7

I have a short question: What does this call return exactely?

context.getPackageManager().getPackageInfo(context.getPackageName(), GET_SIGNATURES).signatures[0].toByteArray();

I know it returns the first app certificate for the app which is the CERT.RSA in the META-INF folder, but what exately does it return? Just a byte-array which represents the whole certificate as the file or some other byte-array? I don't really know much about the structure of certificates and the data they contain so I really don't have any clue.

The best answer would be an instruction for openssl with that I get the returned value from the above code line.

2
  • 1
    "I don't really know much about the structure of certificates and the data they contain so I really don't have any clue." perhaps, its time for you to investigate openssl yourself and understand how certificates are created.
    – t0mm13b
    Commented May 19, 2016 at 9:54
  • I really tried at first to somewhat understand it and find the "obvious" solution to this, but it didn't work out. I decided to ask because I don't really need that knowledge now and I don't have any incentive to dig deeper into the matter as of now. I just want to know the answer and some more or less brief explanation of the stuff and maybe a link to better explanations.
    – SkryptX
    Commented May 19, 2016 at 10:23

3 Answers 3

1

I finally tested it myself on an android simulator and got the final answer. It's actually not hard to understand once I realized that PKCS7 is just a storage-form or rather a container for various signature-types.

Within the app

The call returns the first signature within the CERT.RSA file. It's a PKCS7 file which embeds the X.509-certificate and from what I've read it's always just one signature for android apps.

Signature sig = context.getPackageManager().getPackageInfo(context.getPackageName(), GET_SIGNATURES).signatures[0];

This Signature obtained from above can be directly used to generate a working X.509-certificate like this (taken from here):

 byte[] rawCert = sig.toByteArray();
 InputStream certStream = new ByteArrayInputStream(rawCert);

 CertificateFactory certFactory;
 X509Certificate x509Cert;
 try {
      certFactory = CertificateFactory.getInstance("X509");
      x509Cert = (X509Certificate) certFactory.generateCertificate(certStream);

      //do stuff with your certificate
 } catch(Exception ex) {
      //handle exception
 }

Anywhere else

If you have the certificate outside of your own android app and want the same byte-stream, that is provided by the function above you can do the same with a simple Java-program like this:

 FileInputStream is = new FileInputStream("CERT.RSA");
 CertificateFactory cf = CertificateFactory.getInstance("X.509");
 X509Certificate c = (X509Certificate) cf.generateCertificates(is).toArray()[0];
 byte[] rawCert = c.getEncoded();

This code first reads the file, creates the CertificateFactory and then the important step it to isolate the first certificate in the PKCS7-container. And then c.getEncoded() finally gives you the exact same representation as the method above.

openssl

And last but not least the openssl-command for it(taken from here):

 openssl pkcs7 -inform DER -in CERT.RSA -print_certs -text

It will give you a pretty overview of the information contained and at the end the

 -----BEGIN CERTIFICATE-----
 ...
 -----END CERTIFICATE-----

block. It contains the same data as above. If you parse the contents of this block and decode it with base64 it will give you the exact same byte array as in the upper two examples.

0
context.getPackageManager().getPackageInfo(context.getPackageName(), GET_SIGNATURES).signatures[0]

Would return the representation of the signing certificate associated with an application package. It would be an instance of a Signature class as defined here in the documentation. (The name 'Signature' is slightly misleading and even mentioned in the documentation itself).

context.getPackageManager().getPackageInfo(context.getPackageName(), GET_SIGNATURES).signatures[0].toByteArray();

Would return its byte Array representation. ie: The certificate file's byte array representation.

Adding to that, a certificate is nothing new than a text file, but the data is structured into a common format and encoded. X.509 is one of the most widely used formats. You can find it here. The RFC for a X.509 certificate is here. Certificates are structured such that they can be easily checked if altered by a 3rd party.

There isn't any openssl command which directly returns a byte[]. The closest which I could think of is the openssl command which you can use to get the textual representation of a certificate.

$ openssl x509 -in <your-certificate> -noout -text
5
  • Could you edit your answer more towards the original question and answer the questions explicitly? Also with a reference to openssl for easy display? If you do this I will mark you as accepted :)
    – SkryptX
    Commented May 19, 2016 at 11:19
  • Hi SkryptX I added your changes! Commented May 19, 2016 at 13:00
  • None of the facts here are doublechecked and tested against a real android CERT.RS file and therefore don't work. Found a solution with the old version of the post and the link provided in it.
    – SkryptX
    Commented May 19, 2016 at 17:11
  • I'm sorry mate. So do you recommend me to remove my post? Commented May 19, 2016 at 18:14
  • Well, I don't know... if you want to correct it, go ahead. I will wait a bit more until I post my solution of the stuff. I set a bounty and if somebody wants to claim it they should since the points are gone in a week no matter what and I can't give the points to myself... so you are still in the race for it^^
    – SkryptX
    Commented May 19, 2016 at 19:10
0

The signatures member of PackageInfo is simply an array of all signatures read from the package file.

public Signature[] signatures;

The class android.content.pm.Signature stores a signature in the form

private final byte[] mSignature;

This is what toByteArray() does:

/**
 * @return the contents of this signature as a byte array.
 */
public byte[] toByteArray() {
    byte[] bytes = new byte[mSignature.length];
    System.arraycopy(mSignature, 0, bytes, 0, mSignature.length);
    return bytes;
}

So essentially this code simply provides you the byte array of a signature used to sign the package.

Assuming CERT.RSA is the RSA file in META-INF folder of the apk, you can get the package MD5, SHA1, and SHA256 signatures through:

keytool -printcert -file CERT.RSA
1
  • Modified answer as per better understanding of the question
    – Chebyr
    Commented May 25, 2016 at 11:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.