How to get Keystore fingerprint from code

Question

I am currently struggling with getting some security to the Unity3d app I'm working on, and I want to add verification that apk file wasn't tampered with by some patchers. I know how to get keystore fingerprint from a built app (like keytool), but I have a hard time figuring out how to get that fingerprint from the code of my app during runtime to check that it is the same. I've gone through a lot of other threads to no success so far (like this: Get certificate fingerprint from android app)

Has anyone found solution how to do this or hint where I should start looking? Thanks in advance!

score 4 · Accepted Answer · answered Oct 12 '17 at 19:48

Modify the getCertificateSHA1Fingerprint function from the answer you linked to take Android Context as parameter. Get the Context from Unity and send it to this function then mark as static.

Java:

public final class CertificateSHA1Fingerprint 
{

  private static String getCertificateSHA1Fingerprint(Context mContext) 
  {
  PackageManager pm = mContext.getPackageManager();
  String packageName = mContext.getPackageName();
  int flags = PackageManager.GET_SIGNATURES;
  PackageInfo packageInfo = null;
  try {
   packageInfo = pm.getPackageInfo(packageName, flags);
  } catch (PackageManager.NameNotFoundException e) {
   e.printStackTrace();
  }
  Signature[] signatures = packageInfo.signatures;
  byte[] cert = signatures[0].toByteArray();
  InputStream input = new ByteArrayInputStream(cert);
  CertificateFactory cf = null;
  try {
   cf = CertificateFactory.getInstance("X509");
  } catch (CertificateException e) {
   e.printStackTrace();
  }
  X509Certificate c = null;
  try {
   c = (X509Certificate) cf.generateCertificate(input);
  } catch (CertificateException e) {
   e.printStackTrace();
  }
  String hexString = null;
  try {
   MessageDigest md = MessageDigest.getInstance("SHA1");
   byte[] publicKey = md.digest(c.getEncoded());
   hexString = byte2HexFormatted(publicKey);
  } catch (NoSuchAlgorithmException e1) {
   e1.printStackTrace();
  } catch (CertificateEncodingException e) {
   e.printStackTrace();
  }
  return hexString;
 }

 public static String byte2HexFormatted(byte[] arr) 
 {
   StringBuilder str = new StringBuilder(arr.length * 2);
   for (int i = 0; i < arr.length; i++) 
   {
   String h = Integer.toHexString(arr[i]);
   int l = h.length();
   if (l == 1) h = "0" + h;
   if (l > 2) h = h.substring(l - 2, l);
   str.append(h.toUpperCase());
   if (i < (arr.length - 1)) str.append(':');
   }
  return str.toString();
 }
}

C#:

AndroidJavaClass unityClass;
AndroidJavaObject unityActivity;
AndroidJavaObject unityContext;
AndroidJavaClass customClass;

public string getCertificateSHA1Fingerprint()
{
    //Replace with your full package name
    string packageName = "com.example.CertificateSHA1Fingerprint";

    unityClass = new AndroidJavaClass("com.unity3d.player.UnityPlayer");
    unityActivity = unityClass.GetStatic<AndroidJavaObject>("currentActivity");
    unityContext = unityActivity.Call<AndroidJavaObject>("getApplicationContext");

    customClass = new AndroidJavaClass(packageName);

    string result = customClass.CallStatic<string>("getCertificateSHA1Fingerprint", unityContext);
    return result;
}

You only have to build the Java function with Android Studio and convert it into Jar or .AAR file then put it in your <ProjectName>Assets\Plugins\Android folder. The C# code will be able to communicate with it.

This worked like a charm, just needed to wrap my brains around how to build aar/jar files in Android Studio. Great manual! Thank you! — PavelAlieinikov, Oct 13 '17 at 16:37
I did not test it but it should. Glad I was able to help. Building .aar and .jar is hard for new users but you will get used to that once you do it once. You are welcome! — Programmer, Oct 13 '17 at 16:39

How to get Keystore fingerprint from code

1 Answers1