java - NDK application Signature Check -

i have security key in application. want store securly. store in native shared library (maybe generated code). after want returned method check signature of original apk. no 1 can use file except trusted applications. know, ndk library decompiled, harder make reverse engineering of native code java .class files.

question:

1. is there way calk signature of origin apk native code (c/c++)?
2. how can make sure library called trusted application?

i try answer first question here:

signature of application stored in dex(dalvik executable) file of apk. dex files have following structure:

1. header
2. data section(contains strings, code instructions, fields, etc)
3. arrays of method identifiers, class identifiers, etc

so, beginning of header of dex file:

1. dex_file_magic constant - ubyte[8]
2. adler-32 checksum of application(except dex_file_magic , checksum itself) - uint
3. sha-1 signature of application(except of dex_file_magic, checksum , hash itself) - ubyte[20]

so, calk signature of apk, should compute sha-1 signature of dex file starting offset 32.

to access dex file of apk native code, can read process memory, stored in /proc/self/maps:

file *fp; fp = fopen("/proc/self/maps", "r"); 

each row in proc/$id/maps file has following structure:

1. address
2. permissions
3. offset
4. device
5. inode
6. pathname

here can find better description of proc/$id/maps file's structure: understanding linux /proc/id/maps

to detect location of dex file in process memory should check out 'pathname' column in every row of proc/self/maps file. when row corresponding dex file found, should starting , ending addresses of dex file region:

while (fgets(line, 2048, fp) != null) {     // search '.dex'     if (strstr(line, ".dex") != null) {         // starting , ending addresses of dex file region 

so, when have starting , ending addresses of apk's bytecode, able compute signature of apk.