views:

247

answers:

2

How easy is it to determine whether an iPhone application is cracked and report that device ID to a server rather than block it / or turning the app into a lite version? Would patching remove these methods to the server?

It is mainly a losing battle preventing an app being cracked, but i want a system not dissimilar to product keys / or identifying a binary. Is it possible to have every app downloaded from the app store to have a unique identifier hard coded into it?

Thanks and sorry for barrage of questions!

A: 

Take a look at AntiCrack

http://www.drobnik.com/touch/anticrack/

Though not free, it's donation-ware with no ongoing payments.

I have no affiliation with them, but will be rolling their code into my next project.

To answer your how do I tell if my App is cracked question - probably the best way is to see if your App still contains any encrypted sections. Whenever a pirate cracks an application it strips the encryption in order to run it.

-t

Tim
thanks, i have seen it but i am not fully sure of how effect anti crack is, id love to use it as it would save me bags of time.
With anti crack, are you gauranteed to at least know if the app is cracked, so that i can relay it to a server?
The methods that AntiCrack uses are going to tell you if your App is cracked, yes.
Tim
+1  A: 

We'll see. It's a constant arms race. They've been trying to create effective copy protection for at least 25 years now on the desktop, and still the apps get cracked before they even hit the shelves. A jailbroken iPhone is just a computer, so we shouldn't expect any difference.

For €30, as long as the tool doesn't cause problems of its own for your legitimate users, why not? But that's a major caveat. You have to figure the cost of the tool, the cost of your deploying it, and the cost of every lost customer due to problems, against the number of additional sales you actually make due to freeloaders now paying for your product. Very few freeloaders actually become paying customers; most will just not use the software. So there's not a lot of revenue available to offset the cost of protection.

Remember that last bit; very few freeloaders will ever become paying customers, and their using your product costs you nothing. In fact, it gives you a level of free advertising. So I generally encourage developers to spend their time making their product so awesome that their legitimate customers make them tons of money. Fighting freeloaders mostly distracts from that.

My expectation: Hackulous will figure out how to crack AntiCrack automatically (since it's a single target), making it worthless. AntiCrack will release a new version, making it worthwhile (at which point you'll need to rev your software). Hackulous will crack it again. AntiCrack will update, and so will you. Wash, rinse, repeat.

Apple spends big bucks to prevent jailbreaking. They have control over the hardware and software. How's that worked for them? Anyone think a €30 magic bullet is going to fare better?

Rob Napier
Well do crackers generally take further measures after using crackulous before sending your app for distribution? I just want to know whether it is cracked and log it to a server silently, they wont know that they have no chance of winning a competition I am setting up on the server side. The problem is that I am trying to set up an ambitious 'global' competition, and I dont want it to seem unfair to those paying customers that those that dont pay have equal chance of winning. Any thoughts about how you would secure a competition? Thanks.
If your competition is short-lived enough, then AntiCrack may survive long enough to meet the goal. If it's ongoing, then you're facing the same problem as WoW and all the other MMORPGs, and you'll have to do what they do: constant vigilance, hunting down well-known cracks and working around them. AntiCrack may be a tool in that, but the process is the real thing. It's a never-ending arms race, and you'll have to decide how many cheaters you're willing to put up with. One strategy, though, is to make the app free, and charge a "server access" fee. At least then you have some control.
Rob Napier
I got to thinking about this more. First, if this is just "freeloaders shouldn't get high score," then I'd point you back to my above points and recommend you just let it go. If it's "freeloaders shouldn't be able to win a prize" (you're giving something out), then it's worth more thought. If it's about cheating (modified client), then that's the WoW problem above. For your "I just want to know, and maybe quietly do something on the server" I'd use the simplest approach: checksum your bundle and send it up in an SSL stream. It's as effective as anything else, and unlikely to break anything.
Rob Napier