u%jzSddlZddlmZddlmZddlmZddlm Z ddl m Z ddl m Z ejdZGd d eZy) N)unpack)bytecode) StringBlock)public) ARSCHeaderzpyaxmlparser.axmlparserceZdZdZdZdZdZdZeZdZ e dZ e dZ e d Z e d Ze d Zd Zd ZdZdZdZdZdZdZdZdZdZy) AXMLParseran AXMLParser reads through all chunks in the AXML file and implements a state machine to return information about the current chunk, which can then be read by :class:`~AXMLPrinter`. An AXML file is a file which contains multiple chunks of data, defined by the `ResChunk_header`. There is no real file magic but as the size of the first header is fixed and the `type` of the `ResChunk_header` is set to `RES_XML_TYPE`, a file will usually start with `0x03000800`. But there are several examples where the `type` is set to something else, probably in order to fool parsers. Typically the AXMLParser is used in a loop which terminates if `m_event` is set to `END_DOCUMENT`. You can use the `next()` function to get the next chunk. Note that not all chunk types are yielded from the iterator! Some chunks are processed in the AXMLParser only. The parser will set `is_valid()` to False if it parses something not valid. Messages what is wrong are logged. See http://androidxref.com/9.0.0_r3/xref/frameworks/base/libs/androidfw/include/androidfw/ResourceTypes.h#563 c |jd|_d|_tj||_|j j dkrDtjdj|j j d|_y|j j dkDrDtjdj|j j d|_y t|j }|j |_ |jdk(rtjd |jdk7r6tjd j|jd|_y|j|j j kDrOtjd j|j|j j d|_y|j|j j krNd|_tjd j|j|j j |jt j"k7r5d|_tjd j|j t|j }|jdk7r6tjdj|jd|_y|jt j$k7r6tjdj|jd|_yt'|j ||_g|_g|_y#t$r'}tjd|d|_Yd}~yd}~wwxYw#t$r'}tjd|d|_Yd}~yd}~wwxYw)NTFz;Filesize is too small to be a valid AXML file! Filesize: {}z;Filesize is too large to be a valid AXML file! Filesize: {}z'Error parsing first resource header: %sixmz?Header size is 28024! Are you trying to parse a plain XML file?zTThis does not look like an AXML file. header size does not equal 8! header size = {}zZThis does not look like an AXML file. Declared filesize does not match real size: {} vs {}z|Declared filesize ({}) is smaller than total file size ({}). Was something appended to the file? Trying to parse it anyways.zAXML file has an unusual resource type! Malware likes to to such stuff to anti androguard! But we try to parse it anyways. Resource Type: 0x{:04x}z0Error parsing resource header of string pool: %szbThis does not look like an AXML file. String chunk header size does not equal 28! header size = {}z?Expected String Pool header, got resource type 0x{:04x} instead)_reset_valid axml_tamperedr BuffHandlebuffsizelogerrorformatrAssertionErrorfilesize header_sizewarningtypeconst RES_XML_TYPERES_STRING_POOL_TYPErsb m_resourceIDs namespaces)selfraw_buff axml_headereheaders e/home/ubuntu/.local/share/pipx/venvs/gplaycli/lib/python3.12/site-packages/pyaxmlparser/axmlparser.py__init__zAXMLParser.__init__5s+  "''1  99>> a  IISZZ[_[d[d[i[i[kl mDK  99>> j ( IISZZ[_[d[d[i[i[kl mDK  $TYY/K $((  " "e + KKY Z  " "a ' IIAAG++B   DK  ==499>>+ + IIGGMvMM499>>#3H   DK  ==499>>+ +!%D  KKRRXRXMM499>>#3S    u11 1!%D  KK*+1&1A1A*B    *F    % II;;A6&&<   DK  ;;%44 4 II &-  DK dii0 k  II? CDK  p  IIH! LDK  s0<N O O)O  O PO>>Pc|jS)z Get the state of the AXMLPrinter. if an error happend somewhere in the process of parsing the file, this flag is set to False. )rr#s r(is_validzAXMLParser.is_valids {{ctd|_d|_d|_d|_g|_d|_d|_d|_y)N)m_event m_lineNumberm_namem_namespaceUri m_attributes m_idAttributem_classAttributem_styleAttributer+s r(rzAXMLParser._resets@    " "r-c:|j|jS)N)_do_nextr0r+s r(__next__zAXMLParser.__next__s ||r-c |jtjk(ry|j|jr|j j s'|j j|jk(rtj|_y t|j }|jtjk(rtjd|j dks|j dzdk7rtjdd|_yt#|j |j$z dzD]C}|j&j)t+d|j j-ddEW|jtj.ks|jtj0kDr`tjd j3|j|j |j j5|j |j$d k7rktjd j3|j|j$|j |j j7|j kt+d|j j-d\|_t+d|j j-d\|_|j:d k7rg|jtj<tj>fvr;tjAd j3|jB|j:|jtj<k(rt+d|j j-d\}t+d|j j-d\}|jB|}|jB|}tjdj3|||||dk(r$tjAdj3|||f|jDvr%tjGdj3|||jDj)||fg|jtj>k(rt+d|j j-d\}t+d|j j-d\}||f|jDvr|jDjI||fn%tjAdj3||'|jtjJk(rt+d|j j-d\|_&t+d|j j-d\|_'|j j-d}t+d|j j-d\} t+d|j j-d\|_(| d z dz |_)| dz|_*|jPd z dz |_+|jPdzdz |_(t#d|jTtjXzD]C}|jZj)t+d|j j-ddEt#tj\t_|jZtjXD]!}|jZ|dz |jZ|<#tj`|_y|jtjbk(rnt+d|j j-d\|_&t+d|j j-d\|_'tjd|_y|jtjfk(rt+d|j j-d\|_'t+d|j j-d\} } } } tjdj3|jN| | | | tjh|_ytjAdj3|j|j |j j5|j |jryy#t$r'}tjd|d|_Yd}~yd}~wwxYw)Nz!Error parsing resource header: %sFzAXML contains a RESOURCE MAPr rz,Invalid chunk size in chunk XML_RESOURCE_MAPz uri {}: '{}'zDNamespace prefix '{}' resolves to empty URI. This might be a packer.z{Namespace mapping ({}, {}) already seen! This is usually not a problem but could indicate packers or broken AXML compilers.z]Reached a NAMESPACE_END without having the namespace stored before? Prefix ID: {}, URI ID: {}riz>!;L.Ma.PQRvv666!&&5C`C`:` V]]^_^d^dfgflflmn !!!%%(}}$ $$*F1661==!&&$I  quu%"(diinnQ.?!@ D %+41B$C !D ##z1aff6644A676 HOOGGD0013vv;;; tyy~~a'89dDIINN1$56776?  006#u1B;KK!::@&:JLC=DOO3HH<  IINN1%"(tyy~~a/@"A)/diinnQ6G)H&%&4&:a%?")7&)@&)-)>)>")D(I%)-)>)>)G1(L%q$"8"85;Q;Q"QRQA%%,,VD$))..:K-LQ-OPQu<TV[VlVlmFA+/+<+  $}} vv111 &dDIINN1,=>  .4GTYY^^A=N-O*dHd 3396 T444 %zz  KKIPPQRQWQWYZY_Y_` a II  aee $Ckk"  =qA#  sd eeec|jdk(s:|jtjk7r|jtjk7ry|j |jS)zA Return the String assosciated with the tag name r/r>)r2r0rrVrXr r+s r(namezAXMLParser.namesG ;;" !@T\\UZUbUbEbwwt{{##r-cT|jdk(ry|j|jS)z Return the comment at the current position or None if no comment is given This works only for Tags, as the comments of Namespaces are silently dropped. Currently, there is no way of retrieving comments of namespaces. r N)rLr r+s r(commentzAXMLParser.comments*   : -wwt++,,r-c|jdk(s:|jtjk7r|jtjk7ry|j dk(ry|j |j S)zS Return the Namespace URI (if any) as a String for the current tag r/r>r )r2r0rrVrXr3r r+s r( namespacezAXMLParser.namespaces\ ;;" !@T\\UZUbUbEb   * ,wwt**++r-ct}t|jD]B\}}|j|}|j|}|dk7s*|dk7s0|j ||<D|S)a Returns the current namespace mapping as a dictionary there are several problems with the map and we try to guess a few things here: 1) a URI can be mapped by many prefixes, so it is to decide which one to take 2) a prefix might map to an empty string (some packers) 3) uri+prefix mappings might be included several times 4) prefix might be empty r>)dictsetr"r strip)r#NSMAPkvr_r`s r(nsmapzAXMLParser.nsmapsd( 0DAqwwqzHGGAJE{x2~"'++-h  0 r-c|jdk(s|jtjk7ry|j|jS)zE Return the String assosicated with the current text r/r>)r2r0rrZr r+s r(textzAXMLParser.texts5 ;;"   :wwt{{##r-c|jS)zh Legacy only! use :py:attr:`~androguard.core.bytecodes.AXMLParser.name` instead )rgr+s r(getNamezAXMLParser.getName yyr-c|jS)zh Legacy only! use :py:attr:`~androguard.core.bytecodes.AXMLParser.text` instead )rur+s r(getTextzAXMLParser.getTextrxr-c|jS)zm Legacy only! use :py:attr:`~androguard.core.bytecodes.AXMLParser.namespace` instead )rkr+s r( getPrefixzAXMLParser.getPrefixs ~~r-c|jtjk7rtj d|tj z}|t |jk\rtj d|S)zV Return the start inside the m_attributes array for a given attribute zCurrent event is not START_TAG.zInvalid attribute index)r0rrVrrrSrUr4r#indexoffsets r(_get_attribute_offsetz AXMLParser._get_attribute_offsetsV <<5?? * KK9 :/// S**+ + KK1 2 r-cV|jtjk7ry|jS)zY Return the number of Attributes for a Tag or -1 if not in a tag r/)r0rrVrRr+s r(getAttributeCountzAXMLParser.getAttributeCounts# <<5?? *%%%r-ch|j|}|j|tjz}|S)zN Returns the numeric ID for the namespace URI of an attribute )rr4rATTRIBUTE_IX_NAMESPACE_URI)r#rrr^s r(getAttributeUrizAXMLParser.getAttributeUris4++E2)I)I IJ r-cN|j|}|dk(ry|j|S)zE Return the Namespace URI (if any) for the attribute r r>)rr )r#rr^s r(getAttributeNamespacez AXMLParser.getAttributeNamespaces/""5) * wws|r-c6|j|}|j|tjz}|j|}|sV|j |}|t jddvrdt jdd|z}|Sdj|}|S)zH Returns the String which represents the attribute name attributesinversezandroid:z'android:UNKNOWN_SYSTEM_ATTRIBUTE_{:08x}) rr4rATTRIBUTE_IX_NAMEr r!rSYSTEM_RESOURCESr)r#rrrgresattrs r(getAttributeNamezAXMLParser.getAttributeName s++E2  %*A*A!ABggdm%%d+Dv..|)rr4rrT TYPE_STRINGATTRIBUTE_IX_VALUE_STRINGr )r#rr valueType valueStrings r(getAttributeValuezAXMLParser.getAttributeValue2sj++E2%%fu/L/L&LM )) )++FU5T5T,TUK77;' 'r-N)__name__ __module__ __qualname____doc__r)r,rr:nextr9propertyrgrirkrsrurwrzr|rrrrrrrrr-r(r r s,kZ# DF%P$$ - - , ,2$$ & (IIr-r )loggingstructrpyaxmlparser.constants constantsr pyaxmlparserrpyaxmlparser.stringblockrpyaxmlparser.resourcesrarscutilr getLoggerrobjectr rr-r(rs=$&!0) g12bbr-