rtsp_Engine( 2483): RTSP_REQUEST_HDCP_FAIL
E/WFDSourceSignalTask( 2483): HDCP init fail
V/WFDSourceEngine( 2483): Called OnErrorNoti()
E/IWFDTask( 2483): is Passive Task, Can't Send Event
E/IWFDTask( 2483): is Passive Task, Can't Send Event
E/IWFDTask( 2483): SourceAudioTask is Passive Task, Can't Send Event
E/IWFDTask( 2483): is Passive Task, Can't Send Event
V/WFDNativeCPP( 2483): [Remote] WFD_NOTI_TO_APP_ERROR
D/WFDService( 2955): onDisplayError
D/WFDService( 2955): sendWfdStartForPopup
Follow me on Twitter: @MohammadAG
Google+: https://plus.google.com/103508952817353883168/posts

Check out my Xposed modules.
Send files with Android Beamô on Android 4.1+: File Beam (Touch to Send)
Enable USB Mass Storage Mode on Samsung devices with SG USB Mass Storage Enabler.
Use your flashlight at different brightness levels with Adjustable Torch.
Enable Music Controls on your S-View screen with S-View Music Controls
The Following 23 Users Say Thank You to MohammadAG For This Useful Post: [ Click to Expand ]
 
chenxiaolong
Old
(Last edited by chenxiaolong; 27th August 2013 at 06:56 AM.)
#2  
chenxiaolong's Avatar
Senior Member
Thanks Meter 3,412
Posts: 1,483
Join Date: Sep 2011
Location: Solon

 
DONATE TO ME
Quote:
Originally Posted by MohammadAG View Post
AllShare Cast is Samsung's implementation of Screen Mirroring. It refuses to work on a modified device:

Logcat of where the error occurs:
Code:
I/WFD_Rtsp( 2483): content protection info found!!!
I/WFD_Rtsp( 2483): HDCP is supported by sink
I/WFD_Rtsp( 2483): HDCP port is 1189
I/WFD_Rtsp( 2483): HDCP2 init failed:-650. time: 4155
I/WFD_Rtsp_Engine( 2483): RTSP_REQUEST_HDCP_FAIL 
E/WFDSourceSignalTask( 2483): HDCP init fail
V/WFDSourceEngine( 2483): Called OnErrorNoti()
E/IWFDTask( 2483):  is Passive Task, Can't Send Event
E/IWFDTask( 2483):  is Passive Task, Can't Send Event
E/IWFDTask( 2483): SourceAudioTask is Passive Task, Can't Send Event
E/IWFDTask( 2483):  is Passive Task, Can't Send Event
V/WFDNativeCPP( 2483): [Remote] WFD_NOTI_TO_APP_ERROR
D/WFDService( 2955): onDisplayError
D/WFDService( 2955): sendWfdStartForPopup << POPUP_CAUSE_CONNECTION_DISCONNECT
I/WFDNativeCPP( 2483): [Remote] WFDNative_setParam type:40 data:0
D/RemoteDisplay_Java( 2955): nativeSetWFDParam:1
Looking through the system libraries, the error originates from a shared library: libWFD_ENGINE.so (the library also has a reference to libhdcp2.so)
I've gone through Android's source code and I can't seem to find a reference to that library anywhere in the source code, so I guess it's specific to Samsung.

Ways to get around this:
  • Use Cydia Substrate to hook the native code, making HDCP always init successfully.
  • Find out how the library gets system status.

The first way requires disassembling the shared library and looking for ways to get HDCP to work. This might be very hard to do.
The second part may be easier, if it's just parsing some file in procfs or sysfs or something it can be patched at the kernel level, which might be easier to do considering the kernel's source is out there.

The library doesn't check for su btw, there are reports of users having it work without unrooting their devices. The library also doesn't talk to SysScope, as that was patched numerous times by Xposed modules so it returns Official status, but that also doesn't work.
I'm guessing you're going to have to hack libhdcp2.so. I've found that it deals with 3 paths:
  • /data/system/hdcp2
  • /system/etc/srm.bin
  • /dev/qseecom

I'm guessing /dev/qseecom is the important one as that's the interface to ARM's TrustZone stuff. I'm no assembly expert though, so I have no idea how to interpret the decompiled library

EDIT: Don't know if it's helpful, but if you see something like:

Code:
_ZN11CWFD_HdcpCp22WFD_HdcpSessionConnectEm
when running "strings system/lib/...", run this to translate it into a readable function signature:

Code:
$ echo '_ZN11CWFD_HdcpCp22WFD_HdcpSessionConnectEm' | c++filt
CWFD_HdcpCp::WFD_HdcpSessionConnect(unsigned long)
Current phone: Samsung Galaxy S4 SGH-M919 (T-Mobile) & Nexus 5

I'm making CM 11.0 nightlies with IR, app2sd support, glove mode, and dual booting for all Galaxy S4 variants here: http://forum.xda-developers.com/show....php?t=2383143

I'm the author of the dialer lookup feature in SlimRoms and CyanogenMod. Please PM me for feature requests or to report bugs!
The Following User Says Thank You to chenxiaolong For This Useful Post: [ Click to Expand ]
 
MohammadAG
Old
#3  
Recognized Developer - OP
Thanks Meter 4,852
Posts: 1,071
Join Date: Sep 2009
Location: Jerusalem

 
DONATE TO ME
Quote:
Originally Posted by chenxiaolong View Post
I'm guessing you're going to have to hack libhdcp2.so. I've found that it deals with 3 paths:
  • /data/system/hdcp2
  • /system/etc/srm.bin
  • /dev/qseecom

I'm guessing /dev/qseecom is the important one as that's the interface to ARM's TrustZone stuff. I'm no assembly expert though, so I have no idea how to interpret the decompiled library
Hmm, I'm guessing you have a Qualcomm device? My libhdcp2.so doesn't have a reference to /dev/qseecom (it doesn't even exist), instead it seems to interface with /dev/s5p-smem.
Follow me on Twitter: @MohammadAG
Google+: https://plus.google.com/103508952817353883168/posts

Check out my Xposed modules.
Send files with Android Beamô on Android 4.1+: File Beam (Touch to Send)
Enable USB Mass Storage Mode on Samsung devices with SG USB Mass Storage Enabler.
Use your flashlight at different brightness levels with Adjustable Torch.
Enable Music Controls on your S-View screen with S-View Music Controls
 
chenxiaolong
Old
#4  
chenxiaolong's Avatar
Senior Member
Thanks Meter 3,412
Posts: 1,483
Join Date: Sep 2011
Location: Solon

 
DONATE TO ME
Quote:
Originally Posted by MohammadAG View Post
Hmm, I'm guessing you have a Qualcomm device? My libhdcp2.so doesn't have a reference to /dev/qseecom (it doesn't even exist), instead it seems to interface with /dev/s5p-smem.
Yeah, I should have mentioned that. I have the T-Mobile SGH-M919 model. I also don't have a libWFD_ENGINE.so, but I do have a libwfdhdcpcp.so.

I've attached the libhdcp2.so and libwfd* libraries from the Qualcomm variants.
Attached Files
File Type: zip system.zip - [Click for QR Code] (384.3 KB, 219 views)
Current phone: Samsung Galaxy S4 SGH-M919 (T-Mobile) & Nexus 5

I'm making CM 11.0 nightlies with IR, app2sd support, glove mode, and dual booting for all Galaxy S4 variants here: http://forum.xda-developers.com/show....php?t=2383143

I'm the author of the dialer lookup feature in SlimRoms and CyanogenMod. Please PM me for feature requests or to report bugs!
The Following User Says Thank You to chenxiaolong For This Useful Post: [ Click to Expand ]
 
MohammadAG
Old
#5  
Recognized Developer - OP
Thanks Meter 4,852
Posts: 1,071
Join Date: Sep 2009
Location: Jerusalem

 
DONATE TO ME
Quote:
Originally Posted by chenxiaolong View Post
Yeah, I should have mentioned that. I have the T-Mobile SGH-M919 model. I also don't have a libWFD_ENGINE.so, but I do have a libwfdhdcpcp.so.

I've attached the libhdcp2.so and libwfd* libraries from the Qualcomm variants.
I've been doing some tests on a Note 2, that also fails when the device is modified, but there are easy ways to get that back to stock.
* I've confirmed that SysScope isn't used at all, it works fine even when device status is Settings is modified.
* HDCP also fails to init on the Note 2, but the logcat is a bit more verbose. I didn't copy the logcat, but it does indeed state that TZ failed to open, or opened and then got closed, so this is a TrustZone issue for sure.

I've been digging around the kernel source code, and I found references to wfd in secmem.c, which does point to s5p-smem here https://github.com/AndreiLux/Perseus...s/secmem.c#L43
I'm pretty sure the same goes for the Qualcomm variant.

What I'm not sure of is the CONFIG_EXYNOS_CONTENT_PATH_PROTECTION, it's set to y in the kernel config, I wonder if disabling it would make this all work.

Also, I can't grasp how to communicate with the TZ, trying to read from /dev/s5p-smem throws an Invalid Argument error.
Follow me on Twitter: @MohammadAG
Google+: https://plus.google.com/103508952817353883168/posts

Check out my Xposed modules.
Send files with Android Beamô on Android 4.1+: File Beam (Touch to Send)
Enable USB Mass Storage Mode on Samsung devices with SG USB Mass Storage Enabler.
Use your flashlight at different brightness levels with Adjustable Torch.
Enable Music Controls on your S-View screen with S-View Music Controls
 
chenxiaolong
Old
(Last edited by chenxiaolong; 27th August 2013 at 10:40 PM.)
#6  
chenxiaolong's Avatar
Senior Member
Thanks Meter 3,412
Posts: 1,483
Join Date: Sep 2011
Location: Solon

 
DONATE TO ME
Quote:
Originally Posted by MohammadAG View Post
I've been doing some tests on a Note 2, that also fails when the device is modified, but there are easy ways to get that back to stock.
* I've confirmed that SysScope isn't used at all, it works fine even when device status is Settings is modified.
* HDCP also fails to init on the Note 2, but the logcat is a bit more verbose. I didn't copy the logcat, but it does indeed state that TZ failed to open, or opened and then got closed, so this is a TrustZone issue for sure.

I've been digging around the kernel source code, and I found references to wfd in secmem.c, which does point to s5p-smem here https://github.com/AndreiLux/Perseus...s/secmem.c#L43
I'm pretty sure the same goes for the Qualcomm variant.

What I'm not sure of is the CONFIG_EXYNOS_CONTENT_PATH_PROTECTION, it's set to y in the kernel config, I wonder if disabling it would make this all work.

Also, I can't grasp how to communicate with the TZ, trying to read from /dev/s5p-smem throws an Invalid Argument error.
Hmm, I just tried reading from /dev/qseecom and I get the exact same Invalid Argument error. I've read somewhere on XDA that WIFI passwords are stored in TZ when a Samsung signed kernel is used and they're stored in wpa_supplicant.conf when the kernel is not official.

That leads me to think that TrustZone only works if the signatures match. There's also a chance that it won't work if the binary counter is not 0.

EDIT: Currently, only Qualcomm devices can have their counter reset though. Unfortunately, I don't have any Allshare/Miracast receivers to test with.

EDIT2: WFD apparently stands for WiFi Display: https://github.com/ktoonsez/KT-SGS4/...eo/msm-wfd.txt

EDIT3: Don't know if this is useful. If you decompile SecSettings.apk and take a look at com/android/settings/DevelopmentSettings.java, there's this function:

Code:
  private void removeHdcpOptionsForProduction()
  {
    if ("user".equals(Build.TYPE))
    {
      Preference localPreference = findPreference("hdcp_checking");
      if (localPreference != null)
      {
        getPreferenceScreen().removePreference(localPreference);
        this.mAllPrefs.remove(localPreference);
      }
    }
  }
Changing the build type from user to userdebug in build.prop should enable the HDCP checkbox in development settings. I don't think this will work, but it's worth a try.
Current phone: Samsung Galaxy S4 SGH-M919 (T-Mobile) & Nexus 5

I'm making CM 11.0 nightlies with IR, app2sd support, glove mode, and dual booting for all Galaxy S4 variants here: http://forum.xda-developers.com/show....php?t=2383143

I'm the author of the dialer lookup feature in SlimRoms and CyanogenMod. Please PM me for feature requests or to report bugs!
 
sorg
Old
#7  
Senior Member
Thanks Meter 569
Posts: 690
Join Date: Sep 2006
Location: 台灣
Well, i've hacked libWFD_ENGINE.so some time ago for my own needs. The way i've able to make it work only by disabling HDCP. So, this hacked version uses clear data without HDCP to talk with AllShareCast dongle.
I don't know if generic miracast dongles will accept data without HDCP as i don't have such device.

Included version for I9500 works with I9500XWUBMG1, I9500XXUBMG9, I9500UBUBMH1. Probably, it's compatible with other firmware versions.

P.S.: Since it's developers forum, you should know how to replace the file.
P.P.S: You can use this patched version in any ROM you want, but please give a credit to me.
Attached Files
File Type: zip libWFD_ENGINE.zip - [Click for QR Code] (111.0 KB, 772 views)
Samsung Galaxy S4 SHV-E330S: Optimus ROM (TW 4.4.2) & Kernel. CPU OC 2.7GHz, GPU OC 645MHz, non-KNOX bootloader, UHD/SM/360 Camera.
Samsung Galaxy S4 GT-I9500: Optimus ROM (TW 4.3), Perseus Kernel. CPU No-OC, GPU OC 700MHz, non-KNOX bootloader.
Past models: Samsung Galaxy SIII SHV-E210K & GT-I9300, Samsung Galaxy SII GT-I9100.
The Following 10 Users Say Thank You to sorg For This Useful Post: [ Click to Expand ]
 
MohammadAG
Old
#8  
Recognized Developer - OP
Thanks Meter 4,852
Posts: 1,071
Join Date: Sep 2009
Location: Jerusalem

 
DONATE TO ME
Quote:
Originally Posted by chenxiaolong View Post
EDIT3: Don't know if this is useful. If you decompile SecSettings.apk and take a look at com/android/settings/DevelopmentSettings.java, there's this function:

Code:
  private void removeHdcpOptionsForProduction()
  {
    if ("user".equals(Build.TYPE))
    {
      Preference localPreference = findPreference("hdcp_checking");
      if (localPreference != null)
      {
        getPreferenceScreen().removePreference(localPreference);
        this.mAllPrefs.remove(localPreference);
      }
    }
  }
Changing the build type from user to userdebug in build.prop should enable the HDCP checkbox in development settings. I don't think this will work, but it's worth a try.
Tried that, didn't work, pretty sure that's for MHL or plain HDMI ports on some devices.

Quote:
Originally Posted by sorg View Post
Well, i've hacked libWFD_ENGINE.so some time ago for my own needs. The way i've able to make it work only by disabling HDCP. So, this hacked version uses clear data without HDCP to talk with AllShareCast dongle.
I don't know if generic miracast dongles will accept data without HDCP as i don't have such device.

Included version for I9500 works with I9500XWUBMG1, I9500XXUBMG9, I9500UBUBMH1. Probably, it's compatible with other firmware versions.

P.S.: Since it's developers forum, you should know how to replace the file.
P.P.S: You can use this patched version in any ROM you want, but please give a credit to me.
That actually worked (XWUMBG5). I'm no ROM dev, but if I do end up making a patch with Cydia Substrate (if I figure that out), I'll be sure to credit you

Thanks!
Follow me on Twitter: @MohammadAG
Google+: https://plus.google.com/103508952817353883168/posts

Check out my Xposed modules.
Send files with Android Beamô on Android 4.1+: File Beam (Touch to Send)
Enable USB Mass Storage Mode on Samsung devices with SG USB Mass Storage Enabler.
Use your flashlight at different brightness levels with Adjustable Torch.
Enable Music Controls on your S-View screen with S-View Music Controls
 
sorg
Old
#9  
Senior Member
Thanks Meter 569
Posts: 690
Join Date: Sep 2006
Location: 台灣
Quote:
Originally Posted by MohammadAG View Post
making a patch with Cydia Substrate
I've thought Cydia Substrate gives something special, but after quick look i've found it providing not more than XPosed already provides. You cannot make patch for this using Cydia Substrate because the only thing you can do by this is to hook JNI functions called from Dalvik code (you can do the same in Xposed). You cannot hook internal lib functions where the "magic" happens.
The only way is to replace the whole lib i've provided so far.
Samsung Galaxy S4 SHV-E330S: Optimus ROM (TW 4.4.2) & Kernel. CPU OC 2.7GHz, GPU OC 645MHz, non-KNOX bootloader, UHD/SM/360 Camera.
Samsung Galaxy S4 GT-I9500: Optimus ROM (TW 4.3), Perseus Kernel. CPU No-OC, GPU OC 700MHz, non-KNOX bootloader.
Past models: Samsung Galaxy SIII SHV-E210K & GT-I9300, Samsung Galaxy SII GT-I9100.
The Following User Says Thank You to sorg For This Useful Post: [ Click to Expand ]
 
MohammadAG
Old
(Last edited by MohammadAG; 28th August 2013 at 12:00 PM.)
#10  
Recognized Developer - OP
Thanks Meter 4,852
Posts: 1,071
Join Date: Sep 2009
Location: Jerusalem

 
DONATE TO ME
Quote:
Originally Posted by sorg View Post
I've thought Cydia Substrate gives something special, but after quick look i've found it providing not more than XPosed already provides. You cannot make patch for this using Cydia Substrate because the only thing you can do by this is to hook JNI functions called from Dalvik code (you can do the same in Xposed). You cannot hook internal lib functions where the "magic" happens.
The only way is to replace the whole lib i've provided so far.
Heh, ironic how iOS devs dissed Xposed as not hooking C++ code, I actually thought Cydia Substrate would hook any C++ code on the system.

Oh well, thanks for saving me hours of going through Cydia's docs.

BTW, you might want to post your solution here, http://forum.xda-developers.com/show....php?t=2269150
I don't think a lot of users read this forum.

Sent from my Samsung Galaxy S4 (i9500)
Follow me on Twitter: @MohammadAG
Google+: https://plus.google.com/103508952817353883168/posts

Check out my Xposed modules.
Send files with Android Beamô on Android 4.1+: File Beam (Touch to Send)
Enable USB Mass Storage Mode on Samsung devices with SG USB Mass Storage Enabler.
Use your flashlight at different brightness levels with Adjustable Torch.
Enable Music Controls on your S-View screen with S-View Music Controls

Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes