Integrity check for DEX files

Classes.dex is basically responsible for all the logic business on Android, so many of the tampering with Android apps is for Classes.dex files. In the APK self-protection, you can also consider the Classes.dex file integrity check, simple can be done by CRC check, you can also examine the hash value. Because it's just checking for Classes.dex, you can store the CRC value in a string resource file, or you can put it on your own server.

Gets the checksum value from the server at run time. The basic steps are as follows:

First in the code to complete the checksum value of the logic, this part of the code can no longer change, or the CRC value will change;

Extract the Classes.dex file from the generated APK file, calculate its CRC value, and other hash values are similar;

Put the calculated value in the Strings.xml file.

The core code is as follows:

Code:

1. String Apkpath = This.getpackagecodepath ();

2. Long DEXCRC = Long.parselong (this.getstring (R.STRING.DEX_CRC));

3. try {

4. ZipFile zipfile = new ZipFile (Apkpath);

5. ZipEntry dexentry = zipfile.getentry ("Classes.dex");

6. if (DEXENTRY.GETCRC () = DEXCRC) {

7. SYSTEM.OUT.PRINTLN ("Dex has been *modified!");

8.}else{

9. System.out.println ("Dex hasn ' t been modified!");

10.}

One.} catch (IOException e) {

//TODO auto-generated catch block

E.printstacktrace ();

14.}

However, the above-mentioned protection methods are prone to brute force, and the integrity check is ultimately controlled by returning True/false to control the direction of subsequent code logic, and if an attacker modifies the code logic directly, the integrity check always returns True, and this method is invalid. So similar file integrity checks need to be implemented in conjunction with some other methods, or in other, more subtle ways. Then we can borrow third-party APK security vulnerability detection platform: Love in beta, can detect the program executable Dex do encryption protection processing, give the repair advice, prevent by Dex2jar and other tools to decompile.

Integrity check for DEX files