1

I am facing a compiled resource file for a mobile app (an Android one), built using moSync Framework (http://www.mosync.com). This resource file contains media(images, audio), strings, JS/HTML code for that app. It is built using the resource compiler from moSync framework.

The resource file starts with 4D 41 52 53 or MARS as a signature/identifier.

Would it be possible to extract the resources, to apply some modifications to them and to repack the file ?

Later edit (publishing file header, and first bytes for further analysis):

4D 41 52 53 E0 1C 4D A9 04 3D 72 85 78 56 34 22 10 00 00 00 3F 01 00
00 D7 25 B1 89 00 52 6F 6F 74 00 05 00 00 00 01 64 65 66 61 75 6C 74
2E 63 73 73 00 00 00 00 00 51 0E 00 00 01 48 74 74 70 49 6E 66 6F 45
4E 2E 68 74 6D 6C 00 51 0E 00 00 2C 7A 00 00 01 48 74 74 70 49 6E 66
6F 52 4F 2E 68 74 6D 6C 00 7D 88 00 00 2B 7A 00 00 00 69 6D 61 67 65
73 00 09 00 00 00 01 63 6C 69 65 6E 74 2E 70 6E 67 00 A8 02 01 00 A5
02 00 00 01 64 65 73 74 69 6E 61 74 69 65 2E 70 6E 67 00 4D 05 01 00
AA 03 00 00 01 74 61 78 69 2E 70 6E 67 00 F7 08 01 00 2F 0E 00 00 01
74 61 78 69 30 2E 70 6E 67 00 26 17 01 00 F6 02 00 00 01 74 61 78 69
31 2E 70 6E 67 00 1C 1A 01 00 76 04 00 00 01 74 61 78 69 32 2E 70 6E
67 00 92 1E 01 00 5F 04 00 00 01 74 61 78 69 33 2E 70 6E 67 00 F1 22
01 00 A7 05 00 00 01 74 61 78 69 34 2E 70 6E 67 00 98 28 01 00 0B 05
00 00 01 74 61 78 69 35 2E 70 6E 67 00 A3 2D 01 00 02 06 00 00 00 6A
73 00 01 00 00 00 01 6D 6F 73 79 6E 63 2D 62 72 69 64 67 65 2E 6A 73
00 A5 33 01 00 59 44 00 00

If you convert this data from hex to ascii, you will clearly see that the compiled file is a concatenation of several other files(eg:mosync-bridge.js, HttpInfoEN.html, default.css, taxi0.png). After finding that out, i continued analysing the file. After the last png file inside i found serveral audio/mpeg , audio/x-wav file headers. Those aren't referenced anywhere in the file, but loaded within the app sucessfully.

I also tried to hex-edit the file (eg change an attribute in a css file, without preserving attribute name length), repack and sign the APK. I installed it onto one device, and it would complain that it could not load the resources and crash.

  • Have you tried Apktool? – Maurice Jul 4 '15 at 21:07
  • Yes i have tried. It outputs nothing interesting but smali code and a folder named "assets" which contains two files program.mp3 and resources.mp3. Those are mis-named as being MPEG Layer3 Audio files. Those are compiled resource files as i stated in my question – Sir.pOpE Jul 4 '15 at 21:17
  • The crash is very likely due to the archive having a checksum of its contents. If you alter the individual files inside it, then you would also have to find this checksum and update it accordingly. – glampert Jul 7 '15 at 3:03
  • I am pretty sure it's not a checksum but file offsets in this "archive". I mean the audio files inside aren't refered anywhere in the header like others are, so i suspect the app or the library (moSync) knows where to look for a certain audio resource. if i alter a single bit in a css or html file the app runs ok and my change is visible( i.e.: altering a string from foo to bar, preserving number of chars, initially the app was writing foo now it writes bar) – Sir.pOpE Jul 7 '15 at 9:33
  • It's unlikely the file offsets are hard-coded into the loader. It's more likely the file offsets/object sizes are stored inside the resource file. The most common way to do this is to store all the offsets either in a table (at the start, or end of the file), or as part of a resource 'header'. One way to tell, is to try and find the start and end boundary of a recognizable resource (say your CSS file), then calculate the actual size of the object, convert it to little-endian HEX and search for that word/dword in the file. – fileoffset Jul 14 '15 at 7:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.