Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
Simple Android signature check. It's not bullet proof but does increase the difficulty of backdooring the app
import android.content.Context;
import android.content.pm.PackageInfo;
import android.content.pm.PackageManager;
import android.content.pm.PackageManager.NameNotFoundException;
import android.content.pm.Signature;
public class TamperCheck {
//we store the hash of the signture for a little more protection
private static final String APP_SIGNATURE = "1038C0E34658923C4192E61B16846";
/**
* Query the signature for this application to detect whether it matches the
* signature of the real developer. If it doesn't the app must have been
* resigned, which indicates it may been tampered with.
*
* @param context
* @return true if the app's signature matches the expected signature.
* @throws NameNotFoundException
*/
public boolean validateAppSignature(Context context) throws NameNotFoundException {
PackageInfo packageInfo = context.getPackageManager().getPackageInfo(
getPackageName(), PackageManager.GET_SIGNATURES);
//note sample just checks the first signature
for (Signature signature : packageInfo.signatures) {
// SHA1 the signature
String sha1 = getSHA1(signature.toByteArray());
// check is matches hardcoded value
return APP_SIGNATURE.equals(sha1);
}
return false;
}
//computed the sha1 hash of the signature
public static String getSHA1(byte[] sig) {
MessageDigest digest = MessageDigest.getInstance("SHA1", "BC");
digest.update(sig);
byte[] hashtext = digest.digest();
return bytesToHex(hashtext);
}
//util method to convert byte array to hex string
public static String bytesToHex(byte[] bytes) {
final char[] hexArray = { '0', '1', '2', '3', '4', '5', '6', '7', '8',
'9', 'A', 'B', 'C', 'D', 'E', 'F' };
char[] hexChars = new char[bytes.length * 2];
int v;
for (int j = 0; j < bytes.length; j++) {
v = bytes[j] & 0xFF;
hexChars[j * 2] = hexArray[v >>> 4];
hexChars[j * 2 + 1] = hexArray[v & 0x0F];
}
return new String(hexChars);
}
}
@nildeka

This comment has been minimized.

Copy link

commented Nov 24, 2016

This is very useful. I have some query regarding signing key verification. What if the attacker decompiles the code and remove the function of validation(even with proguarded) or modifies the actual key APP_SIGNATURE

@Tindi

This comment has been minimized.

Copy link

commented Apr 11, 2017

What does it mean if it return false? I keep getting false

@doridori

This comment has been minimized.

Copy link

commented Sep 19, 2017

Lint now will warn on PackageManager.GET_SIGNATURES due to the vuln spoken about here. SO suggests dont have to worry about this from 4.4. Personally I am only allowing one signature to be present. Who uses cert chains (on android) anyway!

@doridori

This comment has been minimized.

Copy link

commented Sep 19, 2017

For paranoia purposes, may be better to use SHA-256 also? SO

Interesting as may want to just use default security provider (no BC dependency in code snippit)

@Omar1123

This comment has been minimized.

Copy link

commented Oct 2, 2017

A SHA1 is used because it is the algorithm with which the certificates are encrypted, you can see it as a standard even though there are examples of collisions with SHA1

@AswathiRevathi

This comment has been minimized.

Copy link

commented Apr 16, 2018

can i get a complete example on anti tamering
?

@DimaKoz

This comment has been minimized.

Copy link

commented Jun 24, 2018

@AswathiRevathi sure. The source code of native signature check can be found here: https://github.com/DimaKoz/stunning-signature

@kde3kko

This comment has been minimized.

Copy link

commented Mar 20, 2019

Hi, I'm about to start working on a React Native plugin (android only) against app tampering.
Do you recommend you gist as a good starting point?

@simplekjl

This comment has been minimized.

Copy link

commented Apr 11, 2019

how do you get the has of the app signature?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.