How to calculate/verify SHA-256-Digest from META-INF/*.SF file?

Question

I'm trying to manually verify an APK file in the way Android would do when such file is installed in some old system (<7). I have one problem I can't really solve.

They say the following:

As you can see, the signature file contains digest entries for the archive's files that look similar to the digest-value entries in the manifest. However, while the digest values in the manifest are computed from the files themselves, the digest values in the signature file are computed from the corresponding entries in the manifest.

So in this case, we have an example entry from the META-INF/MANIFEST.MF file, which is the following one:

Name: FingerprintProtocol.proto
SHA-256-Digest: WQ9R/MGV5m9Dye4Jtl3MiLRmX2RPoEPeinb3me7wnAU=

Now we take the corresponding entry from the META-INF/*.SF file, which looks like this:

Name: FingerprintProtocol.proto
SHA-256-Digest: fWL5eppUj0x6UVdPqHusFkpDbXpq7P0sqchfublqEnA=

The question is: How was fWL5eppUj0x6UVdPqHusFkpDbXpq7P0sqchfublqEnA calculated?

Answer 1

You are trying to verify the APK using the old and outdated JAR signature (aka APK signature scheme v1). This type of signature is outdated for Android as there are some attack scenarios in which a file exists multiple times inside the APK/ZIP file.

Therefore when verifying a APK files you should better rely on the APK signature scheme v2/v3 if present in the APK file. The current verification process is documented here: APK signature verification process

The Android SDK comes with a tool called apksigner.jar (can also be used as library in own Java programs) that allows to to verify an APK files using the most recent available method.

For more details on apksigner and how to use it see this answer: https://android.stackexchange.com/a/218161/2241

Answer 2

It looks like the section includes some white spaces and not only the text. The whole code that should be hashed is the following: