I'm reverse engineering an Android app, and it has some kind of anti-tamper protection. The problem is that I can't find it anywhere in the smali files.
Even if I just re-sign the official APK that I downloaded straight from the Play Store, it detects that it has been tampered with, so it must either be checking file sizes or signatures. I've grepped all the smali files for things like "signature" and "getPackageInfo" to try and find where it's getting the signature from, but I cannot find anything.
What other methods are there to figure out if the APK has been re-signed, even when nothing else has been altered? It is not using SafetyNet.