obfuscated APKs cause processing bugs and logs don't log package name

[johannestaas-trufflesec]

Please review the Community Note before submitting

TruffleHog Version

trufflehog dev, main branch as of 2026-05-28 9am pacific
main was at 36f6f6970 when I ran into this issue

Trace Output

https://gist.github.com/johannestaas-trufflesec/6f06a6fb38f8445b09abd818c714e52b

Expected Behavior

• It should parse obfuscated APKs, or handle bad classes without failing on the APK entirely
• It should continue parsing resources.arsc even if one resource type is unrecognized
• It should also log the package name whenever possible if there is an error

Actual Behavior

• runtime error: slice bounds out of range [65536:16384]
• "malformed class def: bad superclass type: invalid string id"
• no package name, not very useful debug logging

Steps to Reproduce

1. https://f-droid.org/en/packages/ds.pulsar/
2. Download the latest (ds.pulsar_7.apk)
3. Run trufflehog filesystem ./ds.pulsar_7.apk

Environment

• OS: OSX/Darwin
• Version Darwin Kernel Version 25.4.0

Additional Context

Internal, just reporting to follow guidelines (I work here so feel free to slack me)

References

• #0000

[johannestaas-trufflesec]

i'm working on a fix:
#4991

[johannestaas-trufflesec]

Should be good to go