Bypass Signature Check - Android Q&A, Help & Troubleshooting

Hi there,
It the first time here I'm asking for your help !!
I've learn a lot from these forum but can't find an answer to this question !
I first modify waze to alert about speedcamera whatever you speed (I learn from there http://marin.jb.free.fr/waze/) and then patch waze to enable radar in France!
Since Waze 3.9.9.906 alpha, waze added a signature verification at startup which cause the app to crash if signature is different than original.
I tried to dig inside libwaze.so with no sucess (including use of zynamics bindiff) to check for change between 3.9.9.0 and 3.9.9.906.
Can you help me or tell what I can do to bypass signature verification? Is it possible to modify libwaze.so without altering original signature or to spoof waze original signature?
Here is a logcat of the crash :
Code:
03-05 14:36:14.946 25806 25806 E WAZE : [email protected]
--------- beginning of crash
03-05 14:36:14.955 25806 25806 E AndroidRuntime: FATAL EXCEPTION: main
03-05 14:36:14.955 25806 25806 E AndroidRuntime: Process: com.waze, PID: 25806
03-05 14:36:14.955 25806 25806 E AndroidRuntime: java.lang.SecurityException: Signature check failed for com.waze
03-05 14:36:14.955 25806 25806 E AndroidRuntime: at android.os.Parcel.readException(Parcel.java:1620)
03-05 14:36:14.955 25806 25806 E AndroidRuntime: at android.os.Parcel.readException(Parcel.java:1573)
03-05 14:36:14.955 25806 25806 E AndroidRuntime: at com.google.android.gms.common.internal.zzs$zza$zza.zza(Unknown Source)
03-05 14:36:14.955 25806 25806 E AndroidRuntime: at com.google.android.gms.common.internal.zzj.zza(Unknown Source)
03-05 14:36:14.955 25806 25806 E AndroidRuntime: at com.google.android.gms.common.api.internal.zzh$zzc.zzpK(Unknown Source)
03-05 14:36:14.955 25806 25806 E AndroidRuntime: at com.google.android.gms.common.api.internal.zzh$zzf.run(Unknown Source)
03-05 14:36:14.955 25806 25806 E AndroidRuntime: at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:423)
03-05 14:36:14.955 25806 25806 E AndroidRuntime: at java.util.concurrent.FutureTask.run(FutureTask.java:237)
03-05 14:36:14.955 25806 25806 E AndroidRuntime: at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1113)
03-05 14:36:14.955 25806 25806 E AndroidRuntime: at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:588)
03-05 14:36:14.955 25806 25806 E AndroidRuntime: at com.google.android.gms.internal.zzob.run(Unknown Source)
03-05 14:36:14.955 25806 25806 E AndroidRuntime: at java.lang.Thread.run(Thread.java:818)
03-05 14:36:15.008 919 3085 W ActivityManager: Force finishing activity com.waze/.MainActivity
Thank you all!

---

Come on hackers!!!

---

Not an option without ripping the app apart. Even then it may refuse to work. I would just forget about it.

---

I think I've found the smali files to reverse engineer :
Code:
.class public Lcom/google/android/gms/common/GoogleSignatureVerifier;
.super Ljava/lang/Object;
# static fields
.field private static final zzaqd:Lcom/google/android/gms/common/GoogleSignatureVerifier;
# direct methods
.method static constructor <clinit>()V
.locals 1
new-instance v0, Lcom/google/android/gms/common/GoogleSignatureVerifier;
invoke-direct {v0}, Lcom/google/android/gms/common/GoogleSignatureVerifier;-><init>()V
sput-object v0, Lcom/google/android/gms/common/GoogleSignatureVerifier;->zzaqd:Lcom/google/android/gms/common/GoogleSignatureVerifier;
return-void
.end method
.method private constructor <init>()V
.locals 0
invoke-direct {p0}, Ljava/lang/Object;-><init>()V
return-void
.end method
.method public static getInstance()Lcom/google/android/gms/common/GoogleSignatureVerifier;
.locals 1
sget-object v0, Lcom/google/android/gms/common/GoogleSignatureVerifier;->zzaqd:Lcom/google/android/gms/common/GoogleSignatureVerifier;
return-object v0
.end method
.method private zzb(Landroid/content/pm/PackageInfo;Z)Z
.locals 5
const/4 v2, 0x1
const/4 v1, 0x0
iget-object v0, p1, Landroid/content/pm/PackageInfo;->signatures:[Landroid/content/pm/Signature;
array-length v0, v0
if-eq v0, v2, :cond_0
const-string/jumbo v0, "GoogleSignatureVerifier"
const-string/jumbo v2, "Package has more than one signature."
invoke-static {v0, v2}, Landroid/util/Log;->w(Ljava/lang/String;Ljava/lang/String;)I
move v0, v1
:goto_0
return v0
:cond_0
new-instance v3, Lcom/google/android/gms/common/zzc$zzb;
iget-object v0, p1, Landroid/content/pm/PackageInfo;->signatures:[Landroid/content/pm/Signature;
aget-object v0, v0, v1
invoke-virtual {v0}, Landroid/content/pm/Signature;->toByteArray()[B
move-result-object v0
invoke-direct {v3, v0}, Lcom/google/android/gms/common/zzc$zzb;-><init>([B)V
if-eqz p2, :cond_1
invoke-static {}, Lcom/google/android/gms/common/zzc;->zzpc()Ljava/util/Set;
move-result-object v0
:goto_1
invoke-interface {v0, v3}, Ljava/util/Set;->contains(Ljava/lang/Object;)Z
move-result v0
if-eqz v0, :cond_2
move v0, v2
goto :goto_0
:cond_1
invoke-static {}, Lcom/google/android/gms/common/zzc;->zzpd()Ljava/util/Set;
move-result-object v0
goto :goto_1
:cond_2
const-string/jumbo v0, "GoogleSignatureVerifier"
const/4 v2, 0x2
invoke-static {v0, v2}, Landroid/util/Log;->isLoggable(Ljava/lang/String;I)Z
move-result v0
if-eqz v0, :cond_3
const-string/jumbo v0, "GoogleSignatureVerifier"
new-instance v2, Ljava/lang/StringBuilder;
invoke-direct {v2}, Ljava/lang/StringBuilder;-><init>()V
const-string/jumbo v4, "Signature not valid. Found: \n"
invoke-virtual {v2, v4}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;
move-result-object v2
invoke-virtual {v3}, Lcom/google/android/gms/common/zzc$zza;->getBytes()[B
move-result-object v3
invoke-static {v3, v1}, Landroid/util/Base64;->encodeToString([BI)Ljava/lang/String;
move-result-object v3
invoke-virtual {v2, v3}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;
move-result-object v2
invoke-virtual {v2}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;
move-result-object v2
invoke-static {v0, v2}, Landroid/util/Log;->v(Ljava/lang/String;Ljava/lang/String;)I
:cond_3
move v0, v1
goto :goto_0
.end method
# virtual methods
.method public isPackageGoogleSigned(Landroid/content/pm/PackageManager;Landroid/content/pm/PackageInfo;)Z
.locals 3
.param p1, "packageManager" # Landroid/content/pm/PackageManager;
.param p2, "packageInfo" # Landroid/content/pm/PackageInfo;
.prologue
const/4 v2, 0x1
const/4 v0, 0x0
if-nez p2, :cond_1
:cond_0
:goto_0
return v0
:cond_1
invoke-static {p1}, Lcom/google/android/gms/common/GooglePlayServicesUtilLight;->honorsDebugCertificates(Landroid/content/pm/PackageManager;)Z
move-result v1
if-eqz v1, :cond_2
invoke-direct {p0, p2, v2}, Lcom/google/android/gms/common/GoogleSignatureVerifier;->zzb(Landroid/content/pm/PackageInfo;Z)Z
move-result v0
goto :goto_0
:cond_2
invoke-direct {p0, p2, v0}, Lcom/google/android/gms/common/GoogleSignatureVerifier;->zzb(Landroid/content/pm/PackageInfo;Z)Z
move-result v0
if-nez v0, :cond_0
invoke-direct {p0, p2, v2}, Lcom/google/android/gms/common/GoogleSignatureVerifier;->zzb(Landroid/content/pm/PackageInfo;Z)Z
move-result v1
if-eqz v1, :cond_0
const-string/jumbo v1, "GoogleSignatureVerifier"
const-string/jumbo v2, "Test-keys aren\'t accepted on this build."
invoke-static {v1, v2}, Landroid/util/Log;->w(Ljava/lang/String;Ljava/lang/String;)I
goto :goto_0
.end method
.method public isPackageGoogleSigned(Landroid/content/pm/PackageManager;Ljava/lang/String;)Z
.locals 3
.param p1, "packageManager" # Landroid/content/pm/PackageManager;
.param p2, "callingPackage" # Ljava/lang/String;
.prologue
const/16 v0, 0x40
:try_start_0
invoke-virtual {p1, p2, v0}, Landroid/content/pm/PackageManager;->getPackageInfo(Ljava/lang/String;I)Landroid/content/pm/PackageInfo;
:try_end_0
.catch Landroid/content/pm/PackageManager$NameNotFoundException; {:try_start_0 .. :try_end_0} :catch_0
move-result-object v0
invoke-virtual {p0, p1, v0}, Lcom/google/android/gms/common/GoogleSignatureVerifier;->isPackageGoogleSigned(Landroid/content/pm/PackageManager;Landroid/content/pm/PackageInfo;)Z
move-result v0
:goto_0
return v0
:catch_0
move-exception v0
const-string/jumbo v0, "GoogleSignatureVerifier"
const/4 v1, 0x3
invoke-static {v0, v1}, Landroid/util/Log;->isLoggable(Ljava/lang/String;I)Z
move-result v0
if-eqz v0, :cond_0
const-string/jumbo v0, "GoogleSignatureVerifier"
new-instance v1, Ljava/lang/StringBuilder;
invoke-direct {v1}, Ljava/lang/StringBuilder;-><init>()V
const-string/jumbo v2, "Package manager can\'t find package "
invoke-virtual {v1, v2}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;
move-result-object v1
invoke-virtual {v1, p2}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;
move-result-object v1
const-string/jumbo v2, ", defaulting to false"
invoke-virtual {v1, v2}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;
move-result-object v1
invoke-virtual {v1}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;
move-result-object v1
invoke-static {v0, v1}, Landroid/util/Log;->d(Ljava/lang/String;Ljava/lang/String;)I
:cond_0
const/4 v0, 0x0
goto :goto_0
.end method
.method public isUidGoogleSigned(Landroid/content/pm/PackageManager;I)Z
.locals 5
.param p1, "packageManager" # Landroid/content/pm/PackageManager;
.param p2, "uid" # I
.prologue
const/4 v0, 0x0
invoke-virtual {p1, p2}, Landroid/content/pm/PackageManager;->getPackagesForUid(I)[Ljava/lang/String;
move-result-object v2
if-eqz v2, :cond_0
array-length v1, v2
if-nez v1, :cond_1
:cond_0
:goto_0
return v0
:cond_1
array-length v3, v2
move v1, v0
:goto_1
if-ge v1, v3, :cond_0
aget-object v4, v2, v1
invoke-virtual {p0, p1, v4}, Lcom/google/android/gms/common/GoogleSignatureVerifier;->isPackageGoogleSigned(Landroid/content/pm/PackageManager;Ljava/lang/String;)Z
move-result v4
if-eqz v4, :cond_2
const/4 v0, 0x1
goto :goto_0
:cond_2
add-int/lit8 v1, v1, 0x1
goto :goto_1
.end method
.method public verifyPackageIsGoogleSigned(Landroid/content/pm/PackageManager;Ljava/lang/String;)V
.locals 3
.param p1, "packageManager" # Landroid/content/pm/PackageManager;
.param p2, "callingPackage" # Ljava/lang/String;
.annotation system Ldalvik/annotation/Throws;
value = {
Ljava/lang/SecurityException;
}
.end annotation
.prologue
invoke-virtual {p0, p1, p2}, Lcom/google/android/gms/common/GoogleSignatureVerifier;->isPackageGoogleSigned(Landroid/content/pm/PackageManager;Ljava/lang/String;)Z
move-result v0
if-nez v0, :cond_0
new-instance v0, Ljava/lang/SecurityException;
new-instance v1, Ljava/lang/StringBuilder;
invoke-direct {v1}, Ljava/lang/StringBuilder;-><init>()V
const-string/jumbo v2, "Signature check failed for "
invoke-virtual {v1, v2}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;
move-result-object v1
invoke-virtual {v1, p2}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;
move-result-object v1
invoke-virtual {v1}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;
move-result-object v1
invoke-direct {v0, v1}, Ljava/lang/SecurityException;-><init>(Ljava/lang/String;)V
throw v0
:cond_0
return-void
.end method
.method public verifyUidIsGoogleSigned(Landroid/content/pm/PackageManager;I)V
.locals 2
.param p1, "packageManager" # Landroid/content/pm/PackageManager;
.param p2, "uid" # I
.annotation system Ldalvik/annotation/Throws;
value = {
Ljava/lang/SecurityException;
}
.end annotation
.prologue
if-nez p1, :cond_0
new-instance v0, Ljava/lang/SecurityException;
const-string/jumbo v1, "Unknown error: invalid Package Manager"
invoke-direct {v0, v1}, Ljava/lang/SecurityException;-><init>(Ljava/lang/String;)V
throw v0
:cond_0
invoke-virtual {p0, p1, p2}, Lcom/google/android/gms/common/GoogleSignatureVerifier;->isUidGoogleSigned(Landroid/content/pm/PackageManager;I)Z
move-result v0
if-nez v0, :cond_1
new-instance v0, Ljava/lang/SecurityException;
const-string/jumbo v1, "Uid is not Google Signed"
invoke-direct {v0, v1}, Ljava/lang/SecurityException;-><init>(Ljava/lang/String;)V
throw v0
:cond_1
return-void
.end method
.method varargs zza(Landroid/content/pm/PackageInfo;[Lcom/google/android/gms/common/zzc$zza;)Lcom/google/android/gms/common/zzc$zza;
.locals 6
const/4 v2, 0x0
const/4 v1, 0x0
iget-object v0, p1, Landroid/content/pm/PackageInfo;->signatures:[Landroid/content/pm/Signature;
array-length v0, v0
const/4 v3, 0x1
if-eq v0, v3, :cond_0
const-string/jumbo v0, "GoogleSignatureVerifier"
const-string/jumbo v1, "Package has more than one signature."
invoke-static {v0, v1}, Landroid/util/Log;->w(Ljava/lang/String;Ljava/lang/String;)I
move-object v0, v2
:goto_0
return-object v0
:cond_0
new-instance v3, Lcom/google/android/gms/common/zzc$zzb;
iget-object v0, p1, Landroid/content/pm/PackageInfo;->signatures:[Landroid/content/pm/Signature;
aget-object v0, v0, v1
invoke-virtual {v0}, Landroid/content/pm/Signature;->toByteArray()[B
move-result-object v0
invoke-direct {v3, v0}, Lcom/google/android/gms/common/zzc$zzb;-><init>([B)V
move v0, v1
:goto_1
array-length v4, p2
if-ge v0, v4, :cond_2
aget-object v4, p2, v0
invoke-virtual {v4, v3}, Lcom/google/android/gms/common/zzc$zza;->equals(Ljava/lang/Object;)Z
move-result v4
if-eqz v4, :cond_1
aget-object v0, p2, v0
goto :goto_0
:cond_1
add-int/lit8 v0, v0, 0x1
goto :goto_1
:cond_2
const-string/jumbo v0, "GoogleSignatureVerifier"
const/4 v4, 0x2
invoke-static {v0, v4}, Landroid/util/Log;->isLoggable(Ljava/lang/String;I)Z
move-result v0
if-eqz v0, :cond_3
const-string/jumbo v0, "GoogleSignatureVerifier"
new-instance v4, Ljava/lang/StringBuilder;
invoke-direct {v4}, Ljava/lang/StringBuilder;-><init>()V
const-string/jumbo v5, "Signature not valid. Found: \n"
invoke-virtual {v4, v5}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;
move-result-object v4
invoke-virtual {v3}, Lcom/google/android/gms/common/zzc$zza;->getBytes()[B
move-result-object v3
invoke-static {v3, v1}, Landroid/util/Base64;->encodeToString([BI)Ljava/lang/String;
move-result-object v1
invoke-virtual {v4, v1}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;
move-result-object v1
invoke-virtual {v1}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;
move-result-object v1
invoke-static {v0, v1}, Landroid/util/Log;->v(Ljava/lang/String;Ljava/lang/String;)I
:cond_3
move-object v0, v2
goto :goto_0
.end method
.method public zza(Landroid/content/pm/PackageInfo;Z)Z
.locals 4
const/4 v0, 0x1
const/4 v1, 0x0
if-eqz p1, :cond_1
iget-object v2, p1, Landroid/content/pm/PackageInfo;->signatures:[Landroid/content/pm/Signature;
if-eqz v2, :cond_1
if-eqz p2, :cond_0
sget-object v2, Lcom/google/android/gms/common/zzc$zzcm;->zzapV:[Lcom/google/android/gms/common/zzc$zza;
invoke-virtual {p0, p1, v2}, Lcom/google/android/gms/common/GoogleSignatureVerifier;->zza(Landroid/content/pm/PackageInfo;[Lcom/google/android/gms/common/zzc$zza;)Lcom/google/android/gms/common/zzc$zza;
move-result-object v2
:goto_0
if-eqz v2, :cond_1
:goto_1
return v0
:cond_0
new-array v2, v0, [Lcom/google/android/gms/common/zzc$zza;
sget-object v3, Lcom/google/android/gms/common/zzc$zzcm;->zzapV:[Lcom/google/android/gms/common/zzc$zza;
aget-object v3, v3, v1
aput-object v3, v2, v1
invoke-virtual {p0, p1, v2}, Lcom/google/android/gms/common/GoogleSignatureVerifier;->zza(Landroid/content/pm/PackageInfo;[Lcom/google/android/gms/common/zzc$zza;)Lcom/google/android/gms/common/zzc$zza;
move-result-object v2
goto :goto_0
:cond_1
move v0, v1
goto :goto_1
.end method
.method public zza(Landroid/content/pm/PackageManager;Landroid/content/pm/PackageInfo;)Z
.locals 3
const/4 v2, 0x1
const/4 v0, 0x0
if-nez p2, :cond_1
:cond_0
:goto_0
return v0
:cond_1
invoke-static {p1}, Lcom/google/android/gms/common/GooglePlayServicesUtilLight;->honorsDebugCertificates(Landroid/content/pm/PackageManager;)Z
move-result v1
if-eqz v1, :cond_2
invoke-virtual {p0, p2, v2}, Lcom/google/android/gms/common/GoogleSignatureVerifier;->zza(Landroid/content/pm/PackageInfo;Z)Z
move-result v0
goto :goto_0
:cond_2
invoke-virtual {p0, p2, v0}, Lcom/google/android/gms/common/GoogleSignatureVerifier;->zza(Landroid/content/pm/PackageInfo;Z)Z
move-result v0
if-nez v0, :cond_0
invoke-virtual {p0, p2, v2}, Lcom/google/android/gms/common/GoogleSignatureVerifier;->zza(Landroid/content/pm/PackageInfo;Z)Z
move-result v1
if-eqz v1, :cond_0
const-string/jumbo v1, "GoogleSignatureVerifier"
const-string/jumbo v2, "Test-keys aren\'t accepted on this build."
invoke-static {v1, v2}, Landroid/util/Log;->w(Ljava/lang/String;Ljava/lang/String;)I
goto :goto_0
.end method

---

Those features are left out purposely because its illegal to include in certain areas. And so we don't need it discussed on XDA.
Thread closed.
Darth
Forum Moderator