I spent quite a bit of time decrypting the audio packet, and I think you can try to capture libaudio. You will have problems accessing the hardware directly (/ dev / *), as many devices use proprietary audio drivers. There is no rule in this regard.
However, the Audio Abstraction Layer (HAL) provided by /system/lib/libaudio.so should disclose the API described at http://source.android.com/porting/audio.html
The Android system, and especially the audioflinger, uses this libaudio HAL to search for available devices, handle routing, and, of course, to read / write PCM data.
That way, you could capture the interaction between the audio framer and libaudio by renaming it later and providing your own libaudio that will beautify the real one. Therefore, you should be able to record what is happening, and possibly intercept the FM radio output, provided that the hardware is not directly processed.
Of course, all this requires rooting. Please comment if you manage to do this, which interests me.
source share