在日常開發(fā)中，我們會把一些關(guān)鍵的算法與數(shù)據(jù)使用c++編寫，然后打包成so文件使用。

下面舉一個典型的例子

extern "C"
JNIEXPORT jstring JNICALL
Java_com_aizuzi_verificationdemo_MainActivity_getToken(
        JNIEnv *env,
        jobject,
        jstring userId) {

    char* cUserId = jstring2CStr(env,userId);
    char* code = "123456";

    char* result = (char*)malloc((strlen(cUserId) + strlen(code) + 1));
    memset(result,0,sizeof(result));
    strcat(result,cUserId);
    strcat(result,code);

    return env->NewStringUTF(result);
}

java調(diào)用

public native String getToken(String userId);

使用getToken(String userId)就能獲取到加密處理后的token，這樣看起來已經(jīng)達(dá)到加密的要求了，反編譯后也只能混淆處理后getToken方法，這樣就能夠確保數(shù)據(jù)萬無一失了嗎？too young too native?。?！

因為反編譯后已經(jīng)知道我們的應(yīng)用包名與方法參數(shù)，解壓apk后so文件也非常容易的獲取到，所以只要新建一個java類就能輕松的獲取到so文件加密的數(shù)據(jù)了。

那我們怎樣防止生成的so文件被其他人盜用呢？我們知道每個應(yīng)用必須簽名才能安裝，這個簽名只有我們內(nèi)部人員才能獲取，所以如果我們在so文件里能判斷是否是正確的簽名才返回，否則拋出異常，這就能解決so文件被盜用的問題了。

下面的例子我已經(jīng)做成Demo上傳到github，地址：
aizuzi/SignatureVerificationDemo

驗證成功

驗證失敗

首先修改一下getToken方法，我們把上下文對象通過jni傳遞進(jìn)去

 public native String getToken(Context context,String userId);

c++層處理

extern "C"
JNIEXPORT jstring JNICALL
Java_com_aizuzi_verificationdemo_MainActivity_getToken(
        JNIEnv *env,
        jobject,
        jobject contextObject,
        jstring userId) {

    char *sha1 = getSha1(env,contextObject);
    jboolean result = checkValidity(env,sha1);
    if(result){
        return env->NewStringUTF("獲取Token成功");
    }else{
        return env->NewStringUTF("獲取失敗，請檢查valid.cpp文件配置的sha1值");
    }
}

getSha1方法與checkValidity方法

//簽名信息
const char *app_sha1="81BA0CF9134C6415F34C3BCC854913A53C71415E";
const char hexcode[] = {'0','1','2','3','4','5','6','7','8','9','A','B','C','D','E','F'};

char* getSha1(JNIEnv *env, jobject context_object){
    //上下文對象
    jclass context_class = env->GetObjectClass(context_object);

    //反射獲取PackageManager
    jmethodID methodId = env->GetMethodID(context_class, "getPackageManager", "()Landroid/content/pm/PackageManager;");
    jobject package_manager = env->CallObjectMethod(context_object, methodId);
    if (package_manager == NULL) {
        LOGD("package_manager is NULL!!!");
        return NULL;
    }

    //反射獲取包名
    methodId = env->GetMethodID(context_class, "getPackageName", "()Ljava/lang/String;");
    jstring package_name = (jstring)env->CallObjectMethod(context_object, methodId);
    if (package_name == NULL) {
        LOGD("package_name is NULL!!!");
        return NULL;
    }
    env->DeleteLocalRef(context_class);

    //獲取PackageInfo對象
    jclass pack_manager_class = env->GetObjectClass(package_manager);
    methodId = env->GetMethodID(pack_manager_class, "getPackageInfo", "(Ljava/lang/String;I)Landroid/content/pm/PackageInfo;");
    env->DeleteLocalRef(pack_manager_class);
    jobject package_info = env->CallObjectMethod(package_manager, methodId, package_name, 0x40);
    if (package_info == NULL) {
        LOGD("getPackageInfo() is NULL!!!");
        return NULL;
    }
    env->DeleteLocalRef(package_manager);

    //獲取簽名信息
    jclass package_info_class = env->GetObjectClass(package_info);
    jfieldID fieldId = env->GetFieldID(package_info_class, "signatures", "[Landroid/content/pm/Signature;");
    env->DeleteLocalRef(package_info_class);
    jobjectArray signature_object_array = (jobjectArray)env->GetObjectField(package_info, fieldId);
    if (signature_object_array == NULL) {
        LOGD("signature is NULL!!!");
        return NULL;
    }
    jobject signature_object = env->GetObjectArrayElement(signature_object_array, 0);
    env->DeleteLocalRef(package_info);

    //簽名信息轉(zhuǎn)換成sha1值
    jclass signature_class = env->GetObjectClass(signature_object);
    methodId = env->GetMethodID(signature_class, "toByteArray", "()[B");
    env->DeleteLocalRef(signature_class);
    jbyteArray signature_byte = (jbyteArray) env->CallObjectMethod(signature_object, methodId);
    jclass byte_array_input_class=env->FindClass("java/io/ByteArrayInputStream");
    methodId=env->GetMethodID(byte_array_input_class,"<init>","([B)V");
    jobject byte_array_input=env->NewObject(byte_array_input_class,methodId,signature_byte);
    jclass certificate_factory_class=env->FindClass("java/security/cert/CertificateFactory");
    methodId=env->GetStaticMethodID(certificate_factory_class,"getInstance","(Ljava/lang/String;)Ljava/security/cert/CertificateFactory;");
    jstring x_509_jstring=env->NewStringUTF("X.509");
    jobject cert_factory=env->CallStaticObjectMethod(certificate_factory_class,methodId,x_509_jstring);
    methodId=env->GetMethodID(certificate_factory_class,"generateCertificate",("(Ljava/io/InputStream;)Ljava/security/cert/Certificate;"));
    jobject x509_cert=env->CallObjectMethod(cert_factory,methodId,byte_array_input);
    env->DeleteLocalRef(certificate_factory_class);
    jclass x509_cert_class=env->GetObjectClass(x509_cert);
    methodId=env->GetMethodID(x509_cert_class,"getEncoded","()[B");
    jbyteArray cert_byte=(jbyteArray)env->CallObjectMethod(x509_cert,methodId);
    env->DeleteLocalRef(x509_cert_class);
    jclass message_digest_class=env->FindClass("java/security/MessageDigest");
    methodId=env->GetStaticMethodID(message_digest_class,"getInstance","(Ljava/lang/String;)Ljava/security/MessageDigest;");
    jstring sha1_jstring=env->NewStringUTF("SHA1");
    jobject sha1_digest=env->CallStaticObjectMethod(message_digest_class,methodId,sha1_jstring);
    methodId=env->GetMethodID(message_digest_class,"digest","([B)[B");
    jbyteArray sha1_byte=(jbyteArray)env->CallObjectMethod(sha1_digest,methodId,cert_byte);
    env->DeleteLocalRef(message_digest_class);

    //轉(zhuǎn)換成char
    jsize array_size=env->GetArrayLength(sha1_byte);
    jbyte* sha1 =env->GetByteArrayElements(sha1_byte,NULL);
    char *hex_sha=new char[array_size*2+1];
    for (int i = 0; i <array_size ; ++i) {
        hex_sha[2*i]=hexcode[((unsigned char)sha1[i])/16];
        hex_sha[2*i+1]=hexcode[((unsigned char)sha1[i])%16];
    }
    hex_sha[array_size*2]='\0';

    LOGD("hex_sha %s ",hex_sha);
    return hex_sha;
}

jboolean checkValidity(JNIEnv *env,char *sha1){
    //比較簽名
    if (strcmp(sha1,app_sha1)==0)
    {
        LOGD("驗證成功");
        return true;
    }
    LOGD("驗證失敗");
    return false;
}