Implementation¶

// Holds the package name
private val packageNameData = HardcodedPackageName(
    packageName = "com.kevlar.showcase"
)

// Holds the signature
private val signatureData = HardcodedBase64EncodedSignature(
    base64EncodedSignature = "J+nqXLfuIO8B2AmhkMYHGE4jDyw="
)

// Combines all the metadata and configuration
private val integrity = KevlarIntegrity {
    checks {
        packageName {
            hardcodedPackageName(packageNameData)
        }

        signature {
            hardcodedSignatures(signatureData)
        }

        installer()
        debug()
    }
}

// Runs the checks on the current executing app
integrity.attestate(context)

// This returns the signature of the current running application.
val signature: String = KevlarIntegrity.obtainCurrentAppSignature(context)

// Log it to the console for extracting the signature
Log.d("SIGNATURE", signature)

> Task :showcase:signingReport
Variant: debug
Config: debug
Store: /Users/cioccarellia/.android/debug.keystore
Alias: AndroidDebugKey
MD5: 1B:AF:39:46:4E:13:83:F3:45:E9:0A:5A:53:64:9C:CB
SHA1: 27:E9:EA:5C:B7:EE:20:EF:01:D8:09:A1:90:C6:07:18:4E:23:0F:2C
SHA-256: 36:C8:C0:A1:8A:DD:6D:0E:34:F9:6E:7E:98:DC:1F:89:08:BC:CD:2E:EF:88:ED:45:DF:79:85:D2:39:BD:E1:54
Valid until: Tuesday, June 25, 2052
----------
Variant: release
Config: null
Store: null
Alias: null
----------

private const val packageName = HardcodedPackageName("com.kevlar.showcase")
private const val signature = HardcodedBase64EncodedSignature("J+nqXLfuIO8B2AmhkMYHGE4jDyw=")

private val packageName = """Y29tLmtldmxhci5zaG93Y2FzZQ==""".toByteArray()
private val signature = """SitucVhMZnVJTzhCMkFtaGtNWUhHRTRqRHl3PQ==""".toByteArray()


private val base64ObfuscatedHardcodedPackageName = HardcodedPackageName(
    packageName = Base64.decode(base64PackageName, Base64.DEFAULT).toString(Charsets.UTF_8)
)

private val base64ObfuscatedHardcodedSignature = HardcodedBase64EncodedSignature(
    Base64.decode(base64Signature, Base64.DEFAULT).toString(Charsets.UTF_8)
)

// Our arbitrary 256-bit encryption key
private val aesKey256 = """4t7w!z%C*F-JaNcRfUjXn2r5u8x/A?Ds"""

// This is "com.kevlar.showcase", encrypted using AES256 with the previous key
private val encryptedPackageName = """s3wf/AOYtr9BEMVFrweeLnkmerryUykMA8O77S5tMlI=""".toByteArray()

// This is "J+nqXLfuIO8B2AmhkMYHGE4jDyw=", encrypted using AES256 with the previous key
private val encryptedSignature = """tqMJquO3D+EKx1rx4R7/qzmsuEgpp1bKwxXe9AeB/WU=""".toByteArray()


private val aes256EncryptedHardcodedPackageName = HardcodedPackageName(
    packageName = EncryptionUtil.decrypt(
        encryptedPackageName,
        EncryptionUtil.generateKey(aesKey256)
    )
)

private val aes256EncryptedHardcodedSignatures = HardcodedBase64EncodedSignature(
    EncryptionUtil.decrypt(encryptedSignature, EncryptionUtil.generateKey(aesKey256))
)

/**
 * Base64 obfuscated package name and signature
 * */
// Original value is "com.kevlar.showcase", the package name hardcoded value
private val base64EncodedPackageName = """Y29tLmtldmxhci5zaG93Y2FzZQ==""".toByteArray()

private val base64ObfuscatedHardcodedPackageName = HardcodedPackageName(
    packageName = Base64.decode(base64EncodedPackageName, Base64.DEFAULT).toString(Charsets.UTF_8)
)



// Original value is "J+nqXLfuIO8B2AmhkMYHGE4jDyw=", the signature hardcoded value
private val base64EncodedSignature = """SitucVhMZnVJTzhCMkFtaGtNWUhHRTRqRHl3PQ==""".toByteArray()

private val base64ObfuscatedHardcodedSignatures = HardcodedBase64EncodedSignature(
    Base64.decode(base64EncodedSignature, Base64.DEFAULT).toString(Charsets.UTF_8)
)


/**
 * Integrity package
 * */
private val integrity = KevlarIntegrity {
    checks {
        packageName {
            hardcodedPackageName(base64ObfuscatedHardcodedPackageName)
        }

        signature {
            hardcodedSignatures(base64ObfuscatedHardcodedSignatures)
        }

        installer()
        debug()
    }
}




/**
 * Assestation request & callback
 * +/
CoroutineScope(Dispatchers.Default).launch {
    // Attestation request
    when (val attestation = integrity.attestate(context)) {
        is IntegrityAttestation.Blank -> {
            // Pending attestation, no information yet. 
            // Don't do anything.
        }
        is IntegrityAttestation.Clear -> {
            // Good to go.
        }
        is IntegrityAttestation.Failed -> {
            // One or more checks have failed.
        }
    }
}

@AndroidEntryPoint
class IntegrityActivity : AppCompatActivity() {

    private val vm: ActivityViewModel by viewModels()

    override fun onCreate(savedInstanceState: Bundle?) {
        super.onCreate(savedInstanceState)

        lifecycleScope.launch {
            lifecycle.repeatOnLifecycle(Lifecycle.State.STARTED) {
                vm.attestation.collectLatest {
                    when (it) {
                        is IntegrityAttestation.Blank -> {
                            // Pending attestation, no information yet.
                            // Don't do anything.
                        }
                        is IntegrityAttestation.Clear -> {
                            // Good to go.
                        }
                        is IntegrityAttestation.Failed -> {
                            // Pirate software detected.
                        }
                    }
                }
            }
        }

        CoroutineScope(Dispatchers.Main).launch {
            vm.requestAttestation()
        }
    }
}

@HiltViewModel
class ActivityViewModel @Inject constructor(
    private val integrityRepository: IntegrityRepository
) : ViewModel() {
    private val _attestation = MutableStateFlow(KevlarIntegrity.blankAttestation())

    internal val attestation: SharedFlow<IntegrityAttestation> = _attestation.stateIn(
        viewModelScope,
        SharingStarted.Eagerly,
        initialValue = KevlarIntegrity.blankAttestation()
    )

    fun requestAttestation() {
        viewModelScope.launch {
            _attestation.value = integrityRepository.attestate()
        }
    }
}

class IntegrityRepository @Inject constructor(
    @ApplicationContext val context: Context,
    @IoDispatcher val externalDispatcher: CoroutineDispatcher
) {
    /**
     * Base64 obfuscated package name
     * */
    private val base64PackageName = """Y29tLmtldmxhci5zaG93Y2FzZQ==""".toByteArray()
    private val base64Signature = """SitucVhMZnVJTzhCMkFtaGtNWUhHRTRqRHl3PQ==""".toByteArray()


    private val base64ObfuscatedHardcodedPackageName = HardcodedPackageName(
        packageName = Base64.decode(base64PackageName, Base64.DEFAULT).toString(Charsets.UTF_8)
    )

    private val base64ObfuscatedHardcodedSignatures = HardcodedBase64EncodedSignature(
        Base64.decode(base64Signature, Base64.DEFAULT).toString(Charsets.UTF_8)
    )


    /**
     * Integrity package
     * */
    private val integrity = KevlarIntegrity {
        checks {
            packageName {
                hardcodedPackageName(base64ObfuscatedHardcodedPackageName)
            }

            signature {
                hardcodedSignatures(base64ObfuscatedHardcodedSignatures)
            }

            installer()
            debug()
        }
    }

    suspend fun attestate(): IntegrityAttestation = withContext(externalDispatcher) {
        integrity.attestate(context)
    }
}