Simple Android signature check. Please note: This was created in 2013, not actively maintained and may not be compatible with the latest Android versions. It's not particularly difficult for an attacker to decompile an .apk, find this tamper check, replace the APP_SIGNATURE with theirs and rebuild (or use method hooking to return true from `vali…

SignatureCheck.java

import android.content.Context;
import android.content.pm.PackageInfo;
import android.content.pm.PackageManager;
import android.content.pm.PackageManager.NameNotFoundException;
import android.content.pm.Signature;

public class TamperCheck {

//we store the hash of the signture for a little more protection
private static final String APP_SIGNATURE = "1038C0E34658923C4192E61B16846";

  /**
	 * Query the signature for this application to detect whether it matches the
	 * signature of the real developer. If it doesn't the app must have been
	 * resigned, which indicates it may been tampered with.
	 * 
	 * @param context
	 * @return true if the app's signature matches the expected signature.
	 * @throws NameNotFoundException 
	 */
	public boolean validateAppSignature(Context context) throws NameNotFoundException {

		PackageInfo packageInfo = context.getPackageManager().getPackageInfo(
				getPackageName(), PackageManager.GET_SIGNATURES);
    //note sample just checks the first signature
		for (Signature signature : packageInfo.signatures) {
			// SHA1 the signature
			String sha1 = getSHA1(signature.toByteArray());
			// check is matches hardcoded value
			return APP_SIGNATURE.equals(sha1);
		}

		return false;
	}
  
  //computed the sha1 hash of the signature
  public static String getSHA1(byte[] sig) {
  		MessageDigest digest = MessageDigest.getInstance("SHA1");
			digest.update(sig);
			byte[] hashtext = digest.digest();
			return bytesToHex(hashtext);
	}
  
  //util method to convert byte array to hex string
  public static String bytesToHex(byte[] bytes) {
  	final char[] hexArray = { '0', '1', '2', '3', '4', '5', '6', '7', '8',
				'9', 'A', 'B', 'C', 'D', 'E', 'F' };
		char[] hexChars = new char[bytes.length * 2];
		int v;
		for (int j = 0; j < bytes.length; j++) {
			v = bytes[j] & 0xFF;
			hexChars[j * 2] = hexArray[v >>> 4];
			hexChars[j * 2 + 1] = hexArray[v & 0x0F];
		}
		return new String(hexChars);
	}
  
    
}

did it work if we use google app signing?

did it work if we use google app signing?

@laptopmutia
any updates on this?

how to get "APP_SIGNATURE"

Not work after upload to google play

Not work after upload to google play

+1 for this, does not work after uploading on google playstore

Not work after upload to google play

+1 for this, does not work after uploading on google playstore

It does not work because google app signing feature, you need change APP_SIGNATURE to google app signing not your local store key :D

Hi, nice solution but GET_SIGNATURES is deprecated in API level 28

what is the best way in API level 29?

probably not the best, but one solution is:
packageInfo = getPackageManager().getPackageInfo(getPackageName(),PackageManager.GET_SIGNING_CERTIFICATES); signatures = packageInfo.signingInfo.getApkContentsSigners(); MessageDigest md = MessageDigest.getInstance("SHA-1"); for (Signature signature : signatures) { md.update(signature.toByteArray()); sigHash = StringEncryption.SHA1(signature.toCharsString()); }

What if the attacker decompiles the code and remove the function of validation(even with proguarded) or modifies the actual key APP_SIGNATURE

What if the attacker decompiles the code and remove the function of validation(even with proguarded) or modifies the actual key APP_SIGNATURE

There's no silver bullet in security. There will be always a way to attack an app/system. We can just make it harder for them but not impossible to hack.

Thanks for answering @tentenponce. Totally agree. I've updated the comment on the gist for extra clarity.

Please note: This was created in 2013, not actively maintained and may not be compatible with the latest Android versions. It's not particularly difficult for an attacker to decompile an .apk, find this tamper check, replace the APP_SIGNATURE with theirs and rebuild (or use method hooking to return true from validateAppSignature()). It'll make the task of running the .apk unsigned or with edited code slightly more time-consuming and hopefully reduce the effectiveness of automated attacker. But it's not bulletproof.

Hey can you please tell me how to get "APP_SIGNATURE" for release build?

Hey can you please tell me how to get "APP_SIGNATURE" for release build?

this might help:

https://stackoverflow.com/questions/5578871/how-to-get-apk-signing-signature

it is very easy to bypass this check by hooking

hooking what?