iPhone Piracy Protection Code - A Tutorial

[thewitt]

Originally Posted by hellrider

That's easy to pull off. Also, apple would never know that you implemented that, nor could they do anything, as according to them piracy is not a big deal.

Where did you read anything from Apple that says they believe piracy is not a big deal?

-t

[hellrider]

I don't like it when people assume all jailbreakers are pirates. I've had a jailbroken iPod touch for over two years. The jailbreak community is thriving, and ripe with innovative applications and SB hacks

[hellrider]

Originally Posted by thewitt

Where did you read anything from Apple that says they believe piracy is not a big deal?

-t

Obviously they did not explicitly say such a thing, but their inaction on the matter speaks volumes. Cracking apps is literally child's play; apple puts a huge burden on developers by letting them fend for themselves.

[kierster]

Thanks to the OP! Your research and effort will bring many advertisements to future pirates

[hellrider]

signerIdentity checks fail. at least compare an info.plist checksum or filesize

[thewitt]

Originally Posted by hellrider

Obviously they did not explicitly say such a thing, but their inaction on the matter speaks volumes. Cracking apps is literally child's play; apple puts a huge burden on developers by letting them fend for themselves.

I love it when people assume that because a company takes a specific approach to what they perceive as a problem, the company automatically MUST be doing so in support of that problem.

It's very simple.

Apple has priorities as a company for this platform, and currently fighting piracy on the iPhone is not on their short list.

This does not mean it's not important to them, only that it's not currently as high on their list as the other things they are bringing to the platform.

Market penetration in Japan was a huge problem two years ago - they have solved this problem and now own more than 50% of the smart phone market in Japan.

Economic reality will always drive large corporations - and I would expect nothing else of Apple.

We as developers have to elevate the problem to it's proper level of importance, JUST as we had to so so on all of the game platforms of the last 20 years to get the attention of EVERY SINGLE hardware developer that's ever played in this arena.

Apple will address the problem when we make it a high priority for continuing to support the platform.

As long as we don't make it a high priority, they won't make it a high priority. How many of you have submitted bug reports in the Developer Connection to request that Apple do something to help us fight piracy. Any of you? I did - many months ago - and will continue to bring it to their attention whenever possible.

Their inaction at this time does not mean they condone piracy of course - nor that they don't take it seriously - it simply means that with tens of thousand of developers stepping up to the platform to try to take advantage of the nearly 80 million devices they have sold, it's not a serious enough problem to be addressed over the other issues on their plate.

Don't assume they support pirates or don't take piracy seriously simply because they have not yet implemented the pirate-proof platform.

When jailbroken phones simply stop operating, and running pirated Apps cause the phone to lock up, we'll hear a completely different screaming sound from that side of the user community.

I for one will not miss them when they move on to Android.

-t

[Shmoopi]

Originally Posted by thewitt

I love it when people assume that because a company takes a specific approach to what they perceive as a problem, the company automatically MUST be doing so in support of that problem.

It's very simple.

Apple has priorities as a company for this platform, and currently fighting piracy on the iPhone is not on their short list.

This does not mean it's not important to them, only that it's not currently as high on their list as the other things they are bringing to the platform.

Market penetration in Japan was a huge problem two years ago - they have solved this problem and now own more than 50% of the smart phone market in Japan.

Economic reality will always drive large corporations - and I would expect nothing else of Apple.

We as developers have to elevate the problem to it's proper level of importance, JUST as we had to so so on all of the game platforms of the last 20 years to get the attention of EVERY SINGLE hardware developer that's ever played in this arena.

Apple will address the problem when we make it a high priority for continuing to support the platform.

As long as we don't make it a high priority, they won't make it a high priority. How many of you have submitted bug reports in the Developer Connection to request that Apple do something to help us fight piracy. Any of you? I did - many months ago - and will continue to bring it to their attention whenever possible.

Their inaction at this time does not mean they condone piracy of course - nor that they don't take it seriously - it simply means that with tens of thousand of developers stepping up to the platform to try to take advantage of the nearly 80 million devices they have sold, it's not a serious enough problem to be addressed over the other issues on their plate.

Don't assume they support pirates or don't take piracy seriously simply because they have not yet implemented the pirate-proof platform.

When jailbroken phones simply stop operating, and running pirated Apps cause the phone to lock up, we'll hear a completely different screaming sound from that side of the user community.

I for one will not miss them when they move on to Android.

-t

Well said. However, I don't believe jailbroken phones are the problem. Jailbreaking was available long before applications were able to be pirated, and will continue to be around *hopefully long afterwords as well. But application piracy is wrong and should be eliminated. I'm sure that many other jailbroken users would say the same thing.

[thewitt]

Jailbroken phones are simply an enabler - and dealing with one will certainly not be done without dealing with the other.

-t

[kierster]

Found this little tidbit from apple's documentation on

[[NSBundle mainBundle] infoDictionary]

"A dictionary, constructed from the bundle's Info.plist file, that contains information about the receiver. If the bundle does not contain an Info.plist file, a valid dictionary is returned but this dictionary contains only private keys that are used internally by the NSBundle class. The NSBundle class may add extra keys to this dictionary for its own use. "
Mac Dev Center: NSBundle Class Reference

The wording is throwing me off a little bit. At first I thought this meant that the mainBundle would always add keys, messing up any check on what has changed. But after reading it a second time i may understand it now. Does it mean it will make an info.plist if there is none present?

[hellrider]

No, that means that it won't return nil if there is no Info.plist in the bundle. Not something you need to concern yourself with, as you can't submit an app without an info.plist

[kierster]

Alright, that makes sense thanks

[natanavra]

Another code snippet I found; uses singer's ID but also checks for the dates the info.plist as a file, and the date it was compiled for distribution (that's how I got it).

snippie

[hellrider]

Checksums are the most effective way to deter "noob" crackers. Anyone who knows some assembly can easily patch this, but its better than nothing.

Here's a function that returns the MD5 checksum of the given data.

#import CommonCrypto/CommonDigest.h

// this site fails with regards to disallowing < > in CODE blocks

NSString * data_getMD5(NSData *data) {
	
	if (data == nil)
		return nil;

	const void * bytes = [data bytes];
	int len = [data length];
	unsigned char digest[CC_MD5_DIGEST_LENGTH];
	
	CC_MD5_CTX c;
	CC_MD5_Init(&c);
	CC_MD5_Update(&c, bytes, len);
	CC_MD5_Final(digest, &c);
	
	return [NSString stringWithFormat:@"%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x",
			digest[0], digest[1], digest[2], digest[3],
			digest[4], digest[5], digest[6], digest[7],
			digest[8], digest[9], digest[10], digest[11],
			digest[12], digest[13], digest[14], digest[15] ];
}

Pass an NSData object holding the bytes of the info.plist.

Also, you can easily adapt it to do SHA1 instead.

[Shmoopi]

iPhone Anti-Piracy Protection Code Part 2 Is Out!

[Ivan]

Like many others my app has been pirated and the entries on my high score table out number sales 10 to 1!

I am just about to release an update and was going to at least implement the simple check to stop the automated cracker.

However, being curious I first through I would download a pirated version and take a look, so I did a Google search and found my apps IPA file.

Once on my Windows PC I renamed the IPA file extension to ZIP and unzipped it. I noticed that all of the files had the correct timestamp (within 1 minute of each other) including the info.plist.

I then did a binary file compare on the info.plist and compared to the original one from my release to find they were identical. Also looking at the plist file SignerIdentity did not exist.

I am now confused.

Does that mean that this version wasn't cracked and people are uploading non-cracked versions? Am I missing something?

Cheers
Ivan

[dobry]

Hackers don't need to change the info.plist anymore! See the other anti-piracy thread.

My app ($1.99) has also been pirated even though there is also a free lite version of the app available. They download the pirated app approximately 500 times a day.