Getting AllShare Cast working on modified devices

[MohammadAG]

Solutions for devices:

• Galaxy S4 (I9500) by @sorg
• Galaxy Note 8.0 by @mrmrmrmr
• Galaxy Note 2 (N7100 / 4.3 only) by doandu1234
• Galaxy SIII (I9300 / 4.3 only) by @mrmrmrmr

Installation:

• Using a root-enabled file explorer, like Root Explorer, make a backup of /system/lib/libWFD_ENGINE.so
• Download the file corresponding to your device from above, unzip the zip file, and copy the so file to /system/lib, replacing the one already there (again, make a backup).
• Set permissions to 644 / -rw-r--r-- and reboot.

Old post:
AllShare Cast is Samsung's implementation of Screen Mirroring. It refuses to work on a modified device:

Logcat of where the error occurs:

I/WFD_Rtsp( 2483): content protection info found!!!
I/WFD_Rtsp( 2483): HDCP is supported by sink
I/WFD_Rtsp( 2483): HDCP port is 1189
I/WFD_Rtsp( 2483): HDCP2 init failed:-650. time: 4155
I/WFD_Rtsp_Engine( 2483): RTSP_REQUEST_HDCP_FAIL 
E/WFDSourceSignalTask( 2483): HDCP init fail
V/WFDSourceEngine( 2483): Called OnErrorNoti()
E/IWFDTask( 2483):  is Passive Task, Can't Send Event
E/IWFDTask( 2483):  is Passive Task, Can't Send Event
E/IWFDTask( 2483): SourceAudioTask is Passive Task, Can't Send Event
E/IWFDTask( 2483):  is Passive Task, Can't Send Event
V/WFDNativeCPP( 2483): [Remote] WFD_NOTI_TO_APP_ERROR
D/WFDService( 2955): onDisplayError
D/WFDService( 2955): sendWfdStartForPopup

 

[chenxiaolong]

AllShare Cast is Samsung's implementation of Screen Mirroring. It refuses to work on a modified device:

Logcat of where the error occurs:

I/WFD_Rtsp( 2483): content protection info found!!!
I/WFD_Rtsp( 2483): HDCP is supported by sink
I/WFD_Rtsp( 2483): HDCP port is 1189
I/WFD_Rtsp( 2483): HDCP2 init failed:-650. time: 4155
I/WFD_Rtsp_Engine( 2483): RTSP_REQUEST_HDCP_FAIL 
E/WFDSourceSignalTask( 2483): HDCP init fail
V/WFDSourceEngine( 2483): Called OnErrorNoti()
E/IWFDTask( 2483):  is Passive Task, Can't Send Event
E/IWFDTask( 2483):  is Passive Task, Can't Send Event
E/IWFDTask( 2483): SourceAudioTask is Passive Task, Can't Send Event
E/IWFDTask( 2483):  is Passive Task, Can't Send Event
V/WFDNativeCPP( 2483): [Remote] WFD_NOTI_TO_APP_ERROR
D/WFDService( 2955): onDisplayError
D/WFDService( 2955): sendWfdStartForPopup << POPUP_CAUSE_CONNECTION_DISCONNECT
I/WFDNativeCPP( 2483): [Remote] WFDNative_setParam type:40 data:0
D/RemoteDisplay_Java( 2955): nativeSetWFDParam:1

Looking through the system libraries, the error originates from a shared library: libWFD_ENGINE.so (the library also has a reference to libhdcp2.so)
I've gone through Android's source code and I can't seem to find a reference to that library anywhere in the source code, so I guess it's specific to Samsung.

Ways to get around this:

• Use Cydia Substrate to hook the native code, making HDCP always init successfully.
• Find out how the library gets system status.

The first way requires disassembling the shared library and looking for ways to get HDCP to work. This might be very hard to do.
The second part may be easier, if it's just parsing some file in procfs or sysfs or something it can be patched at the kernel level, which might be easier to do considering the kernel's source is out there.

The library doesn't check for su btw, there are reports of users having it work without unrooting their devices. The library also doesn't talk to SysScope, as that was patched numerous times by Xposed modules so it returns Official status, but that also doesn't work.

I'm guessing you're going to have to hack libhdcp2.so. I've found that it deals with 3 paths:

• /data/system/hdcp2
• /system/etc/srm.bin
• /dev/qseecom

I'm guessing /dev/qseecom is the important one as that's the interface to ARM's TrustZone stuff. I'm no assembly expert though, so I have no idea how to interpret the decompiled library

EDIT: Don't know if it's helpful, but if you see something like:

_ZN11CWFD_HdcpCp22WFD_HdcpSessionConnectEm

when running "strings system/lib/...", run this to translate it into a readable function signature:

$ echo '_ZN11CWFD_HdcpCp22WFD_HdcpSessionConnectEm' | c++filt
CWFD_HdcpCp::WFD_HdcpSessionConnect(unsigned long)

 

[MohammadAG]

I'm guessing you're going to have to hack libhdcp2.so. I've found that it deals with 3 paths:

• /data/system/hdcp2
• /system/etc/srm.bin
• /dev/qseecom

I'm guessing /dev/qseecom is the important one as that's the interface to ARM's TrustZone stuff. I'm no assembly expert though, so I have no idea how to interpret the decompiled library

Hmm, I'm guessing you have a Qualcomm device? My libhdcp2.so doesn't have a reference to /dev/qseecom (it doesn't even exist), instead it seems to interface with /dev/s5p-smem.

 

[chenxiaolong]

Hmm, I'm guessing you have a Qualcomm device? My libhdcp2.so doesn't have a reference to /dev/qseecom (it doesn't even exist), instead it seems to interface with /dev/s5p-smem.

Yeah, I should have mentioned that. I have the T-Mobile SGH-M919 model. I also don't have a libWFD_ENGINE.so, but I do have a libwfdhdcpcp.so.

I've attached the libhdcp2.so and libwfd* libraries from the Qualcomm variants.

 

[MohammadAG]

Yeah, I should have mentioned that. I have the T-Mobile SGH-M919 model. I also don't have a libWFD_ENGINE.so, but I do have a libwfdhdcpcp.so.

I've attached the libhdcp2.so and libwfd* libraries from the Qualcomm variants.

I've been doing some tests on a Note 2, that also fails when the device is modified, but there are easy ways to get that back to stock.
* I've confirmed that SysScope isn't used at all, it works fine even when device status is Settings is modified.
* HDCP also fails to init on the Note 2, but the logcat is a bit more verbose. I didn't copy the logcat, but it does indeed state that TZ failed to open, or opened and then got closed, so this is a TrustZone issue for sure.

I've been digging around the kernel source code, and I found references to wfd in secmem.c, which does point to s5p-smem here https://github.com/AndreiLux/Perseus-UNIVERSAL5410/blob/perseus/arch/arm/mach-exynos/secmem.c#L43
I'm pretty sure the same goes for the Qualcomm variant.

What I'm not sure of is the CONFIG_EXYNOS_CONTENT_PATH_PROTECTION, it's set to y in the kernel config, I wonder if disabling it would make this all work.

Also, I can't grasp how to communicate with the TZ, trying to read from /dev/s5p-smem throws an Invalid Argument error.

 

[chenxiaolong]

I've been doing some tests on a Note 2, that also fails when the device is modified, but there are easy ways to get that back to stock.
* I've confirmed that SysScope isn't used at all, it works fine even when device status is Settings is modified.
* HDCP also fails to init on the Note 2, but the logcat is a bit more verbose. I didn't copy the logcat, but it does indeed state that TZ failed to open, or opened and then got closed, so this is a TrustZone issue for sure.

I've been digging around the kernel source code, and I found references to wfd in secmem.c, which does point to s5p-smem here https://github.com/AndreiLux/Perseus-UNIVERSAL5410/blob/perseus/arch/arm/mach-exynos/secmem.c#L43
I'm pretty sure the same goes for the Qualcomm variant.

What I'm not sure of is the CONFIG_EXYNOS_CONTENT_PATH_PROTECTION, it's set to y in the kernel config, I wonder if disabling it would make this all work.

Also, I can't grasp how to communicate with the TZ, trying to read from /dev/s5p-smem throws an Invalid Argument error.

Hmm, I just tried reading from /dev/qseecom and I get the exact same Invalid Argument error. I've read somewhere on XDA that WIFI passwords are stored in TZ when a Samsung signed kernel is used and they're stored in wpa_supplicant.conf when the kernel is not official.

That leads me to think that TrustZone only works if the signatures match. There's also a chance that it won't work if the binary counter is not 0.

EDIT: Currently, only Qualcomm devices can have their counter reset though. Unfortunately, I don't have any Allshare/Miracast receivers to test with.

EDIT2: WFD apparently stands for WiFi Display: https://github.com/ktoonsez/KT-SGS4...n/devicetree/bindings/media/video/msm-wfd.txt

EDIT3: Don't know if this is useful. If you decompile SecSettings.apk and take a look at com/android/settings/DevelopmentSettings.java, there's this function:

  private void removeHdcpOptionsForProduction()
  {
    if ("user".equals(Build.TYPE))
    {
      Preference localPreference = findPreference("hdcp_checking");
      if (localPreference != null)
      {
        getPreferenceScreen().removePreference(localPreference);
        this.mAllPrefs.remove(localPreference);
      }
    }
  }

Changing the build type from user to userdebug in build.prop should enable the HDCP checkbox in development settings. I don't think this will work, but it's worth a try.

 

[sorg]

Well, i've hacked libWFD_ENGINE.so some time ago for my own needs. The way i've able to make it work only by disabling HDCP. So, this hacked version uses clear data without HDCP to talk with AllShareCast dongle.
I don't know if generic miracast dongles will accept data without HDCP as i don't have such device.

Included version for I9500 works with I9500XWUBMG1, I9500XXUBMG9, I9500UBUBMH1. Probably, it's compatible with other firmware versions.

P.S.: Since it's developers forum, you should know how to replace the file.
P.P.S: You can use this patched version in any ROM you want, but please give a credit to me.

 

[MohammadAG]

EDIT3: Don't know if this is useful. If you decompile SecSettings.apk and take a look at com/android/settings/DevelopmentSettings.java, there's this function:

  private void removeHdcpOptionsForProduction()
  {
    if ("user".equals(Build.TYPE))
    {
      Preference localPreference = findPreference("hdcp_checking");
      if (localPreference != null)
      {
        getPreferenceScreen().removePreference(localPreference);
        this.mAllPrefs.remove(localPreference);
      }
    }
  }

Changing the build type from user to userdebug in build.prop should enable the HDCP checkbox in development settings. I don't think this will work, but it's worth a try.

Tried that, didn't work, pretty sure that's for MHL or plain HDMI ports on some devices.

Well, i've hacked libWFD_ENGINE.so some time ago for my own needs. The way i've able to make it work only by disabling HDCP. So, this hacked version uses clear data without HDCP to talk with AllShareCast dongle.
I don't know if generic miracast dongles will accept data without HDCP as i don't have such device.

Included version for I9500 works with I9500XWUBMG1, I9500XXUBMG9, I9500UBUBMH1. Probably, it's compatible with other firmware versions.

P.S.: Since it's developers forum, you should know how to replace the file.
P.P.S: You can use this patched version in any ROM you want, but please give a credit to me.

That actually worked (XWUMBG5). I'm no ROM dev, but if I do end up making a patch with Cydia Substrate (if I figure that out), I'll be sure to credit you

Thanks!

 

[sorg]

making a patch with Cydia Substrate

I've thought Cydia Substrate gives something special, but after quick look i've found it providing not more than XPosed already provides. You cannot make patch for this using Cydia Substrate because the only thing you can do by this is to hook JNI functions called from Dalvik code (you can do the same in Xposed). You cannot hook internal lib functions where the "magic" happens.
The only way is to replace the whole lib i've provided so far.

 

[MohammadAG]

I've thought Cydia Substrate gives something special, but after quick look i've found it providing not more than XPosed already provides. You cannot make patch for this using Cydia Substrate because the only thing you can do by this is to hook JNI functions called from Dalvik code (you can do the same in Xposed). You cannot hook internal lib functions where the "magic" happens.
The only way is to replace the whole lib i've provided so far.

Heh, ironic how iOS devs dissed Xposed as not hooking C++ code, I actually thought Cydia Substrate would hook any C++ code on the system.

Oh well, thanks for saving me hours of going through Cydia's docs.

BTW, you might want to post your solution here, http://forum.xda-developers.com/showthread.php?t=2269150
I don't think a lot of users read this forum.

Sent from my Samsung Galaxy S4 (i9500)

 

[sorg]

QA forum is also not so popular Actually the idea for separate QA forum is a big mistake because it's popular for those who ask. Not those who know the answer.
Do you want to throw away the topic? move it to QA forum!

 

[MohammadAG]

QA forum is also not so popular Actually the idea for separate QA forum is a big mistake because it's popular for those who ask. Not those who know the answer.
Do you want to throw away the topic? move it to QA forum!

Hahaha, I recall your encounter with the binary counter issue that was pretty much nulled that way

Sent from my GT-I9500 using xda app-developers app

 

[e-dredon]

Using your lib on other devices.

Dear Sorg,

Thank you for providing this great lib hack. After reading your posts about the AllShare / ScreenCast feature broke by the root, I could fix it on my samsung galaxy S3 and I understoood the problem with my Cube U30GT2 tablet was probably due to the same HDCP issues.

About the SGS3:
I switched from a 4.1.2 official firmware to CyanogenMod 10.1 beta last January on my SGS3. I finally flashed the leaked XXUFME7 two weeks ago to experiment the AllCast feature of my new Samsung Smart TV. So I might have skipped the Samsung update 0f the bootloader / tz. The WFD worked fine until I rooted the phone last week with cf-root/odin.
I finally decided to give it a try with TriangleAway to see if it would be enough to restore the DRM management chain checkup and it worked fine.

However, for many of us whom have probably upgraded their bootloader/tz with the Samsung latest updates, a lib patch is probably less tricky than a push of some bootloader/tz image thru adb I just hope Samsung will not update the tv/Allshare cast dongle firmware to restrict the streams with HDCP.

The Cube U30GT2
I have installed the Kasty firmware. It's a custom from the official Cube 2.04 firmware based on Android 4.2.2. It includes the Rockchip tools to enable the ScreenMirroring. But as it's pre-rooted when I try to connect to my Samsung smart TV I experience the same problem than with the SGS3. In that case TriangleAway is not an option and i don't know how to find the original bootloader/tz and if it would even work.

All the other Samsung Allshare features are working properly like the UPNP / DLNA.
Sadly there is no libWFD_ENGINE in /system/lib
Rockchip implementation of the standard is named WIMO and is quite poorly documented.
I can copy a proc/kmsg log if someone would be kind to help.

Can you tell me is the libWFD_ENGINE is a generic android 4.2 part of the widi implementation or a Samsung Allshare proprietary lib ?

Thanks

Best regards,

 

[sorg]

Is the libWFD_ENGINE a generic android 4.2 part of the widi implementation or a Samsung Allshare proprietary lib ?

I have no idea.. I only have 2 devices capable wireless display and they are both from Samsung.

---------- Post added at 03:09 PM ---------- Previous post was at 03:00 PM ----------

After reading your few posts about your lib hack and the DRM chain corrupted causing the Allcast connection to fail I tried to reset the flash counter on my Galaxy S3 with TriangleAway and it worked !

Yeah, i've forgot to tell that you have to reset the counter in TriangleAway to make wireless display working even with old bootloader.
The main difference between old and new bootloader/tz is that new bootloader/tz update counter of customs with every boot - that's why it's impossible to make wireless display working with new bootloader/tz.

The same with SGS4 with only difference - there is no bootloader/tz exist without updating counters on every boot. So, the only way is to hack the lib.

a lib patch is probably less tricky

Not for those who(me) hack the lib.
For me it's more simple to skip bootloader and tz update than hack the lib with every new firmware.

 

[mrmrmrmr]

Hi,

I need a similar solution on my Note 8.
How can I patch my libWFD_ENGINE.so ?
I'd appreciate if you could help me.

attached is the file from my Note 8.

when I try the patched file here, it causes a reboot. So it's not compatible with my device.

 

[sorg]

Hi,

I need a similar solution on my Note 8.
How can I patch my libWFD_ENGINE.so ?
I'd appreciate if you could help me.

attached is the file from my Note 8.

when I try the patched file here, it causes a reboot. So it's not compatible with my device.

1) get unmodified libWFD_ENGINE.so from I9500 ROM (XX..MG1)
2) compare with my modified library to find what has been patched. I suggest to use IDAPro to analyze changed parts.
3) apply the same changes to library from Note 8 (or any other device using this library)

That's all i can tell to you. Sorry, i won't provide patches for device i don't own.

 

[mrmrmrmr]

1) get unmodified libWFD_ENGINE.so from I9500 ROM (XX..MG1)
2) compare with my modified library to find what has been patched. I suggest to use IDAPro to analyze changed parts.
3) apply the same changes to library from Note 8 (or any other device using this library)

That's all i can tell to you. Sorry, i won't provide patches for device i don't own.

Thank you. I'll try to do it myself. That's better for me since I'll need to re-do it when I there is an update.
But can you tell me the tools that I need for comparing and patching ?

---------- Post added at 08:03 PM ---------- Previous post was at 07:52 PM ----------

btw, where can I find the rom you mentioned ?
I can't find a cwm zip for i9500 ending with MG1...

 

[mrmrmrmr]

I've got IDA pro installed now.
I've also got libWFD_ENGINE.so from S4 rom UBUBMH1 (I hope the lib is the same as yours)

now how can I compare it in IDA ?
I'd be grateful if you could let me know what steps I need to do.

Thanks.

 

[sorg]

now how can I compare it in IDA ?

you cannot compare it by IDA. IDA is to read the assembler code and understand changes.
According to your questions, you are not familiar with reverse engineering. So, wait for someone who can handle this.

 

[mrmrmrmr]

No. I am not familiar but i believe I can do it. Besides there's noone interested in this.
Please help me. Just tell me the steps. Now i am trying to text compare both binary file's disassemled code in ultracompare. Would that help ?
Please. You're my only hope...