We made a client/server program that runs at localhost. Is it possible to execute a man in the middle attack on the loopback between the client and server?
Depending on how the programs know each other it might be possible.
Assuming you are running a server that only listens on 127.0.0.1 and a client that tries to connect to it. What port does the server listen on? What happens when the port is ocuppied? How does a client know it's a correct port?
Assuming that the port is not hardcoded in both server and client, but is somehow configured, one could setup a MITM on a different port and trick a client to connect to that modified port.
Poor man's example - assuming you have SSH server on your local box
socat TCP-LISTEN:1234 TCP:127.0.0.1:22
In the other console do
ssh 127.0.0.1 -p 1234
You'll see that you connect to your own SSH. Kill the
socat in the first console and you see connection breaks. The
socat is your MITM.
Edit: After you've specified your target (modifying a packet en-route and watching HMAC break it), I'd guess you'll need a second server, that normally only forwards packets from one socket to other, but after somehow notifying it (10% of the time, a specific file exists, a signal is received, 10s after startup...) it modifies the received packet before forwarding.