Question

Is there a way to determine if 2 APKs with same package name is different (assumming that they are coming from 2 different market)? Does getting the hash of the applications would help me? Thanks

Answer 1

Computing a hash or digital signature on the APKs will tell you if they’re exactly identical. If you want to know whether they are functionally equivalent, then you’ll have to extract the contents and examine the resources and executable files. If they have the same names, that would give me about 50% confidence that they are equivalent. If they implement all the same classes and methods (by name), I’d be about 90% certain they are functionally equivalent.

How to calculate an MD5 signature of a file on Linux:

md5sum filename

How to calculate an MD5 signature of a file on Mac or BSD:

md5 filename

How to calculate an MD5/SHA1/SHA512 signature of a file using OpenSSL:

openssl dgst -md5 filename
openssl dgst -sha1 filename
openssl dgst -sha512 filename

How to calculate a signature across all the files in a directory:

cat * | md5sum
cat * | openssl dgst -sha512