Repackaging Detection

Repackaging detection is a security feature that detects that the application was modified and signed again with a different signing certificate. In-App Protection Shielder for Android is able to detect that the application has been repackaged and can be configured to terminate the application in that case.

Configuration

rasp:
  repackaging:
    enabled: true
    response:
      action: terminate
      certificate_hashes:
        - "<SHA-1 of the app signing certificate>"

Repackaging detection is disabled by default. The available responses are described in RASP Feature Overview.

Trusted Certificates

certificate_hashes lists the SHA-1 hashes of the certificates the application is signed with, as 40 hexadecimal characters without colons. It is part of the response and at least one hash is required for both actions.

When the application is published with Play App Signing, list the app signing key certificate. It is shown in Google Play Console under Setup > App integrity > App signing key certificate. Copy the SHA-1 certificate fingerprint and remove the colons:

pbpaste | sed "s/://g"

The hash of a certificate can be computed from a keystore:

keytool -list -v -keystore release.jks -alias release | grep "SHA1:" | sed "s/.*SHA1:[[:space:]]*//" | sed "s/://g"

Or from a signed APK:

apksigner verify --print-certs App.apk | grep "SHA-1" | sed "s/.*: //"

The Shielder also prints the SHA-1 hash of the input application’s signing certificate during processing.

Read Next

• String Obfuscation