Android APK Prevent anti-compilation technology fifth-integrity check

on preventing Android apk we've talked about four of the technologies that we've been deserializing before.

Shell-Adding technology

Modify bytecode at run time

Pseudo-Encryption

Confrontation Jd-gui

If you don't understand, you can check out the top four articles of my blog about these four technologies. Let's move on to another technology - Integrity check that prevents apk decompile .

First, Integrity check principle

The so-called integrity check is that we use various algorithms to calculate the integrity of a file to prevent this file from being modified. One of the most common methods is to calculate a file'sCRC32value or calculate the hash value of a file. We are preventingapkThis method can also be used in the anti-compilation method. We knowapkgenerated byClasses.dexmainly byJavafile generated, it is the entireapklogical implementation of the. So we canClasses.dexfile integrity checks to ensure that the entire program's logic is not modified. If we want to guarantee the entireapkThe integrity of the file, or to the entireapkfile for integrity checking. Let's do the following separately.Classes.dexfiles andapkthe integrity check of the file.

Second, using CRC32 to verify the integrity of the Classes.dex file

(1) Can print out the value of the CRC32 of our apk live Classes.dex file, the code is as follows:

public class mainactivity extendsactivity {@Overrideprotected void OnCreate (bundlesavedinstancestate) {    Super.oncreate (savedinstancestate);    Setcontentview (r.layout.activity_main);    String Apkpath = Getpackagecodepath ();    Long DEXCRC = Long.parselong (getString (R.STRING.CLASSESDEX_CRC));    Try    {        ZipFile zipfile = new ZipFile (apkpath);        ZipEntry dexentry = zipfile.getentry ("Classes.dex");        LOG.I ("Verification", "classes.dexcrc=" +DEXENTRY.GETCRC ());        if (DEXENTRY.GETCRC () = DEXCRC) {        log.i ("Verification", "Dexhas been modified!");        } else{        log.i ("Verification", "Dex hasn ' t been modified!");        }    } catch (IOException e) {     //TODO auto-generated catch block     e.printstacktrace ();    }   }}

Note: The value of R.STRING.CLASSESDEX_CRC can now be a random number.

(2) Run the program print results, my apk program's Classes.dex CRC32 value is 713769644

(3) The above program's Classes.dex file CRC32 value, saved in the resource file string CLASSESDEX_CRC (of course, can also be saved on the server, and then the network to obtain the checksum), and then run the above APK program, printed as follows:

Dex hasn ' t beenmodified!

(4) At this point we add a line or a space in the above code, and then recompile the run will see our program's CRC32 value changed. The program prints as follows:

Dex has beenmodified!

Third, the entire APK integrity is verified with a hash value

as we are going to the whole apk integrity, so we can't have the hash value in the resource file because apk any changes will cause the final apk The resulting hash value is different.

(1) First implement the code that computes its own hash value in the APK, as follows:

public class mainactivity Extendsactivity {@Overrideprotectedvoid onCreate (Bundle savedinstancestate) {super.oncreate     (savedinstancestate); Setcontentview (r.layout.activity_main);     String Apkpath = Getpackagecodepath ();      messagedigest msgdigest = null;     try {         msgdigest = Messagedigest.getinstance ("SHA-1");         byte[] bytes = new Byte[1024];        int bytecount;         fileinputstream fis = new FileInputStream (new File (Apkpath));         while ((byteCount = fis.read (bytes)) > 0)         {             msgdigest.update (bytes, 0, ByteCount);         }   &nBsp;    biginteger bi = new BigInteger (1, Msgdigest.digest ());         string sha = bi.tostring (+);         fis.close ();         //here add a hash from the server and then compare the checksum          } catch (Exception e) {             E.printstacktrace ();         }    }}

(2) Use the Linux sha1sum command to calculate the hash value of our apk, the command is as follows:

sha1sum verification.apk

(3) The hash value generated in (2) is stored on the server, and the integrity comparison is obtained from the server in our code.

above we use the calculation CRC32 and hash values are respectively used for the Classes.dex files and the entire apk integrity is verified, of course, two calibration methods can also be used interchangeably. According to the above, I believe you have a certain understanding of the method of verifying file integrity, the next one we will explain another android apk to prevent anti-compilation technology, look forward to everyone's support.

If you have any questions about this technology and want to get the engineering source of the technology that this article speaks about

: programmer interaction Alliance (coder_online) coder_online You can follow , we can communicate online.

Android APK Prevent anti-compilation technology fifth-integrity check