-
-
Notifications
You must be signed in to change notification settings - Fork 3.6k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
decompiling latest Facebook APK - unsupported res type name for bags. Found: style2 #1719
Comments
Great. Facebook is doing something crazy with resources. Looks like a tweaked (probably custom) version of AndroResGuard. There are two types of images I see - I'll take a look tonight. |
@ahmed-ais , @iBotPeaches It seems to be that guys from Facebook start using AndResGuard (https://github.com/shwenzhang/AndResGuard). It's Proguard's for resource files. IMHO, o understending how process them you should understend how it works. |
I have a good idea of how it works. Been doing this never ending patch war with AndroResGuard for years. However, AndroResGuard just needs to run on a device, so it can strip everything that the host doesn't care about. This means that taking an application back to a point that it can be rebuilt is very difficult. We are looking at hundreds, if not, thousands of resources at the root level renamed and obfuscated which Android doesn't care about because it just follows resourceIds and file paths. It doesn't care about any human-readable names. Our decoder is handling those correctly, but this time instead of being serialized and moved/renamed - they are left in the "raw" state. Likewise, |
@iBotPeaches |
Yeah, I patched that one already locally. The issue is the I'll have a patch up later today. |
@iBotPeaches it sounds great. Thank you for that. Can you explain to me why some resource folders after decompilation named like |
I'm taking a look. It seems a new level of obfuscation is creating a new type tree. So instead of a drawable type, they create |
Okay, throwing up a WIP commit here any minute. Since AndroResGuard is open source, I'm going to build a small little test application and add it into test suite to prevent regressions. Once that is done, I'll get this merged into mainline master. Currently blocked on understanding the types. I think AndroResGuard just is making fake type names, but keeping the underlying typeId the same. This is why the application continues to work on Android. However, apktool decodes the human-readable name into the directory structure which is not valid.
As shown from that stacktrace. Since AndroResGuard doesn't require any update to aapt binary, there is no way this is valid. So about 60% done. Just need tests and that thing to patch. |
Need to sleep on this. Need more research. These extra types like "drawable2" are entirely valid with a type entry table. Rewriting them is not worth it. My first attempt was to rewrite "drawable2" to "drawable" and treat it as such. That produced a valid filepath and aapt built it...almost.
It knows it has the wrong resourceType. So the obvious solution is to remap the typeId back to the original (drawable typeId) instead of the drawable2 typeId. That doesn't seem right though, all that rewriting. So I went back to keeping the weird types, just rewriting the path name. Which leads to even stranger errors:
I just need to sit down, since this tool is open source and do test after test with simple applications until I understand how these extra types play in at the I pushed my highly broken and probably wrong to the branch above. Will revisit. |
Okay, so here is the rub. AndResGuard works by manually rebuilding the Unfortunately, Apktool build process currently works using If we leave the original types (drawable/drawable2/etc), then the build process of
The only solution I have for rebuild support is probably rewriting all these types back to the original, so native |
Merged some changes into master that will help with at least decoding (Perhaps decode in an invalid format). I need to get aapt2 finished before I jump back to this. I think the limitations I'm dealing with when rebuilding are different in aapt2 and don't want to waste time. |
Note to self. Look into skipping resource decoding (-r) and look into why that is not working. Context: #1739 |
Hi @iBotPeaches, Thanks! |
Version 2.4.0 still have problems with the facebook apk. But now it crashes with an exception.
|
I was able to get around the crash by adding the resource type "style2". That type doesn't seem to be documented though so I am not sure the change is correct. https://android.googlesource.com/platform/frameworks/base/+/master/tools/aapt2/Resource.h#66 |
I had to add style3, style4, and style5 to get it to work for me (working on a more recent Facebook APK). If this is a correct fix, do you want a PR? |
Looks like same issue as above (
|
I have the same problem when decompiling with 2.4.0.
|
I have same error when decompile apk recently. It seems apktool failed on all new obfuscate algorithm. It is very bad news :(. I have tried with all tools that have similar apktool functionality. But in the end is the error |
Updated title to reflect true crash and to start linking duplicate issues to this ticket. Sorry for the delay. |
Another sample crashing evenly: https://play.google.com/store/apps/details?id=it.icbpi.mobile&hl=en [14:36 edu@xps tmp] > apktool d base.apk -f
I: Using Apktool 2.4.1 on base.apk
I: Loading resource table...
Exception in thread "main" brut.androlib.AndrolibException: unsupported res type name for bags. Found: style2
at brut.androlib.res.data.value.ResValueFactory.bagFactory(ResValueFactory.java:119)
at brut.androlib.res.decoder.ARSCDecoder.readComplexEntry(ARSCDecoder.java:350)
at brut.androlib.res.decoder.ARSCDecoder.readEntryData(ARSCDecoder.java:276)
at brut.androlib.res.decoder.ARSCDecoder.readTableType(ARSCDecoder.java:252)
at brut.androlib.res.decoder.ARSCDecoder.readTableTypeSpec(ARSCDecoder.java:175)
at brut.androlib.res.decoder.ARSCDecoder.readTablePackage(ARSCDecoder.java:131)
at brut.androlib.res.decoder.ARSCDecoder.readTableHeader(ARSCDecoder.java:82)
at brut.androlib.res.decoder.ARSCDecoder.decode(ARSCDecoder.java:48)
at brut.androlib.res.AndrolibResources.getResPackagesFromApk(AndrolibResources.java:786)
at brut.androlib.res.AndrolibResources.loadMainPkg(AndrolibResources.java:67)
at brut.androlib.res.AndrolibResources.getResTable(AndrolibResources.java:59)
at brut.androlib.Androlib.getResTable(Androlib.java:66)
at brut.androlib.ApkDecoder.setTargetSdkVersion(ApkDecoder.java:236)
at brut.androlib.ApkDecoder.decode(ApkDecoder.java:118)
at brut.apktool.Main.cmdDecode(Main.java:170)
at brut.apktool.Main.main(Main.java:76) |
It seems like skipping resource decoding (via Removing the For anyone facing the same problem, here is the full patch which is able to recompile the latest Messenger apk (with @iBotPeaches Since this is only a workaround for now, have you made any progress on this?
|
If you need only decode apk than quick solution: brut.androlib.res.data.value.ResValueFactory#ResScalarValue
For me it decodes Facebok apk without errors with resources. |
This site is able to decompile Facebook App http://apk-deguard.com/. But I didn't find the file AndroidManifest |
Information
Stacktrace/Logcat
https://pastebin.com/edit/rHKMqygQ
Steps to Reproduce
Frameworks
If this APK is from an OEM ROM (Samsung, HTC, LG): Nope
APK
If this APK can be freely shared, please upload/attach a link to it: https://www.apkmirror.com/apk/facebook-2/facebook/facebook-157-0-0-38-97-release/facebook-157-0-0-38-97-android-apk-download/
Questions to ask before submission
apktool d
,apktool b
without changing anything? yesThe text was updated successfully, but these errors were encountered: