I have an application running the client/server model and offering an online and an offline mode. Each user can read, create or modify text files (even in offline mode) that will be present on his disk. I want to prevent any hand-cration or hand-modification of these files done manually, I mean without client application, so that when a client tries to send a file to the server, the server checks if the digital signature matches, if it doesn't, the file will simply be rejected. Two different clients generating an identical file from a content point of view will provide an identical signature, because I am not interested in the user's identity aspect, only in the tamperation aspect of the data.
To be more specific, I'm coding a game, so the server represents the shop. I do all this to check that the file (which can represent money for example) was created via my app and not by hand by a malicious player who gave himself a large amount of money).
Could the digital signature principle work for me? Because the same smart guy who would try to falsify files could also look into the byte code to see how the function that calculates the digital signature of any file works, in order to reproduce it to create files considered valid by the server as well?
I wonder if I have understood the principle of the digital signature: is the signature really happening client-side? If so, how is the mechanism "hidden" from potential hackers?
Here's a graph I made to explain how the file should behave according to the actions we apply on it.
EDIT: Replacing everything with a more recent, complete and readable version of my initial question.