0

I am trying to understand the exact details of how Android extracts the entries from an APK during the installation process. First some background info:

  • The installation may occur either through Play Store or directly using for example adb using a command like adb install example.apk. Should be noted that depending on how it is installed the process might be slightly different - I am interested in both cases
  • The .apk is basically a zip file and an extraction should occur. Following the zip format specification the extraction should account for the compression method being used by each entry. I located this method which I am not sure if it is related with the installation process but I can see it takes into account the two available compression methods (STORE, DEFLATE).

I have tried in Android 11(emulator x86), to install an APK (through adb) which does not have a compression method of either STORE or DEFLATE for the AndroidManifest.xml and it installs successfully.

What is the responsible code for handling compression methods outside of the ones expected?

Improve this question
3
  • 1
    The only difference between PlayStore and adb install is that nowadays PlayStore delivers apps as split APK files (multiple APK files per app), where as adb install expects a monolithic APK file.
    – Robert
    Commented Sep 6, 2023 at 11:42
  • 1
    … for which there is adb install_multiple if I'm not mistaken ;) And while I'm not sure about the PlayStore app, installation is usually handled by pm install (which adb install hands over to IIRC).
    – Izzy
    Commented Sep 6, 2023 at 16:41
  • This site may be helpful if you don't know it yet dzone.com/articles/depth-android-package-manager If you want to know it for sure how the installation takes place you could try tofind it out on a rooted device: hook certain classes in the installd process using frida-trace. Then you will see if the glass is used the way you think.
    – Robert
    Commented Feb 9 at 20:52

1 Answer 1

Reset to default
1

Android app installation process is not very straightforward like APK is opened, files are extracted, and placed in the relevant directories. In fact, scores of components are involved in the app installation process under the hood; framework services in the Java layer, in the native layer, IPC calls and so on.

Also there are many variable factors which decide how the app will be installed. APK file is opened multiple times during this whole process, possibly in different ways, at different stages.

That said, now to address your question, here I quote two instances from the source code: when the APK file is copied to /data/app/<pkg>/base.apk, and when the native libraries are extracted (if applicable). The Java code in both places (from the PackageManagerService) calls the the native code (from libziparchive). And here both compression methods you have mentioned are being checked during the ZIP / APK extraction process. Similar approach is used when extracting other files like classes (DEX code), assets and XML resources.

Improve this answer
2
  • The different ZIP algorithms used for accessing APK entries were the cause of the Janus vulnerability (CVE-2017-13156) as different algorithms had a different view on the APK which allowed to modify the APK without invalidating the APK signature. That was the reason Google developen APK signature v2 format (which signs the whole ZIP file content).
    – Robert
    Commented Nov 15, 2023 at 21:30
  • Thank you for the two instances mentioned, but I am looking specifically for when the AndroidManifest.xml is being extracted. I also noticed that the behavior is different if it is Android 8 than Android 11.
    – kampias
    Commented Jan 20 at 8:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .