Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

4.1.1 - androguard sign --show --all is broken - same way as Androguard 3.* was broken in #764 #1031

Closed
olokos opened this issue Apr 9, 2024 · 1 comment

Comments

@olokos
Copy link
Contributor

olokos commented Apr 9, 2024

Describe what you wanted to do

  • is this error specific to a single file? NO
  • if possible give a minimal working example where the error happens
    The error happens for all apk files with the default latest release.

Describe what you expected

to get signature output from androguard

Describe what actually happened

deprecated error with ApiException

System Information

  • Androguard Version: 4.1.1 release & current MASTER
  • Python Version: 3.11.7
  • Operating System: Windows 10/11

Further Log Files and Output

androguard\cli\main.py", line 366, in androsign_main
    print("Fingerprint:", binascii.hexlify(x509_public_key.fingerprint))
                                           ^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "asn1crypto\keys.py", line 1299, in fingerprint
    raise APIException(
asn1crypto._errors.APIException: asn1crypto.keys.PublicKeyInfo().fingerprint has been removed, please use oscrypto.asymmetric.PublicKey().fingerprint instead

The issue existed in Androguard 3 source and still exists in latest 4.1.1 release, I've checked all commits after the release and there's no fix in the commits.

As a result, latest release of androguard has a broken sign functionality, this issue happens regardless of sample apk.

This is the exact same bug as #764 that still remains unfixed in the upstream repository.

olokos added a commit to olokos/androguard-olokos-upstream that referenced this issue Apr 22, 2024
…).fingerprint removed

This commit replaces the outdated:
`asn1crypto.keys.PublicKeyInfo().fingerprint` call

With the new:
`oscrypto.asymmetric.PublicKey().fingerprint` call

ValueError/ve is properly excepted and when printed, it shows "Only DSA keys are generated using a hash algorithm, this key is RSA" for RSA signed apk's.

This commit satisfies the:
`asn1crypto._errors.APIException: asn1crypto.keys.PublicKeyInfo().fingerprint has been removed, please use oscrypto.asymmetric.PublicKey().fingerprint instead`
while still keeping the original behavior.
olokos added a commit to olokos/androguard-olokos-upstream that referenced this issue Apr 22, 2024
…emoved

This commit replaces the outdated:
    asn1crypto.keys.PublicKeyInfo().fingerprint` call

With the new:
    oscrypto.asymmetric.PublicKey().fingerprint` call

ValueError/ve is properly excepted and when printed, it shows "Only DSA keys are generated using a hash algorithm, this key is RSA" for RSA signed apk's.

This commit satisfies the:
    asn1crypto._errors.APIException: asn1crypto.keys.PublicKeyInfo().fingerprint has been removed, please use oscrypto.asymmetric.PublicKey().fingerprint instead`
while still keeping the original behavior.
@olokos
Copy link
Contributor Author

olokos commented Apr 22, 2024

First two commits are removed, as I did not like how the commit message name was shortened on github.com

The current PR for this issue is #1040 - I tested it and it works as designed, solving the fingerprint issue on newer androguard installations, since .fingerprint was removed from newer asn1crypto versions and moved into oscrypto instead.

@erev0s erev0s closed this as completed in be77adf Apr 27, 2024
erev0s added a commit that referenced this issue Apr 27, 2024
androsign: Fix #1031 & #764 - use oscrypto to load public_key instead…
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant