The operating system has to verify the checksum before starting an application and before using unverified system files.
There should be a control module within the firmware, operating system which checks the running applications as well as prior to running.
