androguard and android-21

[kvarga]

Looks like there is an issue with androguard and android-21. Specifically the get_android_resources() function seems to be having an issue parsing the resources.arsc file successfully. We discovered issue on some internal builds and I'm going to try to recreate a simple apk to demonstrate, but wanted to go ahead and create issue in case anyone has any ideas.

[kvarga]

Example File Downloaded: https://storage.googleapis.com/randy/DeviceOwnerCheck.apk

Command Ran:

python -c "from androguard.core.bytecodes.apk import APK; apk = APK('DeviceOwnerCheck.apk'); apk.get_android_resources()"

Stack trace:

WARNING: ooo
Traceback (most recent call last):
  File "/Users/kylevarga/Code/devops/launchpad/env/lib/python2.7/site-packages/androguard/core/bytecodes/apk.py", line 627, in get_android_resources
    return self.arscÄ"resources.arsc"Å
KeyError: 'resources.arsc'
Traceback (most recent call last):
  File "<string>", line 1, in <module>
  File "/Users/kylevarga/Code/devops/launchpad/env/lib/python2.7/site-packages/androguard/core/bytecodes/apk.py", line 630, in get_android_resources
    self.arscÄ"resources.arsc"Å = ARSCParser(self.zip.read("resources.arsc"))
  File "/Users/kylevarga/Code/devops/launchpad/env/lib/python2.7/site-packages/androguard/core/bytecodes/apk.py", line 1277, in __init__
    mTableStrings = StringBlock(self.buff)
  File "/Users/kylevarga/Code/devops/launchpad/env/lib/python2.7/site-packages/androguard/core/bytecodes/apk.py", line 744, in __init__
    self.m_styles.append(unpack('<i', buff.read(4))Ä0Å)
struct.error: unpack requires a string argument of length 4

apk is a valid androguard APK object

[kvarga]

This commit ( subho007@62418f1 ) on @xysec fork by @subho007 seems related to this. However it does not fix issue, just moves it further down do a different buff.read() statement somewhere else.

[subho007]

@kvarga yes you are right, this doesn't solves the problem. That was again a quick fix, with broken resources. I am currently trying to find how the size%4==0 passes and then reading 4 chunks throws an error. The problem might be that the size being computed is not correct, or the buffer faces an invalid bytes.

[kvarga]

This seems closely related to the issue here: iBotPeaches/Apktool@0d950f3

However, I'm not sure how to turn this into python to help fix androguard.

[subho007]

Implementation needs to follow this: http://justanapplication.wordpress.com/2011/09/19/android-internals-resources-part-eight-resource-entries-and-values/

[subho007]

@adesnos @Lircyn any suggestions? Majority apps fails to work in androguard because of the following problem !

[adesnos]

Sorry. I will take a look.

[subho007]

@adesnos thank you :) I tried to follow iBotPeaches/Apktool@0d950f3 but the issue still existed ! My patch would be in https://github.com/xysec/androguard/tree/bug/resource which still doesn't work :( any help ?

[kvarga]

Any idea / progress @adesnos - Unfortunately this is beyond my limits, but about at the point I need to find an alternative in the next few weeks if this isn't going to be fixed soon. Wish I could help get this fixed.

[kvarga]

@adesnos Have you had a chance to look at this?

[Colbert337]

@kvarga @subho007 I met the same problem!!! It occurs in the "> or = Android-SDK-21" apps.I think the problem might be that "self.header = unpack('<h', buff.read(2))[0]" is 0,it is not correct.

[xia0pin9]

Don't know if it's related, but I get a similar error when open an apk file, the stack trace shows the error happened in zipfile.py (http://bugs.python.org/issue14315). The androguard included version (md5: 1e042f0661f8966e7a15c81651b4dfb9) generate an "unpack" error, but the (previously mentioned) patched version of zipfile.py works without any problems.

[subho007]

This seems to be fixed at uTest/Androguard
Although, a small bug remains which can be patched according to my comments at uTest/Androguard#1

[subho007]

I have implemented the fix in my repo too at subho007#8 with the fixes