/*## (c) SECURITY EXPLORATIONS    2018 poland                                #*/
/*##     http://www.security-explorations.com                                #*/

/* THIS SOFTWARE IS PROTECTED BY DOMESTIC AND INTERNATIONAL COPYRIGHT LAWS    */
/* UNAUTHORISED COPYING OF THIS SOFTWARE IN EITHER SOURCE OR BINARY FORM IS   */
/* EXPRESSLY FORBIDDEN. ANY USE, INCLUDING THE REPRODUCTION, MODIFICATION,    */
/* DISTRIBUTION, TRANSMISSION, RE-PUBLICATION, STORAGE OR DISPLAY OF ANY      */
/* PART OF THE SOFTWARE, FOR COMMERCIAL OR ANY OTHER PURPOSES REQUIRES A      */
/* VALID LICENSE FROM THE COPYRIGHT HOLDER.                                   */

/* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS    */
/* OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,*/
/* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL    */
/* SECURITY EXPLORATIONS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, */
/* WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF  */
/* OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE     */
/* SOFTWARE.                                                                  */

import java.lang.*;

public class ECMInjector extends SCFilter {
 private static ECMInjector ecminjector;

 private static boolean disable_req = false;

 private static boolean injecting   = false;
 private static boolean faking_ecm  = false;

 private static int ecm_req;
 private static int ecm_req_size;

 private int res1;
 private int res2;
 private int org_res2;

 private int cur_key = 0;
 private int ecm_stamp = 0;

 public ECMInjector() {
  super("ECMInjector",ST_ALL);
 }

 private boolean injecting_ecm() {
  return injecting;
 }

 private boolean faking_ecm() {
  return injecting&&faking_ecm;
 }

 public static void start_injecting() {
  injecting=true;
 }

 public static void stop_injecting() {
  injecting=false;
 }

 public boolean match(int prefix,int state,int cmd,int ptr,int buf,int size) {
  if (cmd==Conax.CMD_ECM) {
   if (prefix==SCInterface.IST_PRECALL) {
    switch(state) {
     case SCInterface.IST_WRITE_REQ_HDR:
     case SCInterface.IST_WRITE_REQ_BODY:
     case SCInterface.IST_WRITE_RESP_REQ:
     case SCInterface.IST_READ_RESP_REQ_CMD:
     case SCInterface.IST_READ_RESP_BODY:
      return true;
     default:
      return false;
    }
   } else {
    switch(state) {
     case SCInterface.IST_READ_RESP_CODE1:
     case SCInterface.IST_READ_RESP_CODE2:
     case SCInterface.IST_WRITE_RESP_REQ:
     case SCInterface.IST_READ_RESP_REQ_CMD:
     case SCInterface.IST_READ_RESP_BODY:
      return true;
     default:
      return false;
    }
   }

  } else return false;
 }

 public boolean action(int prefix,int state,int cmd,int ptr,int buf,int size) {
  boolean res=true;

  switch(prefix) {
   case SCInterface.IST_PRECALL:
    if (state==SCInterface.IST_WRITE_REQ_HDR) {
     faking_ecm=false;

     if (disable_req) {
      ecminjector.disable();
      disable_req=false;
     }
    } else

    if (state==SCInterface.IST_WRITE_REQ_BODY) {
     ecm_stamp=CWFaker.calc_stamp(buf);

     if (VodECMReader.known_ecm(ecm_stamp)) {
      faking_ecm=true;

      cur_key=Memory.read_byte(buf+0x03)&0x01;

      byte tab[]=Utils.buf2barray(buf,size);
      ApiMonitor.log("SCARD MATCHING ECM stamp = "+Utils.hex_value(ecm_stamp,8));
      ApiMonitor.log_buf(tab);
     }

     ecm_req=buf+3;
     ecm_req_size=size-3;
    } else

    if (state==SCInterface.IST_WRITE_RESP_REQ) {
     if (faking_ecm()) {
      Memory.write_byte(buf+4,org_res2);
     }
    } else

    if (state==SCInterface.IST_READ_RESP_REQ_CMD) {
     if (faking_ecm()) {
     }
    } else

    if (state==SCInterface.IST_READ_RESP_BODY) {
     if (faking_ecm()) {
      if (res2!=org_res2) {
       ApiHandler.change_arg(ptr,2,org_res2+2);
      }
     }
    }
    break;

   case SCInterface.IST_POSTCALL:
    if (state==SCInterface.IST_READ_RESP_CODE1) {
     if (faking_ecm()) {
      Memory.write_byte(buf,Conax.CMD_RET_RESP);
     }

     res1=Memory.read_byte(buf);
    } else

    if (state==SCInterface.IST_READ_RESP_CODE2) {
     org_res2=res2=Memory.read_byte(buf);

     if (faking_ecm()) {
      Memory.write_byte(buf,CWFaker.ECM_SIZE);
      res2=Memory.read_byte(buf);
     }
    } else

    if (state==SCInterface.IST_WRITE_RESP_REQ) {
     if (faking_ecm()) {
      Memory.write_byte(buf+4,res2);
      change_res(ptr,Conax.CMD_REQ_HDR_SIZE);
     }
    } else

    if (state==SCInterface.IST_READ_RESP_REQ_CMD) {
     if (faking_ecm()) {
      Memory.write_byte(buf,Conax.CMD_READ_RESP);
      change_res(ptr,1);
     }
    } else

    if (state==SCInterface.IST_READ_RESP_BODY) {
     if (faking_ecm()) {
      CW.inc_word();

      int cur_cw=CW.cur_word();
      int nxt_cw=CW.nxt_word();

      if (cur_key==0) {
       ApiMonitor.log(" cur "+Utils.hex_value(cur_cw,8)+" nxt "+Utils.hex_value(nxt_cw,8));
       CWFaker.put_cw(buf+0x00,CWFaker.CW_FAKE_VALUE,nxt_cw,1);
       CWFaker.put_cw(buf+0x0f,CWFaker.CW_FAKE_VALUE,cur_cw,0);
      } else {
       ApiMonitor.log(" cur "+Utils.hex_value(cur_cw,8)+" nxt "+Utils.hex_value(nxt_cw,8));
       CWFaker.put_cw(buf+0x00,CWFaker.CW_FAKE_VALUE,cur_cw,1);
       CWFaker.put_cw(buf+0x0f,CWFaker.CW_FAKE_VALUE,nxt_cw,0);
      }

      Memory.write_byte(buf+0x1e,0x31);
      Memory.write_byte(buf+0x1f,0x02);
      Memory.write_byte(buf+0x20,0x40);
      Memory.write_byte(buf+0x21,0x00);
      Memory.write_byte(buf+0x22,0x90);
      Memory.write_byte(buf+0x23,0x00);

      change_res(ptr,CWFaker.ECM_SIZE+2);

      CW.set_scard_info(ecm_stamp,cur_cw,true);
      CW.set_scard_info(ecm_stamp,nxt_cw,false);

      VodECMReader.notify_ecm(ecm_stamp,nxt_cw);

      faking_ecm=false;
     }
    }
    break;
  }

  return res;
 }

 public static void start() {
  if (ecminjector==null) {
   ecminjector=new ECMInjector();
   SCInterface.add_filter(ecminjector);
  }

  ecminjector.enable();
 }

 public static void stop() {
  if (ecminjector!=null) {
   disable_req=true;
  }
 }

 public static boolean status() {
  if (ecminjector!=null) {
   return ecminjector.enabled();
  } else return false;
 }

}
