Overview
Android'sSigning mechanismAnd i'm sure you're gonna find it all the time, and when we're ready for the release of an ap, we're gonna need a realese key file to sign this app. Do we have an apk that we didn't specify? No, all apks are signed, and if they don't, they will be compiled by default using the debug in the sdk directory.
Sign function
Signature of androidMechanisms have many effects:
Application upgrade: if you want users to upgrade seamlessly to a new version, you must sign with the same certificate. This is because only when signed with the same certificate will the system allow the installation of an upgraded application. If you use a different certificate, the system will require a different package name for your application, in which case a completely new application is installed. If you want to upgrade the application, sign the certificate the same and the package name the same
Application modularization: the android system allows multiple applications signed with the same certificate to operate in a process, and the system actually uses them as a single application, so that our applications can be deployed in a modular manner and users can independently upgrade one of the modules
Code or data sharing: android provides a signature-based permission mechanism whereby one application can disclose its functionality for another application signed with the same certificate. Sign multiple applications with the same certificate, using a signature-based permission check, so you can share code and data in a secure way between the applications
Use method
Command line configuration
Gradle configuration
Analysis of signature files
There's a lot of different types of signing documents, mainly about androids, like the earliest keepers, jks, pem/pk8
Keystore: keystore was the first signature document ever made by eclipse when he developed android.
Jks (java key store): jks is the format for creating a signature file (build->general signed apk) in the current android studio to create and use the signature file to sign for corresponding apk
Pem/pk8: this is a system signature file, which is also required when android is compiled, so this is a system signature file. Can the system sign file sign apk? The answer is: yes.
That's the structure of the documents we've been able to decompress. MThe contents of the signed document are stored in eta-inf。
MEta-inf\: directory describing package information, location where the signed information is stored
Res\: directory of storage of resource files
Libs\:ndk
Classes. Dex: dalvik bytes above 64k, so subcontracted, multiple
Binary resource file compiled by resource. Arsc
We're going to target mEta-inf\document analysis
Manifest. Mf: stores summary information from sha1 algorithms for each file in the apk package。
Certt. Sf: summary value (first) of manifest. Mf and summary value of each summary item in manifest. Mf
Cert. Rsa: the document saves the signature and public key certificate. A summary of the information used for the signature is the content of cert. Sf
Sign generation
First use sha1 or sha256 for each unsigned apk file, with a value of bThe set64 format is stored in the manifest. Mf file, which is a summary of information generated for each document
Generates a message summary for the manifest file, recreates a message summary of the contents of each file in manifest. Mf, and saves the result in the head properties of certt. Sf, in an algorithm for each property block in the manifest. Mf file, to be stored in a property block。
Sign cert. Sf files and archive them in cert. Rsa
Last three files generated into mEta-inf catalogued and packaged into apk, thus completing the signature of the application。
The application signature is only owned by the developer and, if someone changes the code, the signature is required to run, but the changer's signature is inconsistent with the official signature. We store the hashcode value of the application's official signature in so, and then check if the signature is an official signature after the application has been started. If not, the application closes directly, neither does the encryption function in so
If you change the signature package to cover the installation, you will miss it, and the installation is prohibited:
The traditional verification of signatures on the java floor is inadequate and not only is it easy to reverse it, it is also not flexible enough. There are several ways of strengthening signatures:
Ndk level validation
In short, ndk is a set of packages developed in android with c/c++, generally in sor, and java code is called through the jni interface, and of course can be compiled independently into an enforceable program with the main entrance
Ndk has the advantage of increasing the complexity of the process, as so does obtain the arm code in reverse, rather than the easily modified, understandable code of smali. The difficulty of changing so much will increase。
Resize signer file
The size of the file is not mandatory during the app installation resolutionEnterinfo's length to determine the size of the file is that you can add characters at the end of the file without affecting the use. So you can add a character of any size at the end of the file, and if you are resigned you can determine the size of the verified file。
Service validation
The method of challenge-response is sent by the server to challenge, and then the program encrypts it with a string of its own features before returning to response, if correct, by verifying it, and otherwise preventing it from running。
Upgrade: the server does not return a field, but a core code is returned, and the program dynamically implements the core code。
Increased confusion
In the pp package, in jar = > dex, this step uses a self-defined confusion, replacing class, function and variable names with flexible chinese
Currently there is a problem with the handling of this utf8 character in most anti-compilation tools
Love and miapSecureAnalysis
Measures taken:
1. Adoption of https requests
2. Validation of the source of the request by signing
3. Dispersion of sensitive static constant data, secure storage
4. Confusion
5. Security keyboard for payment passwords
6. Application of dual-use tests
Measures suitable for strengthening:
1. Signature verification
2. Detection of malicious processes, such as xposed
3. Increased confusion
4. Enhancement of encrypted storage, account codes, etc. Storage
Android's security programming habits:
Unable to print sensitive data, the print log switch must be closed before distribution
For components to interact with externally, a control of access rights should be added, and data to be passed is also required
Securely verified publicly accessible components can receive intent, usually containing data, and when we do not emptied these data, apps usually crash, and the attackers may send empty intent to attack。
Self-defined keyboard screen protection for payment passwords because of continuous fast-track screening or video recording to access user passwords。
Response options: preparation of resistance logic against third parties or systems, e. G., shielding and blocking related functions, or when the client is in the process chamber the top layer covers the screenshot with a pure black image object。
7 user operations:
(a) add a sign password or fingerprint login, which requires authentication for entry into the credit wallet; the application is switched to the backstage but the application is not finished, and the password is validated when the application is returned
Change password to add privacy authentication
Direction to be studied - - application reinforcement
Applications have been strengthened to include virus scanning modules, inoculation, debugging, tampering and four modules, and many applications have now emerged within the industry to incorporate solutions, e. G., e. G., e. G., e. G., e. G., e. G., e. G., e. G., e. G., e. G., e. G., e. G., e. G., e. G., e. G., e. G., e. G., e. G., e., e. G., e. G., e. G., e., e. G., e. G., e., e., e., e. G., e., e., e., e., e., e. G., e., e., e., e., e. G., e., e., e. G., e., e., e. G., e., e., e. G., e., e., e., e., e。
Summary
We love miap, both electrician and financial, and we need to be supported by a better safety technology program, which hopefully will make our ap safer through this sharing of secure signatures and applications!
