ResParserError: reserved must be zero!

[bparmentier]

I encountered the following error when analyzing the WhatsApp 2.23.12.75 APK. I don't think I'm allowed to publicly share the APK file here so here is the direct link as can be found on https://www.whatsapp.com/android.

The error happens both with androguard 4.1.2 and the latest master branch (on commit f1d6a46)

$ androguard analyze WhatsApp.apk

[…]

In [3]: a.get_android_resources()
---------------------------------------------------------------------------
KeyError                                  Traceback (most recent call last)
File ~/venv/lib/python3.12/site-packages/androguard/core/apk/__init__.py:2210, in APK.get_android_resources(self)
   2209 try:
-> 2210     return self.arsc["resources.arsc"]
   2211 except KeyError:

KeyError: 'resources.arsc'

During handling of the above exception, another exception occurred:

ResParserError                            Traceback (most recent call last)
Cell In[3], line 1
----> 1 a.get_android_resources()

File ~/venv/lib/python3.12/site-packages/androguard/core/apk/__init__.py:2216, in APK.get_android_resources(self)
   2212 if "resources.arsc" not in self.zip.namelist():
   2213     # There is a rare case, that no resource file is supplied.
   2214     # Maybe it was added manually, thus we check here
   2215     return None
-> 2216 self.arsc["resources.arsc"] = ARSCParser(
   2217     self.zip.read("resources.arsc")
   2218 )
   2219 return self.arsc["resources.arsc"]

File ~/venv/lib/python3.12/site-packages/androguard/core/axml/__init__.py:1827, in ARSCParser.__init__(self, raw_buff)
   1823 start_of_chunk = self.buff.tell() - 8
   1824 expected_end_of_chunk = (
   1825     start_of_chunk + pkg_chunk_header.size
   1826 )
-> 1827 a_res_type = ARSCResType(self.buff, pc)
   1828 self.packages[package_name].append(a_res_type)
   1829 self.resource_configs[package_name][a_res_type].add(
   1830     a_res_type.config
   1831 )

File ~/venv/lib/python3.12/site-packages/androguard/core/axml/__init__.py:2964, in ARSCResType.__init__(self, buff, parent)
   2962 self.reserved = unpack('<H', buff.read(2))[0]
   2963 if self.reserved != 0:
-> 2964     raise ResParserError("reserved must be zero!")
   2965 self.entryCount = unpack('<I', buff.read(4))[0]
   2966 self.entriesStart = unpack('<I', buff.read(4))[0]

ResParserError: reserved must be zero!

It looks related to androguard/androguard#1014 but it's a bit low level for me so I'm not sure.

[eighthave]

This also happens with 3.4.0~a1-14 from Debian. Looks like WhatsApp has a war against the APK reserved fields ;-)

[erev0s]

@bparmentier are you sure you have tried the version in the master branch?

Can you please try again after having created a virtual environment and install androguard with:

pip install git+https://github.com/androguard/androguard

@eighthave ofc it would happen with older versions.

[eighthave]

Do you know what change in master fixed this? I'd like to backport it to the Debian/stable packages. I looked at the diff from v4.1.2 and didn't see anything related. Is it 43552374bfea7103673e2ccbe6b99fb098dcba84 from androguard/androguard#1087 ?

Sometimes bugs get introduced in newer code, that's why I mentioned the old release. Looks like it is fixed in master:

(venv) nobody@cc63fb9300a5:/tmp/whatsapp$ androguard --version
androguard, version 4.1.2
(venv) nobody@cc63fb9300a5:/tmp/whatsapp$ androguard analyze WhatsApp.apk

>>> filename
WhatsApp.apk
>>> a
<androguard.core.apk.APK object at 0x7fcb83c668d0>
>>> d
[<androguard.core.dex.DEX object at 0x7fcb7cce0a90>, <androguard.core.dex.DEX object at 0x7fcb7cce0b10>, <androguard.core.dex.DEX object at 0x7fcb492a3350>, <androguard.core.dex.DEX object at 0x7fcb4db78150>, <androguard.core.dex.DEX object at 0x7fcb09c83350>, <androguard.core.dex.DEX object at 0x7fcae2773350>, <androguard.core.dex.DEX object at 0x7fcab92ab350>]
>>> dx
<analysis.Analysis VMs: 7, Classes: 60067, Methods: 236636, Strings: 232889>

/usr/lib/python3/dist-packages/IPython/paths.py:70: UserWarning: IPython parent '/nonexistent' is not a writable location, using a temp directory.
  warn("IPython parent '{0}' is not a writable location,"
Androguard version 4.1.2 started
In [1]:

[erev0s]

@eighthave Its only in master atm - i will need to make a new release. Will do so in the coming days to verify first the other two pending fixes (for other issues).
The changes you have to look for are for the compact resources. I introduced this in here a0f62e31bafc2faf5f804dbbcab8b3549b496b69 and here 04a5703b8ba7c181bb9f5f5995a2c16b6f9353cf.

[bparmentier]

@erev0s I confirm the issue is still present on the master branch.

Maybe it wasn't clear but the stacktrace I posted is the output of a.get_android_resources() after running androguard analyze WhatsApp.apk (installed in a venv from master). It doesn't crash when you simply run androguard analyze.

[erev0s]

thank you @bparmentier for pointing it out, I did not read it carefully.
I took a closer look and indeed it seems that for some reason that is unclear to me at the moment they are using a different value than that of 0 for the reserved field of the ResTable_type.

In androguard this is the line that checks for it. You could comment it out and install and use that as a temporary solution.

I am making a note to check this further as why this occured.

[MiikaJ]

I tried as a workaround to remove the "reserved must be zero!" exception but it appears there is something more needed. When trying to get the app name with APK.get_app_name() I get some warnings from androguard logger and incorrect result.

2025-02-25 12:30:38.256 | WARNING | androguard.core.axml:_decode_bytes:304 - invalid decoded string length
2025-02-25 12:30:38.333 | WARNING | androguard.core.apk:get_app_name:554 - Exception selecting app name: 'ARSCResTableEntry' object has no attribute 'key'
'@7F12340B'

[erev0s]

@MiikaJ are you sure you commented out the correct part?
I just tried it with the following result:

a = APK("/path/to/apk/WhatsApp.apk")
app_name = a.get_app_name()
print(app_name)


WhatsApp

[MiikaJ]

Modification was correct but my test and modifications were done on top of the 4.1.2 release. I now repeated on top of the master and it works. Also just noticed there is a new 4.1.3 release and the patch on top of that works as well. There must be some other fix between 4.1.2 and 4.1.3 that caused the additional error in 4.1.2.

[erev0s]

hi @MiikaJ indeed there was another fix that i did in the past about a similar issue that was not available in the 4.1.2. Now with the latest release everything should work properly with the fix mentioned above.

[javiUci]

hi, i have the same error when parsing whatsapp messenger apk