I've found a way to fetch bitmaps even from obfuscated apk's (where all renamed images are in root "res" folder) using aapt:
- Get icon path specified in app's Manifest:
aapt dump badging [apk] | grep "application: "
application: label='Total Commander' icon='res/2r.xml' banner='res/BO.png'
If its xml, then we need to go deeper.
- Dump resources to find resource ID for that icon, use grep to filter output, taking one previous line:
aapt dump --values resources [apk] | grep "res/2r.xml" -B1
resource 0x7f0b0000 com.ghisler.android.TotalCommander:mipmap/icon: t=0x03 d=0x00000322 (s=0x0008 r=0x00)
(string8) "res/2r.xml"
So, the resource ID is 0x7f0b0000.
- Search for this resource ID, taking the next line with its real path in each entry:
aapt dump --values resources [apk] | grep "0x7f0b0000" -A1
spec resource 0x7f0b0000 com.ghisler.android.TotalCommander:mipmap/icon: flags=0x00000500
spec resource 0x7f0b0001 com.ghisler.android.TotalCommander:mipmap/icon_launcher_foreground: flags=0x00000500
--
resource 0x7f0b0000 com.ghisler.android.TotalCommander:mipmap/icon: t=0x03 d=0x00000169 (s=0x0008 r=0x00)
(string8) "res/vI.png"
--
resource 0x7f0b0000 com.ghisler.android.TotalCommander:mipmap/icon: t=0x03 d=0x00000196 (s=0x0008 r=0x00)
(string8) "res/0n.png"
--
resource 0x7f0b0000 com.ghisler.android.TotalCommander:mipmap/icon: t=0x03 d=0x00000230 (s=0x0008 r=0x00)
(string8) "res/cH.png"
--
resource 0x7f0b0000 com.ghisler.android.TotalCommander:mipmap/icon: t=0x03 d=0x00000260 (s=0x0008 r=0x00)
(string8) "res/_J.png"
--
resource 0x7f0b0000 com.ghisler.android.TotalCommander:mipmap/icon: t=0x03 d=0x0000027a (s=0x0008 r=0x00)
(string8) "res/PN.png"
--
resource 0x7f0b0000 com.ghisler.android.TotalCommander:mipmap/icon: t=0x03 d=0x000002cb (s=0x0008 r=0x00)
(string8) "res/41.png"
--
resource 0x7f0b0000 com.ghisler.android.TotalCommander:mipmap/icon: t=0x03 d=0x000002fd (s=0x0008 r=0x00)
(string8) "res/S2.png"
--
resource 0x7f0b0000 com.ghisler.android.TotalCommander:mipmap/icon: t=0x03 d=0x00000322 (s=0x0008 r=0x00)
(string8) "res/2r.xml"
- Use the last bitmap entry (skip "xml"), it will be in the best quality (for the highest density). Note that bitmap icon can be in other formats (jpeg, webp).