1

I'm reverse engineering an Android app, and it has some kind of anti-tamper protection. The problem is that I can't find it anywhere in the smali files.

Even if I just re-sign the official APK that I downloaded straight from the Play Store, it detects that it has been tampered with, so it must either be checking file sizes or signatures. I've grepped all the smali files for things like "signature" and "getPackageInfo" to try and find where it's getting the signature from, but I cannot find anything.

What other methods are there to figure out if the APK has been re-signed, even when nothing else has been altered? It is not using SafetyNet.

Improve this question

1 Answer 1

Reset to default
2

Your best bet is to just start reading through the code and see everything it does. It almost certainly is checking signatures, just in a way that your search missed. That could be because it is using an API you didn't search for, or because the code is obfuscated, or because you messed up the search. Note that there are a lot of APIs that could be used to get information about the app. For example, it could be using the JarFile getResource() API. The most reliable method is to just read the code.

Also don't forget to look in the native code, if any! You can check whether the app is using native code by looking in the libs folder. This is a bit of a longshot though, since most programmers are too lazy to write native code. If they are doing the checks in native code, it's probably an off the shelf packer/obfuscator.

For completeness, I should mention that there are several features of an app that depend on its signature. For example, it could be using a signature based permission or a shared userid, each of which would break if you resigned the app. I've never heard of these being used for tamper detection though.

Improve this answer
2
  • Good call on checking the native code. The app is importing a .so file, and just from quickly checking the strings in it, I do see that there are references to getting the packages signature. The odd thing is that the strings are things like (Ljava/lang/String;I)Landroid/content/pm/PackageInfo which look a lot like something you'd see in the smali files.
    – Ian Ling
    May 21, 2017 at 17:08
  • 1
    Those strings are probably used to register the JNI methods so they can be called from Java.
    – Antimony
    May 21, 2017 at 17:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.