1

I have been struggling to verify my own application signature for some time but couldn't make it. I have following code 

public static X509Certificate createCert (byte [] bytes) {
    X509Certificate certret = null;
    CertificateFactory cf = null;
    try {
        cf = CertificateFactory.getInstance("X.509");
        InputStream certStream = new ByteArrayInputStream(bytes);
        certret = (X509Certificate) cf.generateCertificate(certStream);
    } catch (CertificateException e) {
        // TODO Auto-generated catch block
        e.printStackTrace();
    }

    return certret;
}
protected void onCreate(Bundle savedInstanceState) {
    super.onCreate(savedInstanceState);
    setContentView(R.layout.activity_main);


    android.content.pm.Signature[] sigs;
    try {
        sigs = this.getPackageManager().getPackageInfo(this.getPackageName(),PackageManager.GET_SIGNATURES).signatures;
        for (android.content.pm.Signature sig : sigs)
        {
            Log.i("App", "Signature String : " + sig.toString()); 
            Log.i("App", "Signature : " + sig.hashCode());
            X509Certificate cert = createCert(sig.toByteArray());
            java.security.Signature signat;
            try {
                signat = java.security.Signature.getInstance("SHA1withRSA");
                signat.initVerify(cert.getPublicKey());
                boolean ret;
                ret = signat.verify(sig.toByteArray());
                Log.e(TAG, "verify result = " + ret);
            } catch (NoSuchAlgorithmException e) {
                // TODO Auto-generated catch block
                e.printStackTrace();
            } catch (SignatureException e) {
                // TODO Auto-generated catch block
                e.printStackTrace();
            } catch (InvalidKeyException e) {
                // TODO Auto-generated catch block
                e.printStackTrace();
            }
        }
    } catch (NameNotFoundException e) {
        // TODO Auto-generated catch block
        e.printStackTrace();
    }
}

I refer some of the stackoverflow tricks e.g. android verify signature of file with .der public key How to get APK signing signature?

But my verify always returns false.

I don't want to use openssl in my application. How can I verify my own application certificate by programmatic way.

Community
  • 1
  • 1
javed.attari
  • 31
  • 6
  • AFAIR Android requires MD5withRSA signatures. – Robert Jun 12 '14 at 14:40
  • Hi Robert. Thanks. I tried with MD5withRSA but result is still the false. – javed.attari Jun 12 '14 at 14:58
  • Another problem may be that you are verifying the signature content (`sig.toByteArray()`). I assume the signature is a PKCS#7 structure which you parse for extracting the certificate. But in JAR/APK files the signature covers the file `META-INF/MANIFEST.MF`. See also Therefore you should verify this file instead of the signature itself. See also http://stackoverflow.com/questions/5587656/verifying-jar-signature – Robert Jun 13 '14 at 08:00
  • Thanks again Robert. The link you mentioned requires Jar file path to be given. In my app, I dont want it to be based on some file path. If I read the API from some specific path, the cracker would put the right APK in the folder there and recompile my code. Instead, I want to read the content of MANIFEST.MF with standard API set. – javed.attari Jun 16 '14 at 13:39
  • There are http://stackoverflow.com/questions/10187556/reading-android-manifest-file and http://stackoverflow.com/questions/3392189/reading-android-manifest-mf-file gives some way. What I could see is Package class (in the PackageParser) https://github.com/android/platform_frameworks_base/blob/master/core/java/android/content/pm/PackageParser.java isn't included in the PM package description http://developer.android.com/reference/android/content/pm/PackageManager.html. Is there an easy way to get the List of signatures. – javed.attari Jun 16 '14 at 13:40

0 Answers0