Android APK包的唯一性及其鉴别

1、apk证书指纹

1.1先查看apk信息，使用aapt执行

E:\Android\sdk\build-tools\26.0.2\aapt dump badging loginsdkd
emo-release.apk

得到信息如下

package: name='com.thinking.loginsdkdemo' versionCode='1' versionName='1.0' platformBuildVersionName='8.0.0'
sdkVersion:'15'
targetSdkVersion:'26'
application-label:'LoginSdkDemo'
application-icon-120:'res/mipmap-anydpi-v26/ic_launcher.xml'
application-icon-160:'res/mipmap-anydpi-v26/ic_launcher.xml'
application-icon-240:'res/mipmap-anydpi-v26/ic_launcher.xml'
application-icon-320:'res/mipmap-anydpi-v26/ic_launcher.xml'
application-icon-480:'res/mipmap-anydpi-v26/ic_launcher.xml'
application-icon-640:'res/mipmap-anydpi-v26/ic_launcher.xml'
application-icon-65534:'res/mipmap-anydpi-v26/ic_launcher.xml'
application: label='LoginSdkDemo' icon='res/mipmap-anydpi-v26/ic_launcher.xml'
launchable-activity: name='com.thinking.loginsdkdemo.MainActivity'  label='' icon=''
feature-group: label=''
  uses-feature: name='android.hardware.faketouch'
  uses-implied-feature: name='android.hardware.faketouch' reason='default feature for all apps'
main
supports-screens: 'small' 'normal' 'large' 'xlarge'
supports-any-density: 'true'
locales: '--_--'
densities: '120' '160' '240' '320' '480' '640' '65534'

可见当前apk版本是“1”，版本号是“1.0”

1.2 解压APK，找到META-INF文件夹

对文件夹里面的CERT.RSA执行

E:\"Program Files"\Java\jdk1.7.0_79\bin\keytool -pri
ntcert -file .\CERT.RSA

得到

所有者: CN=111111, OU=111111, O=111111, L=111111, ST=111111, C=111111
发布者: CN=111111, OU=111111, O=111111, L=111111, ST=111111, C=111111
序列号: 303230e4
有效期开始日期: Wed Mar 21 09:51:20 CST 2018, 截止日期: Sun Mar 15 09:51:20 CST 2043
证书指纹:
         MD5: 97:62:90:36:5F:5B:04:2D:93:1B:6D:60:ED:D7:23:CA
         SHA1: 64:C8:14:DA:02:2B:D8:DB:E3:EA:37:7F:63:62:4E:C1:E2:C0:44:6A
         SHA256: CD:8D:05:F2:40:6E:10:B6:1B:1E:A7:F2:01:F2:92:E1:D2:CB:43:FB:51:59:79:0A:04:6B:4A:A7:30:DD:05:D8
         签名算法名称: SHA256withRSA
         版本: 3

扩展:

#1: ObjectId: 2.5.29.14 Criticality=false
SubjectKeyIdentifier [
KeyIdentifier [
0000: 87 60 50 61 49 D5 CA 61   E3 32 11 B9 5B 3C CB 8C  .`PaI..a.2..[<..
0010: 85 1D C7 99                                        ....
]
]

其中的“证书指纹”就是我们标识apk的关键信息。

我们现在升级apk版本，然后用相同的key签名再试

执行aapt

package: name='com.thinking.loginsdkdemo' versionCode='2' versionName='2.0' platformBuildVersionName='8.0.0'
sdkVersion:'15'
targetSdkVersion:'26'
application-label:'LoginSdkDemo'
application-icon-120:'res/mipmap-anydpi-v26/ic_launcher.xml'
application-icon-160:'res/mipmap-anydpi-v26/ic_launcher.xml'
application-icon-240:'res/mipmap-anydpi-v26/ic_launcher.xml'
application-icon-320:'res/mipmap-anydpi-v26/ic_launcher.xml'
application-icon-480:'res/mipmap-anydpi-v26/ic_launcher.xml'
application-icon-640:'res/mipmap-anydpi-v26/ic_launcher.xml'
application-icon-65534:'res/mipmap-anydpi-v26/ic_launcher.xml'
application: label='LoginSdkDemo' icon='res/mipmap-anydpi-v26/ic_launcher.xml'
launchable-activity: name='com.thinking.loginsdkdemo.MainActivity'  label='' icon=''
feature-group: label=''
  uses-feature: name='android.hardware.faketouch'
  uses-implied-feature: name='android.hardware.faketouch' reason='default feature for all apps'
main
supports-screens: 'small' 'normal' 'large' 'xlarge'
supports-any-density: 'true'
locales: '--_--'
densities: '120' '160' '240' '320' '480' '640' '65534'

发现版本已经升了

解压执行keytool

所有者: CN=111111, OU=111111, O=111111, L=111111, ST=111111, C=111111
发布者: CN=111111, OU=111111, O=111111, L=111111, ST=111111, C=111111
序列号: 303230e4
有效期开始日期: Wed Mar 21 09:51:20 CST 2018, 截止日期: Sun Mar 15 09:51:20 CST 2043
证书指纹:
         MD5: 97:62:90:36:5F:5B:04:2D:93:1B:6D:60:ED:D7:23:CA
         SHA1: 64:C8:14:DA:02:2B:D8:DB:E3:EA:37:7F:63:62:4E:C1:E2:C0:44:6A
         SHA256: CD:8D:05:F2:40:6E:10:B6:1B:1E:A7:F2:01:F2:92:E1:D2:CB:43:FB:51:59:79:0A:04:6B:4A:A7:30:DD:05:D8
         签名算法名称: SHA256withRSA
         版本: 3

扩展:

#1: ObjectId: 2.5.29.14 Criticality=false
SubjectKeyIdentifier [
KeyIdentifier [
0000: 87 60 50 61 49 D5 CA 61   E3 32 11 B9 5B 3C CB 8C  .`PaI..a.2..[<..
0010: 85 1D C7 99                                        ....
]
]

发现签名指纹是一致的，现在改变一下包名（AndroidManifest.xml和build.gradle都改），再用相同的key签名试下

执行aapt

package: name='com.thinking.loginsdkdemo_test' versionCode='2' versionName='2.0' platformBuildVersionName='8.0.0'
sdkVersion:'15'
targetSdkVersion:'26'
application-label:'LoginSdkDemo'
application-icon-120:'res/mipmap-anydpi-v26/ic_launcher.xml'
application-icon-160:'res/mipmap-anydpi-v26/ic_launcher.xml'
application-icon-240:'res/mipmap-anydpi-v26/ic_launcher.xml'
application-icon-320:'res/mipmap-anydpi-v26/ic_launcher.xml'
application-icon-480:'res/mipmap-anydpi-v26/ic_launcher.xml'
application-icon-640:'res/mipmap-anydpi-v26/ic_launcher.xml'
application-icon-65534:'res/mipmap-anydpi-v26/ic_launcher.xml'
application: label='LoginSdkDemo' icon='res/mipmap-anydpi-v26/ic_launcher.xml'
launchable-activity: name='com.thinking.loginsdkdemo.MainActivity'  label='' icon=''
feature-group: label=''
  uses-feature: name='android.hardware.faketouch'
  uses-implied-feature: name='android.hardware.faketouch' reason='default feature for all apps'
main
supports-screens: 'small' 'normal' 'large' 'xlarge'
supports-any-density: 'true'
locales: '--_--'
densities: '120' '160' '240' '320' '480' '640' '65534'

发现包名改过来了

现在执行keytool

所有者: CN=111111, OU=111111, O=111111, L=111111, ST=111111, C=111111
发布者: CN=111111, OU=111111, O=111111, L=111111, ST=111111, C=111111
序列号: 303230e4
有效期开始日期: Wed Mar 21 09:51:20 CST 2018, 截止日期: Sun Mar 15 09:51:20 CST 2043
证书指纹:
         MD5: 97:62:90:36:5F:5B:04:2D:93:1B:6D:60:ED:D7:23:CA
         SHA1: 64:C8:14:DA:02:2B:D8:DB:E3:EA:37:7F:63:62:4E:C1:E2:C0:44:6A
         SHA256: CD:8D:05:F2:40:6E:10:B6:1B:1E:A7:F2:01:F2:92:E1:D2:CB:43:FB:51:59:79:0A:04:6B:4A:A7:30:DD:05:D8
         签名算法名称: SHA256withRSA
         版本: 3

扩展:

#1: ObjectId: 2.5.29.14 Criticality=false
SubjectKeyIdentifier [
KeyIdentifier [
0000: 87 60 50 61 49 D5 CA 61   E3 32 11 B9 5B 3C CB 8C  .`PaI..a.2..[<..
0010: 85 1D C7 99                                        ....
]
]

发现证书指纹没有变化，这就说明

证书+包名 能唯一确定apk，这也是两个apk能覆盖安装的必要条件。