Tamper Detection

Protection ID: tamper_detection

Tamper Detection verifies the integrity of your application binary at runtime. It detects when the binary has been modified, patched, or repackaged, preventing attackers from distributing altered versions of your application.

Configuration

Tamper Detection is enabled through the rasp configuration:

{
  "protections": {
    "rasp": {
      "enabled": true,
      "tamper_detection": true,
      "action": "exit"
    }
  }
}

{
  "protections": {
    "rasp": {
      "enabled": true,
      "tamper_detection": true,
      "action": "exit"
    }
  }
}

How It Works

A common attack vector is to modify an application's binary to disable security checks, remove restrictions, or inject malicious code, then redistribute the modified version. This is known as repackaging.

Tamper Detection verifies the integrity of the application binary at runtime. If the binary has been modified after Shield protected it, the detection triggers and responds according to your configured action.

What Gets Detected

When to Use

Tamper Detection is essential for applications where binary integrity is critical. This includes applications with in-app purchases or premium features, DRM or license management, security-sensitive operations, and any application distributed through channels where repackaging is a risk.

Related

• Anti-Jailbreak - Detect compromised devices
• Hook Detection - Detect runtime hooking
• Protections Overview - All available protections