Android Security Documentation

Overview

Welcome to the Android Security documentation page. Android Security provides an additional level of security features to Android applications and games made in Unity. It's goal is to prevent someone from re-compiling your APK with modified code, or at least make it more difficult for them.

Getting Started

Prerequisites

• The asset requires that you have the Java JDK installed and configured in the Unity preferences (Edit -> Preferences)
• A keystore must be setup and configured in the Edit/Project Settings/Player Settings/Publishing section of the Android platform. Watch the first section (starting at 2 minutes) of the below tutorial if you don't already have one created.

Storing The Application Signature

After importing the package, navigate to the AndroidSecurity/Resources folder and select the AndroidSecuritySettings asset. If it hasn't imported the signature already, press the "Reimport Signature" button. If successful, the inspector will display the successful import message. If not, a detailed description of the error will be displayed.

Asset Settings

• Lock Asset - Prevents the signature from automatically being overwritten. Good if you share the project between machines that might not have the keystore.
• Automatically Import - Turn on/off automatic importing of the application signature in the Editor.
• Stored Signature - Debug information of the currently stored signature. This is not included in the build.
• Reimport Signature - Reimports the signature from the currently used keystore.

Using Android Security

The asset has three available methods for ensuring your android application has not been tampered with after you've published it. The main class AndroidSecurity resides in the FSG namespace.

IsAppSignatureValid

//Returns true/false if the application signature doesn't match the one stored in the asset.
bool FSG.AndroidSecurity.IsAppSignatureValid(out string signature);

// Example
string signature = string.Empty;
if (FSG.AndroidSecurity.IsAppSignatureValid(out signature) == false)
{
	Debug.LogErrorFormat("Bad application signature: {0}", signature);
	Application.Quit();
}

IsDebuggable

// Returns true/false if the application is currently running in debug mode.
bool FSG.AndroidSecurity.IsDebuggable();

// Example
#if RELEASE
if (FSG.AndroidSecurity.IsDebuggable())
{
	Debug.LogError("Application is running in debug mode when it shouldn't be!");
	Application.Quit();
}
#endif

VerifyGooglePlayInstaller

// Returns true/false if the application was installed from the Google Play store.
bool FSG.AndroidSecurity.VerifyGooglePlayInstaller();

// Example
#if RELEASE
if (FSG.AndroidSecurity.VerifyGooglePlayInstaller() == false)
{
	Debug.LogError("Application was not installed from the Google Play store!");
	Application.Quit();
}
#endif

If you have any questions or issues please email me at jschieck@gmail.com and thanks for your support!