Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
Simple Android signature check. Please note: This was created in 2013, not actively maintained and may not be compatible with the latest Android versions. It's not particularly difficult for an attacker to decompile an .apk, find this tamper check, replace the APP_SIGNATURE with theirs and rebuild (or use method hooking to return true from `vali…
import android.content.Context;
import android.content.pm.PackageInfo;
import android.content.pm.PackageManager;
import android.content.pm.PackageManager.NameNotFoundException;
import android.content.pm.Signature;
public class TamperCheck {
//we store the hash of the signture for a little more protection
private static final String APP_SIGNATURE = "1038C0E34658923C4192E61B16846";
/**
* Query the signature for this application to detect whether it matches the
* signature of the real developer. If it doesn't the app must have been
* resigned, which indicates it may been tampered with.
*
* @param context
* @return true if the app's signature matches the expected signature.
* @throws NameNotFoundException
*/
public boolean validateAppSignature(Context context) throws NameNotFoundException {
PackageInfo packageInfo = context.getPackageManager().getPackageInfo(
getPackageName(), PackageManager.GET_SIGNATURES);
//note sample just checks the first signature
for (Signature signature : packageInfo.signatures) {
// SHA1 the signature
String sha1 = getSHA1(signature.toByteArray());
// check is matches hardcoded value
return APP_SIGNATURE.equals(sha1);
}
return false;
}
//computed the sha1 hash of the signature
public static String getSHA1(byte[] sig) {
MessageDigest digest = MessageDigest.getInstance("SHA1");
digest.update(sig);
byte[] hashtext = digest.digest();
return bytesToHex(hashtext);
}
//util method to convert byte array to hex string
public static String bytesToHex(byte[] bytes) {
final char[] hexArray = { '0', '1', '2', '3', '4', '5', '6', '7', '8',
'9', 'A', 'B', 'C', 'D', 'E', 'F' };
char[] hexChars = new char[bytes.length * 2];
int v;
for (int j = 0; j < bytes.length; j++) {
v = bytes[j] & 0xFF;
hexChars[j * 2] = hexArray[v >>> 4];
hexChars[j * 2 + 1] = hexArray[v & 0x0F];
}
return new String(hexChars);
}
}
@nildeka
Copy link

nildeka commented Nov 24, 2016

This is very useful. I have some query regarding signing key verification. What if the attacker decompiles the code and remove the function of validation(even with proguarded) or modifies the actual key APP_SIGNATURE

@Tindi
Copy link

Tindi commented Apr 11, 2017

What does it mean if it return false? I keep getting false

@doridori
Copy link

doridori commented Sep 19, 2017

Lint now will warn on PackageManager.GET_SIGNATURES due to the vuln spoken about here. SO suggests dont have to worry about this from 4.4. Personally I am only allowing one signature to be present. Who uses cert chains (on android) anyway!

@doridori
Copy link

doridori commented Sep 19, 2017

For paranoia purposes, may be better to use SHA-256 also? SO

Interesting as may want to just use default security provider (no BC dependency in code snippit)

@Omar1123
Copy link

Omar1123 commented Oct 2, 2017

A SHA1 is used because it is the algorithm with which the certificates are encrypted, you can see it as a standard even though there are examples of collisions with SHA1

@AswathiRevathi
Copy link

AswathiRevathi commented Apr 16, 2018

can i get a complete example on anti tamering
?

@DimaKoz
Copy link

DimaKoz commented Jun 24, 2018

@AswathiRevathi sure. The source code of native signature check can be found here: https://github.com/DimaKoz/stunning-signature

@kde3kko
Copy link

kde3kko commented Mar 20, 2019

Hi, I'm about to start working on a React Native plugin (android only) against app tampering.
Do you recommend you gist as a good starting point?

@simplekjl
Copy link

simplekjl commented Apr 11, 2019

how do you get the has of the app signature?

@princegoyal1987
Copy link

princegoyal1987 commented May 31, 2019

How to get the hash of the apk? I mean the string we assign to "APP_SIGNATURE" how do we get that?

@scottyab
Copy link
Author

scottyab commented Jun 5, 2019

@princegoyal1987 to be clear this is the hash of the signing key not the .apk file. Run it in debug and inspect sha1 on line28 or add log statement to print the sha1 to logcat (make sure to remove before publishing). Then update APP_SIGNATURE with your value. Note it will vary depending on you're signing cert i.e if you have different cert for debug and release builds you made want to define APP_SIGNATURE to use a BuildConfigField

@scottyab
Copy link
Author

scottyab commented Jun 5, 2019

@kde3kko, @nildeka just to clarify it's not particularly hard for an attacker to decompile an .apk, find this tamper check, edit the APP_SIGNATURE with theirs and rebuild. It just makes it a bit more time-consuming and maybe they move on to another app without this check. As I said in the summary not bullet proof. Hope this clarifies.

@scottyab
Copy link
Author

scottyab commented Jun 5, 2019

@doridori good point about BC MessageDigest.getInstance("SHA1", "BC"); , I've removed in edit

@laptopmutia
Copy link

laptopmutia commented Sep 15, 2019

did it work if we use google app signing?

@avipars
Copy link

avipars commented Oct 23, 2019

did it work if we use google app signing?

@laptopmutia
any updates on this?

@redragon14368
Copy link

redragon14368 commented Dec 9, 2019

how to get "APP_SIGNATURE"

@yaibait
Copy link

yaibait commented Jan 3, 2020

Not work after upload to google play

@tentenponce
Copy link

tentenponce commented Feb 19, 2020

Not work after upload to google play

+1 for this, does not work after uploading on google playstore

@yaibait
Copy link

yaibait commented Mar 20, 2020

Not work after upload to google play

+1 for this, does not work after uploading on google playstore

It does not work because google app signing feature, you need change APP_SIGNATURE to google app signing not your local store key :D

@mggTimmy
Copy link

mggTimmy commented Apr 2, 2020

Hi, nice solution but GET_SIGNATURES is deprecated in API level 28

@SanarDev
Copy link

SanarDev commented Apr 8, 2020

what is the best way in API level 29?

@mggTimmy
Copy link

mggTimmy commented Apr 8, 2020

probably not the best, but one solution is:
packageInfo = getPackageManager().getPackageInfo(getPackageName(),PackageManager.GET_SIGNING_CERTIFICATES); signatures = packageInfo.signingInfo.getApkContentsSigners(); MessageDigest md = MessageDigest.getInstance("SHA-1"); for (Signature signature : signatures) { md.update(signature.toByteArray()); sigHash = StringEncryption.SHA1(signature.toCharsString()); }

@MANISH-MAHESH-TALREJA
Copy link

MANISH-MAHESH-TALREJA commented Apr 18, 2020

What if the attacker decompiles the code and remove the function of validation(even with proguarded) or modifies the actual key APP_SIGNATURE

@tentenponce
Copy link

tentenponce commented Apr 20, 2020

What if the attacker decompiles the code and remove the function of validation(even with proguarded) or modifies the actual key APP_SIGNATURE

There's no silver bullet in security. There will be always a way to attack an app/system. We can just make it harder for them but not impossible to hack.

@scottyab
Copy link
Author

scottyab commented Apr 20, 2020

Thanks for answering @tentenponce. Totally agree. I've updated the comment on the gist for extra clarity.

Please note: This was created in 2013, not actively maintained and may not be compatible with the latest Android versions. It's not particularly difficult for an attacker to decompile an .apk, find this tamper check, replace the APP_SIGNATURE with theirs and rebuild (or use method hooking to return true from validateAppSignature()). It'll make the task of running the .apk unsigned or with edited code slightly more time-consuming and hopefully reduce the effectiveness of automated attacker. But it's not bulletproof.

@Android1500
Copy link

Android1500 commented Jun 24, 2021

Hey can you please tell me how to get "APP_SIGNATURE" for release build?

@tentenponce
Copy link

tentenponce commented Jun 26, 2021

Hey can you please tell me how to get "APP_SIGNATURE" for release build?

this might help:

https://stackoverflow.com/questions/5578871/how-to-get-apk-signing-signature

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment