| 1234567891011121314151617181920212223242526272829303132333435363738394041424344454647 |
- Subject: Improve APK detection (FC Stegerman)
- Origin: FILE5_44-22-g6d565d82 <https://github.com/file/file/commit/FILE5_44-22-g6d565d82>
- Upstream-Author: Christos Zoulas <christos@zoulas.com>
- Date: Sat Jan 14 19:43:33 2023 +0000
- --- a/magic/Magdir/archive
- +++ b/magic/Magdir/archive
- @@ -1559,7 +1559,7 @@
- !:mime application/vnd.android.package-archive
- !:ext apk
- # Starts with META-INF/MANIFEST.MF (file name length = 20)
- -# NB: checks for resources.arsc or drawables as well to avoid matching JAR files
- +# NB: checks for resources.arsc, classes.dex, etc. as well to avoid matching JAR files
- >26 uleshort 20
- >>30 string META-INF/MANIFEST.MF
- # Contains resources.arsc (near the end, in the central directory)
- @@ -1568,13 +1568,27 @@
- >>>>>(-6.l-16) string APK\x20Sig\x20Block\x2042 \b, with APK Signing Block
- !:mime application/vnd.android.package-archive
- !:ext apk
- ->>>-512 default x
- -# Contains drawables (near the end, in the central directory)
- ->>>>-512 search res/drawable Android package (APK), with MANIFEST.MF and drawables
- +>>>-512 default x
- +# Contains classes.dex (near the end, in the central directory)
- +>>>>-512 search classes.dex Android package (APK), with MANIFEST.MF and classes.dex
- >>>>>-22 string PK\005\006
- >>>>>>(-6.l-16) string APK\x20Sig\x20Block\x2042 \b, with APK Signing Block
- !:mime application/vnd.android.package-archive
- !:ext apk
- +>>>>-512 default x
- +# Contains lib/armeabi (near the end, in the central directory)
- +>>>>>-512 search lib/armeabi Android package (APK), with MANIFEST.MF and armeabi lib
- +>>>>>>-22 string PK\005\006
- +>>>>>>>(-6.l-16) string APK\x20Sig\x20Block\x2042 \b, with APK Signing Block
- +!:mime application/vnd.android.package-archive
- +!:ext apk
- +>>>>>-512 default x
- +# Contains drawables (near the end, in the central directory)
- +>>>>>>-512 search res/drawable Android package (APK), with MANIFEST.MF and drawables
- +>>>>>>>-22 string PK\005\006
- +>>>>>>>>(-6.l-16) string APK\x20Sig\x20Block\x2042 \b, with APK Signing Block
- +!:mime application/vnd.android.package-archive
- +!:ext apk
- # Starts with zipflinger virtual entry (28 + 104 = 132 bytes)
- # See https://github.com/obfusk/apksigcopier/blob/666f5b7/apksigcopier/__init__.py#L230
- >4 string \x00\x00\x00\x00\x00\x00
|
