- Signature problem in android
- Signature problem in android
- Не подписывается файл apk после обновления Android Studio
- Решение
- Ручная установка обновленного APK завершается с ошибкой » подписи не соответствуют ранее установленной версии»
- 6 ответов
- scottyab / SignatureCheck.java
- This comment has been minimized.
- nildeka commented Nov 24, 2016 •
- This comment has been minimized.
- Tindi commented Apr 11, 2017
- This comment has been minimized.
- doridori commented Sep 19, 2017 •
- This comment has been minimized.
- doridori commented Sep 19, 2017
- This comment has been minimized.
- Omar1123 commented Oct 2, 2017
- This comment has been minimized.
- AswathiRevathi commented Apr 16, 2018
- This comment has been minimized.
- DimaKoz commented Jun 24, 2018
- This comment has been minimized.
- kde3kko commented Mar 20, 2019
- This comment has been minimized.
- simplekjl commented Apr 11, 2019
- This comment has been minimized.
- princegoyal1987 commented May 31, 2019 •
- This comment has been minimized.
- scottyab commented Jun 5, 2019
- This comment has been minimized.
- scottyab commented Jun 5, 2019
- This comment has been minimized.
- scottyab commented Jun 5, 2019
- This comment has been minimized.
- laptopmutia commented Sep 15, 2019
- This comment has been minimized.
- avipars commented Oct 23, 2019
- This comment has been minimized.
- redragon14368 commented Dec 9, 2019
- This comment has been minimized.
- yaibait commented Jan 3, 2020
- This comment has been minimized.
- tentenponce commented Feb 19, 2020
- This comment has been minimized.
- yaibait commented Mar 20, 2020
- This comment has been minimized.
- mggTimmy commented Apr 2, 2020
- This comment has been minimized.
- SanarDev commented Apr 8, 2020
- This comment has been minimized.
- mggTimmy commented Apr 8, 2020 •
- This comment has been minimized.
- MANISH-MAHESH-TALREJA commented Apr 18, 2020
- This comment has been minimized.
- tentenponce commented Apr 20, 2020 •
- This comment has been minimized.
- scottyab commented Apr 20, 2020
- This comment has been minimized.
- Android1500 commented Jun 24, 2021 •
- This comment has been minimized.
- tentenponce commented Jun 26, 2021
Signature problem in android
I created an app in Android Studio and signed it. All are worked well.
When I tried to signing another app created by Qt Creator I got the error. A key was generated by Qt Creator.
In build dir I got next:
I decided to move the file «android-build-release-unsigned.ap» in to release dir, but I got the next:
After this error I tried to use a key created by Android Studio, disable signing by Qt Creator and add to «build.gradle» file next:
In build directory I got:
I decided to move the file «android-build-release-unsigned.apk» to debug folder too and run again and apk was installed on device, but the apk wasn’t signed.
Than I remove from «build.gradle» next parts:
and enable signing by QtCreator only with Android Studio generated key, run build
In build folder I got:
I decided to move the file «android-build-release-unsigned.apk» to release folder too, run build again and got:
and in build folder I got:
But the signed apk wasn’t worked like apk signed by Android Studion.
Qt 5.12.4
SDK Version: 26.1.1
NDK Version: 20.0.5594570
build-tools 28.0.3
JDK: jdk1.8.0_201
OS: macOS
How to signing Qt Android apk in release version?
Источник
Signature problem in android
I have a signature problem when I try to generate a armebi-v7a application for Android:
I get the following error message:
I use:
Qt 5.12.2
SDK 26.1.1
NDK 19.2.5345600
build-tools 28.0.3
JDK: jdk1.8.0_181
Everything was going until now. This is the first time I have received an error message of this type.
@Francky033
have you tried deleting the whole build folder yet? and build again
Yes ! without result.
@Francky033 I remember having something similar.
That was due to special characters inside the app signing certificate a ü in my case.
I have found the source of the problem. In fact, apksigner is called before the end of the construction of the apk file, hence the error message about the structure of this file!
In the build-tools directory of the Android SDK, it is therefore necessary to add a TIMEOUT in the apksigner.bat file
I am having the exact same problem:
Since I am using a Mac OS, I don’t have that apksigner.bat file.
Any other idea how to fix this?
I have the same issue on MacOS. I tried to put a sleep 60 at the beginning of the apksigner script shell but it is not working.
Does someone have a solution?
I’m using Qt 5.13 for MAcOS with ANDROID NDK 18
I reinstalled the ANDROID SDK and it is working now.
Источник
Не подписывается файл apk после обновления Android Studio
Создал другой ключевой файл, та же самая картина.
Не пойму куда копать? Подскажите, в чем может быть причина, почему файл не подписывается?
Где находится файл .apk в Android Studio?
Где находится файл .apk проекта в android studio? И какое у него будет имя?
Почему Android Studio не сразу подхватывает изменения кода(только после переустановки apk)?
Иногда после изменения кода в Android Studio (к примеру изменю вывод Log.d )и запуска его смартфоне.
Android Studio не работает после обновления Ubuntu
Я не понял что именно произошло, но вчера произошла установка обновлений на ОС ubuntu 14.04, каких.
Решение
Скомпилировать apk в Android Studio
У меня есть проект, который я разрабатывал в Visual Studio. Сейчас мне надо создать апк файл для.
Открытие apk в Android Studio
Каким способом можно открыть apk в программе? просто надо проверить антивирус, а он засекает.
Android Studio установка apk файла на телефон
Скачиваю для теста файл app-debug.apk с папки app\build\outputs\apk на другое свое андроид.
Как в Android Studio создавать установочные apk файлы для наших гуглофонов?
Как в Android Studio создавать установочные apk файлы для наших гуглофонов? В Eclipse это.
Как скомпилировать Android-Приложение (получить APK-файл)
Осваиваю создание Android-Приложений на Delphi XE5. Сделал «Hello World!», но не могу понять как.
Какая оболочка будет после обновления android?
Помимо версии у android каждый производитель ставит свою оболочку (оформление). Если обновить.
Источник
Ручная установка обновленного APK завершается с ошибкой » подписи не соответствуют ранее установленной версии»
Я построил глупое приложение, чтобы поделиться среди нескольких друзей. Нет необходимости размещать его в app-store.
Я построил первый apk (подпись), загрузил его на веб-сервер и все работало хорошо.
возникла небольшая проблема, я исправил его, перестроил, подписал с тем же хранилищем ключей и загрузил его снова. Теперь кажется, что я не могу установить из нового apk . Отладчик говорит мне:
поэтому я удалил старую версию, откройте приложение ящик и перетащите его на кнопку» Удалить». При открытии «Настройки — > Приложения» я больше не вижу его нигде. Я не вижу никаких следов приложения на моем устройстве.
но я все еще получаю выше сообщение об ошибке.
возможно некоторые информация все еще остается на устройстве где-то? Я могу это подтвердить?
6 ответов
Да, это возможно, если каким-то образом ваше старое приложение не удаляется 100% или его данные не удаляются.
Если вы не знаете точно, что положили в качестве замены для «COM.yourapp.yourapp», затем вы просто открываете Android studio, запускаете приложение, пока оно подключено к устройству, а затем смотрите окно отладки.
com.приложение myapp.myapp в этом случае это имя пакета, который необходимо использовать для удаления.
У меня была та же проблема и adb uninstall решение не работает для меня.
- на вашем устройстве перейдите в Настройки->Приложения
- выберите приложение, и в меню выберите «Удалить для всех пользователей»
даже если я ранее удалил приложение, оно все еще было в списке.
для меня, если приложение предназначено для распространения, adb решение не работает: вы не можете попросить своего друга установить Android sdk на свою машину !
путь в редактировании AndroidManifest.xml и прирастить на — тег (который является корневым элементом).
это обновит установленное приложение
Если вы видите это при проведении подключенных тестов, обязательно включите .тест при удалении через adb, потому что удаление через приложение — > Настройки не избавиться от тестового пакета
Если вы просто удалить через
ваш тестовый пакет все еще будет там. Это было только то, что я заметил при использовании командной строки gradle, не сталкивался с этой проблемой в Android studio
удалите старое приложение с телефона или эмулятора и попробуйте запустить его снова.
Я получил эту ошибку при попытке установить выпуск при подписании сертификата.
исправлено с помощью: app Gradle task uninstallRelease, а затем installRelease снова
Источник
scottyab / SignatureCheck.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
import android.content.Context ; |
import android.content.pm.PackageInfo ; |
import android.content.pm.PackageManager ; |
import android.content.pm.PackageManager.NameNotFoundException ; |
import android.content.pm.Signature ; |
public class TamperCheck < |
// we store the hash of the signture for a little more protection |
private static final String APP_SIGNATURE = » 1038C0E34658923C4192E61B16846 » ; |
/** |
* Query the signature for this application to detect whether it matches the |
* signature of the real developer. If it doesn’t the app must have been |
* resigned, which indicates it may been tampered with. |
* |
* @param context |
* @return true if the app’s signature matches the expected signature. |
* @throws NameNotFoundException |
*/ |
public boolean validateAppSignature ( Context context ) throws NameNotFoundException < |
PackageInfo packageInfo = context . getPackageManager() . getPackageInfo( |
getPackageName(), PackageManager . GET_SIGNATURES ); |
// note sample just checks the first signature |
for ( Signature signature : packageInfo . signatures) < |
// SHA1 the signature |
String sha1 = getSHA1(signature . toByteArray()); |
// check is matches hardcoded value |
return APP_SIGNATURE . equals(sha1); |
> |
return false ; |
> |
// computed the sha1 hash of the signature |
public static String getSHA1 ( byte [] sig ) < |
MessageDigest digest = MessageDigest . getInstance( » SHA1 » ); |
digest . update(sig); |
byte [] hashtext = digest . digest(); |
return bytesToHex(hashtext); |
> |
// util method to convert byte array to hex string |
public static String bytesToHex ( byte [] bytes ) < |
final char [] hexArray = < ' 0 ' , ' 1 ' , ' 2 ' , ' 3 ' , ' 4 ' , ' 5 ' , ' 6 ' , ' 7 ' , ' 8 ' , |
‘ 9 ‘ , ‘ A ‘ , ‘ B ‘ , ‘ C ‘ , ‘ D ‘ , ‘ E ‘ , ‘ F ‘ >; |
char [] hexChars = new char [bytes . length * 2 ]; |
int v; |
for ( int j = 0 ; j bytes . length; j ++ ) < |
v = bytes[j] & 0xFF ; |
hexChars[j * 2 ] = hexArray[v >>> 4 ]; |
hexChars[j * 2 + 1 ] = hexArray[v & 0x0F ]; |
> |
return new String (hexChars); |
> |
> |
This comment has been minimized.
Copy link Quote reply
nildeka commented Nov 24, 2016 •
This is very useful. I have some query regarding signing key verification. What if the attacker decompiles the code and remove the function of validation(even with proguarded) or modifies the actual key APP_SIGNATURE
This comment has been minimized.
Copy link Quote reply
Tindi commented Apr 11, 2017
What does it mean if it return false? I keep getting false
This comment has been minimized.
Copy link Quote reply
doridori commented Sep 19, 2017 •
Lint now will warn on PackageManager.GET_SIGNATURES due to the vuln spoken about here. SO suggests dont have to worry about this from 4.4. Personally I am only allowing one signature to be present. Who uses cert chains (on android) anyway!
This comment has been minimized.
Copy link Quote reply
doridori commented Sep 19, 2017
For paranoia purposes, may be better to use SHA-256 also? SO
Interesting as may want to just use default security provider (no BC dependency in code snippit)
This comment has been minimized.
Copy link Quote reply
Omar1123 commented Oct 2, 2017
A SHA1 is used because it is the algorithm with which the certificates are encrypted, you can see it as a standard even though there are examples of collisions with SHA1
This comment has been minimized.
Copy link Quote reply
AswathiRevathi commented Apr 16, 2018
can i get a complete example on anti tamering
?
This comment has been minimized.
Copy link Quote reply
DimaKoz commented Jun 24, 2018
@AswathiRevathi sure. The source code of native signature check can be found here: https://github.com/DimaKoz/stunning-signature
This comment has been minimized.
Copy link Quote reply
kde3kko commented Mar 20, 2019
Hi, I’m about to start working on a React Native plugin (android only) against app tampering.
Do you recommend you gist as a good starting point?
This comment has been minimized.
Copy link Quote reply
simplekjl commented Apr 11, 2019
how do you get the has of the app signature?
This comment has been minimized.
Copy link Quote reply
princegoyal1987 commented May 31, 2019 •
How to get the hash of the apk? I mean the string we assign to «APP_SIGNATURE» how do we get that?
This comment has been minimized.
Copy link Quote reply
scottyab commented Jun 5, 2019
@princegoyal1987 to be clear this is the hash of the signing key not the .apk file. Run it in debug and inspect sha1 on line28 or add log statement to print the sha1 to logcat (make sure to remove before publishing). Then update APP_SIGNATURE with your value. Note it will vary depending on you’re signing cert i.e if you have different cert for debug and release builds you made want to define APP_SIGNATURE to use a BuildConfigField
This comment has been minimized.
Copy link Quote reply
scottyab commented Jun 5, 2019
@kde3kko, @nildeka just to clarify it’s not particularly hard for an attacker to decompile an .apk, find this tamper check, edit the APP_SIGNATURE with theirs and rebuild. It just makes it a bit more time-consuming and maybe they move on to another app without this check. As I said in the summary not bullet proof. Hope this clarifies.
This comment has been minimized.
Copy link Quote reply
scottyab commented Jun 5, 2019
@doridori good point about BC MessageDigest.getInstance(«SHA1», «BC»); , I’ve removed in edit
This comment has been minimized.
Copy link Quote reply
laptopmutia commented Sep 15, 2019
did it work if we use google app signing?
This comment has been minimized.
Copy link Quote reply
avipars commented Oct 23, 2019
did it work if we use google app signing?
This comment has been minimized.
Copy link Quote reply
redragon14368 commented Dec 9, 2019
how to get «APP_SIGNATURE»
This comment has been minimized.
Copy link Quote reply
yaibait commented Jan 3, 2020
Not work after upload to google play
This comment has been minimized.
Copy link Quote reply
tentenponce commented Feb 19, 2020
Not work after upload to google play
+1 for this, does not work after uploading on google playstore
This comment has been minimized.
Copy link Quote reply
yaibait commented Mar 20, 2020
Not work after upload to google play
+1 for this, does not work after uploading on google playstore
It does not work because google app signing feature, you need change APP_SIGNATURE to google app signing not your local store key 😀
This comment has been minimized.
Copy link Quote reply
mggTimmy commented Apr 2, 2020
Hi, nice solution but GET_SIGNATURES is deprecated in API level 28
This comment has been minimized.
Copy link Quote reply
SanarDev commented Apr 8, 2020
what is the best way in API level 29?
This comment has been minimized.
Copy link Quote reply
mggTimmy commented Apr 8, 2020 •
probably not the best, but one solution is:
packageInfo = getPackageManager().getPackageInfo(getPackageName(),PackageManager.GET_SIGNING_CERTIFICATES); signatures = packageInfo.signingInfo.getApkContentsSigners(); MessageDigest md = MessageDigest.getInstance(«SHA-1»); for (Signature signature : signatures)
This comment has been minimized.
Copy link Quote reply
MANISH-MAHESH-TALREJA commented Apr 18, 2020
What if the attacker decompiles the code and remove the function of validation(even with proguarded) or modifies the actual key APP_SIGNATURE
This comment has been minimized.
Copy link Quote reply
tentenponce commented Apr 20, 2020 •
What if the attacker decompiles the code and remove the function of validation(even with proguarded) or modifies the actual key APP_SIGNATURE
There’s no silver bullet in security. There will be always a way to attack an app/system. We can just make it harder for them but not impossible to hack.
This comment has been minimized.
Copy link Quote reply
scottyab commented Apr 20, 2020
Thanks for answering @tentenponce. Totally agree. I’ve updated the comment on the gist for extra clarity.
Please note: This was created in 2013, not actively maintained and may not be compatible with the latest Android versions. It’s not particularly difficult for an attacker to decompile an .apk, find this tamper check, replace the APP_SIGNATURE with theirs and rebuild (or use method hooking to return true from validateAppSignature() ). It’ll make the task of running the .apk unsigned or with edited code slightly more time-consuming and hopefully reduce the effectiveness of automated attacker. But it’s not bulletproof.
This comment has been minimized.
Copy link Quote reply
Android1500 commented Jun 24, 2021 •
Hey can you please tell me how to get «APP_SIGNATURE» for release build?
This comment has been minimized.
Copy link Quote reply
tentenponce commented Jun 26, 2021
Hey can you please tell me how to get «APP_SIGNATURE» for release build?
this might help:
You can’t perform that action at this time.
You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session.
Источник