mp3 aus Arbeitsspeicher filtern
-
Ich versuche mp3s aus dem RAM von firefox zu extrahieren.
Funktioniert super, wenn ich nen RAW mp3 byte array habe (dann schneidet das Programm die id3 tags ab aber damit kann ich leben).
Bei firefox werden zwar auch ca. 3.6 MB an mp3 daten gefunden (es kommen alle <2000 bytes Sync Bits und am Anfang die byte-Folge "LAME3.95" vor), nur kann ich die Daten nicht abspielen.
Hat jemand eine Idee, was falsch gelaufen sein könnte?Der frame header scheint mir auf den ersten Blick gültig:
FF FB 90 60 00 0F F0 00 Sync: 0x7FF //MPEG Version 1 Version: 3 //mp3 Layer: 1 Protection Bit: 1 //128 kbps Bitrate: 9 //44100 Hz Sampling: 0 Padding: 0/1 Private Bit: 0 //Joint Stereo Channel: 1 //Intensity stereo off and MS stereo on Mode Extension: 2 Copyright: 0 Original: 0 Emphasis: 0
#include <stdio.h> #include <stdlib.h> #include <stdint.h> typedef struct{ uint32_t sync: 11; uint32_t version: 2; uint32_t layer: 2; uint32_t protection: 1; uint32_t bitrate: 4; uint32_t sampling: 2; uint32_t padding: 1; uint32_t privateBit: 1; uint32_t channel: 2; uint32_t modeExt: 2; uint32_t copyright: 1; uint32_t original: 1; uint32_t emphasis: 2; } Frame; void readFrame(Frame *frame, uint8_t *data){ frame->sync = (data[0]<<3) | (data[1]>>5);//11111111 111 frame->version = (data[1]& 24)>>3;//00011000 frame->layer = (data[1]& 6)>>1;//00000110 frame->protection = (data[1]& 1)>>0;//00000001 frame->bitrate = (data[2]&0xF0)>>4;//11110000 frame->sampling = (data[2]& 12)>>2;//00001100 frame->padding = (data[2]& 2)>>1;//00000010 frame->privateBit = (data[2]& 1)>>0;//00000001 frame->channel = (data[3]& 192)>>6;//11000000 frame->modeExt = (data[3]& 45)>>4;//00110000 frame->copyright = (data[3]& 8)>>3;//00001000 frame->original = (data[3]& 4)>>2;//00000100 frame->emphasis = (data[3]& 3)>>0;//00000011 } int getLowest(int *data, int n){ int i, lowest = 123456789; for (i=0; i<n; i++) if(data[i]<lowest) lowest = data[i]; return lowest; } int isNiceFrame(Frame *f){ return (f->sync == 0x7FF) &&//sync bits (f->bitrate != 15) &&//reserved (f->layer == 1) &&//mp3 (f->emphasis == 0) &&//usually unused (f->sampling != 3); //reserved } int main(){ //dumped with Windows 7 task manager FILE *fp = fopen("plugin-container.DMP", "rb"); fseek(fp, 0, SEEK_END); int n = ftell(fp); rewind(fp); uint8_t *data = (uint8_t*)malloc(n); fread(data, 1, n, fp); fclose(fp); Frame f; int i, j; int last = 0; int lastIndex = 0; int maxFrameSize = 2000; int consecutiveSyncBits = 100; int dist[consecutiveSyncBits]; int where[consecutiveSyncBits]; for (i=0; i<consecutiveSyncBits; i++) where[i] = dist[i] = 123456789; for (i=0; i<n; i++){ readFrame(&f, data+i); //printFrame(f); if (isNiceFrame(&f)){ //Save position of current sync bits where[lastIndex] = i; //Save distance for current sync bits dist[lastIndex] = i - last; //Clamp index to range [0, consecutiveSyncBits] lastIndex = lastIndex + 1 < consecutiveSyncBits ? lastIndex + 1 : 0; //Check for many consecutive sync bits int manySyncBits = 1; for (j=0; j<consecutiveSyncBits; j++){ if (dist[j] > maxFrameSize){ manySyncBits = 0; break; } } if (manySyncBits){ printf("Sync: 0x%x\n", f.sync); printf("Version: %i\n", f.version); printf("Layer: %i\n", f.layer); printf("Protection: %i\n", f.protection); printf("Bitrate: %i\n", f.bitrate); printf("Sampling: %i\n", f.sampling); printf("Padding: %i\n", f.padding); printf("PrivateBit: %i\n", f.privateBit); printf("Channel: %i\n", f.channel); printf("Mode Extension: %i\n", f.modeExt); printf("Copyright: %i\n", f.copyright); printf("Original: %i\n", f.original); printf("Emphasis: %i\n\n", f.emphasis); puts("Found many consecutive sync bits"); //search last frame while (i - last < maxFrameSize){ i++; readFrame(&f, data+i); if (f.sync == 0x7FF) last = i; } fp = fopen("out.mp3", "wb"); //get first frame int start = getLowest(where, consecutiveSyncBits); //dump data from first to last frame to file fwrite(data+start, 1, i - start, fp); fclose(fp); printf("Wrote %i bytes to file\n", i - start); break; } last = i; } } free(data); return 0; }
first 0x600 bytes of out.mp3
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 00000000 FF FB 90 60 00 0F F0 00 00 69 00 00 00 08 00 00 ÿû.`..ð..i...... 00000010 0D 20 00 00 01 00 00 01 A4 00 00 00 20 00 00 34 . ......¤... ..4 00000020 80 00 00 04 4C 41 4D 45 33 2E 39 35 00 00 00 00 €...LAME3.95.... 00000030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000040 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000050 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000060 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000070 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000080 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000090 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 000000A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 000000B0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 000000C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 000000D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 000000E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 000000F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000100 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000130 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000140 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000150 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000160 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000170 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000180 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000190 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 000001A0 00 40 00 FF 04 A5 01 00 00 80 04 80 04 FF FB 90 .@.ÿ.¥...€.€.ÿû. 000001B0 60 00 00 00 00 00 69 00 00 00 08 00 00 0D 20 00 `.....i....... . 000001C0 00 01 17 75 A2 70 43 30 CF C1 FA 97 4F 9C 64 9A ...u¢pC0ÏÁú—Oœdš 000001D0 D1 BE 40 0A 34 92 23 83 0F 18 3C 7A 09 98 79 C8 Ѿ@.4’#ƒ..<z.˜yÈ 000001E0 A4 8A 95 4A 51 A8 5E B1 7B 10 32 D2 D2 D1 14 8E ¤Š•JQ¨^±{.2ÒÒÑ.Ž 000001F0 3E 0F E6 E3 E0 EE 24 15 CB C6 24 E1 F4 3D 0F 85 >.æãàî$.ËÆ$áô=.… 00000200 A1 98 B0 3F 11 04 B2 41 71 0C E8 C4 B4 45 23 91 ¡˜°?..²Aq.èÄ´E#‘ 00000210 07 F2 39 A1 6C C0 EE 06 57 29 3D 3E 35 41 34 2D .ò9¡lÀî.W)=>5A4- 00000220 9E 1F AC 30 B3 8D 48 68 71 83 C3 86 1E 40 F3 0D ž.¬0³.HhqƒÃ†.@ó. 00000230 A4 48 8E 1A 1C 60 F0 82 64 0C 3C A3 49 22 1C 30 ¤HŽ..`ð‚d.<£I".0 00000240 F0 E1 87 90 26 61 67 22 44 90 D0 E1 87 8C 26 40 ðá‡.&ag"D.Ðᇌ&@ 00000250 C3 CA 34 92 21 C3 0F 0E 18 7A 04 CC 2C E9 22 48 ÃÊ4’!Ã...z.Ì,é"H 00000260 68 E0 C3 C6 05 90 20 79 85 9C 88 E0 C1 C3 86 1E hàÃÆ.. y…œˆàÁÆ. 00000270 30 99 87 94 69 12 48 8E 0C 3C 60 59 04 13 30 B3 0™‡”i.HŽ.<`Y..0³ 00000280 91 48 30 71 C1 83 8C 26 40 F2 8D 34 90 95 76 D6 ‘H0qÁƒŒ&@ò.4.•vÖ 00000290 40 02 A6 A7 71 68 5E E5 C3 B4 EE 22 92 97 97 17 @.¦§qh^åôî"’——. 000002A0 0C F5 29 06 1E 30 78 F1 C1 38 A0 8C B2 12 61 D1 .õ)..0xñÁ8 Œ².aÑ 000002B0 28 34 11 0E 83 02 70 C0 AC 80 A1 D2 21 48 98 22 (4..ƒ.pÀ¬€¡Ò!H˜" 000002C0 13 08 03 61 31 C1 38 A0 F2 A5 24 51 1C 34 38 C1 ...a1Á8 ò¥$Q.48Á 000002D0 E4 09 90 67 69 A5 2D 49 AD 56 07 48 C0 65 55 03 ä..gi¥-I.V.HÀeU. 000002E0 21 54 65 55 59 21 6A 81 46 2C 90 30 8D 23 16 5D !TeUY!j.F,.0.#.] 000002F0 50 3A 60 83 0B 54 0C 00 B4 65 55 59 20 65 51 42 P:`ƒ.T..´eUY eQB 00000300 56 48 18 07 4C 15 97 55 19 1A 41 93 10 53 51 4C VH..L.—U..A“.SQL 00000310 CB 8E 4D 40 00 00 00 00 00 00 00 00 00 00 00 00 ËŽM@............ 00000320 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000330 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000340 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 ..............@. 00000350 FF 04 A5 01 00 00 80 04 80 04 FF FB 90 60 00 05 ÿ.¥...€.€.ÿû.`.. 00000360 52 FF 5B 3E 90 26 1B E2 5A 4A 27 C2 0C C2 C4 0E Rÿ[>.&.âZJ'Â.ÂÄ. 00000370 51 6F 10 34 94 00 01 3A 9E A1 C6 86 50 00 BA 40 Qo.4”..:ž¡Æ†P.º@ 00000380 07 20 67 03 CC 6C AF 61 D9 0B D8 8E F7 CB 0B 29 . g.Ìl¯aÙ.ØŽ÷Ë.) 00000390 0B C3 F7 09 9C 86 35 FE C4 0B 0B BA 27 B6 79 34 .Ã÷.œ†5þÄ..º'¶y4 000003A0 E2 1A FC 46 85 04 26 00 41 00 14 FE 17 2B E7 FA â.üF….&.A..þ.+çú 000003B0 50 EF 34 2F 85 4E A6 84 EE FF EF 96 88 8E EE 64 Pï4/…N¦„îÿï–ˆŽîd 000003C0 EF FD 32 CB 44 E9 A2 44 42 2E 17 D7 3F FE 17 BB ïý2ËDé¢DB..×?þ.» 000003D0 E5 4F 78 61 15 11 FF 9B FF 51 C3 C3 DA 40 FE 80 åOxa..ÿ›ÿQÃÃÚ@þ€ 000003E0 08 55 FF BB FF 5C FA 95 CE 22 76 BC AE 85 13 AE .Uÿ»ÿ\ú•Î"v¼®….® 000003F0 1C 70 05 17 09 A6 7A C8 10 00 2B 58 00 00 00 04 .p...¦zÈ..+X.... 00000400 10 40 F4 F9 05 13 B6 C7 D6 8C B6 8E FB 3B FF F9 .@ôù..¶ÇÖŒ¶Žû;ÿù 00000410 09 B5 1B CE 73 9C FA BA 11 A4 A3 3F 27 3B AB A2 .µ.Îsœúº.¤£?';«¢ 00000420 9D FE 73 9F CE F3 BA 31 C5 A8 10 39 0C 86 1E 20 .þsŸÎóº1Ũ.9.†. 00000430 71 4E D3 E7 24 0E 06 34 18 80 49 3A 8B 6A 20 9D qNÓç$..4.€I:‹j . 00000440 EC 21 04 99 27 40 E7 D1 E8 58 F1 71 E5 96 2E D4 ì!.™'@çÑèXñqå–.Ô 00000450 8E 5D DA 43 D9 01 E4 DD BB 24 A0 A1 6D 08 86 0A Ž]ÚCÙ.äÝ»$ ¡m.†. 00000460 24 55 90 28 9E E5 8F 79 0E C1 78 76 1F BD 22 31 $U.(žå.y.Áxv.½"1 00000470 8E 8E 88 F7 36 96 28 0B 05 12 6A 9E 3C 6B 1A 89 ŽŽˆ÷6–(...jž<k.‰ 00000480 53 F1 2F 52 F0 8A 3D 26 9D EE 52 61 D2 AC 5C 81 Sñ/RðŠ=&.îRaÒ¬\. 00000490 D1 BC C2 38 76 D9 06 52 7C C4 F7 7F C8 F4 EF E1 ѼÂ8vÙ.R|Ä÷.Èôïá 000004A0 D3 99 1E 7B 0E 7F 32 64 10 5F 7D A2 D9 F0 9C 41 Ó™.{..2d._}¢ÙðœA 000004B0 21 5A 06 08 94 EF 43 8C 14 20 9B AC 04 14 62 1C !Z..”ïCŒ. ›¬..b. 000004C0 EA 62 00 8D 4A BA 98 82 82 E2 02 89 A8 4C 0E B1 êb..Jº˜‚‚â.‰¨L.± 000004D0 03 08 14 5D F6 77 D9 F6 B9 0F FF FF FF 6F F3 C8 ...]öwÙö¹.ÿÿÿoóÈ 000004E0 26 FD 8A 04 E5 9C FC A6 A0 88 B3 83 77 F4 05 9C &ýŠ.åœü¦ ˆ³ƒwô.œ 000004F0 4C 3E CD 7D 61 60 72 EF 62 13 00 40 00 FF 04 A5 L>Í}a`rïb..@.ÿ.¥ 00000500 01 00 00 80 04 80 04 FF FB 90 60 00 00 03 A0 5F ...€.€.ÿû.`... _ 00000510 CB 86 62 00 00 49 44 B9 FF C4 BC 00 4E B5 43 3A ˆb..ID¹ÿļ.NµC: 00000520 19 A5 80 01 19 17 E5 C3 1E B0 00 8D FC C7 82 0C .¥€...åÃ.°..üÇ‚. 00000530 B8 75 FD C5 05 D9 5D 7E FE 2C 4E D2 12 6C 8B 8C ¸uýÅ.Ù]~þ,NÒ.l‹Œ 00000540 B8 B3 17 98 0E 33 61 94 11 E1 9A 96 A6 48 AE 60 ¸³.˜.3a”.áš–¦H®` 00000550 66 E5 72 7C 98 4D 2D 47 8E D3 8E 31 D0 54 20 86 får|˜M-GŽÓŽ1ÐT † 00000560 95 36 9A D6 9B 50 48 8F 17 19 C2 14 86 3F A3 AE •6šÖ›PH...Â.†?£® 00000570 81 B1 70 F1 38 6A 89 78 E1 B9 BF A1 43 33 74 1D .±pñ8j‰xṿ¡C3t. 00000580 19 AB B1 36 56 3C 7A A2 59 36 FF D0 7F B7 38 4D .«±6V<z¢Y6ÿÐ.·8M 00000590 9C 41 48 18 17 4C 4D CC CD BF FF FF FF 35 37 45 œAH..LMÌÍ¿ÿÿÿ57E 000005A0 06 64 67 56 85 88 68 95 FA C6 C0 00 00 00 02 7C .dgV…ˆh•úÆÀ....| 000005B0 30 D1 66 B3 50 C4 DA 09 C5 11 84 06 B7 76 94 6F 0Ñf³PÄÚ.Å.„.·v”o 000005C0 55 C7 B4 33 CE AF 0E 89 F1 1E 24 28 83 10 80 1F UÇ´3ί.‰ñ.$(ƒ.€. 000005D0 85 BD 3E FE 57 97 EF F5 98 90 ED A8 3D B3 15 93 …½>þW—ïõ˜.í¨=³.“ 000005E0 D3 FF EF 9D FF EB 68 E5 8C C8 60 53 D3 88 3D 0B Óÿï.ÿëhåŒÈ`SÓˆ=. 000005F0 4C F9 75 7E A2 CC B6 9A D5 4D BA 50 3D 25 2D 7B Lùu~¢Ì¶šÕMºP=%-{ 00000600 C0 78 75 35 5A 3E 04 24 50 41 A5 4A D1 24 13 88 Àxu5Z>.$PA¥JÑ$.ˆ
//keine hidden-tags?