* refactor: ExtDataInput rework, source layout and formatting
Refactor ExtDataInput classes: ExtDataInput is now the extended interface,
ExtDataInputStream is an easy-to-use FilterInputStream implementing ExtDataInput
with static creator methods for big-endian and little-endian wrappers.
Refactor AaptManager class: unify aapt-related verifications to one class.
Replace Apache Commons' deprecated CountingInputStream with Google Guava's
equivalent with the same name. Apache's BoundedInputStream is an overkill
for our use case and its constructors are deprecated as well.
Normalize source layout to have a common and somewhat more standard order:
Static fields first, instance fields after, methods last.
Fix some formatting, like empty spaces or extra spaces and exception messages.
Renamed ResXmlPatcher to ResXmlUtils, as it has more purposes than just patching.
Renamed DirUtil to DirUtils, to match other utility classes naming convention.
Moved "properties/apktool.properties" to jar's root, to match smali/baksmali.
Moved Android Framework to "prebuilt", as it is just a prebuilt, looks out of
place among .class files.
@SuppressWarnings removed from Duo as there are quite a few unsafe assignments
of raw Duo[] instances to parameterized Duo<> variables in the project, this is
just Java being the primitive boilerplate it is, no point in fighting it.
No end-user changes.
Tested against a full ROM decompile/recompile, no issues found.
* small tweak
* last refinement
* missed a stream
Use BrutIO where possible to improve and simplify stream handling.
Ensure streams are closed when no longer needed.
Some minor formatting tweaks and naming consistency.
No functionality changes.
Recording feature flags moved to ResourcesDecoder to fix
an issue where raw AndroidManifest is attempted to be
parsed even when decoding without resources.
Replaced remaining usages of FileInputStream/FileInputStream
with their NIO equivalents for consistency with rest of code.
Minor redundancy and format tweaks.
* refactor: clean up external pull parser and introduce brut.j.xml
We have no need for an XML pull parser in the project,
it was only used for testing, which is now done with XPath.
The external xpp3 library from org.ogce is obsolete and has
the issue of including javax.xml.namespace.QName which conflicts
with the JRE implementation that exists for a very long time now.
This makes direct usages of QName produce very obscure NPEs that
took me hours to figure out. This patch will allow further
optimization that is WIP.
The external library was replaced by the basic xmlpull API.
The MXSerializer has been cleaned and the features used by apktool
have been integrated into the custom implementation, now part of
a separate module called brut.j.xml.
Writing has been optimized by buffering write operations, inspired
by KXmlSerializer used by Android itself.
A class XmlPullUtils also written that allows copying from a
XmlPullParser into a XmlSerializer with or without an EventHandler.
We use it for AndroidManifestPullStreamDecoder (with EventHandler,
to allow omitting the uses-sdk tag), and for ResXmlPullStreamDecoder
(direct copy, without EventHandler).
saveDocument in ResXmlPatcher was tweaked to output proper output -
a new line after declaration and a new line after root element's
end tag.
TL;DR mostly behind the scene refactor, no end user changes.
* refactor: ApkDecoder & ApkBuilder overhaul
A major rewrite of ApkDecoder and ApkBuilder classes to make them managable.
Removed many instances of redundancy and improved syntaxed and indentation.
Modifying the stock Apktool source to our needs have become too difficult,
so I'm pushing the general (not specific to our needs) changes upstream.
I'd change a lot more, but I wanted to make sure all tests pass as expected,
despite some of them being wierd, outdated or unnecessary.
This also fixes certain files in META-INF being lost during recompile
when the -c/--copy-original option isn't used.
This has been tweaked and tested for several days and I vouch for its stablity.
* style: fix more redundancy
* style: fix more redundancy
* tweak: consistent case-sensitivity for cmd and options
* refactor: tracking unknownFiles via apkInfo is redundant
1) We take advantage of the fact that doNotCompress already tracks uncompressed files,
including those separated into "unknown".
With this change the "unknownFiles" is simply ignored, so it's backward-compatible
with existing decoded APK dirs.
Tweaked a few tests to match the removal of "unknownFiles".
2) Passing doNotCompress to AAPT is redundant, Apktool extracts the temp APK packed by
AAPT to build/apk and then repackages it anyway, so it serves no purpose.
* refactor: fix minSdkVersion from baksmali + clean up more redundancy
* Regression: minSdkVersion inferred from baksmali was not stored properly.
* The arsc extension can be generalized for simplicity as seen in AOSP source.
https://cs.android.com/android/platform/superproject/main/+/main:external/deqp/scripts/android/build_apk.py;l=644?q=apk%20pack&ss=android%2Fplatform%2Fsuperproject%2Fmain:external%2F
Note:
NO_COMPRESS_EXT_PATTERN only collapses paths to a common extension.
It does NOT force these extensions to be always uncompressed.
doNotCompress is the one determining files/extensions that should be uncompressed.
(no funcionality was changed)
* resourcesAreCompressed in apkInfo is redundant. It was only used in invokeAapt,
but not ApkBuilder. Its value is also never set by Apktool, only read.
Like with doNotCompress, passing any kind of compression rules to AAPT is pointless,
since we don't use the temp APK packed by AAPT directly - it's extracted and repacked
by ApkBuilder, where doNotCompress already determines whether resources.arsc should
or should not be compressed in the final APK.
(no funcionality was changed)
* style: optional args come after required args
* style: optional args come after required args
* style: sdkInfo as a normal field for consistency
* style: some formatting tweaks
This lets us assemble classes.dex in a reproducible manner.
Test:
apktool d test.apk > /dev/null
apktool b test > /dev/null
sha1sum test/build/apk/classes.dex
apktool -f d test.apk > /dev/null
apktool b test > /dev/null
sha1sum test/build/apk/classes.dex
* refactor: rename sanitize function
* fix: expose getDir
* fix: safe handling of untrusted resource names
- fixes: GHSA-2hqv-2xv4-5h5w
* test: sample file for GHSA-2hqv-2xv4-5h5w
* refactor: avoid detection of absolute files for resource check
* chore: enable info mode on gradle
* test: skip test on windows
* chore: debug windows handling
* fix: normalize entry with file separators
* fix: normalize filepath after cleansing
* chore: Android paths are not OS specific
* refactor: use java.nio for path traversal checking
* chore: align path separator on Windows for Zip files
* chore: rework towards basic directory traversal
* chore: remove '--info' on build.yml
* perf: process smali code in parallel
Note: backsmali can't be properly multithreaded because of the synchronized methods inside
* perf: start backsmali concurrently with a resources decompiler
* perf: speed up apk building by skipping temp archive creation
Now we're not compressing the same data twice
* refactor: extract duplicated code
* refactor: rename methods and inline some comments
* feat: initial migration to kotlin
* feat: initial migration to kotlin
* fix: wire up dependencies
* fix: Deprecated tag for kotlin detection
* refactor: put all modules into sub-projects
* fix: include jar file (android framework)
* fix: add version message/info
* fix: wire up version/gitrev to properties
* fix: wire up proguard on cli
* fix: wire up proguard
* fix: wire up output cleaning command
* fix: drop license header on gradle files
- fully rewritten from scratch by myself
- no longer including license header on build files
* fix: add compile utf8/flags for java8
* refactor: remove unneeded curly braces
* feat: progress towards maven-publish
* build: publish to maven
* docs: update documentation
* refactor: prevent implicit order by removal of afterEvaluate
* build: remove unused license plugin
* Correct use of <> diamond operator
* Correct modifiers order
* Private constructor for utility class
* Correct use of diamond operator
* Corrected naming convention
* Correct modifier order
* Use not synchronized class
* Introduced try/resource in stream copy
* Removed unused private field
* Code reformat
Reformat of IOUtils.copy from to stream
* Add a space
Improved code formatting
* Code reformat
Only a new space
* Code reformat
Removed extra spaces
Zip/APK files can legally contain entries that point to the parent directory of the one in which the .zip is located.
Usually, unzip implementations ignore them by default, and we‘ll do the same.
This is the list of files (resources, assets, etc) that are stored in
the .apk uncompressed.
For apps that use AssetFileDescriptor.openFd(), the adding compression
will break the call.
Maintains support for the resourcesAreCompressed key, but no longer
records it when decompiling (it instead records resources.arsc in the
doNotCompress list).
