parseapk/parse_apk.py
def parse_signing_block(data, magic_offset):
    '''
    Parses the APK Signing block 
    https://source.android.com/security/apksigning/v2#apk-signing-block-format

    data = content of the entire APK
    magic_offset = offset of where we spotted the magic word "APK Sig Block 42"
    '''
    print "\033[1;34;1m------------- APK Signing Block -------------------"

    # we compute the beginning of the APK Signing block
    # https://source.android.com/security/apksigning/v2
    magic = data[magic_offset:magic_offset+16]
    block_size2 = struct.unpack("<Q", data[magic_offset-8:magic_offset])[0]
    begin_offset = magic_offset +16 - 8 - block_size2
    print "Offset: %d (0x%08x)" % (begin_offset, begin_offset)

    block_size = struct.unpack("<Q", data[begin_offset:begin_offset+8])[0]
    print "Block size  : ", block_size

    if block_size != block_size2:
        print "WARNING: block sizes do not match"

    print "Block size 2: ", block_size2
    print "Magic: ", magic

    # parse pairs
    current_offset = begin_offset + 8
    while current_offset < magic_offset - 8:
        print "\t----- Pair -----"
        pair_id = struct.unpack("<L", data[current_offset:current_offset+4])[0]
        print "\tID: 0x%08X" % (pair_id)
        pair_length = struct.unpack("<L", data[current_offset+4:current_offset+8])[0]
        print "\tValue Length: %d" % (pair_length)
        if pair_id == 0x7109871a:
            print "\tAPK Signature Scheme v2"
            parse_sigv2(data, current_offset+4, pair_length)
        
        current_offset = current_offset + 8 + pair_length

    print "\033[0m"

    Parses the APK Signing block 
    https://source.android.com/security/apksigning/v2#apk-signing-block-format

    data = content of the entire APK
    magic_offset = offset of where we spotted the magic word "APK Sig Block 42"
    


data = content of the entire APK
magic_offset = offset of where we spotted the magic word "APK Sig Block 42"
data = content of the entire APK magic_offset = offset of where we spotted the magic word " APK Sig Block 42 "
def parse_signing_block(data, magic_offset):
    print "\033[1;34;1m------------- APK Signing Block -------------------"
    magic = data[magic_offset:magic_offset+16]
    block_size2 = struct.unpack("<Q", data[magic_offset-8:magic_offset])[0]
    begin_offset = magic_offset +16 - 8 - block_size2
    print "Offset: %d (0x%08x)" % (begin_offset, begin_offset)
    block_size = struct.unpack("<Q", data[begin_offset:begin_offset+8])[0]
    print "Block size  : ", block_size
    if block_size != block_size2:
        print "WARNING: block sizes do not match"
    print "Block size 2: ", block_size2
    print "Magic: ", magic
    current_offset = begin_offset + 8
    while current_offset < magic_offset - 8:
        print "\t----- Pair -----"
        pair_id = struct.unpack("<L", data[current_offset:current_offset+4])[0]
        print "\tID: 0x%08X" % (pair_id)
        pair_length = struct.unpack("<L", data[current_offset+4:current_offset+8])[0]
        print "\tValue Length: %d" % (pair_length)
        if pair_id == 0x7109871a:
            print "\tAPK Signature Scheme v2"
            parse_sigv2(data, current_offset+4, pair_length)
        current_offset = current_offset + 8 + pair_length
    print "\033[0m"
def parse_signing_block ( data , magic_offset ) : print "\033[1;34;1m------------- APK Signing Block -------------------" magic = data [ magic_offset : magic_offset + 16 ] block_size2 = struct . unpack ( "<Q" , data [ magic_offset - 8 : magic_offset ] ) [ 0 ] begin_offset = magic_offset + 16 - 8 - block_size2 print "Offset: %d (0x%08x)" % ( begin_offset , begin_offset ) block_size = struct . unpack ( "<Q" , data [ begin_offset : begin_offset + 8 ] ) [ 0 ] print "Block size  : " , block_size if block_size != block_size2 : print "WARNING: block sizes do not match" print "Block size 2: " , block_size2 print "Magic: " , magic current_offset = begin_offset + 8 while current_offset < magic_offset - 8 : print "\t----- Pair -----" pair_id = struct . unpack ( "<L" , data [ current_offset : current_offset + 4 ] ) [ 0 ] print "\tID: 0x%08X" % ( pair_id ) pair_length = struct . unpack ( "<L" , data [ current_offset + 4 : current_offset + 8 ] ) [ 0 ] print "\tValue Length: %d" % ( pair_length ) if pair_id == 0x7109871a : print "\tAPK Signature Scheme v2" parse_sigv2 ( data , current_offset + 4 , pair_length ) current_offset = current_offset + 8 + pair_length print "\033[0m"
Parses the APK Signing block
https://source.android.com/security/apksigning/v2#apk-signing-block-format
Parses the APK Signing block https : // source . android . com / security / apksigning / v2#apk - signing - block - format
'''
    Parses the APK Signing block 
    https://source.android.com/security/apksigning/v2#apk-signing-block-format

    data = content of the entire APK
    magic_offset = offset of where we spotted the magic word "APK Sig Block 42"
    ''' # we compute the beginning of the APK Signing block # https://source.android.com/security/apksigning/v2 # parse pairs
data
magic_offset