I will start with a question as it goes:
Is it possible to intercept the PCM stream that is routed by the system to the AudioSink (i.e. speakers or headphones) and inject some post-processing on system wide basis?
My current investigation lead me to the following status.
-There is a system-wide audio destination, the CMMFAudioOutput sink. Maybe it is possible to create another sink, that will perform the post-processing and then redirect the resulting stream to the original output.
-There is a set of codecs that are instantiated by the DataPath depending on the FourCCs of the data source and data sink. Maybe it is possible to create a system-wide wrapper that will be called instead of any other codec, that will inside load the needed codec and after that perform the post-processing before returning the stream.
-There might be some other place for such a sound hook that i haven't found in the documentation.
I absolutely understand that such a scenario is a very dangerous thing to allow in an OS for phones. This is the reason that makes me wonder if this problem is solvable at all. Still, there might be some ways, that will surely include driver signing and any other actions preventing malicious usage.