search

csu333 / Surrogate

This is the repository for the Surrogate Xposed module
25 stars 7 forks source link

signature VERIFY FAILED #14

Open redongh opened 6 years ago

redongh commented 6 years ago

important: dev-wise i'm quite a novice to android, please bear with me if i'm wrong!

while trying to get this surrogate-module (v1.1b5) to work within xposed on my good ol' samsung galaxy SII Plus (GT-I9105P) running stock-android 4.2.2 (rooted of course ;) ) i experienced troubles during the installation of net.csu333.surrogate_v1_c38fdf.apk through adb as this yields Failure [INSTALL_PARSE_FAILED_NO_CERTIFICATES].

to me this appears to be an issue with the apk's signature, so i used uber-apk-signer (link) to verify the sig by issueing $ java -jar uber-apk-signer-0.8.0.jar -a ./net.csu333.surrogate_v1_c38fdf.apk -y --verbose which in turn yields in:

01. net.csu333.surrogate_v1_c38fdf.apk

    VERIFY
    file: /home/user/data/software/android/apks/xposed/net.csu333.surrogate_v1_c38fdf.apk
    checksum : 0e4cd0dcdac9d4f3fc41f298cae2c710a3a75419e7b00989263a030e878ed52c (sha256)
    - zipalign verified
    - signature VERIFY FAILED (net.csu333.surrogate_v1_c38fdf.apk)
            ERROR: JAR signer CERT.RSA: JAR signature META-INF/CERT.RSA uses digest algorithm 
            2.16.840.1.101.3.4.2.1 and signature algorithm 1.2.840.113549.1.1.1 which is not supported
            on API Levels [[15, 17]]

guessing from this output i'd say that the apk is signed in a way where it cannot be used on older (ICS, 4.2.2, ...) devices. should users on such devices re-sign the apk or am i possibly the only one still using 4.2.2?

redongh commented 6 years ago

follow-up: after trying to re-sign the apk with an own key (generated with keytool -genkey [...] -keyalg RSA [...]) through jarsigner -verbose -sigalg SHA1withRSA -digestalg SHA1 [...] did for some (to me) weird reason not work as META-INF/CERT.RSA still was of type Signature Algorithm: sha256WithRSAEncryption while my META-INF/REL.RSA was indeed of type Signature Algorithm: sha1WithRSAEncryption. Sidenote: info about the .RSA files obtained from openssl pkcs7 -in <filename>.RSA -inform DER -print_certs | openssl x509 -text -noout

so finally i ended up installing the (original) .apk though Lucky Patcher (Toolbox -> 'Patch to Android' -> 'Signature Verifikation Status always true' + 'Disable .apk Signature Verification' + 'only patch Dalvik Cache' set) which allows the installation of .apks without verifying signatures. this is of course a rather dirty workaround but might be helpful to someone ;)