Tamper Detection Android APK from NDK / JNI

Question

Tamper Detection Android APK from NDK / JNI

Problem

I have some keys that I want to keep safe. Currently, their own shared library generates them on demand. This shared library is used by my apk to get keys. The problem with the current implementation is that an attacker can extract apk, copy the shared library and call a function that generates keys and receive keys. So I want to make sure that the generic lib only generates valid keys if it is called by my apk.

Approach to solving this problem

An approach to solving this problem involves detecting apk fraud on the NDK side. The basic idea is to get the signature of the calling APK at runtime from the JNI. If the signature is valid, then the library generates valid keys, otherwise it generates invalid keys.

Known limitations of this approach

It is understood that it is not 100% reliable.
Since the keys are on the client device, and the client owns the equipment, a dedicated attacker can gain access to the generated key.

What I have done so far The implementation is still based on the ideas mentioned in this postoverflow post

Read the process memory stored in / proc / self / maps
Find the line containing the text '.dex'.

Get the start and end addresses of the DEX file area

FILE *fp;    
fp = fopen("/proc/self/maps", "r");    
if(fp!=NULL){
    char line [ 2048 ];
    while ( fgets ( line, sizeof line, fp ) != NULL ) /* read a line */
    {
        if (strstr(line, ".dex") != NULL) {

            //This is the line we want
            __android_log_write(ANDROID_LOG_INFO,"DexFile",line);
            char * startingAddress;
            char * endingAddress;
            startingAddress = strtok (line," ,.-");
            endingAddress = strtok (NULL," ,.-");
            if(startingAddress!=NULL){
                __android_log_write(ANDROID_LOG_INFO,"DexStart",startingAddress);
            }
            if(endingAddress!=NULL){
            __android_log_write(ANDROID_LOG_INFO,"DexEnd",endingAddress);
            }
            //Now, we have the starting and ending address
        }

    }
    fclose ( fp);
}