I'm reverse engineering an Android app, and it has some kind of anti-tamper protection. The problem is that I can't find it anywhere in the smali files.Even if I just re-sign the official APK that I downloaded straight from the Play Store, it detects that it has been tampered with, so it must either be checking file sizes or signatures. I've grepped all the smali files for things like signature and getPackageInfo to try and find where it's getting the signature from, but I cannot find anything.What other methods are there to figure out if the APK has been re-signed, even when nothing else has been altered? It is not using SafetyNet.
Anti-tampering techniques in Android APK's
android;java;apk;dalvik
Your best bet is to just start reading through the code and see everything it does. It almost certainly is checking signatures, just in a way that your search missed. That could be because it is using an API you didn't search for, or because the code is obfuscated, or because you messed up the search. Note that there are a lot of APIs that could be used to get information about the app. For example, it could be using the JarFile getResource() API. The most reliable method is to just read the code.Also don't forget to look in the native code, if any! You can check whether the app is using native code by looking in the libs folder. This is a bit of a longshot though, since most programmers are too lazy to write native code. If they are doing the checks in native code, it's probably an off the shelf packer/obfuscator.For completeness, I should mention that there are several features of an app that depend on its signature. For example, it could be using a signature based permission or a shared userid, each of which would break if you resigned the app. I've never heard of these being used for tamper detection though.