Casting exception during AxmlHandler transformation

[3ntr0phy]

I'm trying to work on the AndroidManifest on some application and I get this exception of a lot of applications :

java.lang.ClassCastException: java.lang.Float cannot be cast to java.lang.Integer at pxb.android.axml.AxmlWriter$NodeImpl.write(AxmlWriter.java:238) at pxb.android.axml.AxmlWriter$NodeImpl.write(AxmlWriter.java:254) at pxb.android.axml.AxmlWriter$NodeImpl.write(AxmlWriter.java:254) at pxb.android.axml.AxmlWriter$NodeImpl.write(AxmlWriter.java:254) at pxb.android.axml.AxmlWriter.toByteArray(AxmlWriter.java:388) at soot.jimple.infoflow.android.axml.AXmlHandler.toByteArray(AXmlHandler.java:124) at Manifest_extractor.addProperties(Manifest_extractor.java:192) There is some ways for an easy fix? I need to deploy a large set of experiments is a few days..

[mbenz89]

Can you investigate the issue a bit more to track down its cause?

[3ntr0phy]

Sure, I will, in a few days I will add some extra info, sorry for the delay;)

[louison]

I'm currently experiencing the same problem with several apks. The issue seems to be more related to FlowDroid than Soot directly though

[StevenArzt]

AXmlWriter is a third-party component that both FlowDroid and Soot use. At the moment, it is unclear to me whether this is a bug in FlowDroid, in your own code (generating invalid nodes), or in AXml. Could you check why this exception occurs? It would be nice to see why the writer thinks it's dealing with an Integer value.

[louison]

Sure, I'll try to investigate a bit more on that

[3ntr0phy]

Hello, there is any fix for this issue ?

[MarcMil]

I've committed a change to axml, which should fix this issue: https://github.com/Sable/axml/commit/8e1d4277518c1413b849cd7850aa39d32dffb50b

Note that this is on the develop branch.

[Killuaa27]

Thank you @MarcMil Any chance it will be merged into master? I got the same error, that should be fixed, with AXmlComplexValue.

[YaxinCheng]

I am having ~the exact same~ a similar issue, but it is not caused by Float. It crashes when the axml contains AXmlComplexValue. My debugger shows me this:

and it will get into the else branch as it matches with no other type. Can we fix this? The number part should be easy to write, but what about the unit part?

By the way, this can be triggered by simply reading layout files then write it for many apps (if you cannot reproduce, I am happy to provide my sample apk)

import soot.jimple.infoflow.android.resources.AbstractResourceParser

class LayoutModifier(private val apkPath: Path) : AbstractResourceParser() {
    fun readLayoutFiles() {
        handleAndroidResourceFiles(apkPath.toString(), null, IResourceHandler { fileName, _, stream ->
            if (!fileName.startsWith("res/layout") && !fileName.startsWith("res/menu"))
                return@IResourceHandler
            if (!fileName.endsWith(".xml")) {
                return@IResourceHandler
            }

            val handler = AXmlHandler(stream, AXML20Parser())
            handler.toByteArray() // <-- here
        }
    }
}

This zip file contains the apk I used to trigger this error app-debug.zip