Introduction to resources.arsc

In the intricate world of Android application reverse engineering, understanding the foundational components of an APK is paramount. While Java bytecode and native libraries often take center stage, the resources.arsc file stands as a critical, yet often overlooked, binary asset. This file is the compiled resource table, acting as a sophisticated index that maps resource IDs to their corresponding values and configurations. For reverse engineers, mastering resources.arsc is essential for uncovering hidden strings, understanding UI layouts, manipulating application behavior, and even localizing applications without source code.

Unlike simple string tables or XML files, resources.arsc is a highly optimized binary format designed for efficient lookup at runtime. Its binary nature makes direct inspection challenging, requiring a deep understanding of its internal structure. This article will dissect the resources.arsc format, guiding you through its chunk-based architecture, identifying key data structures, and providing a framework for programmatic parsing and analysis.

The Anatomy of resources.arsc: A Chunk-Based Format

The resources.arsc file is structured as a series of interconnected binary chunks. Each chunk begins with a common header, Res_chunk_header, which defines its type, size, and the overall length of the chunk. Understanding this header is the first step to navigating the file.

Core Chunk Header (Res_chunk_header)

Every chunk in the resources.arsc file starts with this universal header, allowing parsers to identify the chunk’s purpose and its boundaries. This is fundamental for skipping irrelevant data or correctly interpreting the subsequent bytes.

struct Res_chunk_header {    uint16_t type;       // Type of the chunk, e.g., RES_TABLE_TYPE, RES_STRING_POOL_TYPE    uint16_t headerSize; // Size of the Res_chunk_header itself (usually 8 bytes)    uint32_t chunkSize;  // Total size of this chunk (header + data) in bytes};

• type: A 16-bit integer identifying the specific kind of chunk (e.g., 0x0001 for ResStringPool_header, 0x0002 for ResTable_package, 0x0008 for ResTable_header).
• headerSize: Specifies the size of this generic header itself. This is crucial as some chunks extend this base header with additional fields.
• chunkSize: The total size of the chunk, including its header. This value is vital for knowing how many bytes to read or skip to get to the next chunk.

The Global String Pool (ResStringPool_header)

Immediately following the main ResTable_header, you’ll typically find the global string pool. This pool stores all unique string values referenced throughout the resources.arsc file, such as resource names, attribute names, and sometimes even localized strings. Its structure includes offsets to the actual string data.

struct ResStringPool_header {    Res_chunk_header header;    uint32_t stringCount;    // Number of strings in the pool    uint32_t styleCount;     // Number of styles in the pool (often 0)    uint32_t flags;          // Encoding flags (e.g., UTF-8, UTF-16)    uint32_t stringsStart;   // Byte offset from the start of the chunk to string data    uint32_t stylesStart;    // Byte offset from the start of the chunk to style data (if any)};

The flags field is particularly important: 0x00000100 indicates UTF-8 encoding, otherwise it’s UTF-16. After the header, an array of stringCount 32-bit offsets follows, each pointing to a string’s position relative to stringsStart. Strings are typically length-prefixed and null-terminated.

Packages and Their Resources (ResTable_package)

Following the global string pool, the file contains one or more ResTable_package chunks. Each package represents a logical grouping of resources. For a typical application, there will be at least two: one for the Android framework resources (package ID 0x01) and one for the application’s own resources (package ID 0x7f).

struct ResTable_package {    Res_chunk_header header;    uint32_t id;            // Package ID (e.g., 0x01 for android, 0x7f for app)    char name[256];         // Package name (UTF-16, null-terminated)    uint32_t typeStrings;   // Offset to the package's type string pool    uint32_t lastPublicType;    uint32_t keyStrings;    // Offset to the package's key string pool    uint32_t lastPublicKey;};

Each package has its *own* type string pool (e.g.,