Current location - Quotes Website - Signature design - Android prevents secondary packaging. What is the use of verifying the public key when verifying the signature?
Android prevents secondary packaging. What is the use of verifying the public key when verifying the signature?
This is necessary. By comparing the public key, we can find out whether this apk has been packaged twice. Generally, the md5 or sha 1 value of the public key is calculated and put into the program, and then the md5 of the current program is calculated when the program is running, and then the comparison is made.

Previous code:

public static int checkAppSignature(Context Context){

string SIGNATURE = " 478 yykkaqf+kst 8y 4 atkvhkyibo = "; //The signature written somewhere in the program needs to be repaired.

Try {

package info package info = context . getpackagemanager()。 get package info(context . get package name(),PackageManager。 Get _ signature);

signature[]signatures = package info . signatures;

signature sign = signatures[0];

message digest MD = message digest . getinstance(" SHA ");

MD . update(sign . tobytearray());

Log.e("proyx ",bytesToHexString(MD . digest()));

The final string currentsignature = Base64.encodettostring (md.digest (), base64. Default);

Log.e("proyx ","contains this string as the value of SIGNATURE: "+currentsignature);

if(signature . equals(current signature)){

Returns 0;

}

Catch (exception e) {

//Suppose there is a problem in checking the signature. But we let the caller decide what to do.

e . printstacktrace();

}

Returns1;

}