Android local RTSP server (spoof), PVPlayer closes

2019-07-31 23:29发布

站内文章 / Android
73 0 0

问题:

I'm trying to "spoof" the android player. I want MediaPlayer (I'm using the VideoView wrapper) to connect to localhost so that I may reply to its RTSP requests. The application works fine when the underlying video system is the VisualOn type (VOME) however any device which uses the PacketView system (PVPlayer) the TCP connection is closed after I send the reply to the DESCRIBE request/challenge.

I know for a fact the reply is not the issue. When I take the exact code (generating the same replies) I use to mimic an RTSP server and make it into a standard (no android libraries) JAR and run it on a PC the android can connect to it and the RTSP conversation goes flawless. The android is then looking for RTP on certain ports (which is the state I am trying to achieve).

I've tried: localhost 127.0.0.1 other IPs in 127.0.0.0/8

As above, the connection is being made, but the TCP socket is closed after DESCRIBE reply.

The only guess I have is that PVPlayer is (for whatever reason) blocking the use of a local RTSP server (checking to make sure where the reply is coming from is indeed remote).

Thank you very much for your time.

Braden

Output:

11-01 17:03:49.096: VERBOSE/PVPlayer(1085): PVPlayer constructor
11-01 17:03:49.096: VERBOSE/PVPlayer(1085): construct PlayerDriver
11-01 17:03:49.096: VERBOSE/PlayerDriver(1085): constructor
11-01 17:03:49.104: VERBOSE/PlayerDriver(1085): OpenCore hardware module loaded
11-01 17:03:49.104: VERBOSE/PlayerDriver(1085): start player thread
11-01 17:03:49.127: VERBOSE/PlayerDriver(1085): startPlayerThread
11-01 17:03:49.127: VERBOSE/PlayerDriver(1085): InitializeForThread
11-01 17:03:49.127: VERBOSE/PlayerDriver(1085): OMX_MasterInit
11-01 17:03:49.127: DEBUG/omx_interface(1085): TIOMXInterface: creating interface
11-01 17:03:49.127: DEBUG/omx_interface(1085): Calling DLOPEN on OMX_CORE_LIBRARY (libOMX_Core.so)
11-01 17:03:49.127: DEBUG/omx_interface(1085): DLOPEN SUCCEEDED (libOMX_Core.so)
11-01 17:03:49.127: DEBUG/omx_interface(1085): TIOMXInterface: library lookup success
11-01 17:03:49.135: DEBUG/TIOMX_CORE(1085): init count = 1
11-01 17:03:49.135: VERBOSE/PlayerDriver(1085): OsclScheduler::Init
11-01 17:03:49.135: VERBOSE/PlayerDriver(1085): CreatePlayer
11-01 17:03:49.151: DEBUG/(1085): enter PVGetInterface
11-01 17:03:49.151: DEBUG/(1085): enter Instance
11-01 17:03:49.151: DEBUG/(1085): enter SharedLibraryLookup
11-01 17:03:49.151: DEBUG/(1085): enter RegisterAllRecognizers
11-01 17:03:49.159: VERBOSE/PlayerDriver(1085): AddToScheduler
11-01 17:03:49.159: VERBOSE/PlayerDriver(1085): PendForExec
11-01 17:03:49.159: VERBOSE/PlayerDriver(1085): OsclActiveScheduler::Current
11-01 17:03:49.159: VERBOSE/PlayerDriver(1085): StartScheduler
11-01 17:03:49.159: VERBOSE/PVPlayer(1085): send PLAYER_SETUP
11-01 17:03:49.159: VERBOSE/PlayerDriver(1085): Send player code: 2
11-01 17:03:49.159: VERBOSE/PlayerDriver(1085): CommandCompleted
11-01 17:03:49.159: VERBOSE/PlayerDriver(1085): Completed command PLAYER_SETUP     status=PVMFSuccess
11-01 17:03:49.159: VERBOSE/PVPlayer(1085): setDataSource(rtsp://localhost:5554        /sample.mp4)
11-01 17:03:49.166: VERBOSE/PVPlayer(1085): setVideoSurface(0x17f2a0)
11-01 17:03:49.166: VERBOSE/PVPlayer(1085): setVideoSurface(0x17f2d8)
11-01 17:03:49.166: VERBOSE/PVPlayer(1085): prepareAsync
11-01 17:03:49.166: VERBOSE/PVPlayer(1085):   data source = rtsp://localhost:5554    /sample.mp4
11-01 17:03:49.174: VERBOSE/PlayerDriver(1085): Send player code: 3
11-01 17:03:49.174: VERBOSE/PlayerDriver(1085): handleSetDataSource
11-01 17:03:49.174: VERBOSE/PlayerDriver(1085): handleSetDataSource- scanning for     extension
11-01 17:03:49.215: DEBUG/KeyguardViewMediator(1210): setHidden false
11-01 17:03:49.229: VERBOSE/PlayerDriver(1085): CommandCompleted
11-01 17:03:49.237: VERBOSE/PlayerDriver(1085): Completed command     PLAYER_SET_DATA_SOURCE status=PVMFSuccess
11-01 17:03:49.237: VERBOSE/PVPlayer(1085): run_init s=0, cancelled=0
11-01 17:03:49.237: VERBOSE/PlayerDriver(1085): Send player code: 6
11-01 17:03:49.237: VERBOSE/PlayerDriver(1085): release string is 2.1-update1 len 11
11-01 17:03:49.237: DEBUG/KeyguardViewMediator(1210): setHidden false
11-01 17:03:49.252: INFO/global(4253): Default buffer size used in BufferedReader     constructor. It would be better to be explicit if an 8k-char buffer is required.
11-01 17:03:49.252: INFO/braden_nio(4253): spoofaway started...
11-01 17:03:49.252: INFO/System.out(4253): OPTIONS rtsp://localhost:5554/sample.mp4     RTSP/1.0
11-01 17:03:49.252: INFO/System.out(4253): CSeq: 0
11-01 17:03:49.252: INFO/System.out(4253): User-Agent: PVPlayer CORE/6.506.4.1     OpenCORE/2.02 (Linux;Android 2.1-update1)
11-01 17:03:49.252: INFO/System.out(4253): ClientChallenge: 9e26d33f2984236010ef6253fb1887f7
11-01 17:03:49.252: INFO/System.out(4253): PlayerStarttime: [28/03/2003:22:50:23 00:00]
11-01 17:03:49.252: INFO/System.out(4253): CompanyID: KnKV4M4I/B2FjJ1TToLycw==
11-01 17:03:49.252: INFO/System.out(4253): GUID: 00000000-0000-0000-0000-000000000000
11-01 17:03:49.252: INFO/System.out(4253): 
11-01 17:03:49.252: INFO/System.out(4253): Loooop
11-01 17:03:49.252: INFO/System.out(4253): DESCRIBE rtsp://localhost:5554/sample.mp4     RTSP/1.0
11-01 17:03:49.252: INFO/System.out(4253): CSeq: 1
11-01 17:03:49.252: INFO/System.out(4253): User-Agent: PVPlayer CORE/6.506.4.1 OpenCORE/2.02 (Linux;Android 2.1-update1)
11-01 17:03:49.252: INFO/System.out(4253): Accept: application/sdp
11-01 17:03:49.252: INFO/System.out(4253): Accept-Encoding: 
11-01 17:03:49.260: INFO/System.out(4253): 
11-01 17:03:49.260: INFO/System.out(4253): describe sent:RTSP/1.0 200 OK
11-01 17:03:49.260: INFO/System.out(4253): Content-Base: rtsp://localhost:5554/sample.mp4/
11-01 17:03:49.260: INFO/System.out(4253): Date: Mon, 31 Oct 2011 15:20:44 EDT
11-01 17:03:49.260: INFO/System.out(4253): Content-Length: 577
11-01 17:03:49.260: INFO/System.out(4253): Session: 1429213185;timeout=60
11-01 17:03:49.260: INFO/System.out(4253): Expires: Mon, 31 Oct 2011 15:20:44 EDT
11-01 17:03:49.260: INFO/System.out(4253): Cseq: 1
11-01 17:03:49.284: INFO/System.out(4253): Content-Type: application/sdp
11-01 17:03:49.284: INFO/System.out(4253): Server: Wowza Media Server 2.2.4 build27452
11-01 17:03:49.284: INFO/System.out(4253): Cache-Control: no-cache
11-01 17:03:49.284: INFO/System.out(4253): 
11-01 17:03:49.284: INFO/System.out(4253): v=0
11-01 17:03:49.284: INFO/System.out(4253): o=- 1429213185 1429213185 IN IP4 127.0.0.1
11-01 17:03:49.284: INFO/System.out(4253): s=WowzaMediaServer
11-01 17:03:49.284: INFO/System.out(4253): c=IN IP4 0.0.0.0
11-01 17:03:49.284: INFO/System.out(4253): t=0 0
11-01 17:03:49.284: INFO/System.out(4253): a=sdplang:en
11-01 17:03:49.284: INFO/System.out(4253): a=range:npt=0- 596.458
11-01 17:03:49.284: INFO/System.out(4253): a=control:*
11-01 17:03:49.284: INFO/System.out(4253): m=audio 0 RTP/AVP 96
11-01 17:03:49.284: INFO/System.out(4253): a=rtpmap:96 mpeg4-generic/48000/2
11-01 17:03:49.284: INFO/System.out(4253): a=fmtp:96 profile-level-id=1;mode=AAC-hbr;sizelength=13;indexlength=3;indexdeltalength=3;config=1190
11-01 17:03:49.284: INFO/System.out(4253): a=control:trackID=1
11-01 17:03:49.284: INFO/System.out(4253): m=video 0 RTP/AVP 97
11-01 17:03:49.284: INFO/System.out(4253): a=rtpmap:97 H264/90000
11-01 17:03:49.284: INFO/System.out(4253): a=fmtp:97 packetization-mode=1;profile-level-id=42C01E;sprop-parameter-sets=Z0LAHpZiA2P8vCAAAAMAIAAABgHixck=,aMuMsg==
11-01 17:03:49.284: INFO/System.out(4253): a=cliprect:0,0,240,424
11-01 17:03:49.284: INFO/System.out(4253): a=framesize:97 424-240
11-01 17:03:49.284: INFO/System.out(4253): a=framerate:24.0
11-01 17:03:49.284: INFO/System.out(4253): a=control:trackID=2
11-01 17:03:49.284: INFO/System.out(4253): Loooop
11-01 17:03:49.291: VERBOSE/PlayerDriver(1085): HandleInformationalEvent: PVMFInfoErrorHandlingStart
11-01 17:03:49.291: VERBOSE/PlayerDriver(1085): HandleInformationalEvent: type=26 UNHANDLED
11-01 17:03:49.291: WARN/MediaPlayer(4253): info/warning (1, 26)
11-01 17:03:49.291: INFO/MediaPlayer(4253): Info (1,26)
11-01 17:03:49.323: VERBOSE/PlayerDriver(1085): CommandCompleted
11-01 17:03:49.323: VERBOSE/PlayerDriver(1085): Completed command PLAYER_INIT status=PVMFFailure
11-01 17:03:49.323: ERROR/PlayerDriver(1085): Command PLAYER_INIT completed with an error or info PVMFFailure
11-01 17:03:49.323: ERROR/MediaPlayer(4253): error (1, -1)
11-01 17:03:49.323: ERROR/MediaPlayer(4253): Error (1,-1)
11-01 17:03:49.323: DEBUG/VideoView(4253): Error: 1,-1
11-01 17:03:49.354: VERBOSE/PVPlayer(1085): run_set_video_surface s=-2147483648, cancelled=0
11-01 17:03:49.354: VERBOSE/PlayerDriver(1085): HandleInformationalEvent: PVMFInfoErrorHandlingComplete
11-01 17:03:49.354: WARN/PlayerDriver(1085): PVMFInfoErrorHandlingComplete
11-01 17:03:49.401: DEBUG/KeyguardViewMediator(1210): setHidden false

回答1:

These devices do a "double describe" (as I call it). They make a few RTSP requests (which they expect replies to) then terminate the TCP connection, open another one, and make the same requests again except going all the way to the play. I'm not sure why on earth they do this. Obviously the solution was to just accept connections from the Android MediaPlayer (stagefright/whatever) in a threaded fashion. Ex: 

while(true){ 
    socket = serversocket.accept();
    Thread mythread = new ThreadImplementation(socket); 
    mythread.start(); 
}


标签： android localhost media-player rtsp
举报

收藏的人(0)

Ta的文章 更多文章
登录 后发表评论
0条评论
还没有人评论过~