1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
|
Subject: Improve detection of APK files; if we find a manifest file, at least say (...)
Origin: FILE5_44-24-gc4361a10 <https://github.com/file/file/commit/FILE5_44-24-gc4361a10>
Upstream-Author: Christos Zoulas <christos@zoulas.com>
Date: Wed Jan 18 16:12:38 2023 +0000
improve detection of APK files; if we find a manifest file, at least say
that it is a jar file (FC Stegerman)
--- a/magic/Magdir/archive
+++ b/magic/Magdir/archive
@@ -1511,66 +1511,70 @@
# Starts with AndroidManifest.xml (file name length = 19)
>26 uleshort 19
>>30 string AndroidManifest.xml Android package (APK), with AndroidManifest.xml
->>>-22 string PK\005\006
->>>>(-6.l-16) string APK\x20Sig\x20Block\x2042 \b, with APK Signing Block
!:mime application/vnd.android.package-archive
!:ext apk
+>>>-22 string PK\005\006
+>>>>(-6.l-16) string APK\x20Sig\x20Block\x2042 \b, with APK Signing Block
# Starts with META-INF/com/android/build/gradle/app-metadata.properties
>26 uleshort 57
>>30 string META-INF/com/android/build/gradle/
>>>&0 string app-metadata.properties Android package (APK), with gradle app-metadata.properties
->>>>-22 string PK\005\006
->>>>>(-6.l-16) string APK\x20Sig\x20Block\x2042 \b, with APK Signing Block
!:mime application/vnd.android.package-archive
!:ext apk
+>>>>-22 string PK\005\006
+>>>>>(-6.l-16) string APK\x20Sig\x20Block\x2042 \b, with APK Signing Block
# Starts with classes.dex (file name length = 11)
>26 uleshort 11
>>30 string classes.dex Android package (APK), with classes.dex
->>>-22 string PK\005\006
->>>>(-6.l-16) string APK\x20Sig\x20Block\x2042 \b, with APK Signing Block
!:mime application/vnd.android.package-archive
!:ext apk
+>>>-22 string PK\005\006
+>>>>(-6.l-16) string APK\x20Sig\x20Block\x2042 \b, with APK Signing Block
# Starts with META-INF/MANIFEST.MF (file name length = 20)
# NB: checks for resources.arsc, classes.dex, etc. as well to avoid matching JAR files
>26 uleshort 20
>>30 string META-INF/MANIFEST.MF
# Contains resources.arsc (near the end, in the central directory)
>>>-512 search resources.arsc Android package (APK), with MANIFEST.MF and resources.arsc
->>>>-22 string PK\005\006
->>>>>(-6.l-16) string APK\x20Sig\x20Block\x2042 \b, with APK Signing Block
!:mime application/vnd.android.package-archive
!:ext apk
+>>>>-22 string PK\005\006
+>>>>>(-6.l-16) string APK\x20Sig\x20Block\x2042 \b, with APK Signing Block
>>>-512 default x
# Contains classes.dex (near the end, in the central directory)
>>>>-512 search classes.dex Android package (APK), with MANIFEST.MF and classes.dex
->>>>>-22 string PK\005\006
->>>>>>(-6.l-16) string APK\x20Sig\x20Block\x2042 \b, with APK Signing Block
!:mime application/vnd.android.package-archive
!:ext apk
+>>>>>-22 string PK\005\006
+>>>>>>(-6.l-16) string APK\x20Sig\x20Block\x2042 \b, with APK Signing Block
>>>>-512 default x
# Contains lib/armeabi (near the end, in the central directory)
>>>>>-512 search lib/armeabi Android package (APK), with MANIFEST.MF and armeabi lib
->>>>>>-22 string PK\005\006
->>>>>>>(-6.l-16) string APK\x20Sig\x20Block\x2042 \b, with APK Signing Block
!:mime application/vnd.android.package-archive
!:ext apk
+>>>>>>-22 string PK\005\006
+>>>>>>>(-6.l-16) string APK\x20Sig\x20Block\x2042 \b, with APK Signing Block
>>>>>-512 default x
# Contains drawables (near the end, in the central directory)
>>>>>>-512 search res/drawable Android package (APK), with MANIFEST.MF and drawables
->>>>>>>-22 string PK\005\006
->>>>>>>>(-6.l-16) string APK\x20Sig\x20Block\x2042 \b, with APK Signing Block
!:mime application/vnd.android.package-archive
!:ext apk
+>>>>>>>-22 string PK\005\006
+>>>>>>>>(-6.l-16) string APK\x20Sig\x20Block\x2042 \b, with APK Signing Block
+# It may or may not be an APK file, but it's definitely a Java JAR file
+>>>>>>-512 default x Java archive data (JAR)
+!:mime application/java-archive
+!:ext jar
# Starts with zipflinger virtual entry (28 + 104 = 132 bytes)
# See https://github.com/obfusk/apksigcopier/blob/666f5b7/apksigcopier/__init__.py#L230
>4 string \x00\x00\x00\x00\x00\x00
>>&0 string \x21\x08\x21\x02
>>>&0 string \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00
>>>>&0 string \x00\x00 Android package (APK), with zipflinger virtual entry
->>>>>-22 string PK\005\006
->>>>>>(-6.l-16) string APK\x20Sig\x20Block\x2042 \b, with APK Signing Block
!:mime application/vnd.android.package-archive
!:ext apk
+>>>>>-22 string PK\005\006
+>>>>>>(-6.l-16) string APK\x20Sig\x20Block\x2042 \b, with APK Signing Block
# APK Signing Block
>0 default x
>>-22 string PK\005\006
@@ -1795,9 +1799,10 @@
>>>38 regex [!-OQ-~]+ Zip data (MIME type "%s"?)
!:mime application/zip
-# Java Jar files
+# Java Jar files (see also APK files above)
>(26.s+30) leshort 0xcafe Java archive data (JAR)
!:mime application/java-archive
+!:ext jar
# iOS App
>(26.s+30) leshort !0xcafe
|
