The latest update of Google Maps is unavailable in my country, so I downloaded a version by googling for "Google Maps 5.4.0 apk". I did in fact find it, but now I wonder how I can tell if this is in fact the same version as in the market.

How can I be sure that it hasn't been tampered with? Are apps signed in any way? Is there any way of checking the signatures?

  • If you visit, from your mobile, the page: m.google.com/maps, does it offer you a download link or something alike? – Nicolás May 14 '11 at 16:23
  • @Nicolás: It links to the market, from which I can't download it. – Nathan Fellman May 14 '11 at 16:29
  • Not surprising coming from google. By the way, and I know I'm not answering your original question, but have you tested MapDroyd? – Nicolás May 14 '11 at 16:38
  • @Nicolás: I haven't, and I actually use Waze for my day to day navigation. Google Maps is just an example. Google Books is another example, Google Streetview yet another (in fact it looks like only Google apps give me this trouble...) – Nathan Fellman May 14 '11 at 16:52
  • 1
    If you have a second app that is "authentic" and comes from the same vendor, you can compare if both apps are signed using the same keys/identity: android.stackexchange.com/a/208326/2241 – Robert May 15 at 18:28

Sidestepping the debate over the legitimacy of installing that app on your phone, the question of verification is one that I've been meaning to understand for a while, and you've prompted me to try to figure out a possible way of verifying who signed an apk.

Android apps are signed in the normal manner of .jar files (.apk is really just a special .jar which is just a special .zip) however it may not be trivial to trace the authenticity of the certificates unless you have something known good to compare to. That's basically what the phone itself does - verifies that something that claims to be from the same party as something already on the phone actually is - the phone doesn't refuse to install things with unknown signers, it can only (object to/clear application data of) apparent forgeries when something new doesn't match something old that it claims to.

You will need to have jarsigner and keytool. I believe these come from the JDK which is a prerequisite to the android SDK rather than the SDK itself.

First you want try to verify the public key contained within the .apk. Usually this is in META-INF/CERTS.RSA but it can be in another file - unzip -l will tell you. You want to see what you can find out about it:

unzip -p suspect.apk META-INF/CERT.RSA | keytool -printcert

That's going to dump out a lot of information about who the signer claims to be. Some certificates are apparently themselves signed by known parties, but without figuring out how to trace that, I suspect you could do something like this:

unzip -p suspect.apk META-INF/CERT.RSA | keytool -printcert | grep MD5
unzip -p knowngood.apk META-INF/CERT.RSA | keytool -printcert | grep MD5

If you have a known trusted apk from the same author who used the same certificate. I'm assuming that the certificates having the same MD5 sum is enough.

Assuming you've decided to trust the certificate, then you can see if it has been used to sign each of the files within the .apk

jarsigner -verbose -verify suspect.apk

(If there's more than one .RSA file in the archive, you should add the -certs flag to tell you which certificate(s) have been used to sign each file, so you can be sure its the certificate you verified)

  • 9
    Is there a way to verify a given apk is the same as the official one on the Google Play store? – Bryce Jan 12 '15 at 4:06
  • @Bryce I have the same question. Did you find an answer ? – Kaizer Sozay Sep 19 '15 at 2:16
  • @Chris Stratton Is it possible to copy Google Maps apk off a device ? Then one can check the certs as you said. – Kaizer Sozay Sep 19 '15 at 2:19
  • In addition, you can extract an APK from a device with the following application: play.google.com/store/apps/details?id=com.ext.ui&hl=en Best, Paul. [Edited by Moderator Firelord] – Spipau Aug 30 '17 at 9:50

There is (now) an apksigner tool in build-tools that does what you want. From the docs:

Check whether the APK's signatures are expected to be confirmed as valid on all Android platforms that the APK supports:

apksigner verify [options] app-name.apk

You can also try uploading the APK to the free VirusTotal.com virus checker. It will generate a unique hash for the APK and if others have already uploaded it to test it (very likely) then you will have more of an idea that the APK is valid.

The service will also scan the APK with over 60 virus scanners and let you know if it believes it has similar signatures to viruses already found.


To compare certificates from a suspect apk file, maybe one idea is to download it's version on the official Play Store on your phone, doing a backup on your computer and go in the backup directory, select the concerned apk file and do the same checks. You can also view the Google certificates by doing the check on a device-default application (like any com.google.android.* apk)

protected by Community Jul 22 at 11:08

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.