That's an area of TOCTOU issues. You can either hash the file and then replace it before running, or replace the code which was supposed to do the hashing with

That's an area of TOCTOU issues. You can either hash the file and then replace it before running, or replace the code which was supposed to do the hashing with a constant value you want, or just run in a VM, freeze it, and replace the hash in memory at the time you want. Unless you perfectly control everything: drive, system, application - you can't validate anything. That is unless you want to run in a signed trusted computing enclave, but those have at least one security failure a year in practice.