dimakoz / stunning-signature

Native Signature Verification For Android (with example)

How to prevent tampering signatures of APK-files using C (Native check of a signature of APKs)

It may be helpful only for non-rooted devices (and of course reverse-engineer always wins).

The example of obtaining apk's signature on the native layer (without jni).

This example was created to help developers stand against one type of an attack. The attack inserts code into Application class (or creates it), hooks the getPackageInfo method of the PackageManager then returns an original signature on demand. This attack is implemented in 'nkstool' tool. After user has applied 'nkstool' tool on your APK, the application always gets its own signature in Java layer or through JNI when it's requested in APK even though it is not true.

The source code of this attacking tool can be found here: https://github.com/L-JINBIN/ApkSignatureKiller

Working example of this tool is in the '/nkstool' directory only for testing and educational purposes!

To test this example (nkstool) just dot he following:

• edit config.txt

• copy your APK (the one to be hacked) to the same directory '/nkstool'

• run script either 'run.bat' or 'run.sh'

Finally you can see results of the checks:

Before the attack - all signatures are equal

After the attack - signatures are not equal. Native layer (C-code) gives you the real signature of the APK.

How do we get a real signature:

• Get a path of our APK

• Extract 'META-INF/CERT.RSA' from the APK

• Parse 'META-INF/CERT.RSA'

• We pass a signature through JNI from native layer to Java (just for convenience)

Here is an example how we can get MD5 from a signature(using mbed TLS)

Also I suggest you do not forget about '-fvisibility=hidden' flag.

Used libraries and projects:

• Minizip This program is distributed under the terms of the same license as zlib.
• https://github.com/W-WTerDan/pkcs7 Public domain

Thanks

• Guys who constantly crack my applications (and not only mine) and post their tools. I was inspired by this one.
• floyd and others from StackOverflow post

Licence

MIT License

Copyright (c) 2018 Dmitrii Kozhevin [email protected]

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

stunning-signature's Issues

Gradle version 'com.android.tools.build:gradle:3.6.3' break functionality

It works fine with 'com.android.tools.build:gradle:3.4.0' but when i updated version to 'com.android.tools.build:gradle:3.6.3' it stops working any hint how to fix or help will be appreciated.

get md5 value

hi
thanks for your work.
i want to get md5 value of signature for check in runtime my apk is orginal. your code back byte of all signature.
how can get this?

there's a simpler way to do it

I suggest get PM from native code can do the samething.
replace
getPackageInfo(package, 0)[0]
with
env->GetMethodID(cz_pm,"getPackageInfo","(Ljava/lang/String;I)Landroid/content/pm/PackageInfo;"
more ...

avoid getting incorrect path from other plugin apk

char *pathHelperGetPath() {

    char *package = getPackageName();
    if (NULL == package) {
        return NULL;
    }

    FILE *fp = fopen("/proc/self/maps", "r");
    if (NULL == fp) {
        free(package);
        return NULL;
    }
    const size_t BUFFER_SIZE = 256;
    char buffer[BUFFER_SIZE] = "";
    char path[BUFFER_SIZE] = "";

    bool find = false;
    while (fgets(buffer, BUFFER_SIZE, fp)) {
        if (sscanf(buffer, "%*llx-%*llx %*s %*s %*s %*s %s", path) == 1) {
            **if (strstr(path, package) && (strstr(path, "/data/app/") || strstr(path, "/mnt/"))) {**
                char *bname = basename(path);
                NSV_LOGI("check basename[%s]", bname);
                if (strcasecmp(getFilenameExt(bname), "apk") == 0) {
                    find = true;
                    break;
                }
            }
        }
    }
    fclose(fp);
    free(package);
    if (find) {
        return strdup(path);
    }
    return NULL;
}

someone modded my app.

Some one modded my app and copied my CERT.RSA from original app, and included in his META-INF and renamed it to com_android_support_support-core-ui.XSA ,

The cert verification results original signature. how is it possible?

usleep(500);

Hey, is there a technical reason for this line?

usleep(500);

WARNING: ABIs [arm64-v8a,armeabi-v7a,armeabi] set by 'android.injected.build.abi' gradle flag contained 'ARMEABI' not targeted by this project.

getting WARNING: ABIs [arm64-v8a,armeabi-v7a,armeabi] set by 'android.injected.build.abi' gradle flag contained 'ARMEABI' not targeted by this project.

warning during build. dont know the reason my ndk is v19

Building

Hi. Thanks for your great work. Could you please help with building your demo project? Unfortunately I am not very experienced with native to resolve the next error:

Build command failed.
Error while executing process /home/alex/Android/Sdk/cmake/3.6.4111459/bin/cmake with arguments {--build /home/alex/Downloads/stunning-signature-master/app/.externalNativeBuild/cmake/debug/x86 --target native-lib}
[1/1] Re-running CMake...
-- Configuring done
-- Generating done
-- Build files have been written to: /home/alex/Downloads/stunning-signature-master/app/.externalNativeBuild/cmake/debug/x86
[1/1] Linking C shared library /home/alex/Downloads/stunning-signature-master/app/build/intermediates/cmake/debug/obj/x86/libnative-lib.so
FAILED: : && /home/alex/Android/Sdk/ndk-bundle/toolchains/llvm/prebuilt/linux-x86_64/bin/clang  --target=i686-none-linux-android19 --gcc-toolchain=/home/alex/Android/Sdk/ndk-bundle/toolchains/llvm/prebuilt/linux-x86_64 -fPIC --sysroot /home/alex/Android/Sdk/ndk-bundle/toolchains/llvm/prebuilt/linux-x86_64/sysroot -g -DANDROID -fdata-sections -ffunction-sections -funwind-tables -fstack-protector-strong -no-canonical-prefixes -mstackrealign -fno-addrsig -Wa,--noexecstack -Wformat -Werror=format-security  -O0 -fno-limit-debug-info  -Wl,--exclude-libs,libgcc.a -Wl,--exclude-libs,libatomic.a -static-libstdc++ -Wl,--build-id -Wl,--warn-shared-textrel -Wl,--fatal-warnings -Wl,--no-undefined -Qunused-arguments -Wl,-z,noexecstack -Wl,-z,relro -Wl,-z,now -shared -Wl,-soname,libnative-lib.so -o /home/alex/Downloads/stunning-signature-master/app/build/intermediates/cmake/debug/obj/x86/libnative-lib.so ../../../cxx/debug/x86/CMakeFiles/native-lib.dir/src/main/c/native-lib.c.o ../../../cxx/debug/x86/CMakeFiles/native-lib.dir/src/main/c/unzip_helper.c.o ../../../cxx/debug/x86/CMakeFiles/native-lib.dir/src/main/c/path_helper.c.o ../../../cxx/debug/x86/CMakeFiles/native-lib.dir/src/main/c/pkcs7_helper.c.o ../../../cxx/debug/x86/CMakeFiles/native-lib.dir/src/main/c/third/minizip/mz_os.c.o ../../../cxx/debug/x86/CMakeFiles/native-lib.dir/src/main/c/third/minizip/mz_os_posix.c.o ../../../cxx/debug/x86/CMakeFiles/native-lib.dir/src/main/c/third/minizip/mz_strm_zlib.c.o ../../../cxx/debug/x86/CMakeFiles/native-lib.dir/src/main/c/third/minizip/mz_strm.c.o ../../../cxx/debug/x86/CMakeFiles/native-lib.dir/src/main/c/third/minizip/mz_strm_buf.c.o ../../../cxx/debug/x86/CMakeFiles/native-lib.dir/src/main/c/third/minizip/mz_strm_mem.c.o ../../../cxx/debug/x86/CMakeFiles/native-lib.dir/src/main/c/third/minizip/mz_strm_posix.c.o ../../../cxx/debug/x86/CMakeFiles/native-lib.dir/src/main/c/third/minizip/mz_strm_split.c.o ../../../cxx/debug/x86/CMakeFiles/native-lib.dir/src/main/c/third/minizip/mz_zip.c.o  /home/alex/Android/Sdk/ndk-bundle/toolchains/llvm/prebuilt/linux-x86_64/sysroot/usr/lib/i686-linux-android/19/liblog.so /usr/lib/libz.so -latomic -lm && :
/home/alex/Android/Sdk/ndk-bundle/toolchains/llvm/prebuilt/linux-x86_64/lib/gcc/i686-linux-android/4.9.x/../../../../i686-linux-android/bin/ld: error: /usr/lib/libz.so: incompatible target
/home/alex/Downloads/stunning-signature-master/app/src/main/c/third/minizip/mz_strm_zlib.c:91: error: undefined reference to 'deflateInit2_'
/home/alex/Downloads/stunning-signature-master/app/src/main/c/third/minizip/mz_strm_zlib.c:98: error: undefined reference to 'inflateInit2_'
/home/alex/Downloads/stunning-signature-master/app/src/main/c/third/minizip/mz_strm_zlib.c:164: error: undefined reference to 'inflate'
/home/alex/Downloads/stunning-signature-master/app/src/main/c/third/minizip/mz_strm_zlib.c:234: error: undefined reference to 'deflate'
/home/alex/Downloads/stunning-signature-master/app/src/main/c/third/minizip/mz_strm_zlib.c:296: error: undefined reference to 'deflateEnd'
/home/alex/Downloads/stunning-signature-master/app/src/main/c/third/minizip/mz_strm_zlib.c:300: error: undefined reference to 'inflateEnd'
/home/alex/Downloads/stunning-signature-master/app/src/main/c/third/minizip/mz_strm_zlib.c:389: error: undefined reference to 'get_crc_table'
/home/alex/Downloads/stunning-signature-master/app/src/main/c/third/minizip/mz_strm_zlib.c:384: error: undefined reference to 'crc32'
clang: error: linker command failed with exit code 1 (use -v to see invocation)
ninja: build stopped: subcommand failed.

Only works with v1 (jar) signing

As it relies on the certificate being present in the META-INF directory. Also note that Android Studio will no longer insert the V1 signature when launching debug builds, so the check needs to be disabled in this situation.

https://stackoverflow.com/questions/57584467/cert-rsa-is-missing-in-debug-build-apk-file-after-upgrade-androidstuio-and-gradl

Getting same signature after rebuilding

After rebuilding using apktool and signapk.jar we can see the same signature