Abstract: Techniques are provided for detecting executable application that is subjected to tampering or unauthorized modification. A checksum for a portion of the executable application is computed at a run time of the executable application by a tamper detection module encoded in the executable application. The tamper detection module compares the checksum to a pre-determined hash value for the portion of the executable application. If the checksum is different from the hash value, the executable application has been tampered with or otherwise modified. The tamper detection module can then cause an alert to be sent to the user and/or the software vendor indicating that the executable application is not genuine.