摘要： 攻击者会利用Android系统应用程序自签名过程中的漏洞进行重签名，从而发布盗版软件。针对该问题，分析Android系统应用程序数字签名及验证过程，提出一种基于MD5值的在线签名比较方案，并通过代码混淆技术增加攻击者反编译的难度，以保障该签名方案的安全性。实验结果表明，该方案可以帮助用户判断应用程序是否为正版，并有效防止本地签名被篡改。

关键词: Android系统, 数字签名, 漏洞分析, 漏洞检测, 代码混淆

Abstract: Aiming at the problem that an attacker can issue pirated software by re-signing the vulnerabilities in the self-signature process of Android system application program,this paper analyses the digital signature and verification process of Android system application program,proposes an online signature comparison scheme based on MD5 value,and increases the difficulty of attacker's decompilation through code obfuscation technology to ensure the security of the signature scheme.Experimental results show that the scheme can help users to judge whether the application is authentic or not,and can effectively prevent the local signature from being tampered with.

Key words: Android system, digital signature, vulnerability analysis, vulnerability detection, code obfuscation

中图分类号: 

• TP302