Error decode: resources.arsc (Facebook messenger)

[jpstotz]

Jadx has totally fails to decode the resources in resources.arsc of Facebook messenger 231.0.0.25.121 (170889108):

Caused by: java.io.IOException: value size, expected: 0x8, actual: 0xa, offset: 0x13ef0e
	at jadx.core.xmlgen.ParserStream.throwException(ParserStream.java:118)
	at jadx.core.xmlgen.ParserStream.checkInt16(ParserStream.java:110)
	at jadx.core.xmlgen.ResTableParser.parseValue(ResTableParser.java:265)
	at jadx.core.xmlgen.ResTableParser.parseEntry(ResTableParser.java:254)
	at jadx.core.xmlgen.ResTableParser.parseTypeChunk(ResTableParser.java:216)
	at jadx.core.xmlgen.ResTableParser.parsePackage(ResTableParser.java:169)
	at jadx.core.xmlgen.ResTableParser.decodeTableChunk(ResTableParser.java:118)
	at jadx.core.xmlgen.ResTableParser.decode(ResTableParser.java:66)

According to Jadx the problematic entry belongs to resource 0x7f090012 (2131296274)[DEFAULT] = id.browser_le_progress_bar. I tries to compare those values to the output of aapt.exe dump --values resources facebookMessenger.apk but I was not able to identify anything unusual regarding this resource in the aapt dump.

[jpstotz]

Apktool 2.4.0 also has problems decoding the resources of this APK. I am not sure if this is the same or a different problem but on the problem in apktool there is a large discussion here: iBotPeaches/Apktool#1719

[root-intruder]

@jpstotz I just ran into the exact same error and wanted to open a ticket...problem still exists with newest jadx version and latest facebook messenger from apkpure as of today.

[jpstotz]

Giving a bug some time to ripen seems to be helpful because this time, checking the resources decoding code again I discovered the cause:

It seems like Facebook messenger uses an obfuscation technique that causes this problem. But the actual problem is not that there is a new unknown type we don't know how to parse, instead the obfuscator manipulates the resource chunk in a way that it defines more entries that fit into the chunk. It seems like aapt and other resource parsing tools just stop when they reach the end of the chunk and ignore the remaining entries.

In Jadx we ignored the chunk size and read the next data block and tried to interpret it the wrong way, which of course totally fails. That is the exception we see in Jadx.

I will prepare a PR after some more tests.

[root-intruder]

@jpstotz Thanks!

[root-intruder]

confirmed working! Thanks!