Error decompiling resources in obfuscated APKs[core]

[redmi111]

Names of resources is decoded fine on v1.2.0 but from 1.3.0 it was obfuscated. For reference attaching the pics from both.

Above is 1.2.0

and below is

1.3.0 stable version. EDIT: 1.4.+ also has exact same problem

[jpstotz]

@redmi111 Can you provide the used APK file? That would it make easier to reproduce this issue and searching for the commit that introduced this problem.

[redmi111]

http://filesharing24.com/d/OxB

Here is the APK. Stable v1.2.0 no issues and stable 1.3.0.1 got that problem.

[jpstotz]

@redmi111 Sorry but something seems to be wrong with the upload. It is no longer available. Instead you can simply rename the file from apk to zip and attach it here in the issue.

[redmi111]

Tried uploading here but getting we don't support that file type error, can you try this wetransfer link

https://we.tl/t-s1WXRb9zg5

[jpstotz]

Thanks, got the file. And found the mentioned code e.g. in com.cutestudio.filerecovery.activity.ImagePreviewActivity.onCreate.

[jpstotz]

The latest commit where the R.color. constant was inserted was 5f24193 on Aug 2, 2021.

The commit that changed the resource constant replacement is ee12f0b which bases on #1221.

[jpstotz]

Ok, back to the latest code base. If I debug the method jadx.core.xmlgen.ResTableParser.getResName(..) with a breakpoint on "color_recovered_main".equals(origKeyName) then I can see that the resource is considered as constant field and thus not renamed: it takes the code path in this if branch which makes use of the (obfuscated) field name instead of the resource name.

	FieldNode constField = root.getConstValues().getGlobalConstFields().get(resRef);
	if (constField != null) {
		constField.add(AFlag.DONT_RENAME);
		return constField.getName();
	}

If I understand the code correctly it prefers the field name in favor of the resource name. Just changing this to the opposite may break other APKs as it may happen that the resource names are obfuscated but not the R field names.

The only possible solution would be some sort of rating function which scans a name and tries to estimate if this is an obfuscated or non-obfuscated name. Then we could rate the resource and the field name and use the which one more likely a non-obfuscated name. @skylot Or do you see an easier way how to deal with this situation?

[skylot]

rating function which scans a name and tries to estimate if this is an obfuscated or non-obfuscated name.

Looks like this is the best solution, another one is just adding new option into preferences. So I think we can just add option with 3 choices like: Auto (will use rating method), use code names and use resource names.
Also, as I remember, this field search code was moved to the top to keep names in sync, actually resolved issue with different names.

[MrIkso]

@skylot don't forget R class might deleted from apk.

[skylot]

Ok. I implemented rating method and options, although rating method can be adjusted better, but I don't have enough samples 🙁
Anyway, this case fixed, so please check other cases and share issues.