git Service of IN-Ulm e.V. Explore Help
Sign In
cbiedl
/
file
1
0
Fork 0
Files Pull Requests 0 Wiki
Browse Source

Cherry-pick fixes related to APK file detection

Christoph Biedl 2 years ago
parent
48ed8775ae
commit
ea3c35979f
5 changed files with 146 additions and 2 deletions
Unified View Show Diff Stats
  1. 2 2
      debian/patches/1673725413.FILE5_44-22-g6d565d82.improve-apk-detection-fc-stegerman.patch
  2. 15 0
      debian/patches/1674058221.FILE5_44-23-gbaf1f4b4.add-mime-type-to-html-fc-stegerman.patch
  3. 109 0
      debian/patches/1674058358.FILE5_44-24-gc4361a10.improve-detection-of-apk-files-if-we-find-a-manifest-file-at-least-say.patch
  4. 17 0
      debian/patches/1674400026.FILE5_44-29-g1e4b7389.increase-strength-to-beat-targa-fc-stegerman.patch
  5. 3 0
      debian/patches/series

+ 2 - 2
debian/patches/1673725413.FILE5_44-22-g6d565d82.improve-apk-detection-fc-stegerman.patch
View File 

@@ -5,7 +5,7 @@ Date: Sat Jan 14 19:43:33 2023 +0000
 
 
 
 --- a/magic/Magdir/archive
 
 --- a/magic/Magdir/archive
 
 +++ b/magic/Magdir/archive
 
 +++ b/magic/Magdir/archive
 
-@@ -1559,7 +1559,7 @@
 
+@@ -1531,7 +1531,7 @@
 
  !:mime	application/vnd.android.package-archive
 
  !:mime	application/vnd.android.package-archive
 
  !:ext	apk
 
  !:ext	apk
 
  # Starts with META-INF/MANIFEST.MF (file name length = 20)
 
  # Starts with META-INF/MANIFEST.MF (file name length = 20)
 
@@ -14,7 +14,7 @@ Date: Sat Jan 14 19:43:33 2023 +0000
 
  >26	uleshort	20
 
  >26	uleshort	20
 
  >>30	string	META-INF/MANIFEST.MF
 
  >>30	string	META-INF/MANIFEST.MF
 
  # Contains resources.arsc (near the end, in the central directory)
 
  # Contains resources.arsc (near the end, in the central directory)
 
-@@ -1568,13 +1568,27 @@
 
+@@ -1540,13 +1540,27 @@
 
  >>>>>(-6.l-16)	string	APK\x20Sig\x20Block\x2042	\b, with APK Signing Block
 
  >>>>>(-6.l-16)	string	APK\x20Sig\x20Block\x2042	\b, with APK Signing Block
 
  !:mime	application/vnd.android.package-archive
 
  !:mime	application/vnd.android.package-archive
 
  !:ext	apk
 
  !:ext	apk

+ 15 - 0
debian/patches/1674058221.FILE5_44-23-gbaf1f4b4.add-mime-type-to-html-fc-stegerman.patch
View File 

@@ -0,0 +1,15 @@
 
+Subject: Add mime type to html (FC Stegerman)
 
+Origin: FILE5_44-23-gbaf1f4b4 <https://github.com/file/file/commit/FILE5_44-23-gbaf1f4b4>
 
+Upstream-Author: Christos Zoulas <christos@zoulas.com>
 
+Date: Wed Jan 18 16:10:21 2023 +0000
 
+
 
+--- a/magic/Magdir/sgml
 
++++ b/magic/Magdir/sgml
 
+@@ -57,6 +57,7 @@
 
+ !:mime	text/html
 
+ 0	string/ct	\<!--
 
+ >&0	search/4096/cWt	\<!doctype\ html	HTML document text
 
++!:mime	text/html
 
+ >&0	search/4096/ct	\<html>	HTML document text
 
+ !:mime	text/html
 
+

+ 109 - 0
debian/patches/1674058358.FILE5_44-24-gc4361a10.improve-detection-of-apk-files-if-we-find-a-manifest-file-at-least-say.patch
View File 

@@ -0,0 +1,109 @@
 
+Subject: Improve detection of APK files; if we find a manifest file, at least say (...)
 
+Origin: FILE5_44-24-gc4361a10 <https://github.com/file/file/commit/FILE5_44-24-gc4361a10>
 
+Upstream-Author: Christos Zoulas <christos@zoulas.com>
 
+Date: Wed Jan 18 16:12:38 2023 +0000
 
+
 
+    improve detection of APK files; if we find a manifest file, at least say
 
+    that it is a jar file (FC Stegerman)
 
+
 
+--- a/magic/Magdir/archive
 
++++ b/magic/Magdir/archive
 
+@@ -1511,66 +1511,70 @@
 
+ # Starts with AndroidManifest.xml (file name length = 19)
 
+ >26	uleshort	19
 
+ >>30	string	AndroidManifest.xml	Android package (APK), with AndroidManifest.xml
 
+->>>-22	string	PK\005\006
 
+->>>>(-6.l-16)	string	APK\x20Sig\x20Block\x2042	\b, with APK Signing Block
 
+ !:mime	application/vnd.android.package-archive
 
+ !:ext	apk
 
++>>>-22	string	PK\005\006
 
++>>>>(-6.l-16)	string	APK\x20Sig\x20Block\x2042	\b, with APK Signing Block
 
+ # Starts with META-INF/com/android/build/gradle/app-metadata.properties
 
+ >26	uleshort	57
 
+ >>30	string	META-INF/com/android/build/gradle/
 
+ >>>&0	string	app-metadata.properties	Android package (APK), with gradle app-metadata.properties
 
+->>>>-22	string	PK\005\006
 
+->>>>>(-6.l-16)	string	APK\x20Sig\x20Block\x2042	\b, with APK Signing Block
 
+ !:mime	application/vnd.android.package-archive
 
+ !:ext	apk
 
++>>>>-22	string	PK\005\006
 
++>>>>>(-6.l-16)	string	APK\x20Sig\x20Block\x2042	\b, with APK Signing Block
 
+ # Starts with classes.dex (file name length = 11)
 
+ >26	uleshort	11
 
+ >>30	string	classes.dex	Android package (APK), with classes.dex
 
+->>>-22	string	PK\005\006
 
+->>>>(-6.l-16)	string	APK\x20Sig\x20Block\x2042	\b, with APK Signing Block
 
+ !:mime	application/vnd.android.package-archive
 
+ !:ext	apk
 
++>>>-22	string	PK\005\006
 
++>>>>(-6.l-16)	string	APK\x20Sig\x20Block\x2042	\b, with APK Signing Block
 
+ # Starts with META-INF/MANIFEST.MF (file name length = 20)
 
+ # NB: checks for resources.arsc, classes.dex, etc. as well to avoid matching JAR files
 
+ >26	uleshort	20
 
+ >>30	string	META-INF/MANIFEST.MF
 
+ # Contains resources.arsc (near the end, in the central directory)
 
+ >>>-512	search	resources.arsc	Android package (APK), with MANIFEST.MF and resources.arsc
 
+->>>>-22	string	PK\005\006
 
+->>>>>(-6.l-16)	string	APK\x20Sig\x20Block\x2042	\b, with APK Signing Block
 
+ !:mime	application/vnd.android.package-archive
 
+ !:ext	apk
 
++>>>>-22	string	PK\005\006
 
++>>>>>(-6.l-16)	string	APK\x20Sig\x20Block\x2042	\b, with APK Signing Block
 
+ >>>-512	default x
 
+ # Contains classes.dex (near the end, in the central directory)
 
+ >>>>-512	search	classes.dex	Android package (APK), with MANIFEST.MF and classes.dex
 
+->>>>>-22	string	PK\005\006
 
+->>>>>>(-6.l-16)	string	APK\x20Sig\x20Block\x2042	\b, with APK Signing Block
 
+ !:mime	application/vnd.android.package-archive
 
+ !:ext	apk
 
++>>>>>-22	string	PK\005\006
 
++>>>>>>(-6.l-16)	string	APK\x20Sig\x20Block\x2042	\b, with APK Signing Block
 
+ >>>>-512	default x
 
+ # Contains lib/armeabi (near the end, in the central directory)
 
+ >>>>>-512	search	lib/armeabi	Android package (APK), with MANIFEST.MF and armeabi lib
 
+->>>>>>-22	string	PK\005\006
 
+->>>>>>>(-6.l-16)	string	APK\x20Sig\x20Block\x2042	\b, with APK Signing Block
 
+ !:mime	application/vnd.android.package-archive
 
+ !:ext	apk
 
++>>>>>>-22	string	PK\005\006
 
++>>>>>>>(-6.l-16)	string	APK\x20Sig\x20Block\x2042	\b, with APK Signing Block
 
+ >>>>>-512	default x
 
+ # Contains drawables (near the end, in the central directory)
 
+ >>>>>>-512	search	res/drawable	Android package (APK), with MANIFEST.MF and drawables
 
+->>>>>>>-22	string	PK\005\006
 
+->>>>>>>>(-6.l-16)	string	APK\x20Sig\x20Block\x2042	\b, with APK Signing Block
 
+ !:mime	application/vnd.android.package-archive
 
+ !:ext	apk
 
++>>>>>>>-22	string	PK\005\006
 
++>>>>>>>>(-6.l-16)	string	APK\x20Sig\x20Block\x2042	\b, with APK Signing Block
 
++# It may or may not be an APK file, but it's definitely a Java JAR file
 
++>>>>>>-512	default x	Java archive data (JAR)
 
++!:mime	application/java-archive
 
++!:ext	jar
 
+ # Starts with zipflinger virtual entry (28 + 104 = 132 bytes)
 
+ # See https://github.com/obfusk/apksigcopier/blob/666f5b7/apksigcopier/__init__.py#L230
 
+ >4	string	\x00\x00\x00\x00\x00\x00
 
+ >>&0	string	\x21\x08\x21\x02
 
+ >>>&0	string	\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00
 
+ >>>>&0	string	\x00\x00	Android package (APK), with zipflinger virtual entry
 
+->>>>>-22	string	PK\005\006
 
+->>>>>>(-6.l-16)	string	APK\x20Sig\x20Block\x2042	\b, with APK Signing Block
 
+ !:mime	application/vnd.android.package-archive
 
+ !:ext	apk
 
++>>>>>-22	string	PK\005\006
 
++>>>>>>(-6.l-16)	string	APK\x20Sig\x20Block\x2042	\b, with APK Signing Block
 
+ # APK Signing Block
 
+ >0	default	x
 
+ >>-22	string	PK\005\006
 
+@@ -1795,9 +1799,10 @@
 
+ >>>38		regex	[!-OQ-~]+		Zip data (MIME type "%s"?)
 
+ !:mime	application/zip
 
+ 
+-# Java Jar files
 
++# Java Jar files (see also APK files above)
 
+ >(26.s+30)	leshort	0xcafe		Java archive data (JAR)
 
+ !:mime	application/java-archive
 
++!:ext	jar
 
+ 
+ # iOS App
 
+ >(26.s+30)	leshort	!0xcafe

+ 17 - 0
debian/patches/1674400026.FILE5_44-29-g1e4b7389.increase-strength-to-beat-targa-fc-stegerman.patch
View File 

@@ -0,0 +1,17 @@
 
+Subject: Increase strength to beat targa (FC Stegerman)
 
+Origin: FILE5_44-29-g1e4b7389 <https://github.com/file/file/commit/FILE5_44-29-g1e4b7389>
 
+Upstream-Author: Christos Zoulas <christos@zoulas.com>
 
+Date: Sun Jan 22 15:07:06 2023 +0000
 
+
 
+--- a/magic/Magdir/android
 
++++ b/magic/Magdir/android
 
+@@ -180,7 +180,9 @@
 
+ # In include/androidfw/ResourceTypes.h:
 
+ # RES_XML_TYPE = 0x0003 followed by the size of the header (ResXMLTree_header),
 
+ # which is 8 bytes (2 bytes type + 2 bytes header size + 4 bytes size).
 
++# The strength is increased to avoid misidentifying as Targa image data
 
+ 0	lelong	0x00080003	Android binary XML
 
++!:strength +1
 
+ 
+ # Android cryptfs footer
 
+ # From https://android.googlesource.com/\

+ 3 - 0
debian/patches/series
View File 

@@ -10,6 +10,9 @@
 
 1673482234.FILE5_44-18-g9fa5e784.detect-android-art-baseline-profiles-found-in-apk-files.patch
 
 1673482234.FILE5_44-18-g9fa5e784.detect-android-art-baseline-profiles-found-in-apk-files.patch
 
 1673482275.FILE5_44-19-g4341ed61.detect-android-package-resource-table-arsc-fc-stegerman.patch
 
 1673482275.FILE5_44-19-g4341ed61.detect-android-package-resource-table-arsc-fc-stegerman.patch
 
 1673725413.FILE5_44-22-g6d565d82.improve-apk-detection-fc-stegerman.patch
 
 1673725413.FILE5_44-22-g6d565d82.improve-apk-detection-fc-stegerman.patch
 
+1674058221.FILE5_44-23-gbaf1f4b4.add-mime-type-to-html-fc-stegerman.patch
 
+1674058358.FILE5_44-24-gc4361a10.improve-detection-of-apk-files-if-we-find-a-manifest-file-at-least-say.patch
 
+1674400026.FILE5_44-29-g1e4b7389.increase-strength-to-beat-targa-fc-stegerman.patch
 
 
 
 # patches that should go upstream
 
 # patches that should go upstream
 
 upstream.disable.att3b.patch
 
 upstream.disable.att3b.patch