How to hit the SHA-1 value of a lost Android key

The experiment revealed that Android SHA-1 is related to the time when keytool generates the key signature file.

 

The prerequisite is that the developer must know all the detailed parameters for generating the secret key 

The following is the file collision code (repeatedly generated)

import time
import os


idx = 0

while True:
    cmd='keytool -keyalg RSA -genkeypair -alias androiddebugkey -keypass android -keystore debug' + str(idx) + '.keystore -storepass android -dname "CN=Android Debug,O=Android,C=US" -validity 9999 -deststoretype pkcs12'
    os.system(cmd)
    time.sleep(0.001)#1ms
    idx +=1