Skip to content

Add safe DEX checksum repair flow (for androguard)#866

Merged
pulorsok merged 3 commits into
ev-flow:masterfrom
e619003:add-auto-repair-bad-dex-checksums
Feb 27, 2026
Merged

Add safe DEX checksum repair flow (for androguard)#866
pulorsok merged 3 commits into
ev-flow:masterfrom
e619003:add-auto-repair-bad-dex-checksums

Conversation

@e619003

@e619003 e619003 commented Feb 25, 2026

Copy link
Copy Markdown
Contributor

Description

When loading APK/DEX with the Androguard core, corrupted DEX header checksum/signature causes Androguard to refuse loading and abort the analysis.

Workflow

Scope: This change is Androguard‑only. Other cores (rizin, radare2, shuriken) are unaffected.

  1. Androguard load flow (APK path)

    • If AnalyzeAPK(self.data, raw=True) raises a checksum‑related error:
      1. When --auto-fix-checksum is provided:
        Silently repair all .dex headers in‑memory and retry loading.

        • DEX header repair:
          • SHA‑1 at 0x0C..0x1F = sha1(data[0x20:]) (20 bytes).
          • Adler32 at 0x08..0x0B = adler32(data[0x0C:]) (4 bytes, little‑endian).
      2. When --auto-fix-checksum is not provided:

        • Interactive TTY : prompt the user once with a clear warning that repairing modifies DEX headers and invalidates APK signatures (hashes will change). Proceed only if the user agrees.
        • Non‑interactive : skip repair and raise the original error, printing a concise hint to rerun with --auto-fix-checksum.
  2. Androguard load flow (DEX path)

    • Same policy as the APK path:
      • If a checksum‑related error occurs in addDEX(...), honor --auto-fix-checksum to repair the single DEX header and retry.
      • Without the --auto-fix-checksum flag and prompt in TTY, skip in non‑interactive.

Behavior

  • Without --auto-fix-checksum (default)

    • Interactive TTY : shows a single confirmation prompt, repairs only on user consent.
    • Non‑interactive : does not repair and does not block; prints a hint to re‑run with --auto-fix-checksum, then raises the original error.
  • With --auto-fix-checksum

    • Performs an in‑memory silent repair and retries the load (no prompt).
  • Other cores (not androguard):

    • unchanged.

…droguard only)

Allow users to configure whether bad checksum should be automatically fixed instead of raising an error.

This option is currently supported for androguard only.

@pulorsok pulorsok left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@pulorsok pulorsok merged commit b821a63 into ev-flow:master Feb 27, 2026
1 check passed
@codecov

codecov Bot commented Feb 27, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 89.28571% with 9 lines in your changes missing coverage. Please review.
✅ Project coverage is 82.27%. Comparing base (05e7ffa) to head (6b541db).
⚠️ Report is 4 commits behind head on master.

Files with missing lines Patch % Lines
quark/core/apkinfo.py 96.00% 3 Missing ⚠️
quark/core/parallelquark.py 0.00% 3 Missing ⚠️
quark/cli.py 0.00% 2 Missing ⚠️
quark/core/quark.py 75.00% 1 Missing ⚠️
Additional details and impacted files
@@           Coverage Diff           @@
##           master     #866   +/-   ##
=======================================
  Coverage   82.27%   82.27%           
=======================================
  Files          80       80           
  Lines        6844     6844           
=======================================
  Hits         5631     5631           
  Misses       1213     1213           
Flag Coverage Δ
unittests 82.27% <89.28%> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants