axml.c File Reference

#include <string.h>
#include <rz_types.h>
#include <rz_core.h>
#include "axml_resources.h"

Go to the source code of this file.

Enumerations
enum	{   TYPE_STRING_POOL = 0x0001 , TYPE_XML = 0x0003 , TYPE_START_NAMESPACE = 0x100 , TYPE_END_NAMESPACE = 0x101 ,   TYPE_START_ELEMENT = 0x0102 , TYPE_END_ELEMENT = 0x103 , TYPE_RESOURCE_MAP = 0x180 }
enum	{   RESOURCE_NULL = 0x00 , RESOURCE_REFERENCE = 0x01 , RESOURCE_STRING = 0x03 , RESOURCE_FLOAT = 0x04 ,   RESOURCE_INT_DEC = 0x10 , RESOURCE_INT_HEX = 0x11 , RESOURCE_BOOL = 0x12 }
enum	{ FLAG_UTF8 = 1 << 8 }

Functions
	RZ_PACKED (typedef struct { ut16 type;ut16 header_size;ut32 size;})
	RZ_PACKED (typedef struct { ut16 size;ut8 unused;ut8 type;union { ut32 d;float f;} data;})
	RZ_PACKED (typedef struct { ut32 line;ut32 comment;ut32 namespace;ut32 name;ut32 flags;ut16 attribute_count;ut16 unused0;ut16 unused1;ut16 unused2;attribute_t attributes[];})
	RZ_PACKED (typedef struct { ut32 line;ut32 comment;ut32 prefix;ut32 uri;})
static char *	resource_value (string_pool_t *pool, const ut8 *data, ut64 data_size, resource_value_t *value)
static bool	dump_element (RzStrBuf *sb, string_pool_t *pool, namespace_t *namespace, const ut8 *data, ut64 data_size, start_element_t *element, const ut32 *resource_map, ut32 resource_map_length, st32 *depth, bool start)
RZ_API RZ_OWN char *	rz_axml_decode (RZ_NONNULL const ut8 *data, const ut64 data_size)
	Decode a buffer with Android XML to regular XML string representation. More...

Variables
	string_pool_t
	attribute_t
	end_element_t

Enumeration Type Documentation

anonymous enum

anonymous enum

Enumerator
TYPE_STRING_POOL
TYPE_XML
TYPE_START_NAMESPACE
TYPE_END_NAMESPACE
TYPE_START_ELEMENT
TYPE_END_ELEMENT
TYPE_RESOURCE_MAP

Definition at line 10 of file axml.c.

     {
    TYPE_STRING_POOL = 0x0001,
    TYPE_XML = 0x0003,
    TYPE_START_NAMESPACE = 0x100,
    TYPE_END_NAMESPACE = 0x101,
    TYPE_START_ELEMENT = 0x0102,
    TYPE_END_ELEMENT = 0x103,
    TYPE_RESOURCE_MAP = 0x180,
};

anonymous enum

anonymous enum

Enumerator
RESOURCE_NULL
RESOURCE_REFERENCE
RESOURCE_STRING
RESOURCE_FLOAT
RESOURCE_INT_DEC
RESOURCE_INT_HEX
RESOURCE_BOOL

Definition at line 20 of file axml.c.

     {
    RESOURCE_NULL = 0x00,
    RESOURCE_REFERENCE = 0x01,
    RESOURCE_STRING = 0x03,
    RESOURCE_FLOAT = 0x04,
    RESOURCE_INT_DEC = 0x10,
    RESOURCE_INT_HEX = 0x11,
    RESOURCE_BOOL = 0x12,
};

anonymous enum

anonymous enum

Enumerator
FLAG_UTF8

Definition at line 30 of file axml.c.

     {
    FLAG_UTF8 = 1 << 8,
};

Function Documentation

dump_element()

static bool dump_element ( RzStrBuf *  sb, string_pool_t *  pool, namespace_t *  namespace, const ut8 *  data, ut64  data_size, start_element_t *  element, const ut32 *  resource_map, ut32  resource_map_length, st32 *  depth, bool  start  )

static

Definition at line 221 of file axml.c.

                                                                                 {
    ut32 i;
 
    char *name = string_lookup(pool, data, data_size, rz_read_le32(&element->name), NULL);
    for (i = 0; i < *depth; i++) {
        rz_strbuf_appendf(sb, "\t");
    }
 
    if (start) {
        rz_strbuf_appendf(sb, "<%s", name);
        ut16 count = rz_read_le16(&element->attribute_count);
        if (*depth == 0 && namespace) {
            char *key = string_lookup(pool, data, data_size, namespace->prefix, NULL);
            char *value = string_lookup(pool, data, data_size, namespace->uri, NULL);
            rz_strbuf_appendf(sb, " xmlns:%s=\"%s\"", key, value);
            free(key);
            free(value);
        }
 
        if (count != 0) {
            rz_strbuf_appendf(sb, " ");
        }
 
        for (i = 0; i < count; i++) {
            attribute_t a = element->attributes[i];
            ut32 key_index = rz_read_le32(&a.name);
            const char *key = (const char *)string_lookup(pool, data, data_size, key_index, NULL);
            bool resource_key = false;
            // If the key is empty, it is a cached resource name
            if (key && *key == '\0') {
                free((char *)key);
                resource_key = true;
                if (resource_map && key_index < resource_map_length) {
                    ut32 resource = rz_read_le32(&resource_map[key_index]);
                    if (resource >= 0x1010000) {
                        resource -= 0x1010000;
                        if (resource < ANDROID_ATTRIBUTE_NAMES_SIZE) {
                            key = ANDROID_ATTRIBUTE_NAMES[resource];
                        }
                    } else {
                        key = "null";
                    }
                } else {
                    key = "null";
                }
            }
            char *value = resource_value(pool, data, data_size, &a.value);
            // If there is a namespace on the value, and there is an active
            // namespace, assume it is the same
            if (rz_read_le32(&a.namespace) != -1 && namespace && namespace->prefix != -1) {
                char *ns = string_lookup(pool, data, data_size, namespace->prefix, NULL);
                rz_strbuf_appendf(sb, "%s:%s=\"%s\"", ns, key, value);
                free(ns);
            } else {
                rz_strbuf_appendf(sb, "%s=\"%s\"", key, value);
            }
            if (i != count - 1) {
                rz_strbuf_appendf(sb, " ");
            }
            if (!resource_key) {
                free((char *)key);
            }
            free(value);
        }
    } else {
        rz_strbuf_appendf(sb, "</%s", name);
    }
 
    rz_strbuf_appendf(sb, ">\n");
    free(name);
    return true;
}

References a, ANDROID_ATTRIBUTE_NAMES, ANDROID_ATTRIBUTE_NAMES_SIZE, attribute_t, count, free(), i, key, NULL, resource_value(), rz_read_le16(), rz_read_le32(), rz_strbuf_appendf(), sb, start, and value.

Referenced by rz_axml_decode().

resource_value()

static char* resource_value ( string_pool_t *  pool, const ut8 *  data, ut64  data_size, resource_value_t *  value  )

static

Definition at line 197 of file axml.c.

                             {
    switch (value->type) {
    case RESOURCE_NULL:
        return rz_str_new("");
    case RESOURCE_REFERENCE:
        return rz_str_newf("@0x%x", value->data.d);
    case RESOURCE_STRING:
        return string_lookup(pool, data, data_size, rz_read_le32(&value->data.d), NULL);
    case RESOURCE_FLOAT:
        return rz_str_newf("%f", value->data.f);
    case RESOURCE_INT_DEC:
        return rz_str_newf("%d", value->data.d);
    case RESOURCE_INT_HEX:
        return rz_str_newf("0x%x", value->data.d);
    case RESOURCE_BOOL:
        return rz_str_newf(value->data.d ? "true" : "false");
    default:
        RZ_LOG_WARN("Resource type is not recognized: %#x\n", value->type);
        break;
    }
    return rz_str_new("null");
}

References NULL, RESOURCE_BOOL, RESOURCE_FLOAT, RESOURCE_INT_DEC, RESOURCE_INT_HEX, RESOURCE_NULL, RESOURCE_REFERENCE, RESOURCE_STRING, RZ_LOG_WARN, rz_read_le32(), rz_str_new(), rz_str_newf(), and value.

Referenced by dump_element().

rz_axml_decode()

RZ_API RZ_OWN char* rz_axml_decode	(	RZ_NONNULL const ut8 *	data,
		const ut64	data_size
	)

Decode a buffer with Android XML to regular XML string representation.

Parameters

data	Buffer containing the AXML data
data_size	Size of the buffer data

Returns

String with the regular XML string

Definition at line 303 of file axml.c.

                                                                                     {
    string_pool_t *pool = NULL;
    namespace_t *namespace = NULL;
    const ut32 *resource_map = NULL;
    ut32 resource_map_length = 0;
    RzStrBuf *sb = NULL;
    st32 depth = 0;
 
    rz_return_val_if_fail(data, NULL);
    if (data_size == 0) {
        return strdup("");
    }
 
    RzBuffer *buffer = rz_buf_new_with_pointers(data, data_size, false);
    if (!buffer) {
        RZ_LOG_ERROR("Error allocating RzBuffer\n");
        goto error;
    }
 
    ut64 offset = 0;
 
    chunk_header_t header = { 0 };
    if (rz_buf_fread_at(buffer, offset, (ut8 *)&header, "ssi", 1) != sizeof(header)) {
        goto bad;
    }
 
    if (header.type != TYPE_XML) {
        goto bad;
    }
 
    ut64 binary_size = header.size;
    if (binary_size > data_size) {
        goto bad;
    }
 
    offset += sizeof(header);
 
    sb = rz_strbuf_new("");
 
    while (offset < binary_size) {
        if (rz_buf_fread_at(buffer, offset, (ut8 *)&header, "ssi", 1) != sizeof(header)) {
            goto bad;
        }
 
        ut16 type = header.type;
 
        // After reading the original chunk header, read the type-specific
        // header
        offset += sizeof(header);
 
        switch (type) {
        case TYPE_STRING_POOL: {
            ut16 header_size = header.size;
            if (header_size == 0 || header_size > data_size) {
                goto bad;
            }
 
            pool = malloc(header_size);
            if (!pool) {
                goto bad;
            }
 
            if (rz_buf_read_at(buffer, offset, (void *)pool, header_size) != header_size) {
                goto bad;
            }
            break;
        }
        case TYPE_START_ELEMENT: {
            // The string pool must be the first header
            if (!pool) {
                goto bad;
            }
 
            ut16 header_size = header.size;
            if (header_size == 0 || header_size > data_size) {
                goto bad;
            }
 
            start_element_t *element = malloc(header_size);
            if (!element) {
                goto bad;
            }
 
            if (rz_buf_read_at(buffer, offset, (void *)element, header_size) != header_size) {
                free(element);
                goto bad;
            }
 
            if (!dump_element(sb, pool, namespace, data, data_size, element,
                    resource_map, resource_map_length, &depth, true)) {
                free(element);
                goto bad;
            }
 
            depth++;
 
            free(element);
            break;
        }
        case TYPE_END_ELEMENT: {
            depth--;
            if (depth < 0) {
                goto bad;
            }
 
            end_element_t end;
            if (rz_buf_read_at(buffer, offset, (void *)&end, sizeof(end)) != sizeof(end)) {
                goto bad;
            }
 
            // The beginning of the start and end element structs
            // are the same, so we can use this interchangably
            if (!dump_element(sb, pool, namespace, data, data_size, (start_element_t *)&end,
                    resource_map, resource_map_length, &depth, false)) {
                goto bad;
            }
            break;
        }
        case TYPE_START_NAMESPACE:
            // If there is already a start namespace, override it
            free(namespace);
            namespace = malloc(sizeof(*namespace));
            if (rz_buf_fread_at(buffer, offset, (ut8 *)namespace, "iiii", 1) != sizeof(*namespace)) {
                goto bad;
            }
            break;
        case TYPE_END_NAMESPACE:
            break;
        case TYPE_RESOURCE_MAP:
            resource_map = (ut32 *)(data + offset);
            resource_map_length = header.size;
            if (resource_map_length > data_size - offset) {
                goto bad;
            }
            resource_map_length /= sizeof(ut32);
            break;
        default:
            RZ_LOG_WARN("Type is not recognized: %#x\n", type);
        }
 
        offset += header.size - sizeof(header);
    }
 
    rz_buf_free(buffer);
    free(pool);
    free(namespace);
    return rz_strbuf_drain(sb);
bad:
    RZ_LOG_ERROR("Invalid Android Binary XML\n");
error:
    if (buffer)
        rz_buf_free(buffer);
    free(pool);
    rz_strbuf_free(sb);
    return NULL;
}

References dump_element(), test_evm::end, end_element_t, error(), free(), header, malloc(), NULL, rz_buf_fread_at(), rz_buf_free(), rz_buf_new_with_pointers(), rz_buf_read_at(), RZ_LOG_ERROR, RZ_LOG_WARN, rz_return_val_if_fail, rz_strbuf_drain(), rz_strbuf_free(), rz_strbuf_new(), sb, st32, strdup(), string_pool_t, type, TYPE_END_ELEMENT, TYPE_END_NAMESPACE, TYPE_RESOURCE_MAP, TYPE_START_ELEMENT, TYPE_START_NAMESPACE, TYPE_STRING_POOL, TYPE_XML, and ut64().

Referenced by cmd_print_fromage().

RZ_PACKED() [1/4]

RZ_PACKED

(

typedef struct { ut16 size;ut8 unused;ut8 type;union { ut32 d;float f;} data;}

)

Definition at line 55 of file axml.c.

                   {
        ut16 size;
        ut8 unused;
        ut8 type;
        union {
            ut32 d;
            float f;
        } data;
    })
resource_value_t;
 
RZ_PACKED(
    typedef struct {
        ut32 namespace;
        ut32 name;
        ut32 unused;
        resource_value_t value;
    })

References d, f, and type.

RZ_PACKED() [2/4]

RZ_PACKED

(

typedef struct { ut16 type;ut16 header_size;ut32 size;}

)

Definition at line 35 of file axml.c.

                   {
        ut16 type;
        ut16 header_size;
        ut32 size;
    })
chunk_header_t;
 
// String pool referenced throughout the Binary XML, there must only be ONE
RZ_PACKED(
    typedef struct {
        ut32 string_count;
        ut32 style_count;
        ut32 flags;
        ut32 strings_offset;
        ut32 styles_offset;
        ut32 offsets[];
    })

References type.

RZ_PACKED() [3/4]

RZ_PACKED

(

typedef struct { ut32 line;ut32 comment;ut32 namespace;ut32 name;ut32 flags;ut16 attribute_count;ut16 unused0;ut16 unused1;ut16 unused2;attribute_t attributes[];}

)

Definition at line 76 of file axml.c.

                   {
        ut32 line;
        ut32 comment;
        ut32 namespace;
        ut32 name;
        ut32 flags;
        ut16 attribute_count;
        ut16 unused0;
        ut16 unused1;
        ut16 unused2;
        attribute_t attributes[];
    })
start_element_t;
 
RZ_PACKED(
    typedef struct {
        ut32 line;
        ut32 comment;
        ut32 namespace;
        ut32 name;
    })

References attribute_t, flags, setup::line, and name.

RZ_PACKED() [4/4]

RZ_PACKED

(

typedef struct { ut32 line;ut32 comment;ut32 prefix;ut32 uri;}

)

Definition at line 100 of file axml.c.

                   {
        ut32 line;
        ut32 comment;
        ut32 prefix;
        ut32 uri;
    })
namespace_t;
 
static char *string_lookup(string_pool_t *pool, const ut8 *data, ut64 data_size, ut32 i, size_t *length) {
    if (i > rz_read_le32(&pool->string_count)) {
        return NULL;
    }
 
    ut32 offset = rz_read_le32(&pool->offsets[i]);
    ut8 *start = (ut8 *)((uintptr_t)data + rz_read_le32(&pool->strings_offset) + 8 + offset);
 
    char *name = NULL;
    if (pool->flags & FLAG_UTF8) {
        if ((ut64)start > (ut64)data + data_size - sizeof(ut16)) {
            return NULL;
        }
 
        // Ignore UTF-16LE encoded length
        ut32 n = *start++;
        if (n & 0x80) {
            n = ((n & 0x7f) << 8) | *start++;
        }
 
        if ((ut64)start > (ut64)data + data_size - sizeof(ut16)) {
            return NULL;
        }
 
        // UTF-8 encoded length
        n = *start++;
        if (n & 0x80) {
            n = ((n & 0x7f) << 8) | *start++;
        }
 
        name = calloc(n + 1, 1);
 
        if (n == 0) {
            if (length) {
                *length = 0;
            }
 
            return name;
        }
 
        if ((ut64)start > (ut64)data + data_size - sizeof(ut32) - n - 1) {
            free(name);
            return NULL;
        }
 
        memcpy(name, start, n);
 
        if (length) {
            *length = n;
        }
    } else {
        if ((ut64)start > (ut64)data + data_size - sizeof(ut32)) {
            return NULL;
        }
 
        ut16 *start16 = (ut16 *)start;
 
        // If >0x7fff, stored as a big-endian ut32
        ut32 n = rz_read_le16(start16++);
        if (n & 0x8000) {
            n |= ((n & 0x7fff) << 16) | rz_read_le16(start16++);
        }
 
        // Size of UTF-16LE without NULL
        n *= 2;
 
        name = calloc(n * 2 + 1, 1);
 
        if ((ut64)start16 > (ut64)data + data_size - sizeof(ut32) - n - 1) {
            free(name);
            return NULL;
        }
 
        // If UTF-16LE, decode to UTF-8 so we can print it to the screen
        if (rz_str_utf16_to_utf8((ut8 *)name, n * 2, (const ut8 *)start16, n, true) < 0) {
            free(name);
            RZ_LOG_ERROR("Failed to decode UTF16-LE\n");
            return NULL;
        }
 
        if (length) {
            *length = n;
        }
    }
 
    return name;
}

References setup::line, and prefix.

Variable Documentation

attribute_t

attribute_t

Definition at line 74 of file axml.c.

Referenced by dump_element(), and RZ_PACKED().

end_element_t

end_element_t

Definition at line 98 of file axml.c.

Referenced by rz_axml_decode().

string_pool_t

string_pool_t

Definition at line 53 of file axml.c.

Referenced by rz_axml_decode().