Question

我目前正在努力为我正在开发的Unity3d应用程序获取一些安全性，并且我想添加验证apk文件未被某些修补程序篡改。我知道如何从构建的应用程序（如keytool）获取密钥库指纹，但我很难弄清楚如何在运行时从我的应用程序代码中获取指纹，以检查它是否相同。到目前为止，我已经经历了很多其他线程没有成功（像这样：Get certificate fingerprint from android app）

有没有人找到解决方法如何做到这一点或提示我应该从哪里开始寻找？提前谢谢！

Answer 1

修改您关联的http://aurora.uconn.edu/2017/08/08/facebook/中的getCertificateSHA1Fingerprint功能，将Android Context作为参数。从Unity获取Context并将其发送到此功能，然后标记为static。

<强>爪哇：

public final class CertificateSHA1Fingerprint 
{

  private static String getCertificateSHA1Fingerprint(Context mContext) 
  {
  PackageManager pm = mContext.getPackageManager();
  String packageName = mContext.getPackageName();
  int flags = PackageManager.GET_SIGNATURES;
  PackageInfo packageInfo = null;
  try {
   packageInfo = pm.getPackageInfo(packageName, flags);
  } catch (PackageManager.NameNotFoundException e) {
   e.printStackTrace();
  }
  Signature[] signatures = packageInfo.signatures;
  byte[] cert = signatures[0].toByteArray();
  InputStream input = new ByteArrayInputStream(cert);
  CertificateFactory cf = null;
  try {
   cf = CertificateFactory.getInstance("X509");
  } catch (CertificateException e) {
   e.printStackTrace();
  }
  X509Certificate c = null;
  try {
   c = (X509Certificate) cf.generateCertificate(input);
  } catch (CertificateException e) {
   e.printStackTrace();
  }
  String hexString = null;
  try {
   MessageDigest md = MessageDigest.getInstance("SHA1");
   byte[] publicKey = md.digest(c.getEncoded());
   hexString = byte2HexFormatted(publicKey);
  } catch (NoSuchAlgorithmException e1) {
   e1.printStackTrace();
  } catch (CertificateEncodingException e) {
   e.printStackTrace();
  }
  return hexString;
 }

 public static String byte2HexFormatted(byte[] arr) 
 {
   StringBuilder str = new StringBuilder(arr.length * 2);
   for (int i = 0; i < arr.length; i++) 
   {
   String h = Integer.toHexString(arr[i]);
   int l = h.length();
   if (l == 1) h = "0" + h;
   if (l > 2) h = h.substring(l - 2, l);
   str.append(h.toUpperCase());
   if (i < (arr.length - 1)) str.append(':');
   }
  return str.toString();
 }
}

<强> C＃：

AndroidJavaClass unityClass;
AndroidJavaObject unityActivity;
AndroidJavaObject unityContext;
AndroidJavaClass customClass;

public string getCertificateSHA1Fingerprint()
{
    //Replace with your full package name
    string packageName = "com.example.CertificateSHA1Fingerprint";

    unityClass = new AndroidJavaClass("com.unity3d.player.UnityPlayer");
    unityActivity = unityClass.GetStatic<AndroidJavaObject>("currentActivity");
    unityContext = unityActivity.Call<AndroidJavaObject>("getApplicationContext");

    customClass = new AndroidJavaClass(packageName);

    string result = customClass.CallStatic<string>("getCertificateSHA1Fingerprint", unityContext);
    return result;
}

您只需使用Android Studio构建Java函数并将其转换为Jar或.AAR文件，然后将其放入<ProjectName>Assets\Plugins\Android文件夹中。 C＃代码将能够与之通信。

如何从代码中获取Keystore指纹

1 个答案: