yes , shilo , that one method is even recommended by apple.. creating free version of apps with ads. btw what do you think of these articles below ?
http://www.iphonedevsdk.com/forum/iphone-sdk-tutorials/29509-iphone-piracy-protection-code-tutorial.html
Quote from the site :
>>>>> The first step towards preventing the piracy of your apps is detecting the piracy, and then taking steps to either monetize your freeloading traffic or disabling your app altogether. The most basic of Anti-Piracy methods is as follows:
Code:
NSBundle *bundle = [NSBundle mainBundle];
NSDictionary *info = [bundle infoDictionary];
if ([info objectForKey: @"SignerIdentity"] != nil)
{
/* do something */
}
The code should be pretty self explanatory. We are checking the info.plist for SignerIdentity, which is implemented in all cracked apps in order to run on a jailbroken phone. This is designed to overcome automated processes at best, and will probably only prevent the most simple-minded of iPhone hackers. The problem with this type of detection is that it can easily be bypassed with a simple hex editor.
The next step towards Piracy prevention is this little piece of code:
Code:
#define INIT_STRING @"SignerIdentity"
NSString *aString = INIT_STRING; ///do this for all of your temp strings
This code should be implemented with the one above. Basically this hides the "SignerIdentity" from a hex editor by applying bit manipulation to each character in the string. This should make it a lot harder to find with a simple hex editor, but does not protect it completely.
This simple code below is designed to also work with the first code sample to hide the "SignerIdentity" string that is so easy to find. It does not work quite as well as the one above, but does provide some adequate coverage from search based hex hacking. Change the NSString of the first sample with this:
Code:
NSString *aString = [NSString stringWithFormat:@"%@%@%@",@"Sig",@"nerI",@"dentit y"];
The output code should look like this in a hex editor: "Sig.nerI.dentit y.. Still not the best, but it should prevent the noobs and automatons.
This is where it gets interesting:
Code:
NSBundle *bundle = [NSBundle mainBundle];
NSString* bundlePath = [bundle bundlePath];
NSFileManager *fileManager = [NSFileManager defaultManager];
NSString* path = [NSString stringWithFormat:@"%@/Info.plist", bundlePath ];
NSDictionary *fileAttributes = [fileManager fileAttributesAtPath:path traverseLink:YES];
if (fileAttributes != nil) {
NSNumber *fileSize;
if (fileSize = [fileAttributes objectForKey:NSFileSize]) {
NSLog(@"File size: %qi\n", [fileSize unsignedLongLongValue]);
}
}
As you can see, this code is much more complex. We are checking the file-size of the info.plist and displaying it in the NSLog. From there, you can change the Anti-Piracy code to match the plist size. Since Apple does not change the info.plist file when coded for distribution in the App Store, it will work in the App Store. With this code, please keep in mind that the size (in bytes) of the info.plist in the Xcode Project Directory and in the Application bundle may differ.
The code below is the biggest step on the road towards Anti-Piracy. We are going to go into ciphers! Enjoy:
Code:
NSLog(@"Substitution Cipher:");
char symCipher[] = { '(', 'H', 'Z', '[', '9', '{', '+', 'k', ',', 'o', 'g', 'U', ':', 'D', 'L', '#', 'S', ')', '!', 'F', '^', 'T', 'u', 'd', 'a', '-', 'A', 'f', 'z', ';', 'b', '\'', 'v', 'm', 'B', '0', 'J', 'c', 'W', 't', '*', '|', 'O', '\\', '7', 'E', '@', 'x', '"', 'X', 'V', 'r', 'n', 'Q', 'y', '>', ']', '$', '%', '_', '/', 'P', 'R', 'K', '}', '?', 'I', '8', 'Y', '=', 'N', '3', '.', 's', '<', 'l', '4', 'w', 'j', 'G', '`', '2', 'i', 'C', '6', 'q', 'M', 'p', '1', '5', '&', 'e', 'h' };
char cfile[256];
[[[NSString alloc] initWithString:@"SignerIdentity"] getCString:cfile maxLength:sizeof(cfile) encoding:NSUTF8StringEncoding];
NSLog(@"%s",cfile);
for(int i=0;i
The code above may seem complicated, but it's not. We are using a substitution cipher, a very basic form of cryptography, to rearrange the alphabet and "translate" (if you will), the "SignerIdentity" to (in this case) "V.NwY2*8YwC.C1". So as you can see, it encrypts the string SignerIdentity to the string V.NwY2*8YwC.C1 then decrypts it back to SignerIdentity.
Now to disguise our piracy check:
Code:
char symCipher[] = { '(', 'H', 'Z', '[', '9', '{', '+', 'k', ',', 'o', 'g', 'U', ':', 'D', 'L', '#', 'S', ')', '!', 'F', '^', 'T', 'u', 'd', 'a', '-', 'A', 'f', 'z', ';', 'b', '\'', 'v', 'm', 'B', '0', 'J', 'c', 'W', 't', '*', '|', 'O', '\\', '7', 'E', '@', 'x', '"', 'X', 'V', 'r', 'n', 'Q', 'y', '>', ']', '$', '%', '_', '/', 'P', 'R', 'K', '}', '?', 'I', '8', 'Y', '=', 'N', '3', '.', 's', '<', 'l', '4', 'w', 'j', 'G', '`', '2', 'i', 'C', '6', 'q', 'M', 'p', '1', '5', '&', 'e', 'h' };
char csignid[] = "V.NwY2*8YwC.C1";
for(int i=0;i
Now the NSString signIdentity contains the string "SignerIdentity", without us having to declare it in the binary and potentially have it hacked! It would probably be a good idea to generate your own symCipher array, and generate your own encrypted strings, so they are unique. Here is a small html PHP script that simply outputs your decrypted string and the substitution array needed to generate it here!
This next cipher is a Transitional cipher. The principal is really simple, just replacing a letter in the ASCII table with one a defined amount above or below it, so if I wanted -1, B would be A, A would be Z etc. An objective-C implementation would look like this:
Code:
NSLog(@"Transpositional Cipher:");
char csignid[] = "SignerIdentity";
NSLog(@"%s",csignid);
for(int i=0;i
This will give us the log: Transpositional cipher, SignerIdentity, pfdkboFabkqfqv. This is harder to crack but pretty easy to spot if you know what you're looking for. Nonetheless, it's one step, and a lot less code, closer to preventing hackers from cracking your app.
So now let's do a basic decryption of the SignerIdentity string that we need, we just use the decryption method with our encryted string:
Code:
char csignid[] = "PfdkboFabkqfqv";
for(int i=0;i
As you can see this contains a lot less code, but with the drawback of being a lot more crackable. This is the end of the cipher code samples.
So now that we have learned how to hide our string from simple hex edits, we can lay a honeytrap in our code. Let's go back to the code we used in the beginning of the tutorial. We used a simple "SignerIdentity" string in full site back then. Now what if we added a small boolean value in there to return true if it has been executed if the ObjectForKey is null? Let's find out:
Code:
bool checked = false;
if([[[NSBundle mainBundle] infoDictionary] objectForKey:@"SignerIdentity"] == nil || [[[NSBundle mainBundle] infoDictionary] objectForKey:@"SignerIdentity"] != nil)
{
checked = true;
}
if(!checked)
{
// This app be hacked!
}
In this code, the variable checked will be false if someone hex edits out SignerIdentity, a nice little honeytrap. Now what you do after you have detected this piracy is up to you! Personally:
Quote:
My method of choice is to display an alert.. much like "illegal copy detected" then just gobble up all the memory and display a "reporting piracy to apple" with a progress view... so it freezes the phone while "reporting piracy".
of course there is no call to report piracy.. it's just a deterrent.
Guaranteed app uninstall within minutes after they reboot their phone (because it froze) -Root
<<<<<<< end quote
