A legal installation package acquiring method, performed by a terminal and comprising: acquiring (201, 401) characteristic information of a first installation package, the characteristic information uniquely identifying codes of the first installation package; sending (202, 402) the characteristic information to an authentication server, the characteristic information triggering the authentication server to feed back to the terminal a differential package corresponding to the characteristic information when the authentication server determines that the first installation package is an illegal installation package based on the characteristic information; receiving the differential package fed back by the authentication server, the differential package including a difference between the illegal installation package and a legal installation package corresponding to the illegal installation package; combining (204, 406) the differential package with the first installation package to obtain the legal installation package; acquiring characteristic information of a second installation package, when determining that the second installation package is an illegal installation package; and sending reporting information, which contains the characteristic information and an identifier of the second installation package, to the authentication server, the reporting information triggering the authentication server to increment a number of times of reporting the second installation package corresponding to the characteristic information and to determine the second installation package corresponding to the characteristic information as an illegal installation package when the number of times of reporting is greater than a predetermined reporting threshold. acquiring (201, 401) characteristic information of a first installation package, the characteristic information uniquely identifying codes of the first installation package; sending (202, 402) the characteristic information to an authentication server, the characteristic information triggering the authentication server to feed back to the terminal a differential package corresponding to the characteristic information when the authentication server determines that the first installation package is an illegal installation package based on the characteristic information; receiving the differential package fed back by the authentication server, the differential package including a difference between the illegal installation package and a legal installation package corresponding to the illegal installation package; combining (204, 406) the differential package with the first installation package to obtain the legal installation package; acquiring characteristic information of a second installation package, when determining that the second installation package is an illegal installation package; and sending reporting information, which contains the characteristic information and an identifier of the second installation package, to the authentication server, the reporting information triggering the authentication server to increment a number of times of reporting the second installation package corresponding to the characteristic information and to determine the second installation package corresponding to the characteristic information as an illegal installation package when the number of times of reporting is greater than a predetermined reporting threshold.