Alex Rivera | Logout

How to detect a cracked iPhone App and a jailbroken device (different methods)

Asked 2011-01-18T19:08:08.130
13

I'm building a blacklisting service for cracked iPhone apps and I am curious if I missed a method for detecting cracked apps.

In the moment following app crack detection methods are available for the service:

  1. checking plist size
  2. checking signer identity
  3. checking if binary is crypted (not sure if this is working correctly since no cracked app got detected this way)
  4. checking modified date of info.plist against modified date of package (not sure if this is working - used code like: http://snippie.net/snip/f7530ff2 to do that)

I also wonder if it is possible to check if the device is jailbroken? This would help, too, because the service will work much like a spam blacklist and jailbreak could be used to increase the score.

I have also included a honeypot, which shows me that the tools used by the crackers eliminate some of the checks I do. For instance the plist check for size or signer identity.

My question is now:

  • Are there more "good" checks I should use?

and

  • Is there a way to detect Jailbreak?
iphone detection cracking piracy-protection
Edit
Report

1 Answer

7
-(IBAction)rootCheck:(id)sender {

    NSArray *jailbrokenPath = [NSArray arrayWithObjects:
                               @"/Applications/Cydia.app",
                               @"/Applications/RockApp.app",
                               @"/Applications/Icy.app",
                               @"/usr/sbin/sshd",
                               @"/usr/bin/sshd",
                               @"/usr/libexec/sftp-server",
                               @"/Applications/WinterBoard.app",
                               @"/Applications/SBSettings.app",
                               @"/Applications/MxTube.app",
                               @"/Applications/IntelliScreen.app",
                               @"/Library/MobileSubstrate/DynamicLibraries/Veency.plist",
                               @"/Applications/FakeCarrier.app",
                               @"/Library/MobileSubstrate/DynamicLibraries/LiveClock.plist",
                               @"/private/var/lib/apt",
                               @"/Applications/blackra1n.app",
                               @"/private/var/stash",
                               @"/private/var/mobile/Library/SBSettings/Themes",
                               @"/System/Library/LaunchDaemons/com.ikey.bbot.plist",
                               @"/System/Library/LaunchDaemons/com.saurik.Cydia.Startup.plist",
                               @"/private/var/tmp/cydia.log",
                               @"/private/var/lib/cydia", nil];

    NSString *rooted;
    for(NSString *string in jailbrokenPath)
        if ([[NSFileManager defaultManager] fileExistsAtPath:string])
            rooted=@"y";
        else
            rooted=@"n";

    NSLog(@"%@", rooted);
}

sample code: http://www.evernote.com/shard/s13/sh/e45f27ee-3dd5-4eb1-9f56-1981cdd3286b/bc156eb773315647c13c2c7ee419

answered 2011-09-15T03:13:12.173

Your Answer