Open kidovn opened 5 months ago
How come I've never heard of android:graph
? Need to find what framework/sdk version that is from.
Is there any way I can fix by myself, for example build resource without checking the error?
Sure - remove all those attributes the framework doesn't know about. A hacky workaround, but it might work.
Confirmed, I'll investigate if bug or a new framework.
Appears to be a bug. We have a situation where the resource namespaces are stripped, like so.
➜ 3533 aapt2 d xmltree app-release.apk --file res/6x.xml
N: android=http://schemas.android.com/apk/res/android (line=5)
N: app=http://schemas.android.com/apk/res-auto (line=5)
E: navigation (line=5)
A: (0x010100d0)=@0x7f0a0420
A: (0x7f04060a)=@0x7f0a007f
E: include (line=7)
A: (0x7f040322)=@0x7f110003
E: include (line=8)
A: (0x7f040322)=@0x7f11000b
Apktool falls back to the default namespace (android) when it cannot find one as shown here: https://github.com/iBotPeaches/Apktool/blob/master/brut.apktool/apktool-lib/src/main/java/brut/androlib/res/decoder/AXmlResourceParser.java#L321-L327
So I believe we are improperly treating it as an Android attribute, when it might be a local attribute. We do have 2 namespaces in this file leveraged, so either Apktool has a bug when parsing the namespace stack or this isn't possible and we must first check if we find a valid resource in android (framework), otherwise fall back to the first non-android namespace.
I took a look at this some more. While the namespace uri was stripped, the prefix wasn't. So I should be able to maintain a common pool of URIs to match up the respective prefixes in combination with that is already detected.
"http://schemas.android.com/apk/res/android" - "android"
"http://schemas.android.com/apk/distribution" - "dist"
"http://schemas.android.com/tools" - "tools"
I see a bug - we are mixing up offset/index when resolving a non-main uri/prefix for the namespaces. I should have a fix within a week.
[9, 5, -1, 1, 0x7F110003]
Haven't been able to pinpoint how this is occurring yet. So ignore my notes as I leave reminders for myself for next time.
So after hitting the include, which is improperly associated with the android namespace, instead of app. We see
E: include (line=7)
A: (0x7f040322)=@0x7f110003
Its a new element, so our index starts at 0, thus offset is 0. This becomes 16 which is "android"
. The correct index is 1 so our bug must be in the NamespaceStack. I'll have to annotate file below as I step through next time.
The file
➜ 3533 xxd 6x.xml
00000000: 0300 0800 940a 0000 0100 1c00 6c02 0000 ............l...
00000010: 2000 0000 0000 0000 0001 0000 9c00 0000 ...............
00000020: 6c02 0000 0000 0000 0300 0000 0600 0000 l...............
00000030: 0900 0000 0c00 0000 0f00 0000 1200 0000 ................
00000040: 1500 0000 1800 0000 1b00 0000 1e00 0000 ................
00000050: 3700 0000 5400 0000 6400 0000 7c00 0000 7...T...d...|...
00000060: 9400 0000 9d00 0000 a700 0000 c800 0000 ................
00000070: ce00 0000 d900 0000 1801 0000 2b01 0000 ............+...
00000080: 3401 0000 3f01 0000 6901 0000 9601 0000 4...?...i.......
00000090: a001 0000 ad01 0000 b501 0000 bd01 0000 ................
000000a0: c501 0000 0000 0000 0000 0000 0000 0000 ................
000000b0: 0000 0000 0000 0000 0000 0000 0000 0000 ................
000000c0: 0000 1616 4163 6365 7074 4465 6c69 7665 ....AcceptDelive
000000d0: 7279 4672 6167 6d65 6e74 001a 1a41 7574 ryFragment...Aut
000000e0: 6f41 6363 6570 7444 656c 6976 6572 7946 oAcceptDeliveryF
000000f0: 7261 676d 656e 7400 0d0d 426c 616e 6b46 ragment...BlankF
00000100: 7261 676d 656e 7400 1515 4465 6c69 7665 ragment...Delive
00000110: 7279 4c69 7374 436f 6e74 6169 6e65 7200 ryListContainer.
00000120: 1515 456d 7074 7944 656c 6976 6572 7946 ..EmptyDeliveryF
00000130: 7261 676d 656e 7400 0606 6163 7469 6f6e ragment...action
00000140: 0007 0761 6e64 726f 6964 001e 1e61 6e64 ...android...and
00000150: 726f 6964 782e 6672 6167 6d65 6e74 2e61 roidx.fragment.a
00000160: 7070 2e46 7261 676d 656e 7400 0303 6170 pp.Fragment...ap
00000170: 7000 0808 6172 6775 6d65 6e74 003c 3c63 p...argument.<<c
00000180: 6f6d 2e72 6f61 6472 756e 6e65 722e 6465 om.roadrunner.de
00000190: 6c69 7665 7279 2e63 6f6d 6d6f 6e2e 6461 livery.common.da
000001a0: 7461 2e65 6e74 6974 6965 732e 4465 7374 ta.entities.Dest
000001b0: 696e 6174 696f 6e54 7970 6500 1010 6465 inationType...de
000001c0: 7374 696e 6174 696f 6e5f 7479 7065 0006 stination_type..
000001d0: 0664 6961 6c6f 6700 0808 6672 6167 6d65 .dialog...fragme
000001e0: 6e74 0027 2768 7474 703a 2f2f 7363 6865 nt.''http://sche
000001f0: 6d61 732e 616e 6472 6f69 642e 636f 6d2f mas.android.com/
00000200: 6170 6b2f 7265 732d 6175 746f 002a 2a68 apk/res-auto.**h
00000210: 7474 703a 2f2f 7363 6865 6d61 732e 616e ttp://schemas.an
00000220: 6472 6f69 642e 636f 6d2f 6170 6b2f 7265 droid.com/apk/re
00000230: 732f 616e 6472 6f69 6400 0707 696e 636c s/android...incl
00000240: 7564 6500 0a0a 6e61 7669 6761 7469 6f6e ude...navigation
00000250: 0005 056f 2e63 456a 0005 056f 2e63 4573 ...o.cEj...o.cEs
00000260: 0005 056f 2e63 5356 0005 056f 2e64 655a ...o.cSV...o.deZ
00000270: 0000 0000 8001 0800 2c00 0000 0100 0101 ........,.......
00000280: 0300 0101 d000 0101 4900 047f d701 047f ........I.......
00000290: 2203 047f 5505 047f 5605 047f 0a06 047f "...U...V.......
000002a0: 0001 1000 1800 0000 0500 0000 ffff ffff ................
000002b0: 1000 0000 1900 0000 0001 1000 1800 0000 ................
000002c0: 0500 0000 ffff ffff 1200 0000 1800 0000 ................
000002d0: 0201 1000 4c00 0000 0500 0000 ffff ffff ....L...........
000002e0: ffff ffff 1b00 0000 1400 1400 0200 0100 ................
000002f0: 0000 0000 0900 0000 0200 0000 ffff ffff ................
00000300: 0800 0001 2004 0a7f 0900 0000 0800 0000 .... ...........
00000310: ffff ffff 0800 0001 7f00 0a7f 0201 1000 ................
00000320: 3800 0000 0700 0000 ffff ffff ffff ffff 8...............
00000330: 1a00 0000 1400 1400 0100 0000 0000 0000 ................
00000340: 0900 0000 0500 0000 ffff ffff 0800 0001 ................
00000350: 0300 117f 0301 1000 1800 0000 0700 0000 ................
00000360: ffff ffff ffff ffff 1a00 0000 0201 1000 ................
00000370: 3800 0000 0800 0000 ffff ffff ffff ffff 8...............
00000380: 1a00 0000 1400 1400 0100 0000 0000 0000 ................
00000390: 0900 0000 0500 0000 ffff ffff 0800 0001 ................
000003a0: 0b00 117f 0301 1000 1800 0000 0800 0000 ................
000003b0: ffff ffff ffff ffff 1a00 0000 0201 1000 ................
000003c0: 3800 0000 0900 0000 ffff ffff ffff ffff 8...............
000003d0: 1a00 0000 1400 1400 0100 0000 0000 0000 ................
000003e0: 0900 0000 0500 0000 ffff ffff 0800 0001 ................
000003f0: 0a00 117f 0301 1000 1800 0000 0900 0000 ................
00000400: ffff ffff ffff ffff 1a00 0000 0201 1000 ................
00000410: 6000 0000 0e00 0000 ffff ffff ffff ffff `...............
00000420: 1700 0000 1400 1400 0300 0300 0000 0000 ................
00000430: 0900 0000 0000 0000 0c00 0000 0800 0003 ................
00000440: 0c00 0000 0900 0000 0100 0000 1100 0000 ................
00000450: 0800 0003 1100 0000 0900 0000 0200 0000 ................
00000460: ffff ffff 0800 0001 7f00 0a7f 0301 1000 ................
00000470: 1800 0000 0e00 0000 ffff ffff ffff ffff ................
00000480: 1700 0000 0201 1000 6000 0000 1300 0000 ........`.......
00000490: ffff ffff ffff ffff 1700 0000 1400 1400 ................
000004a0: 0300 0300 0000 0000 0900 0000 0000 0000 ................
000004b0: 0e00 0000 0800 0003 0e00 0000 0900 0000 ................
000004c0: 0100 0000 1f00 0000 0800 0003 1f00 0000 ................
000004d0: 0900 0000 0200 0000 ffff ffff 0800 0001 ................
000004e0: cf01 0a7f 0301 1000 1800 0000 1300 0000 ................
000004f0: ffff ffff ffff ffff 1700 0000 0201 1000 ................
00000500: 6000 0000 1700 0000 ffff ffff ffff ffff `...............
00000510: 1700 0000 1400 1400 0300 0300 0000 0000 ................
00000520: 0900 0000 0000 0000 0a00 0000 0800 0003 ................
00000530: 0a00 0000 0900 0000 0100 0000 1c00 0000 ................
00000540: 0800 0003 1c00 0000 0900 0000 0200 0000 ................
00000550: ffff ffff 0800 0001 1000 0a7f 0301 1000 ................
00000560: 1800 0000 1700 0000 ffff ffff ffff ffff ................
00000570: 1700 0000 0201 1000 6000 0000 1c00 0000 ........`.......
00000580: ffff ffff ffff ffff 1700 0000 1400 1400 ................
00000590: 0300 0300 0000 0000 0900 0000 0000 0000 ................
000005a0: 0d00 0000 0800 0003 0d00 0000 0900 0000 ................
000005b0: 0100 0000 1e00 0000 0800 0003 1e00 0000 ................
000005c0: 0900 0000 0200 0000 ffff ffff 0800 0001 ................
000005d0: 9001 0a7f 0301 1000 1800 0000 1c00 0000 ................
000005e0: ffff ffff ffff ffff 1700 0000 0201 1000 ................
000005f0: 6000 0000 2100 0000 ffff ffff ffff ffff `...!...........
00000600: 1600 0000 1400 1400 0300 0300 0000 0000 ................
00000610: 0900 0000 0000 0000 0b00 0000 0800 0003 ................
00000620: 0b00 0000 0900 0000 0100 0000 1d00 0000 ................
00000630: 0800 0003 1d00 0000 0900 0000 0200 0000 ................
00000640: ffff ffff 0800 0001 6e00 0a7f 0301 1000 ........n.......
00000650: 1800 0000 2100 0000 ffff ffff ffff ffff ....!...........
00000660: 1600 0000 0201 1000 7400 0000 2700 0000 ........t...'...
00000670: ffff ffff ffff ffff 0f00 0000 1400 1400 ................
00000680: 0400 0100 0000 0000 0900 0000 0200 0000 ................
00000690: ffff ffff 0800 0001 ce01 0a7f 0900 0000 ................
000006a0: 0400 0000 ffff ffff 0800 0001 cf01 0a7f ................
000006b0: 0900 0000 0600 0000 ffff ffff 0800 0001 ................
000006c0: 2004 0a7f 0900 0000 0700 0000 ffff ffff ...............
000006d0: 0800 0012 ffff ffff 0301 1000 1800 0000 ................
000006e0: 2700 0000 ffff ffff ffff ffff 0f00 0000 '...............
000006f0: 0201 1000 7400 0000 2c00 0000 ffff ffff ....t...,.......
00000700: ffff ffff 0f00 0000 1400 1400 0400 0100 ................
00000710: 0000 0000 0900 0000 0200 0000 ffff ffff ................
00000720: 0800 0001 0f00 0a7f 0900 0000 0400 0000 ................
00000730: ffff ffff 0800 0001 1000 0a7f 0900 0000 ................
00000740: 0600 0000 ffff ffff 0800 0001 2004 0a7f ............ ...
00000750: 0900 0000 0700 0000 ffff ffff 0800 0012 ................
00000760: ffff ffff 0301 1000 1800 0000 2c00 0000 ............,...
00000770: ffff ffff ffff ffff 0f00 0000 0201 1000 ................
00000780: 7400 0000 3100 0000 ffff ffff ffff ffff t...1...........
00000790: 0f00 0000 1400 1400 0400 0100 0000 0000 ................
000007a0: 0900 0000 0200 0000 ffff ffff 0800 0001 ................
000007b0: b802 0a7f 0900 0000 0400 0000 ffff ffff ................
000007c0: 0800 0001 9001 0a7f 0900 0000 0600 0000 ................
000007d0: ffff ffff 0800 0001 2004 0a7f 0900 0000 ........ .......
000007e0: 0700 0000 ffff ffff 0800 0012 ffff ffff ................
000007f0: 0301 1000 1800 0000 3100 0000 ffff ffff ........1.......
00000800: ffff ffff 0f00 0000 0201 1000 7400 0000 ............t...
00000810: 3600 0000 ffff ffff ffff ffff 0f00 0000 6...............
00000820: 1400 1400 0400 0100 0000 0000 0900 0000 ................
00000830: 0200 0000 ffff ffff 0800 0001 6d00 0a7f ............m...
00000840: 0900 0000 0400 0000 ffff ffff 0800 0001 ................
00000850: 6e00 0a7f 0900 0000 0600 0000 ffff ffff n...............
00000860: 0800 0001 2004 0a7f 0900 0000 0700 0000 .... ...........
00000870: ffff ffff 0800 0012 ffff ffff 0301 1000 ................
00000880: 1800 0000 3600 0000 ffff ffff ffff ffff ....6...........
00000890: 0f00 0000 0201 1000 6000 0000 3b00 0000 ........`...;...
000008a0: ffff ffff ffff ffff 0f00 0000 1400 1400 ................
000008b0: 0300 0100 0000 0000 0900 0000 0200 0000 ................
000008c0: ffff ffff 0800 0001 b902 0a7f 0900 0000 ................
000008d0: 0400 0000 ffff ffff 0800 0001 2904 0a7f ............)...
000008e0: 0900 0000 0600 0000 ffff ffff 0800 0001 ................
000008f0: 2004 0a7f 0201 1000 4c00 0000 3e00 0000 .......L...>...
00000900: ffff ffff ffff ffff 1300 0000 1400 1400 ................
00000910: 0200 0000 0000 0000 0900 0000 0100 0000 ................
00000920: 1500 0000 0800 0003 1500 0000 0900 0000 ................
00000930: 0300 0000 1400 0000 0800 0003 1400 0000 ................
00000940: 0301 1000 1800 0000 3e00 0000 ffff ffff ........>.......
00000950: ffff ffff 1300 0000 0301 1000 1800 0000 ................
00000960: 3b00 0000 ffff ffff ffff ffff 0f00 0000 ;...............
00000970: 0201 1000 6000 0000 4400 0000 ffff ffff ....`...D.......
00000980: ffff ffff 0f00 0000 1400 1400 0300 0100 ................
00000990: 0000 0000 0900 0000 0200 0000 ffff ffff ................
000009a0: 0800 0001 be02 0a7f 0900 0000 0400 0000 ................
000009b0: ffff ffff 0800 0001 2804 0a7f 0900 0000 ........(.......
000009c0: 0600 0000 ffff ffff 0800 0001 2004 0a7f ............ ...
000009d0: 0201 1000 4c00 0000 4700 0000 ffff ffff ....L...G.......
000009e0: ffff ffff 1300 0000 1400 1400 0200 0000 ................
000009f0: 0000 0000 0900 0000 0100 0000 1500 0000 ................
00000a00: 0800 0003 1500 0000 0900 0000 0300 0000 ................
00000a10: 1400 0000 0800 0003 1400 0000 0301 1000 ................
00000a20: 1800 0000 4700 0000 ffff ffff ffff ffff ....G...........
00000a30: 1300 0000 0301 1000 1800 0000 4400 0000 ............D...
00000a40: ffff ffff ffff ffff 0f00 0000 0301 1000 ................
00000a50: 1800 0000 0500 0000 ffff ffff ffff ffff ................
00000a60: 1b00 0000 0101 1000 1800 0000 0500 0000 ................
00000a70: ffff ffff 1200 0000 1800 0000 0101 1000 ................
00000a80: 1800 0000 0500 0000 ffff ffff 1000 0000 ................
00000a90: 1900 0000 ....
➜ 3533
and sadly my attempt to replicate fails - it correctly decodes.
<?xml version="1.0" encoding="utf-8"?>
<navigation android:id="@null" app:startDestination="@id/nav_home"
xmlns:android="http://schemas.android.com/apk/res/android" xmlns:app="http://schemas.android.com/apk/res-auto">
<include app:graph="@navigation/desktop_navigation" />
<fragment android:label="@string/menu_home" android:name="com.ibotpeaches.issue3533_2.ui.home.HomeFragment" android:id="@id/nav_home" />
<fragment android:label="@string/menu_gallery" android:name="com.ibotpeaches.issue3533_2.ui.gallery.GalleryFragment" android:id="@id/nav_gallery" />
<fragment android:label="@string/menu_slideshow" android:name="com.ibotpeaches.issue3533_2.ui.slideshow.SlideshowFragment" android:id="@id/nav_slideshow" />
</navigation>
Somehow this application stripped the ending namespace declaration which has thrown off the detection of namespaces when assigning them.
@REAndroid - could I pick your brain with this? Looking at file res/6x.xml
in this application - Apktool improperly associates the Android namespace instead of the app namespace.
➜ 3533 aapt2 d xmltree app-release.apk --file res/6x.xml
N: android=http://schemas.android.com/apk/res/android (line=5)
N: app=http://schemas.android.com/apk/res-auto (line=5)
E: navigation (line=5)
A: (0x010100d0)=@0x7f0a0420
A: (0x7f04060a)=@0x7f0a007f
E: include (line=7)
A: (0x7f040322)=@0x7f110003
Apktool is doing (wrongly)
<?xml version="1.0" encoding="utf-8"?>
<navigation id="@id/nav_graph_delivery" android:startDestination="@id/blankFragment" xmlns:android="http://schemas.android.com/apk/res/android" xmlns:app="http://schemas.android.com/apk/res-auto">
<include android:graph="@navigation/nav_graph_delivery_confirmation" />
ApkEditor is doing it right (?), but introduces a new prefix I can't follow.
<?xml version='1.0' encoding='utf-8' ?>
<navigation android:id="@id/nav_graph_delivery" courier:startDestination="@id/blankFragment" xmlns:android="http://schemas.android.com/apk/res/android" xmlns:courier="http://schemas.android.com/apk/res-auto">
<include courier:graph="@navigation/nav_graph_delivery_confirmation" />
Best I can tell in some research is I have some oddities around start/end namespace as well as dealing with a null one. Could you help me understand how you got courier
in your tool?
This is not my tool. Another people ask me for change something
@iBotPeaches
ARSCLib/APKEditor resolves NS prefix on package name suffix rather than relying on uri last path segment. I don't remember where I read it but last segment of NS uri is referring package name.
0x01xxxxxx -> lookup frameworks -> pick "android"
0x7fxxxxxx -> lookup packages -> com.something.graph -> pick "graph"
Parsing uri for prefix might cause problems on building specially for multi-package resources, and also proguard/others are stripping away namespaces
Thanks @REAndroid - makes sense. The application ended in com.something.courier
which matches ARSCLib output. Makes sense how you got to it now.
I assume you did that instead of hard-coding "app" to workaround multi-package resources.
Information
apktool -version
) - 2.9.3java --version
) - 17.0.6Stacktrace/Logcat
Steps to Reproduce
Frameworks
If this APK is from an OEM ROM (Samsung, HTC, LG). Please attach framework files (
.apks
that live in/system/framework
or/system/priv-app
) NoAPK
If this APK can be freely shared, please upload/attach a link to it.
https://install.appcenter.ms/orgs/hockeyapp-z6mg/apps/roadrunner/distribution_groups/all-users-of-roadrunner
Questions to ask before submission
apktool d
,apktool b
without changing anything? Yes