Command line tool to print MD5 / SHA1 / SHA256 fingerprints of Android APK package.
Why we need it?
keytool no longer print MD5 after java8.
But sometimes we do need the MD5 for example, in WeChat and AliPay developer console.
Some alternative tools do not work well:
-
Gen_Signature_Android.apk, need to be install to Android device, sometimes refused by Android device.
-
jadx, a powerful to decompile APK, we can view details of APK package, but it's too heavy.
To view the fingerprints, a very tiny command line tool will be enough.
Installation
Please make sure your Python is v3.7 or above.
python3 --version
python3 -m pip install apk-signatureOr, clone from GitHub:
git clone https://github.com/floatinghotpot/apk-signature.git
cd apk-signature
python3 -m pip install -e .How To Use
apk-signature <path_to_apk_file>Example:
apk-signature myapp.apkHow It Works
Here are the steps that the tool actualy runs:
# unzip the IPA file to tmp folder
mkdir ./tmp
unzip <path_to_apk_file> -d ./tmp
# run openssl to extract certificate file from CERT.RSA
openssl pkcs7 -inform DER -in ./tmp/META-INF/CERT.RSA -print_certs -out ./tmp/CERT.cert
# print the fingerprints in upper case
openssl x509 -in ./tmp/CERT.cert -fingerprint -noout -md5
openssl x509 -in ./tmp/CERT.cert -fingerprint -noout -sha1
openssl x509 -in ./tmp/CERT.cert -fingerprint -noout -sha256
# print the fingterprints in lower case
openssl x509 -in ./tmp/CERT.cert -outform DER | openssl dgst -md5
openssl x509 -in ./tmp/CERT.cert -outform DER | openssl dgst -sha1
openssl x509 -in ./tmp/CERT.cert -outform DER | openssl dgst -sha256
# clean up the tmp folder
rm -r ./tmpDependency
It will call openssl, so make sure it's installed first.
If not installed, install it with Homebrew:
brew install opensslCredits
A simple tool created by Raymond Xie, to print the MD5/SHA1/SHA256 signature of APK package with command line.
Any comments are welcome.
