I have a question about how to detect a program/binary modification assuming the program is able to communicate with a remote validation server. More specifically I'm asking for android APK file, but it can be for any other program as well.
I imagine the following hypothetical scenario:
There is an APK installation file that the user is downloading and installing on his device. The application, after being installed and used is sending "some information" about its integrity to a remote server. The server is validating that the program is OK or is modified by hackers.
Given that scenario and the fact that APKs are written in Java, what are some ways that a developer can use to generate a hash value of his application files, so later this hash can be sent to a remote server that in turn will be able to validate that hash - hash over files sizes, or some other kind of structure?
I am interested in some ways to generate that "some information" which is sent to the validation server.
Please correct me if the question is not very properly asked as this scenario is not so clear to me and maybe there are other ways this can be achieved more easily. Thanks a lot!
--- EXTENSION ---
Hello and thank you very much for the answers!
I am surprised by the answers a little bit, because I didn't think too deep about the issue and I thought that there will be some easy mechanism to do this :) But now I hear that even TPMs cannot guarantee 100% protection...
As a lamer on the topic, I would like to ask something more. I don't want to protect the program from redistribution, like a copy protection mechanism. I want the program to be tested from time to time via validation server, that it's not modified.
This is the scenario:
The server that is distributing the application computes a hash of the program with some weird algorithm, if there is such. Later the program uses the same weird algorithm to compute a hash of itself and send it to the server. The server then compares the two hashes. If someone has modified a file, a JMP instruction for example, the hash should be different and the app considered hacked. What are the flaws in this scenario? That someone will be able to disassemble the algorithm to compute the hash from the program and later modify the program to send the same value to the server?
And even if this is the case, do you think that this is still a lot of work for someone to do, and it may not be worth it?