Android签名验证简介

﹏ヽ暗。殇╰゛Y 2022-04-16 01:14 283阅读 0赞

**分享一下我老师大神的人工智能教程！零基础，通俗易懂！[http://blog.csdn.net/jiangjunshow][http_blog.csdn.net_jiangjunshow]**

**也欢迎大家转载本篇文章。分享知识，造福人民，实现我们中华民族伟大复兴！**

本文博客[原文][Link 1]

Android 原生自带了个安装器（packages\\apps\\PackageInstaller），

通过其中的源码 PackageParser.java  (frameworks\\base\\core\\java\\android\\content\\pm)

我们大概就能知道其签名验证机制的验证过程。

其中主要涉及2个函数：

**函数1**

public  boolean  collectCertificates ( Package  pkg ,  int  flags )  \{

pkg . mSignatures  =  null ;

WeakReference < byte \[\]>  readBufferRef ;

byte \[\]  readBuffer  =  null ;

synchronized  ( mSync )  \{

readBufferRef  =  mReadBuffer ;

if  ( readBufferRef  !=  null )  \{

mReadBuffer  =  null ;

readBuffer  =  readBufferRef . get ();

if  ( readBuffer  ==  null )  \{

readBuffer  =  new  byte \[ 8192 \];

readBufferRef  =  new  WeakReference < byte \[\]>( readBuffer );

try  \{

JarFile  jarFile  =  new  JarFile ( mArchiveSourcePath );

Certificate \[\]  certs  =  null ;

if  (( flags & PARSE\_IS\_SYSTEM )  !=  0 )  \{

// If this package comes from the system image, then we

// can trust it...  we'll just use the AndroidManifest.xml

// to retrieve its signatures, not validating all of the

// files.

JarEntry jarEntry = jarFile.getJarEntry(ANDROID\_MANIFEST\_FILENAME);

certs = loadCertificates(jarFile, jarEntry, readBuffer);

if (certs == null) \{

Slog.e(TAG, "Package " + pkg.packageName

+ " has no certificates at entry "

+ jarEntry.getName() + "; ignoring!");

jarFile.close();

mParseError = PackageManager.INSTALL\_PARSE\_FAILED\_NO\_CERTIFICATES;

return false;

if (DEBUG\_JAR) \{

Slog.i(TAG, "File " + mArchiveSourcePath + ": entry=" + jarEntry

+ " certs=" + (certs != null ? certs.length : 0));

if (certs != null) \{

final int N = certs.length;

for (int i=0; i<N; i++) \{

Slog.i(TAG, "  Public key: "

+ certs\[i\].getPublicKey().getEncoded()

+ " " + certs\[i\].getPublicKey());

\} else \{

Enumeration<JarEntry> entries = jarFile.entries();

final Manifest manifest = jarFile.getManifest();

while (entries.hasMoreElements()) \{

final JarEntry je = entries.nextElement();

if (je.isDirectory()) continue;

final  String  name  =  je . getName ();

if  ( name . startsWith ( "META-INF/" ))

continue ;

if  ( ANDROID\_MANIFEST\_FILENAME . equals ( name ))  \{

final  Attributes  attributes  =  manifest . getAttributes ( name );

pkg . manifestDigest  =  ManifestDigest . fromAttributes ( attributes );

final  Certificate \[\]  localCerts  =  loadCertificates ( jarFile ,  je ,  readBuffer );

if  ( DEBUG\_JAR )  \{

Slog . i ( TAG ,  "File "  \+  mArchiveSourcePath  \+  " entry "  \+  je . getName ()

\+  ": certs="  \+  certs  \+  " ("

\+  ( certs  !=  null  ?  certs . length  :  0 )  \+  ")" );

if  ( localCerts  ==  null )  \{

Slog . e ( TAG ,  "Package "  \+  pkg . packageName

\+  " has no certificates at entry "

\+  je . getName ()  \+  "; ignoring!" );

jarFile . close ();

mParseError  =  PackageManager . INSTALL\_PARSE\_FAILED\_NO\_CERTIFICATES ;

return  false ;

\}  else  if  ( certs  ==  null )  \{

certs  =  localCerts ;

\}  else  \{

// Ensure all certificates match.

for (int i=0; i<certs.length; i++) \{

boolean found = false;

for (int j=0; j<localCerts.length; j++) \{

if (certs\[i\] != null &&

certs\[i\].equals(localCerts\[j\])) \{

found = true;

break;

if (!found || certs.length != localCerts.length) \{

Slog.e(TAG, "Package " + pkg.packageName

+ " has mismatched certificates at entry "

+ je.getName() + "; ignoring!");

jarFile.close();

mParseError = PackageManager.INSTALL\_PARSE\_FAILED\_INCONSISTENT\_CERTIFICATES;

return false;

jarFile.close();

synchronized  ( mSync )  \{

mReadBuffer  =  readBufferRef ;

if  ( certs  !=  null  &&  certs . length  >  0 )  \{

final  int  N  =  certs . length ;

pkg . mSignatures  =  new  Signature \[ certs . length \];

for  ( int  i = 0 ;  i < N ;  i \++)  \{

pkg . mSignatures \[ i \]  =  new  Signature (

certs \[ i \]. getEncoded ());

\}  else  \{

Slog . e ( TAG ,  "Package "  \+  pkg . packageName

\+  " has no certificates; ignoring!" );

mParseError  =  PackageManager . INSTALL\_PARSE\_FAILED\_NO\_CERTIFICATES ;

return  false ;

\}  catch  ( CertificateEncodingException  e )  \{

Slog . w ( TAG ,  "Exception reading "  \+  mArchiveSourcePath ,  e );

mParseError  =  PackageManager . INSTALL\_PARSE\_FAILED\_CERTIFICATE\_ENCODING ;

return  false ;

\}  catch  ( IOException  e )  \{

Slog . w ( TAG ,  "Exception reading "  \+  mArchiveSourcePath ,  e );

mParseError  =  PackageManager . INSTALL\_PARSE\_FAILED\_CERTIFICATE\_ENCODING ;

return  false ;

\}  catch  ( RuntimeException  e )  \{

Slog . w ( TAG ,  "Exception reading "  \+  mArchiveSourcePath ,  e );

mParseError  =  PackageManager . INSTALL\_PARSE\_FAILED\_UNEXPECTED\_EXCEPTION ;

return  false ;

return  true ;

**函数2**

private  Certificate \[\]  loadCertificates ( JarFile  jarFile ,  JarEntry  je ,

byte \[\]  readBuffer )  \{

try  \{

// We must read the stream for the JarEntry to retrieve

// its certificates.

InputStream is = new BufferedInputStream(jarFile.getInputStream(je));

while (is.read(readBuffer, 0, readBuffer.length) != -1) \{

// not using

is.close();

return je != null ? je.getCertificates() : null;

\} catch (IOException e) \{

Slog.w(TAG, "Exception reading " + je.getName() + " in "

+ jarFile.getName(), e);

\} catch (RuntimeException e) \{

Slog.w(TAG, "Exception reading " + je.getName() + " in "

+ jarFile.getName(), e);

return null;

通过上面的代码，我们已经能够得到了签名的证书，通过证书我们就得到PublicKey，通过比较PublicKey我们就能比较签名是否一致，当然这里假设的是只有一个签名。

实例1

package  edu . edut . robin . utils ; import  java . io . ByteArrayInputStream ; import  java . io . IOException ; import  java . io . InputStream ; import  java . security . PublicKey ; import  java . security . cert . Certificate ; import  java . security . cert . CertificateFactory ; import  java . security . cert . X509Certificate ; import  java . util . jar . JarEntry ; import  java . util . jar . JarFile ; import  android . content . Context ; import  android . content . pm . PackageInfo ; import  android . content . pm . PackageManager ; import  android . content . pm . PackageManager . NameNotFoundException ; import  android . util . Base64 ; public  class  SigntureUtil \{       final  static  String  TAG  =  "Signture" ;      public  static  String \[\]  getPublicKeyString ( PackageInfo  pi )      \{           PublicKey  pubKeys \[\]  =  getPublicKey ( pi );          if  ( pubKeys  ==  null  ||  pubKeys . length  ==  0 )          \{               return  null ;          \}          String \[\]  strPubKeys  =  new  String \[ pubKeys . length \];          for  ( int  i  =  0 ;  i  <  pubKeys . length ;  i \++)             strPubKeys \[ i \]  =  Base64 . encodeToString ( pubKeys \[ i \]. getEncoded (),                      Base64 . DEFAULT );          return  strPubKeys ;      \}      private  static  PublicKey \[\]  getPublicKey ( PackageInfo  pi )      \{           try          \{               if  ( pi . signatures  ==  null  ||  pi . signatures . length  ==  0 )              \{                   return  null ;              \}              PublicKey \[\]  publicKeys  =  new  PublicKey \[ pi . signatures . length \];              for  ( int  i  =  0 ;  i  <  publicKeys . length ;  i \++)              \{                   byte \[\]  signature  =  pi . signatures \[ i \]. toByteArray ();                  CertificateFactory  certFactory  =  CertificateFactory                          . getInstance ( "X.509" );                  InputStream  is  =  new  ByteArrayInputStream ( signature );                 X509Certificate cert  =  ( X509Certificate )  certFactory                          . generateCertificate ( is );                 publicKeys \[ i \]  =  cert . getPublicKey ();              \}          \}  catch  ( Exception  ex )          \{           \}          return  null ;      \}      private  static  PublicKey \[\]  getInstalledAppPublicKey ( Context  context ,              String  packageName )      \{           PackageManager  pm  =  context . getPackageManager ();          PackageInfo  pi ;          try          \{              pi  =  pm . getPackageInfo ( packageName ,  PackageManager . GET\_SIGNATURES );              if  ( pi  !=  null  &&  pi . versionName  !=  null )              \{                   return  getPublicKey ( pi );              \}          \}  catch  ( NameNotFoundException  e )          \{               // not installed              return  null ;          \}  catch  ( Exception  e )          \{              e . printStackTrace ();          \}          return  null ;      \}      private  static  Certificate \[\]  loadCertificates ( JarFile  jarFile ,  JarEntry  je )      \{           try          \{               // We must read the stream for the JarEntry to retrieve              // its certificates.              byte \[\]  readBuffer  =  new  byte \[ 1024 \];              InputStream  is  =  jarFile . getInputStream ( je );              while  ( is . read ( readBuffer ,  0 ,  readBuffer . length )  !=  \- 1 )                  ;              is . close ();              return  ( je  !=  null )  ?  je . getCertificates ()  :  null ;          \}  catch  ( IOException  e )          \{              e . printStackTrace ();          \}          return  null ;      \}      public  static  boolean  verifySignature ( Context  context ,  String  packageName ,              String  filePath )      \{           boolean  verifyed  =  true ;          try          \{               PublicKey \[\]  installedAppPubKeys  =  getInstalledAppPublicKey ( context ,                     packageName );              if  ( installedAppPubKeys  ==  null || installedAppPubKeys . length == 0 )              \{                   // package not installed                  return  true ;              \}              JarFile  jarFile  =  new  JarFile ( filePath );             verifyed  =  false ;              JarEntry  je  =  jarFile . getJarEntry ( "classes.dex" );              Certificate \[\]  certs  =  loadCertificates ( jarFile ,  je );              if  ( certs  !=  null  &&  certs . length  >  0 )              \{                   for  ( int  i  =  0 ;  i  <  certs . length ;  i \++)                  \{                       PublicKey  pubKey  =  certs \[ i \]. getPublicKey ();                      for ( int  j = 0 ; j < installedAppPubKeys . length ; j \++)                      \{                           if  ( pubKey . equals ( installedAppPubKeys \[ j \]))                          \{                              verifyed  =  true ;                              break ;                          \}                      \}                      if ( verifyed )                          break ;                  \}              \}  else              \{                  verifyed  =  true ;              \}             jarFile . close ();          \}  catch  ( Exception  e )          \{              verifyed  =  true ;          \}          return  verifyed ;      \} \}

关于数字签名的更多内容请阅读《 [数字签名简介][Link 2] [》][Link 2]

关于java本身的数字签名和数字证书请参考《 [Java中的数字签名和数字证书][Java] 》和 《 [Jar文件的数字签名][Jar] 》

结束

#### 给我老师的人工智能教程打call！[http://blog.csdn.net/jiangjunshow][http_blog.csdn.net_jiangjunshow] ####

![这里写图片描述][SouthEast]

[http_blog.csdn.net_jiangjunshow]: https://blog.csdn.net/jiangjunshow/article/details/77338485
[Link 1]: http://hubingforever.blog.163.com/blog/static/1710405792012103085612776/
[Link 2]: http://hubingforever.blog.163.com/blog/static/17104057920118774251514/
[Java]: http://hubingforever.blog.163.com/blog/static/17104057920118631458629/
[Jar]: http://hubingforever.blog.163.com/blog/static/17104057920118104058241/
[SouthEast]: /images/20220416/8c0ae9924a224d1d90a07a69ecacc1a5.png