DynamicRefTable App Generation

[iBotPeaches]

I'm going to try out discussions here to see how it works to collect highly specific details to points that spread among many tickets.

#2099
#2514
#2002
#1550

Package Groups (2)
Package Group 0 id=0x7f packageCount=1 name=com.twitter.android
  Package 0 id=0x7f name=com.twitter.android
    type 0 configCount=1 entryCount=117
Package Group 1 id=0x7e packageCount=1 name=com.twitter.android.webrtcnative
  DynamicRefTable entryCount=1:
    0x7e -> com.twitter.android.webrtcnative

Some applications have many packages in one resources.arsc file. Apktool in the past has just picked the package with most resources and that is leading to many many issues in the backlog.

Need to create a test app to remakes this behavior in as small as possible.

[MrIkso]

https://developer.android.com/guide/app-bundle/play-feature-delivery
More information this, i forgot the direct link about this technology

[Comnir]

A multi-package APK can be created as follows (not a minimal example though):

1. Build a bundle of an Android application which has a dynamic feature. For example, the dynamic features codelab
2. Convert the aab (bundle) to an APK set (apks) file using Bundletool
   2.1. Can be downloaded from its Github repo.
   2.2. Android documentation for Bundletool
   2.3. More information about the aab file format
   2.4. java -jar bundletool.jar build-apks --mode=universal --local-testing --bundle <path to .aab> --output
3. Unzip the generated APKs file - it has 2 files: toc.pb and universal.apk
4. Try to decompile the universal.apk with APKTool - the warning W: Could not decode attr value, ... will be printed (when using APKTool that includes the chunk type fix - support lib/specType out-of-order reading - fix "Invalid chunk type: expected=0x00000200, got=0x00000203" #2527)
5. Try to build back the APK - this will fail with Error: No resource type specified - reproduce Support applications with multiple packages. #2514

This zip includes aab/apks/apk for the Dynamic features codelab:
aab-apks-and-apk_for_codelab-dynamic-features.zip

I tried to understand how the multi-package apk (universal.apk) is built by debugging Bundletool. I thought they might be using aapt2 to compile with different packages, but didn't find code to show that it happens.
Instead, I think they are building the APK resources in a protobuf format and then converting to a binary APK with aapt2.

As for compiling with aapt2, according to aapt2 documentation, --package-id must be at least 127 (0x7f), but the package ids for the other packages are lower then 127, so it's not clear to me how we could use aapt2 to compile for different packages. Even if it was possible, it's not clear to me how we could merge multiple APK files with resources.arsc of different package ids.

The Bundletool code has a class named ResourceTableMerger to merge resource tables in-memory.
When building a universal.apk, ApkzlibApkSerializerHelper#writeToZipFile creates a partial proto APK with writeProtoApk and then uses aapt2's convertApkProtoToBinary.

So a possible direction for building the APK would be integrating with Bundletool (but that means relying on possibly internal APIs/data objects) and this should rely on package-id that is stored for resources during decompile.
@iBotPeaches - what do you think? Is this a valid approach?

[ticketsvl]

@iBotPeaches Hi, good idea to combine all in one ticket.

I'm going to try out discussions here to see how it works to collect highly specific details to points that spread among many tickets.

Can you expand your steps more detailed for easy reproduction? I want to try your method.
I`ve compiled apktool with patch what's next?

This works perfectly for Twitter, given the following patch above.

1. Use this patch.

2. Install the application itself as a package (rename to 126 - `0x7e`)

3. Decode application

4. Rebuild application

The way this works is that Apktool extracts needed frameworks (1, 126) as requirements but skips 127 (0x7F) as that is private. So when you try and build you get a framework missing exception. That is why installing the application itself, but lying around the pgkId works. So when aapt2 is looking for resources the -I include parameter includes the old application which has the 0x7e resources to find mapping.

This of course is highly dependent on having the old application which true app builders do not. I've been messing around with Instant apps like the discussion here - #2524 and trying to figure out how to make Android Studio be very verbose with all its commands to gradle/aapt2 so I can figure out the steps that it does to produce a binary from source.

What about "having the old application" prior version of troubled one? I have many of them, for example. And?