java.lang.ArrayIndexOutOfBoundsException when decompile apk

[david8557]

Hello, when using apktool 2.9.3, smali version 3.0.3, it works fine, but later smali version it has this error. This seem to be smali problem, please take a look when you have free time. Thank you!
APK link: https://pixeldrain.com/u/fhzaEige
Issue link in apktool: iBotPeaches/Apktool#3767

I: Using Apktool 2.11.0 on test.apk with 8 threads
I: Baksmaling classes.dex...
I: Baksmaling classes2.dex...
I: Copying raw assets/.wxxaawy.dex file...
I: Baksmaling classes3.dex...
I: Baksmaling classes4.dex...
I: Loading resource table...
I: Decoding file-resources...
I: Loading resource table from file: C:\Users\sss\AppData\Local\apktool\framework\1.apk
I: Decoding values / XMLs...
I: Decoding AndroidManifest.xml with resources...
I: Regular manifest package...
Exception in thread "main" java.lang.RuntimeException: java.util.concurrent.ExecutionException: java.lang.ArrayIndexOutOfBoundsException: Index 10350680 out of bounds for length 129317
at brut.androlib.BackgroundWorker.waitForFinish(SourceFile:0)
at brut.androlib.ApkDecoder.decode(SourceFile:0)
at brut.apktool.Main.main(SourceFile:0)
Caused by: java.util.concurrent.ExecutionException: java.lang.ArrayIndexOutOfBoundsException: Index 10350680 out of bounds for length 129317
at java.base/java.util.concurrent.FutureTask.report(FutureTask.java:122)
at java.base/java.util.concurrent.FutureTask.get(FutureTask.java:191)
... 3 more
Caused by: java.lang.ArrayIndexOutOfBoundsException: Index 10350680 out of bounds for length 129317
at com.android.tools.smali.dexlib2.dexbacked.DexBuffer.readSmallUint(SourceFile)
at com.android.tools.smali.dexlib2.dexbacked.DexBackedDexFile.getMapItemForSection(SourceFile:0)
at com.android.tools.smali.dexlib2.dexbacked.DexBackedDexFile.(SourceFile)
at com.android.tools.smali.dexlib2.dexbacked.ZipDexContainer.getEntries(SourceFile:0)
at com.android.tools.smali.dexlib2.dexbacked.ZipDexContainer.getDexEntryNames(SourceFile)
at brut.androlib.ApkDecoder.decodeSourcesSmaliJob(SourceFile:0)
at brut.androlib.ApkDecoder.lambda$decodeSourcesSmali$0(SourceFile)
at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:572)
at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:317)
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1144)
at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642)
at java.base/java.lang.Thread.run(Thread.java:1570)

An error has occured.

[sgjesse]

Thank you for the report. However the APK linked in https://pixeldrain.com/u/fhzaEige is not accessible.

[david8557]

Thank you for the report. However the APK linked in https://pixeldrain.com/u/fhzaEige is not accessible.

That link is still working fine for me.
Btw, here is another link: https://mega.nz/file/KcEHUTBR#SIzo4N7nfrxrkJvIVks97BYMcOvYIdXo54JEaKRoiGQ

[david8557]

Thank you for the report. However the APK linked in https://pixeldrain.com/u/fhzaEige is not accessible.

@sgjesse Hello, is there any progress on this problem?

[sgjesse]

Looking at the DEX files in the APK, then the DEX file assets/.wxxaawy.dex cannot be parsed. Unpacking and running baksmali directly on that file fails also fails with version 3.0.3:

java -jar baksmali-3.0.3-fat.jar d assets/.wxxaawy.dex
Exception in thread "main" java.lang.IllegalArgumentException: bad utf-8 byte d6 at offset 000000eb
	at com.android.tools.smali.util.Utf8Utils.throwBadUtf8(Utf8Utils.java:284)
	at com.android.tools.smali.util.Utf8Utils.utf8BytesWithUtf16LengthToString(Utf8Utils.java:220)
	at com.android.tools.smali.dexlib2.dexbacked.DexReader.readString(DexReader.java:610)
	at com.android.tools.smali.dexlib2.dexbacked.DexBackedDexFile$5.get(DexBackedDexFile.java:336)
	at com.android.tools.smali.dexlib2.dexbacked.DexBackedDexFile$5.get(DexBackedDexFile.java:329)
	at com.android.tools.smali.dexlib2.dexbacked.DexBackedDexFile$6.get(DexBackedDexFile.java:372)
	at com.android.tools.smali.dexlib2.dexbacked.DexBackedDexFile$6.get(DexBackedDexFile.java:367)
	at com.android.tools.smali.dexlib2.dexbacked.DexBackedClassDef.getType(DexBackedClassDef.java:108)
	at com.android.tools.smali.dexlib2.util.SyntheticAccessorResolver.<init>(SyntheticAccessorResolver.java:80)
	at com.android.tools.smali.baksmali.DisassembleCommand.getOptions(DisassembleCommand.java:287)
	at com.android.tools.smali.baksmali.DisassembleCommand.run(DisassembleCommand.java:182)
	at com.android.tools.smali.baksmali.Main.main(Main.java:101)

All of the classes[2-9]?.dex in the APK disassembles without issues.

[islamElbanna]

This should be fixed by #91

[david8557]

I can confirm that this problem is because of baksmali. In working apktool version, it use smali 3.0.3. When I change smali to 3.0.4, error occured. I think problem is in this code ZipDexContainer.java. It seem try to search for more dex, so it will try baksmali the bugged dex assets/.wxxaawy.dex. In apktool, I already use --only-main-classes, so it shouldn't try to decompile that dex.
`/**
* Gets a list of the names of dex files in this zip file.
*
* @return A list of the names of dex files in this zip file
*/
@nonnull @OverRide public List getDexEntryNames() throws IOException {
return new ArrayList<>(getEntries().keySet());
}

private Map<String, DexBackedDexFile> getEntries() throws IOException {
    if (entries != null) {
      return entries;
    }
    entries = new TreeMap<String, DexBackedDexFile>();
    try (ZipFile zipFile = getZipFile()) {
        Enumeration<? extends ZipEntry> entriesEnumeration = zipFile.entries();

        while (entriesEnumeration.hasMoreElements()) {
            ZipEntry entry = entriesEnumeration.nextElement();

            if (!isDex(zipFile, entry)) {
                continue;
            }

            // There might be several dex files in zip entry since DEX v41.
            try (InputStream inputStream = zipFile.getInputStream(entry)) {
                byte[] buf = InputStreamUtil.toByteArray(inputStream);
                for (int offset = 0, i = 1; offset < buf.length; i++) {
                  DexBackedDexFile dex = new DexBackedDexFile(opcodes, buf, 0, true, offset);
                  entries.put(entry.getName() + (i > 1 ? ("/" + i) : ""), dex);
                  offset += dex.getFileSize();
                };
            } catch (ArrayIndexOutOfBoundsException ex) {
                // This is expected if the dex file is invalid.
            }
        }

        return entries;
    }
}`

[iBotPeaches]

@sgjesse - Open for another release soon? The fix from #91 and all these reported OOB would be resolved. Since any container load calls getEntries which then aggressively loads all entries (including the bugged .dex) which crashes out on any masquerading dex.

#91 seems to solve it and/or using baksmali with the raw .dex files in isolation. Any usage like Apktool does with full apk/stream is affected.

[david8557]

@sgjesse Please release it soon. Fix has been push for 4 months since April already.