reprotobuf icon indicating copy to clipboard operation
reprotobuf copied to clipboard

KeyError: 'sub'

Open ifynk opened this issue 9 years ago • 15 comments

Tried to use your script with Google Play app and got this error

Traceback (most recent call last): File "reprotobuf.py", line 246, in workspace.structure_packages() File "reprotobuf.py", line 62, in structure_packages for name in self.tree['sub']: KeyError: 'sub'

ifynk avatar Sep 22 '16 18:09 ifynk

+1

FrankPortman avatar Sep 22 '16 20:09 FrankPortman

+1 same error

But next I tryed with another apk And got this error:

reprotobuf.py", line 241, in analyze
    assert 'tag' in properties
AssertionError

dimmduh avatar Oct 11 '16 14:10 dimmduh

+1 same error

spiside avatar Oct 11 '16 18:10 spiside

@dimmduh Which APK did you get this error with?

mmcloughlin avatar Oct 15 '16 18:10 mmcloughlin

@mmcloughlin I tried google play 6.9.20, 5.9.12, 4.2.3

dimmduh avatar Oct 16 '16 01:10 dimmduh

I tried this apk. com.android.vending-1.apk.zip

ifynk avatar Oct 16 '16 05:10 ifynk

@ifynk In that APK the generated classes are obfuscated. The script currently identifies protobuf classes by looking for classes that extend MessageNano. This base class is actually com.google.protobuf.nano.b in that APK. The root cause of your error is that it's not actually finding any classes.

Even more discouraging is the fact that the message classes themselves have been obfuscated. Reverse engineering is still possible via this method (looking for classes extending b instead), but we'd end up with an obfuscated schema also.

mmcloughlin avatar Oct 30 '16 19:10 mmcloughlin

an obfuscated schema is still useful though, since we already know the majority of the schema from older versions, and could re-puzzle what changed in the schema with each update ;-)

Would it be possible to reliably detect what obfucsated base class name matches the MessageNano and finding the extended classes still with the python script?

the proto-interpretation would then be a job for humans.

mfonville avatar Oct 30 '16 20:10 mfonville

Let me look into whether I can identify the obfuscated MessageNano class.

mmcloughlin avatar Oct 30 '16 20:10 mmcloughlin

Any progress with this? I'm getting the same issue.

avaidyam avatar Dec 08 '16 09:12 avaidyam

+1

APTy avatar Dec 09 '16 02:12 APTy

+1

jvaill avatar Dec 09 '16 06:12 jvaill

Hey! Sorry to bug you, just wondering if there would be an update regarding this issue. Cheers!

spiside avatar Mar 20 '17 22:03 spiside

+1

dkbarn avatar Jul 15 '17 13:07 dkbarn

Any updates on this?

ReimarPB avatar Apr 06 '21 15:04 ReimarPB