Signature of two different apps are being compared inside the code of an app For a particular Mobile App, I am trying to understand the client-side code of an apk by decompiling the apk using Jadx-GUI. While I was going through the code, I found out interesting code snippet (shown in the image). Signature of the existing app is being compared with that of the app named &quot;Android&quot;.

I observed this type of comparison in more than one app. I fetched the certificate details and found out that they both are different and the certificates are self-signed (they are not using Google Play Signing)
So, my question is Why are the developers comparing the signature of two different apps? Under what scenarios is this type of signature verification useful?
The code snippet does not compares the own app signature to an ordinary app, instead it compares it to the package android better known as &quot;Android System&quot;.
&quot;Android System&quot; as the name indicates is a system app signed with the ROM's system signing key. Therefore the code snippet you found compares if the the app specified by it's package name in parameter str was signed by the system key.
I would assume that the app that contains this code first gets the list of all installed packages and then calls this method for each installed package name.
In the end this would allow to identify all apps that have system permissions. What can not be determined by the code is why this list is generated. It could be for security reason to check if there are &quot;strange apps&quot; with system permission or alternatively building the system apps list could be the first step on an app that tries to attack the system by trying to find vulnerabilities in system apps.