Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>"Audio Recorder" is indeed a very simple tweak. The author tried to obfuscate important parts of his tweak (which function is being hooked), but here is what I found.</p> <p>Tweak basically hooks just one function - <code>AudioConverterConvertComplexBuffer</code> from <code>AudioToolbox.framework</code>. Tweak is loaded in <code>mediaserverd</code> daemon at startup. </p> <p>First, we need to find out when we should start recording because <code>AudioConverterConvertComplexBuffer</code> is called even when you just playing regular audio files. To achieve that tweak is listening to <code>kCTCallStatusChangeNotification</code> notification from <code>CTTelephonyCenter</code>. </p> <p>Second, <code>AudioConverterConvertComplexBuffer</code> implementation. I didn't finished it yet so I will post what I have so far. Here is somewhat working example that will get you started. </p> <p><em>Helper class to keep track of AudioConverterRef - ExtAudioFileRef pairs</em></p> <pre><code>@interface ConverterFile : NSObject @property (nonatomic, assign) AudioConverterRef converter; @property (nonatomic, assign) ExtAudioFileRef file; @property (nonatomic, assign) BOOL failedToOpenFile; @end @implementation ConverterFile @end </code></pre> <p><em>ConverterFile objects container</em></p> <pre><code>NSMutableArray* callConvertersFiles = [[NSMutableArray alloc] init]; </code></pre> <p><em>AudioConverterConvertComplexBuffer original implementation</em></p> <pre><code>OSStatus(*AudioConverterConvertComplexBuffer_orig)(AudioConverterRef, UInt32, const AudioBufferList*, AudioBufferList*); </code></pre> <p><em>AudioConverterConvertComplexBuffer hook declaration</em></p> <pre><code>OSStatus AudioConverterConvertComplexBuffer_hook(AudioConverterRef inAudioConverter, UInt32 inNumberPCMFrames, const AudioBufferList *inInputData, AudioBufferList *outOutputData); </code></pre> <p><em>Hooking</em></p> <pre><code>MSHookFunction(AudioConverterConvertComplexBuffer, AudioConverterConvertComplexBuffer_hook, &amp;AudioConverterConvertComplexBuffer_orig); </code></pre> <p><em>AudioConverterConvertComplexBuffer hook definition</em></p> <pre><code>OSStatus AudioConverterConvertComplexBuffer_hook(AudioConverterRef inAudioConverter, UInt32 inNumberPCMFrames, const AudioBufferList *inInputData, AudioBufferList *outOutputData) { //Searching for existing AudioConverterRef-ExtAudioFileRef pair __block ConverterFile* cf = nil; [callConvertersFiles enumerateObjectsUsingBlock:^(ConverterFile* obj, NSUInteger idx, BOOL *stop){ if (obj.converter == inAudioConverter) { cf = obj; *stop = YES; } }]; //Inserting new AudioConverterRef if (!cf) { cf = [[[ConverterFile alloc] init] autorelease]; cf.converter = inAudioConverter; [callConvertersFiles addObject:cf]; } //Opening new audio file if (!cf.file &amp;&amp; !cf.failedToOpenFile) { //Obtaining input audio format AudioStreamBasicDescription desc; UInt32 descSize = sizeof(desc); AudioConverterGetProperty(cf.converter, kAudioConverterCurrentInputStreamDescription, &amp;descSize, &amp;desc); //Opening audio file CFURLRef url = CFURLCreateWithFileSystemPath(NULL, (CFStringRef)[NSString stringWithFormat:@"/var/mobile/Media/DCIM/Call%u.caf", [callConvertersFiles indexOfObject:cf]], kCFURLPOSIXPathStyle, false); ExtAudioFileRef audioFile = NULL; OSStatus result = ExtAudioFileCreateWithURL(url, kAudioFileCAFType, &amp;desc, NULL, kAudioFileFlags_EraseFile, &amp;audioFile); if (result != 0) { cf.failedToOpenFile = YES; cf.file = NULL; } else { cf.failedToOpenFile = NO; cf.file = audioFile; //Writing audio format ExtAudioFileSetProperty(cf.file, kExtAudioFileProperty_ClientDataFormat, sizeof(desc), &amp;desc); } CFRelease(url); } //Writing audio buffer if (cf.file) { ExtAudioFileWrite(cf.file, inNumberPCMFrames, inInputData); } return AudioConverterConvertComplexBuffer_orig(inAudioConverter, inNumberPCMFrames, inInputData, outOutputData); } </code></pre> <p>This is roughly how it's done in the tweak. But why it's done like that? When phone call is in progress <code>AudioConverterConvertComplexBuffer_hook</code> will be called continuously. But inAudioConverter argument will be different. I've found that there can be more than nine different inAudioConverter objects passed to our hook during one phone call. They will have different audio formats so we can't write everything in one file. This is why we building array of AudioConverterRef-ExtAudioFileRef pairs - to keep track of what is being saved to where. This code will create as many file as there is AudioConverterRef objects. All files will containt different audio - one or two will be the speaker sound. Others - microphone. I've tested this code on iPhone 4S with iOS 6.1 and it works. Unfortunately, call recording on 4S can be done only when speaker is turned on. There is no such limitation on iPhone 5. This is mentioned in tweak's description.</p> <p>Only thing left is to find out how we can find just two specific inAudioConverter objects - one for speaker audio and one for microphone. Everything else is not a problem.</p> <p>And one last thing - <code>mediaserverd</code> process is sandboxed so as our tweak. We can't save files anywhere we want. This is why I chose that file path - it can be written even from the inside of the sandbox.</p> <p>PS Even though I've posted this code credit has to go to Elias Limneos. He's done it.</p>
    singulars
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. VO
      singulars
      1. This table or related slice is empty.
    2. VO
      singulars
      1. This table or related slice is empty.
    3. VO
      singulars
      1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload