I'm reverse engineering a very popular Android app.

They perform some type of signature verification on the APK, however they do it without:

  • Calling PackageManager.signatures
  • Calling PackageInfo.signingInfo
  • Instantiating a JarFile or JarEntry
  • Calling native functions(there is a native library with signature verification code, however it has no JNI_onLoad and the function is not called)
  • Directly accessing the META-INF directory
  • Utilizing SafetyNet

I have verified that the APK is performing signature verification and not any other type of tamper-detection by resigning the APK and not modifying any files.

The only thing I can think of is that the APK is using reflection to call a method whose signature is encrypted or encoded.

  • Have you checked whether they are reading the file manually? Also, did you check for native methods other than JNI_onLoad? – Antimony Dec 30 '18 at 16:11
  • The native function that has the signature verification code does not get called. And there are no strings that contain "META-INF", so I don't believe that they are reading it manually. – dake Dec 30 '18 at 18:04
  • How SafetyNet is related when verifying the signature of the app? – GMX Apr 16 '19 at 8:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.