Android - Installation Source - Monitor (Pro)

A common method to cheat in Android games is to download the target app, manipulate it, and then upload it to other stores or sideload it. Prevent this by validating the app's installation source.

Monitor

The 'AndroidPackageSourceMonitor' (class AndroidPackageSourceMonitor, namespace GUPS.AntiCheat.Monitor.Android) determines where the app was installed from. When the source has been resolved, it emits an AndroidSourceStatus to its observers, containing the recognized store and its package name. If the store could not be identified, EAppStore.Unknown is used, leaving the decision to you based on the raw package name.

Status

The monitor emits an AndroidSourceStatus, which implements IAndroidStatus (and therefore IWatchedSubject):

public struct AndroidSourceStatus : IAndroidStatus
{
    // True if the installer could not be retrieved (e.g. a JNI failure).
    public bool FailedToRetrieveData { get; }

    // The recognized app store, or EAppStore.Unknown.
    public EAppStore AppStoreSource { get; }

    // The raw installer package name reported by the OS.
    public string AppStoreSourcePackage { get; }
}
  • FailedToRetrieveData: True when the installation source could not be retrieved or an exception occurred; the other values are then not valid.
  • AppStoreSource: The recognized app store as an EAppStore value (see the table below), or Unknown.
  • AppStoreSourcePackage: The raw installer package name, useful when the store is Unknown.

Lifecycle and timing

The monitor resolves the installation source once, in its OnStart callback, and then notifies observers a single time with the resulting AndroidSourceStatus. If the source could not be resolved, it still notifies with FailedToRetrieveData set to true.

Configuration

There are no inspector fields on this monitor. The allowed installation sources are configured in the AntiCheat project settings and validated by the detector (see 'Detect Disallowed Installation Source'). Go to 'Project Settings -> GuardingPearSoftware -> AntiCheat' and open the 'Android - App Store - Settings' section.

In the AntiCheat Project Settings, assign the allowed installation sources.

Development builds

The paired detector honors the global 'Verify development builds' switch. By default it validates the app only in release builds, so the check is skipped in development builds and inside the Unity editor. Enable this option in 'Project Settings -> GuardingPearSoftware -> AntiCheat' while testing.

Enable 'Verify development builds' to also validate the app in development builds and the editor.

Supported Platforms

The monitor is only available on Android platforms.

Requirements

Requires an Android build with at least Android 4.4 (API level 19) (December 2013).

How To Use

Attach the 'AndroidPackageSourceMonitor' to a child GameObject of the 'AntiCheat-Monitor' and pair it with the 'AndroidPackageTamperingDetector'.

Add Monitor Component

Add the 'AndroidPackageSourceMonitor' MonoBehavior from the 'GUPS.AntiCheat.Monitor.Android' namespace to your 'AntiCheat-Monitor' GameObject, or better, to a child GameObject.

Add the 'AndroidPackageSourceMonitor' as a Component.

Monitored Installation Sources

The following app stores or installation sources are supported by default, as they are common sources. If the source could not be recognized or parsed, "Unknown" is used as the default.

Appstore Description
Android Package Installer Package Installer. The installation of apps outside of stores is done by a system app that is integrated into every Android device. This system app, known as the package installer, is responsible for installing applications that originate from apk files downloaded from various locations.
Amazon Appstore Amazon's digital application distribution platform.
Aptoide An open-source independent Android app store.
Cafe Bazaar An Iranian Android marketplace.
F-Droid An open-source software repository for Android.
Google Play Store Google's official app store.
Huawei AppGallery Huawei's official app distribution platform.
Myket A popular Android app store.
Oppo App Market Oppo's official app store.
Samsung Galaxy Store Samsung's official app store.
TapTap A Chinese app store for mobile games.
Vivo App Store Vivo's official app distribution platform.
Xiaomi Mi GetApps Xiaomi's official app store.
XDA Labs A platform for mobile development projects.
Unknown Unknown installation source. Used if it is none of the above sources.

Consume the status in code

Besides pairing the monitor with a detector, you can subscribe your own observer to receive the AndroidSourceStatus directly. Every monitor derives from AMonitor and exposes Subscribe(IObserver<IWatchedSubject>), which returns an IDisposable you can dispose to unsubscribe.

using System;
using GUPS.AntiCheat.Core.Watch;
using GUPS.AntiCheat.Monitor.Android;
using UnityEngine;

public class AndroidSourceStatusLogger : MonoBehaviour, IObserver<IWatchedSubject>
{
    private void Start()
    {
        var monitor = GetComponentInChildren<AndroidPackageSourceMonitor>();
        monitor.Subscribe(this);
    }

    public void OnNext(IWatchedSubject subject)
    {
        if (subject is AndroidSourceStatus status)
        {
            if (status.FailedToRetrieveData)
            {
                Debug.LogWarning("Could not resolve the installation source.");
                return;
            }

            Debug.Log($"Installed from: {status.AppStoreSource} ({status.AppStoreSourcePackage})");
        }
    }

    public void OnError(Exception error) { }
    public void OnCompleted() { }
}

Detect Disallowed Installation Source

To react to the sent status and thus validate the installation source, you need a detector. To do this, use the 'AndroidPackageTamperingDetector', an aggregated detector that can react to various attempts to tamper with the Android app itself.