Call Audio Stream Modification in Android 4.0 ICS

Question

I've been working on a project that would greatly benefit from call-stream modification. This has been repeatedly said/assumed to be unachievable, as most people believe that the hardware loop for the in-call audio is completely disconnected from the main MCU of the device.

Questions like Stream audio to a phone call Android have received answers stating that it is impossible to access the audio. I agree that this is definitely impossible from the Android API, but it is completely unclear whether the hardware ACTUALLY is disconnected completely.

The stackoverflow user 'artsylar' said that they were able to modify the 'framework layer' of Android OS to inject recorded audio into call streams, which would be a huge step forward (see Play an audio clip onto an ongoing call, artsylar's comment on the selected answer). Assuming artsylar's success is valid, there definitely is a way to control the call stream audio by modifying the framework (I assume the telephony base framework in the Android source).

Basically, I completely agree that modifying or controlling the call-stream is impossible from the application layer. However, I am interested in customizing the Android OS in framework or Radio Interface Layer; artsylar seems to have had success, but there is no explanation in open-literature on how. Given the current state of Android technology, could anyone clarify the above to actually establish whether controlling call audio is possible by modifying the core Android OS, and a good path to accomplish this goal?

I believe that a final clarification on this issue would be of great value to the open-source community.

Thanks!

Large

Did you manage to modify the call-stream? – Surbase

What is the current status of your research? – Stanislas

Answer 1

It's technically possible to inject audio into the voice call uplink on some platforms (Qualcomm's MSM8960 and APQ8064, for example). Support exists at the hardware level and at the device driver level. But to make that functionality available to normal applications you'd have to create a custom Android ROM where you've added all the necessary user-space parts in both the Java layers and native layers of Android.

So the short answer is: no, there's no standard way of doing this as an app developer (doesn't matter if you use the SDK or NDK).
If you're working for an OEM or by some other means are able to build and flash your own Android ROMs you can probably get the information you need by asking your platform vendor.

Rover

.... device - redmi10c processor - Qualcomm SM6225 Snapdragon 680 4G ...... I'm building a lineageOS 19.1 from the base, as my final goal I want to inject an audio file into the incoming call uplink, up to now I did lots of research but I'm still finding a way, (i edited mixer_paths.xml, edited the audio focus inside sdk then I'm trying to edit msm_pcm_routing_v2.c but everything doesn't to helps to reach my goal ) if you can please help me I'm trying to use tinylasa but it's also failed . I need your help or guidance @Michael, – Firehouse

Answer 2

It is very difficult to do so because it relates to handling the Linux Kernal inside the Android OS.

Not only is there no API support , but also the security issue is not allowed to do so.

As being a professional in the software engineering field especially the programmers, we never assume anyone's success on invention and the related project is valid until the project is being tested.

Also streaming the audio during the call may invoke the issue of privacy and security issue among the smartphone users and the service provider of telephony

Shamefaced

Linux kernel? No. Hardware support is essential too, because phones use (mic -> baseband processor, mic -> OS) dual chain, and not (mic -> OS -> baseband, as it can be expected).. – Stanislas

@Stanislas if you say that it's like "mic -> baseband processor", then how Bluetooth headsets work ? So I don't think you're right, it's more like "mic -> OS -> baseband". – Tag

@André, it's little documented, but no - Bluetooth transfers work by on-chip transfers too. You can google a bunch of few datasheets and block schemes/diagrams of chinese MT6575,MT6589 and corresponding radio chips MT6627, MT6627 - I suspect that MRGPCM channel between chips is audio transfer path. There's also something called DAIBT, which chinese people use at some schemes to designate sound processing parts.. More to say, some phones are not mirroring even microphone audio sent to baseband in call. – Stanislas

@André PCM audio in Bluetooth/RF processor doesn't shows up in HCI/application stack, because it's processed in-chip for power efficiency and low-latency requirements. With Bluegiga's prototype bluetooth modules like WT11x, it can be found that a PCM processing unit is built into chip; there's no need for complex processing outside it. – Stanislas

@André another reason: there is no way to send audio received from Bluetooth back to baseband, because there is no input for audio. – Stanislas

@André and I will be personally happy to know that there's a way to capture non-mirrored audio stream and modify it :( – Stanislas

@Stanislas Are there any change of it in 2021? – Swope

@Stanislas Is this still valid in 2022? – Dowden