How to check if class exists somewhere in package?

Question

I'm currently dealing with a particular issue with my paid application. Internally it contains a licensing check. The app is patched by hackers by modifying the app apk/jar. They are adding a new class which helps bypass the licensing check.

My goal is to somehow check for this particular patch. If I find it I know my app has been compromised.

Any tips on how to know that something has been modified on the package? Doing a hash over the app is not really an option in my case.

I thought maybe checking if this class exists would help, but what if they change the name of the class? Then, another idea is somehow check for unexpected includes added to the class.

Any of these possible? Any suggestions would help :)

Answer 1

Here is what I used in Android - standard Java:

public boolean isClass(String className) {
    try  {
        Class.forName(className);
        return true;
    }  catch (ClassNotFoundException e) {
        return false;
    }
}

Implementation example:

if (isClass("android.app.ActionBar")) {
    Toast.makeText(getApplicationContext(), "YES", Toast.LENGTH_SHORT).show();
}

Answer 2

Not sure about android but in standard JDK you would do something like this:

try {
 Class.forName( "your.fqdn.class.name" );
} catch( ClassNotFoundException e ) {
 //my class isn't there!
}

Answer 3

How does it get loaded if it's a random class in a random package?

That being said, see http://download.oracle.com/javase/6/docs/api/java/lang/System.html#getProperties%28%29 and java.class.path. For normal java apps, you have to walk the classpath and then search the entries (for jars) or directories (for .class files). But in a container-class-loader environment, this will fail to work (and I'm not sure how that applies to an android environment).

Answer 4

You can use

public static Class<?> forName (String className)

and check the ClassNotFoundException

http://developer.android.com/reference/java/lang/Class.html#forName%28java.lang.String%29