mitm: add video in motion feature

Credits and testing: @Ioniq3

Author: manio

README.md

@@ -15,6 +15,7 @@ Currently it is intended to run as a more-or-less drop-in replacement of the `aa
   - Remove tap restriction
   - Disable media sink
   - Disable TTS sink
+  - Video in motion
   - Developer mode
 
 ## Current project status
@@ -204,6 +205,9 @@ OPTIONS:
 
     -V, --version
             Print version information
+
+        --video-in-motion
+            MITM: video in motion
 ```
 Most options are self explanatory, but these needs some more attention:<br>
 - `-l, --legacy`<br>

src/io_uring.rs

@@ -270,6 +270,7 @@ pub async fn io_loop(
     disable_media_sink: bool,
     disable_tts_sink: bool,
     remove_tap_restriction: bool,
+    video_in_motion: bool,
 ) -> Result<()> {
     info!("{} 🛰️ Starting TCP server...", NAME);
     let bind_addr = format!("0.0.0.0:{}", TCP_SERVER_PORT).parse().unwrap();
@@ -355,6 +356,7 @@ pub async fn io_loop(
                 disable_media_sink,
                 disable_tts_sink,
                 remove_tap_restriction,
+                video_in_motion,
             ));
             from_stream = tokio_uring::spawn(proxy(
                 ProxyType::MobileDevice,
@@ -368,6 +370,7 @@ pub async fn io_loop(
                 disable_media_sink,
                 disable_tts_sink,
                 remove_tap_restriction,
+                video_in_motion,
             ));
         } else {
             // We need to copy in both directions...

src/main.rs

@@ -102,6 +102,10 @@ struct Args {
     #[clap(long, requires("mitm"))]
     remove_tap_restriction: bool,
 
+    /// MITM: video in motion
+    #[clap(long, requires("mitm"))]
+    video_in_motion: bool,
+
     /// MITM: Disable media sink
     #[clap(long, requires("mitm"))]
     disable_media_sink: bool,
@@ -314,6 +318,7 @@ fn main() {
     let disable_media_sink = args.disable_media_sink;
     let disable_tts_sink = args.disable_tts_sink;
     let remove_tap_restriction = args.remove_tap_restriction;
+    let video_in_motion = args.video_in_motion;
 
     // build and spawn main tokio runtime
     let runtime = Builder::new_multi_thread().enable_all().build().unwrap();
@@ -332,6 +337,7 @@ fn main() {
         disable_media_sink,
         disable_tts_sink,
         remove_tap_restriction,
+        video_in_motion,
     ));
 
     info!(

src/mitm.rs

@@ -17,6 +17,7 @@ use tokio_uring::buf::BoundedBuf;
 include!(concat!(env!("OUT_DIR"), "/protos/mod.rs"));
 use crate::mitm::protos::*;
 use crate::mitm::AudioStreamType::*;
+use crate::mitm::SensorMessageId::*;
 use crate::mitm::SensorType::*;
 use protobuf::text_format::print_to_string_pretty;
 use protobuf::{Enum, Message, MessageDyn};
@@ -49,6 +50,10 @@ pub const ENCRYPTED: u8 = 1 << 3;
 // location for hu_/md_ private keys and certificates:
 const KEYS_PATH: &str = "/etc/aa-proxy-rs";
 
+pub struct ModifyContext {
+    sensor_channel: Option<u8>,
+}
+
 #[derive(PartialEq, Copy, Clone)]
 pub enum ProxyType {
     HeadUnit,
@@ -246,20 +251,44 @@ pub async fn pkt_modify_hook(
     disable_media_sink: bool,
     disable_tts_sink: bool,
     remove_tap_restriction: bool,
+    video_in_motion: bool,
+    ctx: &mut ModifyContext,
 ) -> Result<()> {
-    if pkt.channel != 0 {
-        return Ok(());
-    }
-
     // message_id is the first 2 bytes of payload
     let message_id: i32 = u16::from_be_bytes(pkt.payload[0..=1].try_into()?).into();
+    let data = &pkt.payload[2..]; // start of message data
+
+    // handling driving_status_data change
+    if let Some(ch) = ctx.sensor_channel {
+        if ch == pkt.channel {
+            match protos::SensorMessageId::from_i32(message_id).unwrap_or(SENSOR_MESSAGE_ERROR) {
+                SENSOR_MESSAGE_BATCH => {
+                    if let Ok(mut msg) = SensorBatch::parse_from_bytes(data) {
+                        if !msg.driving_status_data.is_empty() {
+                            // forcing status to 0 value
+                            msg.driving_status_data[0].set_status(0);
+                            // regenerating payload data
+                            pkt.payload = msg.write_to_bytes()?;
+                            pkt.payload.insert(0, (message_id >> 8) as u8);
+                            pkt.payload.insert(1, (message_id & 0xff) as u8);
+                        }
+                    }
+                }
+                _ => (),
+            }
+        }
+        // end sensors processing
+        return Ok(());
+    }
 
+    if pkt.channel != 0 {
+        return Ok(());
+    }
     // trying to obtain an Enum from message_id
     let control = protos::ControlMessageType::from_i32(message_id);
     debug!("message_id = {:04X}, {:?}", message_id, control);
 
     // parsing data
-    let data = &pkt.payload[2..]; // start of message data
     match control.unwrap_or(MESSAGE_UNEXPECTED_MESSAGE) {
         MESSAGE_SERVICE_DISCOVERY_RESPONSE => {
             let mut msg = ServiceDiscoveryResponse::parse_from_bytes(data)?;
@@ -313,6 +342,24 @@ pub async fn pkt_modify_hook(
                 );
             }
 
+            // obtain SENSOR_DRIVING_STATUS_DATA sensor channel
+            if video_in_motion {
+                if let Some(svc) = msg
+                    .services
+                    .iter()
+                    .find(|svc| !svc.sensor_source_service.sensors.is_empty())
+                {
+                    if let Some(_) = svc
+                        .sensor_source_service
+                        .sensors
+                        .iter()
+                        .find(|s| s.sensor_type() == SENSOR_DRIVING_STATUS_DATA)
+                    {
+                        ctx.sensor_channel = Some(svc.id() as u8);
+                    }
+                }
+            }
+
             // remove tap restriction by removing SENSOR_SPEED
             if remove_tap_restriction {
                 if let Some(svc) = msg
@@ -483,6 +530,7 @@ pub async fn proxy<A: Endpoint<A> + 'static>(
     disable_media_sink: bool,
     disable_tts_sink: bool,
     remove_tap_restriction: bool,
+    video_in_motion: bool,
 ) -> Result<()> {
     let ssl = ssl_builder(proxy_type).await?;
 
@@ -553,6 +601,9 @@ pub async fn proxy<A: Endpoint<A> + 'static>(
     }
 
     // main data processing/transfer loop
+    let mut ctx = ModifyContext {
+        sensor_channel: None,
+    };
     loop {
         // handling data from opposite device's thread, which needs to be transmitted
         if let Ok(mut pkt) = rx.try_recv() {
@@ -564,6 +615,8 @@ pub async fn proxy<A: Endpoint<A> + 'static>(
                 disable_media_sink,
                 disable_tts_sink,
                 remove_tap_restriction,
+                video_in_motion,
+                &mut ctx,
             )
             .await?;
             pkt.encrypt_payload(&mut mem_buf, &mut server).await?;