The question you ask should be this: how much can I make crackers live? if you distribute your application through the game store, look at this question , even if it is different from the topic, the answers and links are valuable.
I assume that your application is not free (since CSV seems valuable), so take a closer look at the licensing verification library and this blogpost , especially. details Technique: check the license for uploading to a trusted server; and Technique: make your application immune to interference .
in short, and as I understand it, the way you go is as follows:
- Upload your apk to Google using the RSA public key.
- implement the LVL request inside your application (without encryption and without a private key inside the application package! **
- redirects the lvl response to your server with the message through a secure SSL connection.
- on your trusted server, using your RSA private key, you should check the things mentioned in the blogpost, especially. put the requested user IDs in the database and count the requests from one UID, if it is much higher than average, you can assume that this user ID is the one used for invalid requests.
- don't answer if something goes wrong with the check
- If everything is ok, answer your csv. just save your data on the android client if you want the user to use csv without connecting, otherwise any root device or hacked apk could access and redistribute csv - it is better: just click on the requested parts (for example, strings) of csv to the user
see this question and try replaying again and how to prevent it so that no one plays the call that csv or its parts provided (e.g. serial numbers in the UID).
obfuscate your code as well as possible to make the work even harder, as @VinceFR already mentioned.
there are still some attacks, such as these two:
- root and check the saved csv, but do not redistribute - that’s why you don’t want to store your csv on the client
- reverse engineering your application, write down, hopefully, the full csv package that they received and use, probably remove the LVL code to use your application for free - so you still have to confuse and send only the requested details.
even checksums using PackageManager , signature apk, etc. pp will not do this 100%.
but in fact, until the client first loads csv (or any other data), your data will be saved. it even saves while you can trust your users (for example, a limited circle of users of trust for an internal application or something else, then you should choose the androids vpn options to access the file). after that, it’s just a matter of time and effort to insert a hack into your application and get valuable csv - and the question is whether someone should invest in this time.
sitelink containing additional information and links to LVL from Justin Case .
read all these links well and remember: to do it is difficult enough to make it invaluable, cannot stop those crackers who take value from success - I mean, crack some kind of “crack”. The software is more valuable, even without getting money or anything else, for some people.
PS: see this answer to another question for “hacked” software - but even a website and its data can be constantly duplicated if it costs it.