1 importjava.io.IOException;2 importjava.nio.BufferUnderflowException;3 importjava.nio.ByteBuffer;4 importjava.nio.ByteOrder;5 importjava.nio.channels.FileChannel;6 importjava.util.LinkedHashMap;7 importjava.util.Map;8

9 final classApkUtil {10 privateApkUtil() {11 super();12 }13

14 /**

15 * APK Signing Block Magic Code: magic “APK Sig Block 42” (16 bytes)16 * "APK Sig Block 42" : 41 50 4B 20 53 69 67 20 42 6C 6F 63 6B 20 34 3217 */

18 public static final long APK_SIG_BLOCK_MAGIC_HI = 0x3234206b636f6c42L; //LITTLE_ENDIAN, High

19 public static final long APK_SIG_BLOCK_MAGIC_LO = 0x20676953204b5041L; //LITTLE_ENDIAN, Low

20 private static final int APK_SIG_BLOCK_MIN_SIZE = 32;21

22 /*

23 The v2 signature of the APK is stored as an ID-value pair with ID 0x7109871a24 (https://source.android.com/security/apksigning/v2.html#apk-signing-block)25 */

26 public static final int APK_SIGNATURE_SCHEME_V2_BLOCK_ID = 0x7109871a;27

28 /**

29 * The padding in APK SIG BLOCK (V3 scheme introduced)30 * Seehttps://android.googlesource.com/platform/tools/apksig/+/master/src/main/java/com/android/apksig/internal/apk/ApkSigningBlockUtils.java31 */

32 public static final int VERITY_PADDING_BLOCK_ID = 0x42726577;33

34 public static final int ANDROID_COMMON_PAGE_ALIGNMENT_BYTES = 4096;35

36

37 //Our Channel Block ID

38 public static final int APK_CHANNEL_BLOCK_ID = 0x71777777;39

40 public static final String DEFAULT_CHARSET = "UTF-8";41

42 private static final int ZIP_EOCD_REC_MIN_SIZE = 22;43 private static final int ZIP_EOCD_REC_SIG = 0x06054b50;44 private static final int UINT16_MAX_VALUE = 0xffff;45 private static final int ZIP_EOCD_COMMENT_LENGTH_FIELD_OFFSET = 20;46

47 public static long getCommentLength(final FileChannel fileChannel) throwsIOException {48 //End of central directory record (EOCD)49 //Offset Bytes Description[23]50 //0 4 End of central directory signature = 0x06054b5051 //4 2 Number of this disk52 //6 2 Disk where central directory starts53 //8 2 Number of central directory records on this disk54 //10 2 Total number of central directory records55 //12 4 Size of central directory (bytes)56 //16 4 Offset of start of central directory, relative to start of archive57 //20 2 Comment length (n)58 //22 n Comment59 //For a zip with no archive comment, the60 //end-of-central-directory record will be 22 bytes long, so61 //we expect to find the EOCD marker 22 bytes from the end.

62

63

64 final long archiveSize =fileChannel.size();65 if (archiveSize

77 final long maxCommentLength = Math.min(archiveSize -ZIP_EOCD_REC_MIN_SIZE, UINT16_MAX_VALUE);78 final long eocdWithEmptyCommentStartPosition = archiveSize -ZIP_EOCD_REC_MIN_SIZE;79 for (int expectedCommentLength = 0; expectedCommentLength <=maxCommentLength;80 expectedCommentLength++) {81 final long eocdStartPos = eocdWithEmptyCommentStartPosition -expectedCommentLength;82

83 final ByteBuffer byteBuffer = ByteBuffer.allocate(4);84 fileChannel.position(eocdStartPos);85 fileChannel.read(byteBuffer);86 byteBuffer.order(ByteOrder.LITTLE_ENDIAN);87

88 if (byteBuffer.getInt(0) ==ZIP_EOCD_REC_SIG) {89 final ByteBuffer commentLengthByteBuffer = ByteBuffer.allocate(2);90 fileChannel.position(eocdStartPos +ZIP_EOCD_COMMENT_LENGTH_FIELD_OFFSET);91 fileChannel.read(commentLengthByteBuffer);92 commentLengthByteBuffer.order(ByteOrder.LITTLE_ENDIAN);93

94 final int actualCommentLength = commentLengthByteBuffer.getShort(0);95 if (actualCommentLength ==expectedCommentLength) {96 returnactualCommentLength;97 }98 }99 }100 throw new IOException("ZIP End of Central Directory (EOCD) record not found");101 }102

103 public static long findCentralDirStartOffset(final FileChannel fileChannel) throwsIOException {104 returnfindCentralDirStartOffset(fileChannel, getCommentLength(fileChannel));105 }106

107 public static long findCentralDirStartOffset(final FileChannel fileChannel, final long commentLength) throwsIOException {108 //End of central directory record (EOCD)109 //Offset Bytes Description[23]110 //0 4 End of central directory signature = 0x06054b50111 //4 2 Number of this disk112 //6 2 Disk where central directory starts113 //8 2 Number of central directory records on this disk114 //10 2 Total number of central directory records115 //12 4 Size of central directory (bytes)116 //16 4 Offset of start of central directory, relative to start of archive117 //20 2 Comment length (n)118 //22 n Comment119 //For a zip with no archive comment, the120 //end-of-central-directory record will be 22 bytes long, so121 //we expect to find the EOCD marker 22 bytes from the end.

122

123 final ByteBuffer zipCentralDirectoryStart = ByteBuffer.allocate(4);124 zipCentralDirectoryStart.order(ByteOrder.LITTLE_ENDIAN);125 fileChannel.position(fileChannel.size() - commentLength - 6); //6 = 2 (Comment length) + 4 (Offset of start of central directory, relative to start of archive)

126 fileChannel.read(zipCentralDirectoryStart);127 final long centralDirStartOffset = zipCentralDirectoryStart.getInt(0);128 returncentralDirStartOffset;129 }130

131 public static PairfindApkSigningBlock(132 final FileChannel fileChannel) throwsIOException, SignatureNotFoundException {133 final long centralDirOffset =findCentralDirStartOffset(fileChannel);134 returnfindApkSigningBlock(fileChannel, centralDirOffset);135 }136

137 public static PairfindApkSigningBlock(138 final FileChannel fileChannel, final long centralDirOffset) throwsIOException, SignatureNotFoundException {139

140 //Find the APK Signing Block. The block immediately precedes the Central Directory.141

142 //FORMAT:143 //OFFSET DATA TYPE DESCRIPTION144 //* @+0 bytes uint64: size in bytes (excluding this field)145 //* @+8 bytes payload146 //* @-24 bytes uint64: size in bytes (same as the one above)147 //* @-16 bytes uint128: magic

148

149 if (centralDirOffset

152 +centralDirOffset);153 }154 //Read the magic and offset in file from the footer section of the block:155 //* uint64: size of block156 //* 16 bytes: magic

157 fileChannel.position(centralDirOffset - 24);158 final ByteBuffer footer = ByteBuffer.allocate(24);159 fileChannel.read(footer);160 footer.order(ByteOrder.LITTLE_ENDIAN);161 if ((footer.getLong(8) !=APK_SIG_BLOCK_MAGIC_LO)162 || (footer.getLong(16) !=APK_SIG_BLOCK_MAGIC_HI)) {163 throw newSignatureNotFoundException(164 "No APK Signing Block before ZIP Central Directory");165 }166 //Read and compare size fields

167 final long apkSigBlockSizeInFooter = footer.getLong(0);168 if ((apkSigBlockSizeInFooter Integer.MAX_VALUE - 8)) {170 throw newSignatureNotFoundException(171 "APK Signing Block size out of range: " +apkSigBlockSizeInFooter);172 }173 final int totalSize = (int) (apkSigBlockSizeInFooter + 8);174 final long apkSigBlockOffset = centralDirOffset -totalSize;175 if (apkSigBlockOffset < 0) {176 throw newSignatureNotFoundException(177 "APK Signing Block offset out of range: " +apkSigBlockOffset);178 }179 fileChannel.position(apkSigBlockOffset);180 final ByteBuffer apkSigBlock =ByteBuffer.allocate(totalSize);181 fileChannel.read(apkSigBlock);182 apkSigBlock.order(ByteOrder.LITTLE_ENDIAN);183 final long apkSigBlockSizeInHeader = apkSigBlock.getLong(0);184 if (apkSigBlockSizeInHeader !=apkSigBlockSizeInFooter) {185 throw newSignatureNotFoundException(186 "APK Signing Block sizes in header and footer do not match: "

187 + apkSigBlockSizeInHeader + " vs " +apkSigBlockSizeInFooter);188 }189 returnPair.of(apkSigBlock, apkSigBlockOffset);190 }191

192 public static Map findIdValues(final ByteBuffer apkSigningBlock) throwsSignatureNotFoundException {193 checkByteOrderLittleEndian(apkSigningBlock);194 //FORMAT:195 //OFFSET DATA TYPE DESCRIPTION196 //* @+0 bytes uint64: size in bytes (excluding this field)197 //* @+8 bytes pairs198 //* @-24 bytes uint64: size in bytes (same as the one above)199 //* @-16 bytes uint128: magic

200 final ByteBuffer pairs = sliceFromTo(apkSigningBlock, 8, apkSigningBlock.capacity() - 24);201

202 final Map idValues = new LinkedHashMap(); //keep order

203

204 int entryCount = 0;205 while(pairs.hasRemaining()) {206 entryCount++;207 if (pairs.remaining() < 8) {208 throw newSignatureNotFoundException(209 "Insufficient data to read size of APK Signing Block entry #" +entryCount);210 }211 final long lenLong =pairs.getLong();212 if ((lenLong < 4) || (lenLong >Integer.MAX_VALUE)) {213 throw newSignatureNotFoundException(214 "APK Signing Block entry #" +entryCount215 + " size out of range: " +lenLong);216 }217 final int len = (int) lenLong;218 final int nextEntryPos = pairs.position() +len;219 if (len >pairs.remaining()) {220 throw newSignatureNotFoundException(221 "APK Signing Block entry #" + entryCount + " size out of range: " +len222 + ", available: " +pairs.remaining());223 }224 final int id =pairs.getInt();225 idValues.put(id, getByteBuffer(pairs, len - 4));226

227 pairs.position(nextEntryPos);228 }229

230 returnidValues;231 }232

233 /**

234 * Returns new byte buffer whose content is a shared subsequence of this buffer's content235 * between the specified start (inclusive) and end (exclusive) positions. As opposed to236 * {@linkByteBuffer#slice()}, the returned buffer's byte order is the same as the source237 * buffer's byte order.238 */

239 private static ByteBuffer sliceFromTo(final ByteBuffer source, final int start, final intend) {240 if (start < 0) {241 throw new IllegalArgumentException("start: " +start);242 }243 if (end source.capacity()) {248 throw new IllegalArgumentException("end > capacity: " + end + " > " +capacity);249 }250 final int originalLimit =source.limit();251 final int originalPosition =source.position();252 try{253 source.position(0);254 source.limit(end);255 source.position(start);256 final ByteBuffer result =source.slice();257 result.order(source.order());258 returnresult;259 } finally{260 source.position(0);261 source.limit(originalLimit);262 source.position(originalPosition);263 }264 }265

266 /**

267 * Relative get method for reading {@codesize} number of bytes from the current268 * position of this buffer.269 *

270 *

This method reads the next {@codesize} bytes at this buffer's current position,271 * returning them as a {@codeByteBuffer} with start set to 0, limit and capacity set to272 * {@codesize}, byte order set to this buffer's byte order; and then increments the position by273 * {@codesize}.274 */

275 private static ByteBuffer getByteBuffer(final ByteBuffer source, final intsize)276 throwsBufferUnderflowException {277 if (size < 0) {278 throw new IllegalArgumentException("size: " +size);279 }280 final int originalLimit =source.limit();281 final int position =source.position();282 final int limit = position +size;283 if ((limit < position) || (limit >originalLimit)) {284 throw newBufferUnderflowException();285 }286 source.limit(limit);287 try{288 final ByteBuffer result =source.slice();289 result.order(source.order());290 source.position(limit);291 returnresult;292 } finally{293 source.limit(originalLimit);294 }295 }296

297 private static void checkByteOrderLittleEndian(finalByteBuffer buffer) {298 if (buffer.order() !=ByteOrder.LITTLE_ENDIAN) {299 throw new IllegalArgumentException("ByteBuffer byte order must be little endian");300 }301 }302

303

304 }