If someone tampers with an installed android app (apk file), are there any checks done at the time of launching to ensure integrity of an app is not compromised? As I understand there are no checks performed at launch time and I am trying to do the following:
I am trying to compute SHA-1 digests of the installed applications (apk file). I am aware that an apk file is like a zip file. It consists of other files. However, I am treating it as any other file (just a stream of bytes) and trying to compute SHA-1 digests of all the apk files. Are there any problems with this approach? The following code kept on giving null exception:
private static byte[] getSHA1FromFileContent(String filename) {
try
{
MessageDigest digest = MessageDigest.getInstance("SHA-1");
//byte[] buffer = new byte[65536]; //created at start.
final FileInputStream fis = new FileInputStream(filename);
int n = 0;
byte[] buffer = null;
while (n != -1)
{
n = fis.read(buffer);
if (n > 0)
{
digest.update(buffer, 0, n);
}
}
byte[] digestResult = digest.digest();
return digestResult;
}
catch (Exception e)
{
return null;
}
}
As an alternative when I attempted to retrieve the files from the apk file and save the individual files as follows, I again kept on null exception
public void unzip()
{
try
{
FileInputStream fin = new FileInputStream(_zipFile);
ZipInputStream zin = new ZipInputStream(fin);
ZipEntry ze = null;
while ((ze = zin.getNextEntry()) != null)
{
Log.v("Decompress", "Unzipping " + ze.getName());
if(ze.isDirectory()) {
_dirChecker(ze.getName());
} else {
File dstfile = new File(_location + ze.getName());
dstfile.createNewFile();
FileOutputStream fout = new FileOutputStream(dstfile.getPath());
//OutputStream out = openFileOutput(_location + ze.getName(), Context.MODE_PRIVATE);
for (int c = zin.read(); c != -1; c = zin.read()) {
fout.write(c);
}
zin.closeEntry();
fout.close();
}
}
zin.close();
}
catch(Exception e)
{
Log.e("Decompress", "unzip", e);
}
}
I am also verifying the application configuration by way of - PreferencesManager.getDefaultSharedPreferences call providing the package name of the application as input parameter
In order to verify the integrity of an installed application is the above check enough?
android
I am trying to compute SHA-1 digests of the installed applications (apk file). I am aware that an apk file is like a zip file. It consists of other files. However, I am treating it as any other file (just a stream of bytes) and trying to compute SHA-1 digests of all the apk files. Are there any problems with this approach? The following code kept on giving null exception:
private static byte[] getSHA1FromFileContent(String filename) {
try
{
MessageDigest digest = MessageDigest.getInstance("SHA-1");
//byte[] buffer = new byte[65536]; //created at start.
final FileInputStream fis = new FileInputStream(filename);
int n = 0;
byte[] buffer = null;
while (n != -1)
{
n = fis.read(buffer);
if (n > 0)
{
digest.update(buffer, 0, n);
}
}
byte[] digestResult = digest.digest();
return digestResult;
}
catch (Exception e)
{
return null;
}
}
As an alternative when I attempted to retrieve the files from the apk file and save the individual files as follows, I again kept on null exception
public void unzip()
{
try
{
FileInputStream fin = new FileInputStream(_zipFile);
ZipInputStream zin = new ZipInputStream(fin);
ZipEntry ze = null;
while ((ze = zin.getNextEntry()) != null)
{
Log.v("Decompress", "Unzipping " + ze.getName());
if(ze.isDirectory()) {
_dirChecker(ze.getName());
} else {
File dstfile = new File(_location + ze.getName());
dstfile.createNewFile();
FileOutputStream fout = new FileOutputStream(dstfile.getPath());
//OutputStream out = openFileOutput(_location + ze.getName(), Context.MODE_PRIVATE);
for (int c = zin.read(); c != -1; c = zin.read()) {
fout.write(c);
}
zin.closeEntry();
fout.close();
}
}
zin.close();
}
catch(Exception e)
{
Log.e("Decompress", "unzip", e);
}
}
I am also verifying the application configuration by way of - PreferencesManager.getDefaultSharedPreferences call providing the package name of the application as input parameter
In order to verify the integrity of an installed application is the above check enough?
android
