/*## (c) SECURITY EXPLORATIONS    2018 poland                                #*/
/*##     http://www.security-explorations.com                                #*/

/* THIS SOFTWARE IS PROTECTED BY DOMESTIC AND INTERNATIONAL COPYRIGHT LAWS    */
/* UNAUTHORISED COPYING OF THIS SOFTWARE IN EITHER SOURCE OR BINARY FORM IS   */
/* EXPRESSLY FORBIDDEN. ANY USE, INCLUDING THE REPRODUCTION, MODIFICATION,    */
/* DISTRIBUTION, TRANSMISSION, RE-PUBLICATION, STORAGE OR DISPLAY OF ANY      */
/* PART OF THE SOFTWARE, FOR COMMERCIAL OR ANY OTHER PURPOSES REQUIRES A      */
/* VALID LICENSE FROM THE COPYRIGHT HOLDER.                                   */

/* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS    */
/* OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,*/
/* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL    */
/* SECURITY EXPLORATIONS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, */
/* WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF  */
/* OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE     */
/* SOFTWARE.                                                                  */

import java.lang.*;
import java.io.*;
import java.util.*;

public class MPEGBuilder {
 public static final int TS_PACKET_SIZE = 0xbc;

 public static final int SYNC_BYTE      = 0x47;

 public static final int PMT_PID        = 0x1111;
 public static final int TSID           = 0x2222;
 public static final int MAGIC_SVID     = 0x3333;

 private static final int crctab[]={
  0x00000000,
  0x04C11DB7, 0x09823B6E, 0x0D4326D9, 0x130476DC, 0x17C56B6B,
  0x1A864DB2, 0x1E475005, 0x2608EDB8, 0x22C9F00F, 0x2F8AD6D6,
  0x2B4BCB61, 0x350C9B64, 0x31CD86D3, 0x3C8EA00A, 0x384FBDBD,
  0x4C11DB70, 0x48D0C6C7, 0x4593E01E, 0x4152FDA9, 0x5F15ADAC,
  0x5BD4B01B, 0x569796C2, 0x52568B75, 0x6A1936C8, 0x6ED82B7F,
  0x639B0DA6, 0x675A1011, 0x791D4014, 0x7DDC5DA3, 0x709F7B7A,
  0x745E66CD, 0x9823B6E0, 0x9CE2AB57, 0x91A18D8E, 0x95609039,
  0x8B27C03C, 0x8FE6DD8B, 0x82A5FB52, 0x8664E6E5, 0xBE2B5B58,
  0xBAEA46EF, 0xB7A96036, 0xB3687D81, 0xAD2F2D84, 0xA9EE3033,
  0xA4AD16EA, 0xA06C0B5D, 0xD4326D90, 0xD0F37027, 0xDDB056FE,
  0xD9714B49, 0xC7361B4C, 0xC3F706FB, 0xCEB42022, 0xCA753D95,
  0xF23A8028, 0xF6FB9D9F, 0xFBB8BB46, 0xFF79A6F1, 0xE13EF6F4,
  0xE5FFEB43, 0xE8BCCD9A, 0xEC7DD02D, 0x34867077, 0x30476DC0,
  0x3D044B19, 0x39C556AE, 0x278206AB, 0x23431B1C, 0x2E003DC5,
  0x2AC12072, 0x128E9DCF, 0x164F8078, 0x1B0CA6A1, 0x1FCDBB16,
  0x018AEB13, 0x054BF6A4, 0x0808D07D, 0x0CC9CDCA, 0x7897AB07,
  0x7C56B6B0, 0x71159069, 0x75D48DDE, 0x6B93DDDB, 0x6F52C06C,
  0x6211E6B5, 0x66D0FB02, 0x5E9F46BF, 0x5A5E5B08, 0x571D7DD1,
  0x53DC6066, 0x4D9B3063, 0x495A2DD4, 0x44190B0D, 0x40D816BA,
  0xACA5C697, 0xA864DB20, 0xA527FDF9, 0xA1E6E04E, 0xBFA1B04B,
  0xBB60ADFC, 0xB6238B25, 0xB2E29692, 0x8AAD2B2F, 0x8E6C3698,
  0x832F1041, 0x87EE0DF6, 0x99A95DF3, 0x9D684044, 0x902B669D,
  0x94EA7B2A, 0xE0B41DE7, 0xE4750050, 0xE9362689, 0xEDF73B3E,
  0xF3B06B3B, 0xF771768C, 0xFA325055, 0xFEF34DE2, 0xC6BCF05F,
  0xC27DEDE8, 0xCF3ECB31, 0xCBFFD686, 0xD5B88683, 0xD1799B34,
  0xDC3ABDED, 0xD8FBA05A, 0x690CE0EE, 0x6DCDFD59, 0x608EDB80,
  0x644FC637, 0x7A089632, 0x7EC98B85, 0x738AAD5C, 0x774BB0EB,
  0x4F040D56, 0x4BC510E1, 0x46863638, 0x42472B8F, 0x5C007B8A,
  0x58C1663D, 0x558240E4, 0x51435D53, 0x251D3B9E, 0x21DC2629,
  0x2C9F00F0, 0x285E1D47, 0x36194D42, 0x32D850F5, 0x3F9B762C,
  0x3B5A6B9B, 0x0315D626, 0x07D4CB91, 0x0A97ED48, 0x0E56F0FF,
  0x1011A0FA, 0x14D0BD4D, 0x19939B94, 0x1D528623, 0xF12F560E,
  0xF5EE4BB9, 0xF8AD6D60, 0xFC6C70D7, 0xE22B20D2, 0xE6EA3D65,
  0xEBA91BBC, 0xEF68060B, 0xD727BBB6, 0xD3E6A601, 0xDEA580D8,
  0xDA649D6F, 0xC423CD6A, 0xC0E2D0DD, 0xCDA1F604, 0xC960EBB3,
  0xBD3E8D7E, 0xB9FF90C9, 0xB4BCB610, 0xB07DABA7, 0xAE3AFBA2,
  0xAAFBE615, 0xA7B8C0CC, 0xA379DD7B, 0x9B3660C6, 0x9FF77D71,
  0x92B45BA8, 0x9675461F, 0x8832161A, 0x8CF30BAD, 0x81B02D74,
  0x857130C3, 0x5D8A9099, 0x594B8D2E, 0x5408ABF7, 0x50C9B640,
  0x4E8EE645, 0x4A4FFBF2, 0x470CDD2B, 0x43CDC09C, 0x7B827D21,
  0x7F436096, 0x7200464F, 0x76C15BF8, 0x68860BFD, 0x6C47164A,
  0x61043093, 0x65C52D24, 0x119B4BE9, 0x155A565E, 0x18197087,
  0x1CD86D30, 0x029F3D35, 0x065E2082, 0x0B1D065B, 0x0FDC1BEC,
  0x3793A651, 0x3352BBE6, 0x3E119D3F, 0x3AD08088, 0x2497D08D,
  0x2056CD3A, 0x2D15EBE3, 0x29D4F654, 0xC5A92679, 0xC1683BCE,
  0xCC2B1D17, 0xC8EA00A0, 0xD6AD50A5, 0xD26C4D12, 0xDF2F6BCB,
  0xDBEE767C, 0xE3A1CBC1, 0xE760D676, 0xEA23F0AF, 0xEEE2ED18,
  0xF0A5BD1D, 0xF464A0AA, 0xF9278673, 0xFDE69BC4, 0x89B8FD09,
  0x8D79E0BE, 0x803AC667, 0x84FBDBD0, 0x9ABC8BD5, 0x9E7D9662,
  0x933EB0BB, 0x97FFAD0C, 0xAFB010B1, 0xAB710D06, 0xA6322BDF,
  0xA2F33668, 0xBCB4666D, 0xB8757BDA, 0xB5365D03, 0xB1F740B4
 };

 public static int mpeg_crc32(byte tab[],int off,int size) {
  long crc=0xffffffff;

  for(int i=0;i<size;i++) {
   crc=(crc<<8)^crctab[(int)((crc>>>24)^((int)tab[off+i]))&0xff];
  }

  return (int)(crc);
 }

 private static void fill(byte tab[],byte val) {
  for(int i=0;i<tab.length;i++) {
   tab[i]=val;
  }
 }

 private static void put_short(byte tab[],int pos,int val) {
  tab[pos]=(byte)((val>>8)&0xff);
  tab[pos+1]=(byte)(val&0xff);
 }

 private static void put_word(byte tab[],int pos,int val) {
  put_short(tab,pos,(val>>16)&0xffff);
  put_short(tab,pos+2,val&0xffff);
 }

 private static void put_ts_header_with_start(byte tab[],int pos,int pid,int counter,boolean start) {
  tab[pos]=(byte)SYNC_BYTE;

  if (start) {
   tab[pos+1]=(byte)(0x40|((pid>>8)&0x1f));//transport_error_indicator    = 0
                                           //payload_unit_start_indicator = 1
                                           //transport_priority           = 0
  } else {
   tab[pos+1]=(byte)(0x00|((pid>>8)&0x1f));//transport_error_indicator    = 0
                                           //payload_unit_start_indicator = 1
                                           //transport_priority           = 0
  }

  tab[pos+2]=(byte)(pid&0xff);
  tab[pos+3]=(byte)(0x10|(counter&0x0f)); //transport_scrambling_control = 00 (Not scrambled)
                                         //adaptation_field_control     = 01 (No adaptation_field, payload only)
 }

 private static void put_ts_header(byte tab[],int pid,int counter) {
  put_ts_header_with_start(tab,0,pid,counter,true);
 }
 
 public static byte[] create_pat(int tsid) {
  byte pat[]=new byte[TS_PACKET_SIZE];
  fill(pat,(byte)0xff);

  int pos=0;

  put_ts_header(pat,MPEGDefs.PAT_PID,0);
  pos+=4;

  pat[pos++]=(byte)0;                  //pointer_field for PSI packets

  int crc_start=pos;

  pat[pos++]=(byte)MPEGDefs.program_association_section;
  pat[pos++]=(byte)0xb0;

  int size_off=pos;
  pos++;

  int sec_start=pos;

  put_short(pat,pos,tsid);
  pos+=2;

  pat[pos++]=(byte)0x01;

  pat[pos++]=(byte)0x00; //section number
  pat[pos++]=(byte)0x00; //last section number

  put_short(pat,pos,MAGIC_SVID);
  pos+=2;

  put_short(pat,pos,PMT_PID&0x1fff);
  pos+=2;

  int crc_end=pos;
  int sec_end=pos+4;

  pat[size_off]=(byte)(sec_end-sec_start);

  int crc32=mpeg_crc32(pat,crc_start,crc_end-crc_start);

  put_word(pat,pos,crc32);

  return pat;
 }

 public static byte[] create_pmt(int pcr_pid,int video_pid,int audio_pid,int unknown_pid,int video_type,int audio_type) {
  byte pmt[]=new byte[TS_PACKET_SIZE];
  fill(pmt,(byte)0xff);

  int pos=0;

  put_ts_header(pmt,PMT_PID,0);
  pos+=4;

  pmt[pos++]=(byte)0;        //pointer_field for PSI packets

  int crc_start=pos;

  pmt[pos++]=(byte)MPEGDefs.TS_program_map_section;
  pmt[pos++]=(byte)0xb0;

  int size_off=pos;
  pos++;

  int sec_start=pos;

  put_short(pmt,pos,MAGIC_SVID);
  pos+=2;

  pmt[pos++]=(byte)0x01;     //version_number=0, current_next_indicator=1

  pmt[pos++]=(byte)0x00;     //section_number
  pmt[pos++]=(byte)0x00;     //last_section_number

  put_short(pmt,pos,pcr_pid&0x1fff);
  pos+=2;

  put_short(pmt,pos,0x0006); //program info length
  pos+=2;

  pmt[pos++]=(byte)0x09;     //CA_descriptor
  pmt[pos++]=(byte)0x04;

  put_short(pmt,pos,0x0b01); //CA_system_ID
  pos+=2;
  put_short(pmt,pos,0x0068); //CA_PID
  pos+=2;

  /* audio stream          */
  pmt[pos++]=(byte)audio_type;
  put_short(pmt,pos,audio_pid&0x1fff);
  pos+=2;

  int adesc_size=pos;
  pos+=2;

  int adesc_start=pos;

  pmt[pos++]=(byte)0x0a;     //ISO_639_language_descriptor
  pmt[pos++]=(byte)0x04;

  pmt[pos++]=(byte)0x70;    //"p"
  pmt[pos++]=(byte)0x6f;    //"o"
  pmt[pos++]=(byte)0x6c;    //"l"
  pmt[pos++]=(byte)0x01;

  int adesc_end=pos;

  put_short(pmt,adesc_size,adesc_end-adesc_start); //ES_info_length

  /* video  stream         */
  pmt[pos++]=(byte)video_type;
  put_short(pmt,pos,video_pid&0x1fff);
  pos+=2;

  int vdesc_size=pos;
  pos+=2;

  int vdesc_start=pos;
  int vdesc_end=pos;

  put_short(pmt,vdesc_size,vdesc_end-vdesc_start); //ES_info_length

  /* unknown stream        */
  pmt[pos++]=(byte)0xad;
  put_short(pmt,pos,unknown_pid&0x1fff);
  pos+=2;

  put_short(pmt,pos,0x0000);                       //ES_info_length
  pos+=2;
  
  int crc_end=pos;
  int sec_end=pos+4;

  pmt[size_off]=(byte)(sec_end-sec_start);

  int crc32=mpeg_crc32(pmt,crc_start,crc_end-crc_start);

  put_word(pmt,pos,(int)crc32);

  return pmt;
 }

 public static byte[] create_pat_pmt(int tsid,int pcr_pid,int video_pid,int audio_pid,int unknown_pid,int video_type,int audio_type) {
  byte pat[]=create_pat(tsid);    
  byte pmt[]=create_pmt(pcr_pid,video_pid,audio_pid,unknown_pid,video_type,audio_type);

  byte res[]=new byte[2*TS_PACKET_SIZE];

  System.arraycopy(pat,0,res,0,TS_PACKET_SIZE);
  System.arraycopy(pmt,0,res,TS_PACKET_SIZE,TS_PACKET_SIZE);

  return res;
 }

 public static byte[] create_vod_pat_pmt(int recid) {
  byte pat[]=create_pat(TSID);    

  byte pmt[]=get_vod_pmt(recid);

  byte res[]=new byte[2*TS_PACKET_SIZE];

  System.arraycopy(pat,0,res,0,TS_PACKET_SIZE);
  System.arraycopy(pmt,0,res,TS_PACKET_SIZE,TS_PACKET_SIZE);

  return res;
 }

 public static void dump_mpeg_hdr(String filename) {
  try {
   int pcr_pid     =0x801;
   int unknown_pid =0x810;

   int video_pid   =0x801;
   int video_type  =27;

   int audio_pid   =0x802;
   int audio_type  =15;

   byte data[]=create_pat_pmt(TSID,pcr_pid,video_pid,audio_pid,unknown_pid,video_type,audio_type);

   FileOutputStream fos=new FileOutputStream(filename,false);
   fos.write(data);
   fos.close();
  } catch(Throwable t) {
   System.out.println("exception "+t);
  }
 }

 public static byte[] get_ts_packet(int pid,byte data[]) {
  byte packet[]=new byte[TS_PACKET_SIZE];
  fill(packet,(byte)0xff);

  int pos=0;

  put_ts_header(packet,pid,0);
  pos+=4;

  packet[pos++]=(byte)0;        //pointer_field for PSI packets

  int crc_start=pos;

  System.arraycopy(data,0,packet,pos,data.length-4);
  pos+=data.length-4;

  int crc_end=pos;

  int crc32=mpeg_crc32(packet,crc_start,crc_end-crc_start);
  put_word(packet,pos,(int)crc32);

  return packet;
 }

 public static byte[] get_ts_packets(int pid,byte data[]) {
  int pktspace=TS_PACKET_SIZE-4;

  int pktcnt=1;

  if (data.length>(pktspace-1)) {
   pktcnt+=(data.length-pktspace-1+pktspace-1)/pktspace;
  }

  byte packets[]=new byte[TS_PACKET_SIZE*pktcnt];  
  fill(packets,(byte)0xff);

  int size=data.length;

  int srcoff=0;
  int dstoff=0;

  boolean start=true;

  for(int i=0;i<pktcnt;i++) {
   put_ts_header_with_start(packets,dstoff,pid,i,start);
   dstoff+=4;

   int copycnt=size<pktspace ? size:pktspace;

   if (start) {
    packets[dstoff++]=(byte)0;        //pointer_field for PSI packets
    start=false;
    if (pktcnt>1) copycnt--;
   }

   System.arraycopy(data,srcoff,packets,dstoff,copycnt);
   
   srcoff+=copycnt;
   dstoff+=copycnt;

   size-=copycnt;
  }

  return packets;
 }

 public static byte[] get_pat() {
  byte pat[]=null;

  byte pat_data[]=MPEGSniffer.get_PAT();

  if (pat_data!=null) {
   pat=get_ts_packet(MPEGDefs.PAT_PID,pat_data);
  }

  return pat;
 }

 public static byte[] get_pmt(int svid) {
  byte pmt[]=null;

  int pmt_pid=MPEG.get_PMT_pid(svid);

  if (pmt_pid>0) {
   byte pmt_data[]=MPEGSniffer.get_PMT(pmt_pid,svid);

   pmt=get_ts_packets(pmt_pid,pmt_data);
  }

  return pmt;
 }

 public static byte[] get_vod_pmt(int recid) {
  byte pmt[]=null;

  byte pmt_data[]=VOD.get_pmt(recid);

  put_short(pmt_data,3,MAGIC_SVID);

  pmt=get_ts_packet(PMT_PID,pmt_data);

  return pmt;
 }
  
}
