Android apk签名

http://www.zhihu.com/question/20749413

http://www.cnblogs.com/tanlon/archive/2012/07/09/2583661.html

http://blog.youkuaiyun.com/wulianghuan/article/details/18400581

原理： 1、签名过的包会在apk中生成META-INF文件夹，并创建CERT.RSA、CERT.SF、MANIFEST.MF

* 3个文件，其中CERT.SF、MANIFEST.MF文件保存了对apk中文件的SHA1数字签名，

* 那么在apk安装校验时，改变后的文件摘要信息与MANIFEST.MF的检验信息不同，于是程序就不能成功安装。

* 2、在安装时只能使用公钥才能解密它。解密之后，将它与未加密的摘要信息进行对比，如果相符，则表明内容没有被异常修改。

* 3、生成MANIFEST.MF没有使用密钥信息，生成 CERT.SF 文件使用了私钥文件。

* 那么我们可以很容易猜测到，CERT.RSA文件的生成肯定和公钥相关。CERT.RSA文件中保存了公钥、所采用的加密算法等信息。

* 4、Android签名机制不能阻止APK包被修改，但修改后的再签名无法与原先的签名保持一致。

* 5、APK包加密的公钥就打包在APK包内，且不同的私钥对应不同的公钥

* 。换句话言之，不同的私钥签名的APK公钥也必不相同。所以我们可以根据公钥的对比， 来判断私钥是否一致。

方式一（需要知道keystore）

-------------------------------------------------------------------------------------------------------------------------

当前路径下包含用于对app签名的test.keystore文件，且keystore密码为123456，别名为openapi，别名密码为6543(http://sourceforge.net/directory/os:windows/freshness:recently-updated/?q=md5 )

keytool -exportcert -alias openapi -keypass 654321 -keystore ./test.keystore -storepass 123456 | md5sum
keytool -list -v -keystore keystorefile -storepass 123456

-------------------------------------------------------------------------------------------------------------------------

方式二

-------------------------------------------------------------------------------------------------------------------------

假定安装了JDK，如果想查HelloWorld.apk所使用的签名的fingerprint，可以这样做：

1. 查找apk里的rsa文件

（Windows）
> jar tf HelloWorld.apk |findstr RSA
（Linux）
$ jar tf HelloWorld.apk |grep RSA

META-INF/CERT.RSA

2. 从apk中解压rsa文件

jar xf HelloWorld.apk META-INF/CERT.RSA

3. 获取签名的fingerprints

keytool -printcert -file META-INF/CERT.RSA

...
Certificate fingerprints:
MD5: BC:6D:BD:6E:49:69:2A:57:A8:B8:28:89:04:3B:93:A8
SHA1: 0D:DF:76:F4:85:96:DF:17:C2:68:1D:3D:FF:9B:0F:D2:A1:CF:14:60
Signature algorithm name: SHA1withRSA
Version: 3
...

4. 清理工作，删除rsa文件

（Windows）
rmdir /S /Q META-INF

（Linux）
rm -rf META-INF

如果你想知道两个apk是不是用的同一个签名，那比一下它们签名的MD5码（或SHA1码）是不是一样就行了。

-------------------------------------------------------------------------------------------------------------------------

方式二（对应sh脚本）

-------------------------------------------------------------------------------------------------------------------------

#!/bin/sh
#
#echo $0
#echo $1
#echo $2

FILE=$1
tmp=a.txt
#检查apk中具体的签名文件,得到的cert_XSA可能是META-INF/*.RSA或者META-INF/*.DSA
cert_XSA=`jar tf $FILE | grep SA`
#从apk中提取具体的签名文件。
jar xf $FILE $cert_XSA
#keytool -printcert -file $cert_XSA | grep MD5 > "$FILE.certMD5"
keytool -printcert -file $cert_XSA | grep MD5 > "$tmp"
echo "==========================="
echo "md5 is save in "$tmp" "
echo "==========================="

if [ $2="" ];then
echo "==========================="
echo "Cannot compare,please provide the second apk file path"
echo "==========================="
exit
fi

FILE=$2
tmp=b.txt
#检查apk中具体的签名文件,得到的cert_XSA可能是META-INF/*.RSA或者META-INF/*.DSA
cert_XSA=`jar tf $FILE | grep SA`
#从apk中提取具体的签名文件。
jar xf $FILE $cert_XSA
#keytool -printcert -file $cert_XSA | grep MD5 > "$FILE.certMD5"
keytool -printcert -file $cert_XSA | grep MD5 > "$tmp"

# ...
# ... 经过上述步骤得到$FILE1.certMD5和$FILE2.certMD5
# ...
tmpa=a.txt
tmpb=b.txt
certMD5_diff=`diff $tmpa $tmpb`
if [ "$certMD5_diff" = "" ]; then
echo "$FILE1.certMD5 == $FILE2.certMD5"
fi

方式三（Jave代码的方式）

-------------------------------------------------------------------------------------------------------------------------

package com.sina.weibo.sdk.demo.tools;

import java.io.IOException;
import java.io.InputStream;
import java.lang.ref.WeakReference;
import java.security.cert.CertificateEncodingException;
import java.util.Enumeration;
import java.util.jar.JarEntry;
import java.util.jar.JarFile;
import java.util.logging.Level;
import java.util.logging.Logger;


public class ApkCerMgr2 {

	private static final Object mSync = new Object();
	private static WeakReference<byte[]> mReadBuffer;

	public static String getSign(String path ) {
//		if (args.length < 1) {
//			System.out.println("Usage: java -jar GetAndroidSig.jar <apk/jar>");
//			System.exit(-1);
//		}
//
//		System.out.println(args[0]);

		String mArchiveSourcePath = path ;//args[0];

		WeakReference<byte[]> readBufferRef;
		byte[] readBuffer = null;
		synchronized (mSync) {
			readBufferRef = mReadBuffer;
			if (readBufferRef != null) {
				mReadBuffer = null;
				readBuffer = readBufferRef.get();
			}
			if (readBuffer == null) {
				readBuffer = new byte[8192];
				readBufferRef = new WeakReference<byte[]>(readBuffer);
			}
		}

		try {
			JarFile jarFile = new JarFile(mArchiveSourcePath);
			java.security.cert.Certificate[] certs = null;

			Enumeration entries = jarFile.entries();
			while (entries.hasMoreElements()) {
				JarEntry je = (JarEntry) entries.nextElement();
				if (je.isDirectory()) {
					continue;
				}
				if (je.getName().startsWith("META-INF/")) {
					continue;
				}
				java.security.cert.Certificate[] localCerts = loadCertificates(
						jarFile, je, readBuffer);
				if (false) {
					System.out.println("File " + mArchiveSourcePath + " entry "
							+ je.getName() + ": certs=" + certs + " ("
							+ (certs != null ? certs.length : 0) + ")");
				}
				if (localCerts == null) {
					System.err.println("Package has no certificates at entry "
							+ je.getName() + "; ignoring!");
					jarFile.close();
					
					return null;
				} else if (certs == null) {
					certs = localCerts;
				} else {
					// Ensure all certificates match.
					for (int i = 0; i < certs.length; i++) {
						boolean found = false;
						for (int j = 0; j < localCerts.length; j++) {
							if (certs[i] != null
									&& certs[i].equals(localCerts[j])) {
								found = true;
								break;
							}
						}
						if (!found || certs.length != localCerts.length) {
							System.err
									.println("Package has mismatched certificates at entry "
											+ je.getName() + "; ignoring!");
							jarFile.close();
							return null; // false
						}
					}
				}
			}

			jarFile.close();

			synchronized (mSync) {
				mReadBuffer = readBufferRef;
			}

			if (certs != null && certs.length > 0) {
				final int N = certs.length;

				for (int i = 0; i < N; i++) {
					String charSig = new String(toChars(certs[i].getEncoded()));
					System.out.println("Cert#: " + i + "  Type:"
							+ certs[i].getType() + "\nPublic key: "
							+ certs[i].getPublicKey() + "\nHash code: "
							+ certs[i].hashCode() + " / 0x"
							+ Integer.toHexString(certs[i].hashCode())
							+ "\nTo char: " + charSig);
					return charSig ;
				}
				
			} else {
				System.err.println("Package has no certificates; ignoring!");
			}
		} catch (CertificateEncodingException ex) {
			Logger.getLogger(ApkCerMgr2.class.getName()).log(Level.SEVERE,
					null, ex);
		} catch (IOException e) {
			System.err.println("Exception reading " + mArchiveSourcePath + "\n"
					+ e);
		} catch (RuntimeException e) {
			System.err.println("Exception reading " + mArchiveSourcePath + "\n"
					+ e);
		}
		return null ;
	}

	private static char[] toChars(byte[] mSignature) {
		byte[] sig = mSignature;
		final int N = sig.length;
		final int N2 = N * 2;
		char[] text = new char[N2];

		for (int j = 0; j < N; j++) {
			byte v = sig[j];
			int d = (v >> 4) & 0xf;
			text[j * 2] = (char) (d >= 10 ? ('a' + d - 10) : ('0' + d));
			d = v & 0xf;
			text[j * 2 + 1] = (char) (d >= 10 ? ('a' + d - 10) : ('0' + d));
		}

		return text;
	}

	private static java.security.cert.Certificate[] loadCertificates(
			JarFile jarFile, JarEntry je, byte[] readBuffer) {
		try {
			// We must read the stream for the JarEntry to retrieve
			// its certificates.
			InputStream is = jarFile.getInputStream(je);
			while (is.read(readBuffer, 0, readBuffer.length) != -1) {
				// not using
			}
			is.close();

			return (java.security.cert.Certificate[]) (je != null ? je
					.getCertificates() : null);
		} catch (IOException e) {
			System.err.println("Exception reading " + je.getName() + " in "
					+ jarFile.getName() + ": " + e);
		}
		return null;
	}
}

-------------------------------------------------------------------------------------------------------------------------

方式四（Android代码的方式）

-------------------------------------------------------------------------------------------------------------------------

  public static PackageInfo getPackageForFile(String path, Context context) {
    	try {
    		PackageManager pm = context.getPackageManager();
        	PackageInfo pi = pm.getPackageArchiveInfo(path, /*PackageManager.GET_PERMISSIONS|*/PackageManager.GET_SIGNATURES);
        	
        	return pi ;
		} catch (Exception e) {
		}
    	return null ;
    	
    }
    
    public Signature[] getSign(String myPkgName) throws Exception {
		PackageManager pm = cx.getPackageManager();
		PackageInfo info = pm.getPackageInfo(myPkgName,
				PackageManager.GET_SIGNATURES);// 设置
												// PackageManager.GET_SIGNATURES
												// 位，以保证返回证书签名信息。

		return info.signatures;// 这样就可以通过
								// packageInfo.signatures
								// 来访问到APK的签名信息。
	}
    
    public static PackageInfo getPacakgeInfo(Context context, String packageName) {
        PackageInfo pi;
        try {
            pi = context.getPackageManager().getPackageInfo(packageName,
                    PackageManager.GET_SIGNATURES);
                return pi;
        } catch (NameNotFoundException e) {
            return null;
        }
    }
    
    public static String getSign0(PackageInfo packageinfo) {
		String charsString = packageinfo.signatures[0].toCharsString();
		
		return charsString;
	}
    
    
	public static String getSignMd5(PackageInfo packageinfo) {
		String charsString = packageinfo.signatures[0].toCharsString();
		byte[] bytes = charsString
				.getBytes();
		return getMD5(bytes);
	}
	
	 public static String getMD5(byte[] plainText) {
	        try {
	            MessageDigest md = MessageDigest.getInstance("MD5");
	            md.update(plainText);
	            byte[] b = md.digest();

	            return toHexString(b);
	        } catch (NoSuchAlgorithmException e) {
	            e.printStackTrace();
	            return null;
	        }
	    }
	 
	 /** 16进制数组 */
	    static final char[] HEXCHAR = { '0', '1', '2', '3', '4', '5', '6', '7', '8', '9',
	            'a',
	            'b',
	            'c', 'd', 'e', 'f' };
	    
	    /**
	     * 将字节数组转换为16进制字符串
	     * 
	     * @param byt
	     *            要转换的字节
	     * @return 字符串
	     */
	    public static String toHexString(byte[] byt) {
	        StringBuilder sb = new StringBuilder(byt.length * 2);
	        for (int i = 0; i < byt.length; i++) {
	            sb.append(HEXCHAR[(byt[i] & 0xf0) >>> 4]);// SUPPRESS CHECKSTYLE :
	                                                      // magic number
	            sb.append(HEXCHAR[byt[i] & 0x0f]);// SUPPRESS CHECKSTYLE : magic
	                                              // number
	        }
	        return sb.toString();
	    }
	    
	    

/**
	 * Android中 Signature 和Java中 Certificate 的对应关系。它们的关系如下面代码所示： pkg.mSignatures
	 * = new Signature[certs.length]; for ( int i = 0 ; i < N; i ++ ) {
	 * pkg.mSignatures[i] = new Signature( certs[i].getEncoded()); }
	 * 也就是说signature = new Signature(certificate.getEncoded());
	 * certificate证书中包含了公钥和证书的其他基本信息。公钥不同，证书肯定互不相同。 可以通过certificate的getPublicKey
	 * 方法获取公钥信息。所以比对签名证书本质上就是比对公钥信息。
	 * 
	 * 获取apk中CERT.RSA公钥信息中的特殊标识码
	 * 
	 */
	public final HashMap<String, String> getPublicKey(String myPkgName) {
		try {

			CertificateFactory certFactory = CertificateFactory
					.getInstance("X.509");
			X509Certificate cert = (X509Certificate) certFactory
					.generateCertificate(new ByteArrayInputStream(
							getSign(myPkgName)[0].toByteArray()));

			HashMap<String, String> map = new HashMap<String, String>();
			map.put(ISSUER_DN_KEY, String.valueOf(cert.getIssuerDN()));
			map.put(SERIAL_NUMBER_KEY, String.valueOf(cert.getSerialNumber()));
			return map;
		} catch (Exception e) {
			e.printStackTrace();
		}
		return null;
	}

-------------------------------------------------------------------------------------------------------------------------