Simple Android signature check. Please note: This was created in 2013, not actively maintained and may not be compatible with the latest Android versions. It's not particularly difficult for an attacker to decompile an .apk, find this tamper check, replace the APP_SIGNATURE with theirs and rebuild (or use method hooking to return true from `validateAppSignature()`). It'll make the task of running the .apk unsigned or with edited code slightly more time-consuming and hopefully reduce the effectiveness of automated attacker. But it's not bulletproof.

/*

• Copyright 2013 Scott Alexander-Bown
• Licensed under the Apache License, Version 2.0 (the "License");
• you may not use this file except in compliance with the License.
• You may obtain a copy of the License at

• http://www.apache.org/licenses/LICENSE-2.0
  

• Unless required by applicable law or agreed to in writing, software
• distributed under the License is distributed on an "AS IS" BASIS,
• WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
• See the License for the specific language governing permissions and
• limitations under the License. */ import android.content.Context; import android.content.pm.PackageInfo; import android.content.pm.PackageManager; import android.content.pm.PackageManager.NameNotFoundException; import android.content.pm.Signature;

public class TamperCheck {

//we store the hash of the signture for a little more protection private static final String APP_SIGNATURE = "1038C0E34658923C4192E61B16846";

/** * Query the signature for this application to detect whether it matches the * signature of the real developer. If it doesn't the app must have been * resigned, which indicates it may been tampered with. * * @param context * @return true if the app's signature matches the expected signature. * @throws NameNotFoundException */ public boolean validateAppSignature(Context context) throws NameNotFoundException {

	PackageInfo packageInfo = context.getPackageManager().getPackageInfo(
			getPackageName(), PackageManager.GET_SIGNATURES);
//note sample just checks the first signature
	for (Signature signature : packageInfo.signatures) {
		// SHA1 the signature
		String sha1 = getSHA1(signature.toByteArray());
		// check is matches hardcoded value
		return APP_SIGNATURE.equals(sha1);
	}

	return false;
}

//computed the sha1 hash of the signature public static String getSHA1(byte[] sig) { MessageDigest digest = MessageDigest.getInstance("SHA1"); digest.update(sig); byte[] hashtext = digest.digest(); return bytesToHex(hashtext); }

//util method to convert byte array to hex string public static String bytesToHex(byte[] bytes) { final char[] hexArray = { '0', '1', '2', '3', '4', '5', '6', '7', '8', '9', 'A', 'B', 'C', 'D', 'E', 'F' }; char[] hexChars = new char[bytes.length * 2]; int v; for (int j = 0; j < bytes.length; j++) { v = bytes[j] & 0xFF; hexChars[j * 2] = hexArray[v >>> 4]; hexChars[j * 2 + 1] = hexArray[v & 0x0F]; } return new String(hexChars); }

}