TTSDK

TTSDK(TrustTracker SDK，简称TTSDK)，由江苏先安科技有限公司开发，用于验证和追溯APK(Android Application Package file)签名。

TTSDK分两个版本：TTSDK-Android和TTSDK-PC。TTSDK以Jar包的形式提供，封装了Android系统下PKI相关的功能模块，提供了对Android APK中签名文件的解析、副署签名的验证，支持通过SVS和OCSP两种方式查询签名证书状态。使用TTSDK可以方便快速的将验证和追溯APK签名的代码集成到已有的平台或者APP中。

TTSDK的使用许可如下:

部分示例代码如下：
1)对未安装的APK验证其原生签名

//首先获得未安装APK的全路径
String apkPath ="../../XXX.apk";

//然后调用TTAPKSignatureVerifier的静态函数验证即可
boolean result = TTAPKSignatureVerifier. verifySignature (apkPath);

2)判断APK(已安装)是否含有副署签名，如有并验证签名

PackageInfo packageInfo = ...;//获得App 的PackageInfo对象
//读取 Apk 中的包含签名信息的RSA数据
byte[] rsaData = TTCounterSignatureTracker.readRSAFile(packageInfo);
//构造副署签名的 Verifier
TTCounterSignatureVerifier csVerifier = new TTCounterSignatureVerifier(rsaData);
//判断 RSA 数据中是否含有副署签名
Boolean hasCounterSign = csVerifier.hasCounterSignature();
if (hasCounterSign) {
  //校验RSA数据中的副署签名是否正确，这里校验每一个副署签名，只要一个副署签名验证失败，
  //则返回验证结果false，全部都通过，返回true
  Boolean isCSCorrect = csVerifier.verifyCounterSignature();
  ....
}

3）判断APK(未安装)是否含有副署签名，如果有验证副署签名

//首先获得未安装APK的全路径
String apkPath = "../../XX.APK";//获得App的全路径

//然后构造副署签名验证器
TTCounterSignatureVerifier verifier= new TTCounterSignatureVerifier (apkPath);

//判断是否含有副署签名，如果有则验证副署签名
if(verifier. hasCounterSignature()){
  boolean result = verifier. verifyCounterSignature();
}

4)在线查询数字证书状态

//在线SVS方式验证证书状态
String entityCert = "MII..";//实体证书
//构造SVS方式的证书验证器
TTSVSVerifier svsVerifier =new TTSVSVerifier();
//验证证书
boolean result = svsVerifier.verify(entityCert);
//如果验证结果失败，获取错误代码
if(!result){
	String errorCode = svsVerifier.getErrorCode();
}

TTSDK-Andorid 目前最新的版本是v1.1.0，下载地址如下：

下载 “TTSDK-Android v1.1.0”

ttsdk-android-1.1.0.zip – 已下载4468次 – 1.52 MB

TTSDK-PC目前最新的版本是v1.1.0，下载地址如下：

下载 “TTSDK-PC v1.1.0”

ttsdk-pc-1.1.0.zip – 已下载2765次 – 1.61 MB

TTSDK使用了BouncyCastle库, 下面是BouncyCastle许可信息:

LICENSE
Copyright (c) 2000 – 2013 The Legion of the Bouncy Castle Inc. (http://www.bouncycastle.org)

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the “Software”), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.