IssueTracker

Android binary XML (not to be confused with the new ABX scheme introduced in Android 12) is an special binary format that expects the first 4 bytes to be as follows (in hexadecimal, little endian):

03 00 08 00

Where 0x03 denotes the XML chunk and 0x08 denotes the size of its header. All the XML files including the XML resources and AndroidManifest.xml are converted to this special format during compilation. However, a few days ago, I have discovered a particular case where an app has a different format which is as follows:

00 00 08 00

As can be seen above, the first byte is 0x00 which denotes a NULL chunk. Now, the AOSP-supplied apksig library comes with a class namely AndroidBinXmlParser which explicitly checks for an XML chunk which cannot be found above which means that whoever developed the app used a modified version of the library. But to my surprise, I have found that Android OS and aapt2 (aapt fails though) can successfully parse the manifest and the app can be installed successfully without issues. Since the AOSP-provided apksig, by default, does not allow this particular magic. I think this to be an AOSP bug which can be solved in one of the two ways:

1. Modify the apksig library to support NULL-type XML chunk (A bug in apksig)
2. Modify the resource parser in the AOSP to disable support for NULL-type XML chunk (a bug in the OS/aapt2).

PS: The app in question is a Chinese app known as NP Manager. This app has a bad reputation with many AVs flagging it as malicious. This is why this issue should not be taken lightly.

1. Link to the APK (please avoid installing it in a regular device): https://upload.disroot.org/r/cGLNRSCB#/ZYIgKSMr4R0KQif91gLCnXF/rNqbIbMwYzny3Z9A3Y=
2. VirusTotal report: https://www.virustotal.com/gui/file/271bd6583c859606267570e0dae3d0173a47255c48d025e4dc950fab5baaadcc

Thanks.