Deutsch English Français Italiano |
<v3n3iq$egib$1@dont-email.me> View for Bookmarking (what is this?) Look up another Usenet article |
Path: ...!eternal-september.org!feeder3.eternal-september.org!news.eternal-september.org!.POSTED!not-for-mail From: Newyana2 <newyana@invalid.nospam> Newsgroups: comp.mobile.android Subject: Re: binary AndroidManifest.xml, resource ID to string. How to ? Date: Tue, 4 Jun 2024 09:07:49 -0400 Organization: A noiseless patient Spider Lines: 54 Message-ID: <v3n3iq$egib$1@dont-email.me> References: <v3mqem$d089$1@dont-email.me> MIME-Version: 1.0 Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Injection-Date: Tue, 04 Jun 2024 15:07:38 +0200 (CEST) Injection-Info: dont-email.me; posting-host="e36f5d8c046d1fa67ebfb9ed3e357e45"; logging-data="475723"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX1/8ETgZOt1yV9zsOcR8MK2Bz2qhXOJduiY=" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:78.0) Gecko/20100101 Thunderbird/78.3.1 Cancel-Lock: sha1:450V349yTPStxKs3MXCzX0RE+Go= In-Reply-To: <v3mqem$d089$1@dont-email.me> Content-Language: en-US Bytes: 3112 On 6/4/2024 6:31 AM, R.Wieser wrote: > Hello all, > > I wanted to convert a binary "AndroidManifest.xml" to text again, and > curently have a readable result. > > One thing I've not been able to figure out though. In a sourcefile I see > lines like > > android:icon="@mipmap/ic_launcher" > android:label="@string/app_name" > android:roundIcon="@mipmap/ic_launcher" > android:theme="@style/Translucent"> > > , but all that the binary XML file contains is resource-IDs > > icon = @:7F0E0000 > label = @:7F110065 > roundIcon = @:7F0E0000 > theme = @:7F120157 > > , and I have no idea how to translate the latter to the former. :-\ > > I've done my dues and spend time searching the Web, but have not been able > to find any kind of clue to how to do it (the information I found stopped > short of explaining it). > > If anyone knows how to do it or has an URL to a website explaining it I > would be obliged. > Just a wild guess, but in PE files there's generally a resource table to store icons. The table is located through a system of numeric pointers. You read the file header, locate the resource table pointer, go to that offset, walk the table pointers, etc. It's all about pointers to offsets. So one thing you could check is whether some rendering of 7F0E0000 as an offset in the file points to either icon bytes, an icon path string, or another pointer. But you'd also need to figure out 7F0E0000. Is it a little endian long integer? Is it two short integers? Does the 7F mean something else? It looks to me like those numbers may have sections and not just represent whole numbers. This kind of thing can be monstrously difficult because most people have no reason to care about such things. So you have to track down some kind of industry spec doc. It's like the PE file structure. There are docs that explain it, but for the most part it's not relevant to people using computers. And without the decoder guide it's just gibberish bytes.