Skip to content

Conversation

@IgorEisberg
Copy link
Collaborator

Obfuscators can exploit the new missing entry injection to prevent rebuilding by causing entry specs with identical names to be injected.
Example scenario:

res/values/public.xml:

<resources>
    <public type="attr" name="existingAttr" id="0x7f010000" />
</resources>

res/values/attrs.xml:

<resources>
    <attr name="existingAttr" format="string" />
</resources>

res/layout/issue.xml:

N: android=http://schemas.android.com/apk/res/android (line=2)
  N: app=http://schemas.android.com/apk/res-auto (line=2)
    E: merge (line=2)
        E: TextView (line=4)
          A: http://schemas.android.com/apk/res/android:layout_width(0x010100f4)=-2
          A: http://schemas.android.com/apk/res/android:layout_height(0x010100f5)=-2
          A: http://schemas.android.com/apk/res-auto:existingAttr(0x7f010001)=1

The spec 0x7f010001 is missing and the obfuscator renamed the raw attribute name to "existingAttr", which is already assigned to 0x7f010000.
Apktool will inject a generic spec with the ID 0x7f010001 and the name "existingAttr" - that's a duplicate, and the APK can't be rebuilt.

We patch this hole before obfuscators exploit it.

Obfuscators can exploit the new missing entry injection to prevent rebuilding by causing entry specs with identical names to be injected.
Example scenario:

res/values/public.xml:

<resources>
    <public type="attr" name="existingAttr" id="0x7f010000" />
</resources>

res/values/attrs.xml:

<resources>
    <attr name="existingAttr" format="string" />
</resources>

res/layout/issue.xml:

N: android=http://schemas.android.com/apk/res/android (line=2)
  N: app=http://schemas.android.com/apk/res-auto (line=2)
    E: merge (line=2)
        E: TextView (line=4)
          A: http://schemas.android.com/apk/res/android:layout_width(0x010100f4)=-2
          A: http://schemas.android.com/apk/res/android:layout_height(0x010100f5)=-2
          A: http://schemas.android.com/apk/res-auto:existingAttr(0x7f010001)=1

The spec 0x7f010001 is missing and the obfuscator renamed the raw attribute name to "existingAttr", which is already assigned to 0x7f010000.
Apktool will inject a generic spec with the ID 0x7f010001 and the name "existingAttr" - that's a duplicate, and the APK can't be rebuilt.

We patch this hole before obfuscators exploit it.
@IgorEisberg IgorEisberg enabled auto-merge (squash) December 12, 2025 19:51
@IgorEisberg
Copy link
Collaborator Author

In fact, obfuscators could already have exploited this by renaming entries in the ARSC to some repeated valid name, because we hadn’t enforced name uniqueness until now.

@IgorEisberg IgorEisberg merged commit bb437dc into main Dec 12, 2025
18 checks passed
@IgorEisberg IgorEisberg deleted the exploit-fix branch December 12, 2025 20:23
@iBotPeaches iBotPeaches added this to the 3.0.0 milestone Dec 12, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants