Initial commit: Null DRM Official

Capture, decrypt, and restream toolkit with compiled-in app modules
(RTE, TG4, BBC), on-device MITM proxy, streamd control plane, and www.
BBC module.yaml is published (clear streams); other module values stay local.

apps/proxy/device/push.sh

@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+# Push rteproxy to the phone and start it in the background.
+set -euo pipefail
+cd "$(dirname "$0")"
+
+BIN="${1:-rteproxy-android-arm64}"
+REMOTE="${REMOTE:-/data/local/tmp/rteproxy}"
+OUT="${OUT:-/data/local/tmp/rte_cap.json}"
+LISTEN="${LISTEN:-:8080}"
+DNS="${DNS:-1.1.1.1,1.0.0.1,8.8.8.8}"
+ADB="${ADB:-adb}"
+
+if [[ ! -f "$BIN" ]]; then
+  echo "missing $BIN — run ./build.sh first" >&2
+  exit 1
+fi
+
+"$ADB" get-state >/dev/null
+"$ADB" push "$BIN" "$REMOTE"
+"$ADB" shell chmod 755 "$REMOTE"
+
+# Stop a previous instance (ignore if none)
+"$ADB" shell "pkill -f /data/local/tmp/rteproxy" >/dev/null 2>&1 || true
+sleep 0.5
+
+"$ADB" shell "sh -c '$REMOTE -listen $LISTEN -out $OUT -ca-dir /data/local/tmp -dns $DNS >/data/local/tmp/rteproxy.log 2>&1 &'"
+sleep 1
+
+echo "--- process ---"
+"$ADB" shell "ps -A | grep rteproxy || true"
+echo "--- log ---"
+"$ADB" shell "cat /data/local/tmp/rteproxy.log || true"
+echo
+echo "CA cert on device: /data/local/tmp/rteproxy-ca.crt"
+echo "  adb pull /data/local/tmp/rteproxy-ca.crt ."
+echo "  → Settings → Security → Install a certificate → CA certificate"
+echo
+echo "Set Wi‑Fi HTTP proxy to 127.0.0.1${LISTEN}"
+echo "Play the stream, then:"
+echo "  adb pull $OUT /tmp/rte_cap.json"
+echo "  python getrtelive.py"