apk/dex differences, diffoscope can't really tell what's going on. Any ideas?

[Marcus Hoffmann]

Hi Bernhard,

On 29.05.21 17:45, Bernhard M. Wiedemann wrote:
> 
> 
> On 29/05/2021 14.30, Marcus Hoffmann via rb-general wrote:
>> we're trying to hunt down an unreproducible apk build.
>>
>> We currently have a diff between two dex files which diffoscope can't
>> really tell us anything about:
>> https://bubu1.eu/diffoscope_dex.html
>>
>> Anyone got any idea what's going on here?
>>
>> (File are https://bubu1.eu/classes.dex and
>> https://bubu1.eu/classes_fynn.dex)
> 
> They differ in
> "pg-map-id":"xxxxxxx"
> 
> and the 24 differing bytes starting at offset 8 could be a 192 bit
> checksum over the remaining content.

Oooh, that makes a lot of sense (and the torproject gitlab issue seems 
to confirm that). The other thing is proguard/r8 releated, that should 
help a lot trying to figure that out!

I was confused because I'm used to getting diffs in the 
discompile/disassembly of dex files which is explicitly not the case 
here (which is good, it's a step forward from where we were last week!)

> 
> If in doubt, check the code creating it for "pg-map-id" and for what
> goes after the dex\n035\000 magic header.
> 
> https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/40085
> seems related.
> 
> https://speakerdeck.com/jakewharton/diffusing-changes-in-your-apks-droidcon-toronto-2019
> also has something.
>