I'm a developer of a mobile Android app. In my app, I've implemented code that reports the SHA-1 certificate fingerprint (implemented in Java code, as described in this post), in this way we can tell which users are using the real (Google Play signed) APK, and which are not.
Lately, i've stumbled across cases where users are using a modified APK, but this APK still reports the fingerprint of the genuine app (as signed by Google Play). We extracted the signature from the APK also using keytool as described in this post.
My question - is there any way a hacker could open the APK, modify it and then re-pack it and re-sign it so that it'll report the real fingerprint (apart from getting access to the signing key somehow) ?