Android - Installed apps - integrity check
<ol>
<li>If someone tampers with an installed android app (apk file), are there any checks done at the time of launching to ensure integrity of an app is not compromised?  As I  understand there are no checks performed at launch time and I am trying to do the following:</li>
<li>I am trying to compute SHA-1 digests of the installed applications (apk file).  I am aware that an apk file is like a zip file.  It consists of other files.  However, I am treating it as any other file (just a stream of bytes) and trying to compute SHA-1 digests of all the apk files.  Are there any problems with this approach?  The following code kept on giving null exception: </li>
</ol>

<p>private static byte[] getSHA1FromFileContent(String filename)
{</p>

<pre><code>try
{
    MessageDigest digest = MessageDigest.getInstance("SHA-1");
    //byte[] buffer = new byte[65536]; //created at start.
    final FileInputStream fis = new FileInputStream(filename);
    int n = 0;
    byte[] buffer = null;
    while (n != -1)
    {
        n = fis.read(buffer);
        if (n &gt; 0)
        {
            digest.update(buffer, 0, n);
        }
    }
    byte[] digestResult = digest.digest();
    return digestResult;
}
catch (Exception e)
{
    return null;
}
</code></pre>

<p>}</p>

<p>As an alternative when I attempted to retrieve the files from the apk file and save the individual files as follows, I again kept on null exception </p>

<pre><code>public void unzip() 
{ 
        try  
        { 
          FileInputStream fin = new FileInputStream(_zipFile); 
          ZipInputStream zin = new ZipInputStream(fin); 
          ZipEntry ze = null; 
          while ((ze = zin.getNextEntry()) != null) 
          { 
            Log.v("Decompress", "Unzipping " + ze.getName()); 

            if(ze.isDirectory()) { 
              _dirChecker(ze.getName()); 
            } else { 
                File dstfile = new File(_location + ze.getName()); 
                dstfile.createNewFile();
            FileOutputStream fout = new FileOutputStream(dstfile.getPath()); 
            //OutputStream out = openFileOutput(_location + ze.getName(), Context.MODE_PRIVATE);
            for (int c = zin.read(); c != -1; c = zin.read()) { 
                fout.write(c); 
              } 

              zin.closeEntry(); 
              fout.close(); 
            } 

          } 
          zin.close(); 
        } 
        catch(Exception e) 
        { 
          Log.e("Decompress", "unzip", e); 
        } 
}   
</code></pre>

<ol>
<li>I am also verifying the application configuration by way of - PreferencesManager.getDefaultSharedPreferences call providing the package name of the application as input parameter  </li>
<li>In order to verify the integrity of an installed application is the above check enough?</li>
</ol>
