Skip to content

feat(artifacts): decode Android compiled resource tables - #9798

Draft
blankym wants to merge 2 commits into
morluto:mainfrom
blankym:feat-arsc-reader
Draft

blankym wants to merge 2 commits into
morluto:mainfrom
blankym:feat-arsc-reader

Conversation

@blankym

@blankym blankym commented Nov 10, 2026 •

Copy link
Copy Markdown
Contributor

Problem

resources.arsc — the compiled resource table inside every APK — is currently opaque to artifact inspection: AXML manifests decode but every @0x7f… reference stays numeric, and the table itself is not admitted by any reader.

Approach

Read-only ResTable decoder following the established DecodedRegionArtifactReader pattern:

  • domain/arscFormat.ts: chunk-type 0x0002 header recognition + declared facts
  • domain/android/arscDocument.ts: global string pool, package chunks, type/key pools, type specs, typed entries and configuration qualifiers → deterministic resources.xml projection
  • ArscArtifactReader + detection/inventory/extraction wiring, metadata schemas, format vocabularies
  • Reuses the AXML string-pool parser and typed-value renderer so values match the manifest decoder exactly
  • Bounded: 64 MiB file, 1M strings/entries, 96 MiB output; typed format/limit failures; library/overlay/staged-alias chunks walked and reported as limitations

Stacked on #9590

This branch builds on feat-axml-reader (shared StringPool/renderTypedValue exports). The PR diff shows the complete stack until #9590 merges; the arsc-only change is the top commit (52effad0).

Validation

  • 19/19 new unit + boundary tests; AXML suite 32/32 unchanged (exports are additive)
  • check:fast (typecheck+lint) clean; docs:check clean
  • Real artifact: fanqie resources.arsc (4.2 MB, sha256 e4c92dd4…) → 4.5 MB well-formed resources.xml (xmllint verified), 60,064 entries, package com.dragon.read/0x7f, app_name → 番茄免费小说 via the UTF-8 global pool, config qualifiers (zh, v22–v31, densities) decoded

Out of scope

Overlay-policy/library/staged-alias payloads (walked, limited); runtime resource resolution.

Human owner: @blankym

  • I have reviewed the complete diff
  • I have verified the validation evidence above
  • This PR is ready for maintainer review

blankym and others added 2 commits November 10, 2026 15:04
Add a read-only AXML reader that decodes the ResXMLTree chunk stream —
string pool, resource map and the element tree — into deterministic XML
text as a document.xml region, following the decoded-region reader
pattern. Typed attribute values render literally, android: prefixes come
from the resource map or declared namespaces, and coverage, limits and
malformed-input failures stay typed. Resource table names, DEX
references and component semantics are not resolved.

Verified against a real APK AndroidManifest.xml (368 strings, 326
elements, 590 attributes): inspect classifies axml with document facts,
and extraction emits the decoded manifest with declared package,
versions, permissions and intents intact.
Read-only ResTable (resources.arsc) reader: parses the global string
pool, package chunks, type/key pools, type specs and typed entries, and
projects a deterministic resources.xml region naming every entry by id
and key with its configuration qualifier, public flag and literal value.

- Bounded decode (64 MiB file, 1M strings/entries, 96 MiB output) with
  typed format/limit failures; sparse entries skipped, library/overlay/
  staged-alias chunks walked and reported as limitations
- Reuses the AXML string-pool and typed-value rendering so values match
  the manifest decoder exactly
- Fixture builder, unit + boundary + MCP tests, docs page, skill note

Real-artifact validation: fanqie resources.arsc (4.2 MB, sha256
e4c92dd4) decoded to 4.5 MB valid XML, 60,064 entries, package
com.dragon.read/0x7f, app_name resolved to 番茄免费小说 through the
UTF-8 global pool, config qualifiers (zh, v22-v31, densities) decoded.

Stacked on morluto#9590 (shares axmlDocument exports); diff becomes
arsc-only once that lands.

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant