App签名原理以及应用的重签名

在日常开发中，我们都是利用Xcode来打包签名我们的应用的，在签名过程中需要的是文件主要包括：

1、CertificateSigningRequest.certSigningRequest
2、App ID
3、创建的证书(aps_development.cer)
4、配置文件(demo.mobileprovision)
5、真机的测试还需要注册手机

CertificateSigningRequest.certSigningRequest

包括：申请者信息、申请者公钥、摘要算法和公钥加密算法

    0:d=0  hl=4 l= 642 cons: SEQUENCE          4:d=1  hl=4 l= 362 cons:  SEQUENCE          8:d=2  hl=2 l=   1 prim:   INTEGER           :0011:d=2  hl=2 l=  61 cons:   SEQUENCE          13:d=3  hl=2 l=  32 cons:    SET               15:d=4  hl=2 l=  30 cons:     SEQUENCE          17:d=5  hl=2 l=   9 prim:      OBJECT            :emailAddress28:d=5  hl=2 l=  17 prim:      IA5STRING         :2186682180@qq.com47:d=3  hl=2 l=  12 cons:    SET               49:d=4  hl=2 l=  10 cons:     SEQUENCE          51:d=5  hl=2 l=   3 prim:      OBJECT            :commonName56:d=5  hl=2 l=   3 prim:      UTF8STRING        :mac61:d=3  hl=2 l=  11 cons:    SET               63:d=4  hl=2 l=   9 cons:     SEQUENCE          65:d=5  hl=2 l=   3 prim:      OBJECT            :countryName70:d=5  hl=2 l=   2 prim:      PRINTABLESTRING   :CN74:d=2  hl=4 l= 290 cons:   SEQUENCE          78:d=3  hl=2 l=  13 cons:    SEQUENCE          80:d=4  hl=2 l=   9 prim:     OBJECT            :rsaEncryption91:d=4  hl=2 l=   0 prim:     NULL              93:d=3  hl=4 l= 271 prim:    BIT STRING        368:d=2  hl=2 l=   0 cons:   cont [ 0 ]        370:d=1  hl=2 l=  13 cons:  SEQUENCE          372:d=2  hl=2 l=   9 prim:   OBJECT            :sha256WithRSAEncryption383:d=2  hl=2 l=   0 prim:   NULL              385:d=1  hl=4 l= 257 prim:  BIT STRING

aps_development.cer

取出CertificateSigningRequest.certSigningRequest的公钥添加账号信息，再通过哈希算法生成一个信息摘要，使用苹果的CA私钥进行加密.
证书信息包括：申请者信息、申请者公钥、通过苹果私钥加密的数字签名

Certificate:Data:Version: 3 (0x2)Serial Number: 3374615860942785221 (0x2ed50b3efce4cac5)Signature Algorithm: sha1WithRSAEncryptionIssuer: C=US, O=Apple Inc., OU=Apple Worldwide Developer Relations, CN=Apple Worldwide Developer Relations Certification AuthorityValidityNot Before: Jul 26 03:32:12 2018 GMTNot After : Jul 26 03:32:12 2019 GMTSubject: UID=com.your.demo, CN=Apple Development IOS Push Services: com.your.demo, OU=C2R4SEKKYS, C=CNSubject Public Key Info:Public Key Algorithm: rsaEncryptionPublic-Key: (2048 bit)Modulus:00:d1:df:fa:d6:42:09:b7:f6:43:4b:a9:6a:ce:c7:26:ed:b3:11:a5:27:bb:7a:89:1f:dc:27:91:8c:1a:36:85:8a:7d:9a:90:33:77:0f:fc:a8:ad:78:68:35:02:ac:e4:79:95:a6:16:c6:46:6f:79:21:ae:2c:c1:a1:17:bd:53:eb:3d:53:c5:ec:6d:7b:9a:d8:e7:5f:78:ef:e6:bc:f2:57:fa:37:77:19:f5:ff:94:b1:10:7f:62:4a:5d:e6:cd:1c:66:0d:70:4d:af:12:ef:00:f0:36:96:55:40:11:06:fa:24:57:c3:b7:5e:4c:bc:6b:2e:bc:b4:dc:d1:66:d9:32:c6:3b:87:7c:81:0f:94:33:39:4b:17:5f:c1:81:61:04:f2:18:78:ee:d4:f1:a3:d0:1e:61:9c:e1:7d:7b:dd:f3:92:f5:a0:af:72:fc:d2:6b:2c:b3:d8:17:6e:e3:21:f2:25:64:3f:ec:7a:ae:dd:1a:b9:13:60:70:5f:6b:4a:a5:f3:16:21:d3:fb:88:91:d8:ca:70:21:c7:81:a9:80:9e:ce:a9:68:f4:50:4f:f1:f3:0c:fa:c7:e3:c8:6f:3a:aa:98:c3:f4:ce:f9:9f:84:ca:6e:de:c2:cd:94:73:7f:a6:bd:2e:1e:59:ce:f5:4c:ef:c9:b5:ae:c9:f8:ec:c3:43Exponent: 65537 (0x10001)X509v3 extensions:X509v3 Basic Constraints: CA:FALSEX509v3 Authority Key Identifier: keyid:88:27:17:09:A9:B6:18:60:8B:EC:EB:BA:F6:47:59:C5:52:54:A3:B7X509v3 Certificate Policies: Policy: 1.2.840.113635.100.5.1User Notice:Explicit Text: Reliance on this certificate by any party assumes acceptance of the then applicable standard terms and conditions of use, certificate policy and certification practice statements.CPS: http://www.apple.com/appleca/X509v3 Extended Key Usage: TLS Web Client AuthenticationX509v3 CRL Distribution Points: Full Name:URI:http://developer.apple.com/certificationauthority/wwdrca.crlX509v3 Subject Key Identifier: B7:E9:1B:B6:7D:55:12:FA:A0:BA:DA:32:DF:5B:6F:8A:07:89:D4:70X509v3 Key Usage: Digital Signature1.2.840.113635.100.6.3.1: ..Signature Algorithm: sha1WithRSAEncryption35:f4:44:43:f7:3a:fc:78:0d:35:72:34:71:6c:c9:77:c6:a2:c4:ac:c5:57:cf:04:50:9d:ba:d1:aa:e9:88:b7:e7:72:b0:35:57:7c:67:21:b7:30:7e:49:57:ce:3d:5c:38:5f:6f:18:a9:aa:38:c7:a9:36:d3:f0:a7:d8:07:91:39:a9:0d:83:1a:51:c6:39:bc:0b:47:78:25:eb:99:ec:1e:a9:0a:51:5e:d1:cb:05:c9:5f:da:f8:59:89:c2:ae:b5:5a:67:2c:f0:1c:75:39:90:8c:bf:5f:5d:5c:69:8d:06:e5:e4:41:33:5a:61:26:8f:b4:a6:64:47:e7:b0:99:8a:69:be:e7:21:17:92:56:9b:ee:44:62:a7:55:c9:93:24:14:eb:47:15:0d:0c:9f:77:77:2e:08:bf:94:3e:5f:9c:2c:8f:fd:31:21:8b:b5:f2:40:02:6f:be:93:eb:b9:5c:b4:4d:f0:07:07:19:3f:0d:f4:0b:a0:83:85:ad:62:71:44:9e:2c:13:66:5b:85:80:4f:dc:5d:c3:e3:ba:cc:ab:8b:c0:e4:f1:f6:e9:4c:ef:a5:c2:18:0f:d3:6c:72:42:1c:58:3c:5e:3c:08:8a:99:24:a0:9f:d6:4a:0f:14:64:57:bf:5e:20:77:b5:fc:35:78:35:fd:70:73:fe:2f

demo.mobileprovision

公钥包含在证书里面，证书又包含在配置文件里面，配置文件在打包APP时会被复制到.app目录下面
配置文件还包括：
App ID 、授权文件、使用的证书、可安装的设备列表

查看配置文件信息：
security cms -D -i embedded.mobileprovision

那么是如何保证证书是可信的呢？
申请者信息 + 申请者公钥通过->哈希算法生成->信息摘要
数字签名通过->iOS系统公钥解密生成->信息摘要
然后判断这两个信息摘要是否相等

对应用进行签名时，先使用证书所对应的私钥去对代码和资源等进行签名，在苹果系统检测证书合法后得到对应的公钥，再使用该公钥对应的签名合法性验证

授权文件：简单的说，授权文件（entitlements）是一个沙盒配置列表，其中列出了哪些行为会被允许，那些行为会被拒绝。

命令行对应用重签名

1、获取证书列表

 mac$ security find-identity -p codesigning -v1) 4F86649C742DA4AFF213D1282B8CC9615E7E0096 "iPhone Distribution: Sichuan Demo Times Technology Co., Ltd (C2R4SEKKYD)"2) 4FC6DA19E0EF58B1AAC1153987A3CD3B3360E35C "iPhone Developer: demo (SM4SR2949D)"2 valid identities found

2、生成entitlements.plist

1、新建一个Xcode项目，配置BundleIdentifier,保证和需要重签名应用的一致，编译生成.app文件，然后提取其中的embedded.mobileprovision文件
2、生成profile.plist文件
security cms -D -i embedded.mobileprovision > profile.plist
3、生成entitlements.plist文件
/usr/libexec/PlistBuddy -x -c 'Print :Entitlements' profile.plist > entitlements.plist

3、复制embedded.mobileprovision文件到Demo.app目录下
4、对动态库进行签名

codesign -fs 4FC6DA19E0EF58B1AAC1153987A3CD3B3360E35C 动态库

5、对整个目标APP进行签名

codesign -f -s 4FC6DA19E0EF58B1AAC1153987A3CD3B3360E35C --entitlements entitlements.plist Demo.app

5、生成ipa安装包

新建Payload目录，然后拷贝Demo.app到目录下，然后压缩该目录，然后重命名为demo.ipa即可，最后利用iTools安装到手机。

其他操作
向Mach-O文件中注入其他动态库

动态库注入工具
https://github.com/Tyilo/insert_dylib

1、下载代码编译，获得可执行文件 insert_dylib 拷贝到指定斌bin目录
2、注入动态库
insert_dylib  动态库加载路径   Mach-O文件
insert_dylib @executable_path/test_tweak.dylib AFDemo --all-yes --weak AFDemo
参数选项：
—weak  即使动态库找不到也不会报错
—all-yes  后面所有的选项都为yes
insert_dylib 的本质是往mach-o文件的Load Commands中添加一个LC_LOAD_DYLIB或LC_LOAD_WEAK_DYLIB
修改动态库加载地址
install_name_tool -change /Library/Frameworks/CydiaSubstrate.framework/CydiaSubstrate @loader_path/CydiaSubstrate ./test_tweak.dylib
@executable_path 代表可执行文件所在目录
@loader_path 代表动态库所在的目录
3、查看动态库是否注入成功
otool -L Mach-O文件