阅读说明：本技术 应用程序安装包的构建方法、安装方法及装置 (Construction method, installation method and device of application program installation package ) 是由 魏小进 陈世亮 丁涛 朱庭俊 杨梅 刘硕 于 2021-09-10 设计创作，主要内容包括：本发明公开了应用程序安装包的构建方法,包括：计算待打包文件夹中各文件的哈希值,将各文件的文件名和各文件的哈希值关联,并保存在第一文件中,对所述第一文件的内容加密,并写入第二文件；将所述第二文件添加入所述待打包文件夹。本发明还提供了应用程序安装包的安装方法、应用程序安装包的构建装置及应用程序安装包的安装装置。本发明能够识别软件安装包中任何文件被纂改的情况,降低软件被盗版、被植入广告或病毒或勒索软件的可能性。(The invention discloses a construction method of an application program installation package, which comprises the following steps: calculating the hash value of each file in the folder to be packaged, associating the file name of each file with the hash value of each file, storing the file name of each file in a first file, encrypting the content of the first file, and writing the content into a second file; and adding the second file into the folder to be packaged. The invention also provides an installation method of the application program installation package, a construction device of the application program installation package and an installation device of the application program installation package. The invention can identify the condition that any file in the software installation package is tampered, and reduce the possibility that the software is pirated, implanted with advertisements or viruses or lasso software.)

1. The construction method of the application program installation package is characterized by comprising the following steps:

calculating the hash value of each file in the folder to be packaged, associating the file name of each file with the hash value of each file, storing the file name of each file in a first file, encrypting the content of the first file, and writing the content into a second file;

and adding the second file into the folder to be packaged.

2. The method for constructing an application installation package according to claim 1, wherein the folder to be packaged is scanned, a file list of the folder to be packaged is generated, and hash values of files on the file list are sequentially calculated.

3. The method for constructing the application installation package according to claim 1, wherein after the second file is added to the folder to be packaged, the folder to be packaged is packaged as a self-extracting program, and an installation program to be run after the extraction is specified.

4. The method of constructing an application installation package according to claim 3, further comprising:

and digitally signing the self-decompression program.

5. The method for installing the application program installation package is characterized by comprising the following steps:

checking whether the second file exists in an installation file folder or not, if so, decrypting the second file to obtain the content of the first file, wherein the first file comprises the file name of each file in the installation file and the hash value of each file;

and calculating the hash value of each file in the installation folder, comparing the hash value with the hash value of each file recorded in the first file, and if the hash values are the same, executing installation.

6. The method of installing an application installation package of claim 5, wherein if the second file does not exist, then installation is not performed.

7. The method for constructing an application installation package according to claim 5, wherein if the hash value of each file recorded in the first file is different, no installation is performed.

8. The method of constructing an application installation package according to claim 5, further comprising:

and running a self-decompression program to obtain the installation folder, wherein the self-decompression program is obtained by packaging the installation folder.

9. The device for constructing the application program installation package is characterized by comprising the following components:

a processor;

a memory storing executable instructions;

wherein the processor is configured to execute the executable instructions to execute the method for constructing the application installation package according to any one of claims 1 to 4.

10. An installation apparatus for an application installation package, comprising:

a processor;

a memory storing executable instructions;

wherein the processor is configured to execute the executable instructions to perform the method of installing an application installation package of any of claims 5 to 8.

Technical Field

The present invention relates to the field of computer-related technology. More specifically, the invention relates to a construction method, an installation method and a device of an application program installation package.

Background

A software installation package is a collection of files that contains the files to be deployed onto a target computer, including all the files for a software installation. And operating the installation program in the installation package, releasing all files of the software to a hard disk, and finishing the work of modifying a registry, modifying system setting, creating shortcuts and the like.

As installation becomes the initial and common step in the software usage process, a customized installation program is necessary to avoid the repeated investment of manpower in designing the installation program, to speed up the release and marketing of software, and to reduce the trouble of the user in learning how to install. But the existing stereotyped installation program does not have the function of checking that the files in the installation package are falsified. The software installation package is maliciously tampered with to show that the function of the software is modified by a third party, advertisements or viruses can be implanted into the software by the third party, the advertisements can be seen when a user opens or uses the software, the identity information of the user can be seriously revealed under the serious condition, the system is poisoned and the like. Although some files of the installation package can verify whether the files are tampered by checking the digital signature, most files do not support the digital signature, the digital signature needs to purchase special signature software, and the verification of the signature also needs professional verification technology and is inconvenient to use. Therefore, it is desirable to design a technical solution that can overcome the above-mentioned drawbacks to a certain extent.

Disclosure of Invention

An object of the present invention is to provide a method for constructing an application installation package, an installation method and an apparatus thereof, which can identify the situation that any file in a software installation package is tampered with, and reduce the possibility that software is pirated, implanted with advertisements or viruses or Lesoh software.

To achieve these objects and other advantages and in accordance with the purpose of the invention, as embodied and broadly described herein, there is provided a method for building an application installation package, comprising: calculating the hash value of each file in the folder to be packaged, associating the file name of each file with the hash value of each file, storing the file name of each file in a first file, encrypting the content of the first file, and writing the content into a second file; and adding the second file into the folder to be packaged.

Further, scanning the folder to be packaged, generating a file list of the folder to be packaged, and sequentially calculating hash values of the files on the file list.

Further, after the second file is added into the folder to be packaged, the folder to be packaged is packaged into a self-decompression program, and an installation program to be operated after decompression is specified.

Further, still include: and digitally signing the self-decompression program.

According to another aspect of the present invention, there is provided an installation method of an application installation package, including: checking whether the second file exists in an installation file folder or not, if so, decrypting the second file to obtain the content of the first file, wherein the first file comprises the file name of each file in the installation file and the hash value of each file; and calculating the hash value of each file in the installation folder, comparing the hash value with the hash value of each file recorded in the first file, and if the hash values are the same, executing installation.

Further, if the second file does not exist, the installation is not executed.

Further, if the hash value of each file recorded in the first file is different, the installation is not executed.

Further, still include: and running a self-decompression program to obtain the installation folder, wherein the self-decompression program is obtained by packaging the installation folder.

According to still another aspect of the present invention, there is provided an apparatus for building an application installation package, including: a processor; a memory storing executable instructions; wherein the processor is configured to execute the executable instructions to perform the method for building the application installation package.

According to still another aspect of the present invention, there is provided an installation apparatus of an application installation package, including: a processor; a memory storing executable instructions; wherein the processor is configured to execute the executable instructions to perform the installation method of the application installation package.

The invention at least comprises the following beneficial effects:

when an application program installation package is constructed, adding a second file into a folder to be packaged, wherein the second file is obtained by encrypting the content of a first file, and the first file comprises the file name of each file in the folder to be packaged and the hash value of each file; when the application program installation package is installed, whether the second file exists needs to be checked firstly, then the second file is decrypted, whether the files in the installation file folder are consistent with the records of the first file is checked, and after two checks, the condition that any file in the software installation package is falsified can be identified, so that the possibility that the software is pirated, and is implanted with advertisements or viruses or Lesson software is reduced.

Additional advantages, objects, and features of the invention will be set forth in part in the description which follows and in part will become apparent to those having ordinary skill in the art upon examination of the following or may be learned from practice of the invention.

Drawings

FIG. 1 is a method for building an application installation package, according to an embodiment of the present invention;

FIG. 2 is a block diagram illustrating a method for installing an application installation package, according to an embodiment of the present invention.

Detailed Description

The present invention is further described in detail below with reference to the attached drawings so that those skilled in the art can implement the invention by referring to the description text.

It will be understood that terms such as "having," "including," and "comprising," as used herein, do not preclude the presence or addition of one or more other elements or groups thereof.

The embodiment of the application provides a method for constructing an application program installation package, which comprises the following steps: 1) calculating the hash value of each file in the folder to be packaged, associating the file name of each file with the hash value of each file, storing the file name of each file in a first file, encrypting the content of the first file, and writing the content into a second file; 2) and adding the second file into the folder to be packaged.

In step 1), the folder to be packaged includes an installation program and other necessary files, hash algorithms are respectively used for the files, the hash algorithms can be selected from any one of the hash algorithms, SHA1-256 can be selected, the file names of the files and the hash values of the files are associated to be respectively used as a record, the record is stored in a first file, the content of the first file is encrypted, the second file is written, and the encryption method can be any appropriate file encryption algorithm, such as AES 256. In the step 2), adding the second file into the folder to be packaged so as to form the application program installation package. When the installation package is installed, whether a second file exists is detected, if not, installation is stopped, if yes, the second file is decrypted to obtain the content of the first file, according to the file name of the first file, the same hash algorithm is used for calculating hash values in sequence, the hash values are compared with the hash values recorded in the first file respectively, if not, installation is stopped, and if yes, installation is continuously executed. It can be seen that the second file is placed in the folder to be packaged in advance, so that the installation package can be checked twice before installation, the situation that any file in the software installation package is tampered can be identified, and the possibility that software is pirated, and is implanted with advertisements or viruses or Lesoh software is reduced.

In other embodiments, the folder to be packaged is scanned, a file list of the folder to be packaged is generated, hash values of the files on the file list are sequentially calculated, file names of the files are obtained according to the file list, and a hash algorithm is sequentially executed, so that the efficiency is higher.

In other embodiments, after the second file is added into the folder to be packaged, the folder to be packaged is packaged into a self-decompression program, and an installation program to be run after decompression is specified, so that a user can install the file conveniently.

In other embodiments, further comprising: and performing digital signature on the self-decompression program, so that the self-decompression program needs to be verified, and the difficulty of tampering the self-decompression program is improved.

In other embodiments, the installation package builder scans folders to be packaged to obtain all file lists; the installation package building program calculates hash values (SHA1-256) for all file contents in the file list, and saves the file name and the hash values in a file A. Each file is a record; the installation package building program encrypts the content of the file A and writes the encrypted content into a file B; the installation package building program puts the file B into a folder to be packaged; the installation package building program packages the file folder into a self-decompression program, and specifies an installation program to be operated after decompression; carrying out digital signature on the generated self-decompression program; and all the work of the installation package building program is finished.

The embodiment of the application also provides an installation method of the application program installation package, which comprises the following steps: a) checking whether the second file exists in an installation file folder or not, if so, decrypting the second file to obtain the content of the first file, wherein the first file comprises the file name of each file in the installation file and the hash value of each file; b) and calculating the hash value of each file in the installation folder, comparing the hash values with the hash values of the files recorded in the first file, and executing installation if the hash values are the same.

The embodiment provides a method for installing an obtained application program installation package, which is to perform verification before installation, and embed a verification process and a decryption algorithm, such as an AES256 decryption algorithm, into an installation program, where an installation folder is obtained by decompressing the application program installation package, and first verify whether a second file exists in the installation folder, if so, the installation program decrypts the second file to obtain the content of a first file, and according to the file names therein, calculate hash values in sequence by using the same hash algorithm, compare the hash values with hash values recorded in the first file, and if so, continue to perform installation. The method can be used for verifying the installation package twice before installation, can identify the condition that any file in the software installation package is tampered, and reduces the possibility that the software is pirated, implanted with advertisements or viruses or Lesoh software.

In other embodiments, if the second file does not exist, the installation is not executed, whether the second file exists or not can be compared through a preset file name, and when the second file does not exist, the fact that the installation package is tampered is indicated.

In other embodiments, if the hash value of each file recorded in the first file is different, the installation is not performed, and if the hash value of each file recorded in the first file is different, it indicates that a certain file in the installation package is tampered.

In other embodiments, further comprising: and running a self-decompression program to obtain the installation folder, wherein the self-decompression program is obtained by packaging the installation folder, and the self-decompression program is convenient for a user to install.

In other embodiments, the method comprises: running a self-decompression program to complete self-decompression, and starting a decompressed installation program; the installation program checks whether the file B exists; if not, an error is reported to exit; the installation program decrypts the file B to obtain a file list to be verified and a corresponding hash value; for all entries in the file list: obtaining a decompressed complete path according to the file name; calculating the hash value of the file content according to the complete path; comparing the hash value obtained by calculation with the hash value in the item, and if the hash values are different, reporting an error and exiting; installing the file to be installed to the target position by the installing program; from this point the installation procedure is completed.

An embodiment of the present application further provides a device for constructing an application installation package, including: a processor; a memory storing executable instructions; wherein the processor is configured to execute the executable instructions to perform the method for building the application installation package. The processor and the memory can adopt the prior art, the memory stores the installation package construction program, and the installation package construction program executes the application program installation package construction method.

An embodiment of the present application further provides an installation apparatus for an application installation package, including: a processor; a memory storing executable instructions; wherein the processor is configured to execute the executable instructions to perform the installation method of the application installation package. The processor and the memory can adopt the prior art, the memory stores the installation package running program, and the installation package constructing program executes the installation method of the application program installation package.

The following description is given with reference to an embodiment, as shown in fig. 1 and 2.

1. The files to be packed (file 1.txt, file 2.exe) and the installer. exe are put into folder D: \ test

2. Running an installation package building program, and selecting folder D: \ test to be packaged and a post point of an installation program Installer.exe after decompression to be packaged;

3. the installation package building program scans folders to be packaged to obtain all file lists; (S1)

4. The installation package construction program calculates the hash values (SHA1-256) of the contents of the files 1.txt and 2.exe in the D: \ test to obtain a hash value 1 and a hash value 2. Storing two records of (file 1.txt, hash value 1) and (file 2.exe, hash value 2) in a file A; (S2)

5. The installation package building program encrypts the content of the file A (corresponding to the first file) and writes the encrypted content into the file B; (S3)

6. The installation package building program puts the file B (corresponding to the second file) into the folder D to be packaged, wherein the folder D is \ test; (S4)

7. The installation package building program packs D, wherein the test self-decompression program is Setup.exe, and an installation program installer.exe to be operated after decompression is specified; (S5)

8. Digitally signing the generated self-decompression program setup.exe; (S6, optional step)

And all the work of the installation package building program is finished.

9. Running setup.exe to complete self-decompression, and starting a decompressed installation program Installer.exe; (S7)

10. Instoller. exe checks if file B exists; if not, an error is reported to exit; (S8)

11. The Installer.exe decrypts the file B to obtain a list of files to be verified and a corresponding hash value; (S9)

12. Instoller. exe for all entries in the file list: (S10)

Obtaining a decompressed complete path according to the file name; (S101)

Calculating the hash value of the file content according to the complete path; (S102)

Comparing the hash value obtained by calculation with the hash value in the item, and if the hash values are different, reporting an error and exiting; (S103)

Installing the file to be installed to the target position by the installing program; (S104)

From this point the installation procedure is completed.

The number of apparatuses and the scale of the process described herein are intended to simplify the description of the present invention. Applications, modifications and variations of the construction method of the application installation package of the present invention will be apparent to those skilled in the art.

While embodiments of the invention have been described above, it is not limited to the applications set forth in the description and the embodiments, which are fully applicable in various fields of endeavor to which the invention pertains, and further modifications may readily be made by those skilled in the art, it being understood that the invention is not limited to the details shown and described herein without departing from the general concept defined by the appended claims and their equivalents.