xcode 检测 iOS 应用是否被黑
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/11609651/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
Detect if iOS app hacked
提问by Eugene Trapeznikov
My friend got a jailbroken iPad. When he installed Business Model Generation App from Installous and tried to use it, the application showed a UIAlertViewwith the following message:
我的朋友得到了一个越狱的 iPad。当他从 Installous 安装 Business Model Generation App 并尝试使用它时，该应用程序显示了UIAlertView以下消息：
Does anybody know how to do that?
有人知道怎么做吗？
I have 2 ideas:
我有两个想法：
- If there is some set flag when you download app from the App Store, then you can use this flag: if
flag = NO, you show theUIAlertView. - Something with a server (but in this case, you should know all device IDs and who installed your application from the App Store).
- 如果从 App Store 下载应用程序时设置了某个标志，那么您可以使用此标志：如果
flag = NO，则显示UIAlertView. - 带有服务器的东西（但在这种情况下，您应该知道所有设备 ID 以及谁从 App Store 安装了您的应用程序）。
Am I right? How can I implement this feature?
我对吗？如何实现此功能？
回答by Eugene Trapeznikov
You can detect two files: SC_Infoand iTunesMetadata.?plist.
您可以检测两个文件：SC_Info和iTunesMetadata.?plist.
If you can't find them, then your app was pirated: these files are installed after downloading from the App Store.
如果您找不到它们，那么您的应用程序是盗版的：这些文件是在从 App Store 下载后安装的。
This is the code to check:
这是要检查的代码：
NSString * bundlePath = [ [NSBundle mainBundle] bundlePath ];
if ( ! [ [NSFileManager defaultManager] fileExistsAtPath: ( @"%@/SC_Info", bundlePath ) ] )
{
// jailbroken
}
if ( ! [ [NSFileManager defaultManager] fileExistsAtPath: ( @"%@/iTunesMetadata.?plist", bundlePath ) ] )
{
// jailbroken
}
回答by wattson12
There are some libraries around which can detect if an app is cracked (and jailbroken as well), this questiongives a good overview but basically its done by checking the signer identity
有一些库可以检测应用程序是否被破解（以及越狱），这个问题提供了一个很好的概述，但基本上它是通过检查签名者身份来完成的
one library is AntiCrack. I havent used this library so I dont know how well it works
一个库是AntiCrack。我没有使用过这个库，所以我不知道它的效果如何
回答by Rincha
I'm using this code on swift:
我在 swift 上使用此代码：
if Bundle.main.infoDictionary?["SignerIdentity"] != nil
|| !FileManager.default.fileExists(atPath: ("\(Bundle.main.bundlePath)/SC_Info"))
|| !FileManager.default.fileExists(atPath: ("\(Bundle.main.bundlePath)/iTunesMetadata.?plist")){
// Jailbroken
}
回答by iBreakiOS
This is an old question, but being a jailbreak developer myself, I think it can help folks who stumble upon it while searching for jailbreak detection bypass or such things, which are more and more relevant these days. The problem OP has is now very often present, more than it used to be.
这是一个老问题，但作为一名越狱开发人员，我认为它可以帮助那些在搜索越狱检测绕过或诸如此类的东西时偶然发现它的人，这些东西如今越来越相关。OP 的问题现在经常出现，比以前更多。
These kinds of applications, even nowadays in 2020 detect various jailbreak utilities. I am a jailbreak developer myself. When we build a jailbreak for whatever iOS version, we add quite some base binaries to aid further.
这些类型的应用程序，即使在 2020 年的今天，也会检测到各种越狱实用程序。我自己就是一个越狱开发者。当我们为任何 iOS 版本构建越狱时，我们会添加相当多的基本二进制文件以进一步提供帮助。
Nowadays we place them in various hidden folders like /jb/binor /jailbreak/binbag/or /jb/jbstuff/etc, while in the past they used to be placed literally on the default iOS directories such as /bin /sbinetc.
现在我们把它们放在像各种隐藏的文件夹/jb/bin或/jailbreak/binbag/或/jb/jbstuff/等，而在过去，他们曾经是字面上放置于iOS的默认目录如/ bin中/sbin等等。
Applications that have jailbreak detection do a [NSFileManager defaultManager] fileExistsAtPath:...to check for the presence of Cydia, these base binaries (most of the times they check for /bin/bash, but nowadays for even more), and today, they even check if the ROOT FShas been remounted as R/W(it's normally RO, with only /varbeing writeable).
具有越狱检测功能的应用程序[NSFileManager defaultManager] fileExistsAtPath:...会检查是否存在Cydia，这些基本二进制文件（大多数时候他们会检查/bin/bash，但现在更多），今天，他们甚至会检查 是否ROOT FS已重新安装为R/W（通常是RO，带有只能/var写）。
Tweaks downloaded from Cydiausually don't check for jailbreak detection (well, most of the times - there is drama between various jailbreak devs so there are artificial limitations even today), but they check the repo you downloaded from.
从下载的调整Cydia通常不检查越狱检测（好吧，大多数时候 - 各种越狱开发者之间存在戏剧性，因此即使在今天也存在人为限制），但它们会检查您下载的存储库。
Most of the time it's as simple as what AppSync Unifiedtweak ended up doing.
大多数情况下，它就像AppSync Unified调整最终所做的一样简单。
There's a variable or a #definesomewhere in the code of the tweak with the proper Cydiarepo URL or identifier, and the tweak checks the Cydialists to see if the tweak has been downloaded from there. If it hasn't, it would present an alert.
#define调整代码中有一个变量或某处具有正确的存储Cydia库 URL 或标识符，调整检查Cydia列表以查看调整是否已从那里下载。如果没有，它会发出警报。
Some tweaks implement strange DRMs with license being downloaded from server-side every time you reboot the phone (this is odd and very little used int he jailbreak community).
一些调整实现了奇怪的 DRM，每次重启手机时都会从服务器端下载许可证（这很奇怪，而且在越狱社区中很少使用）。
Here's an example of what the AppSync Unified Tweak does:
以下是 AppSync Unified Tweak 功能的示例：
#define DPKG_PATH "/var/lib/dpkg/info/net.angelxwind.appsyncunified.list"
....
if (access(DPKG_PATH, F_OK) == -1) {
NSLog(@"You seem to have installed AppSync Unified from a Cydia/APT repository that is not cydia.akemi.ai (package ID net.angelxwind.appsyncunified).");
NSLog(@"If someone other than Linus Yang (laokongzi) or Karen/あけみ is taking credit for the development of this tweak, they are likely lying.");
NSLog(@"Please only download AppSync Unified from the official repository to ensure file integrity and reliability.");
}
....
So in the case of this jailbreak tweak, it just checks the repo it's been downloaded from. A simple patch in here would be to just load the AppSyncUnified.dylibinto an arm64/arm disassembler like Hopper or IDA or even Radare2 and patch the branch. Make it a Binstead of a conditional branch, so that the result of the comparison is never accounted for. As simple as that. If you wanna analyze the full source-code of AppSync Unified, there's the GitHub repo.
因此，在此越狱调整的情况下，它只会检查从中下载的存储库。这里的一个简单补丁就是将其加载AppSyncUnified.dylib到像 Hopper 或 IDA 甚至 Radare2 这样的 arm64/arm 反汇编器中并修补分支。使其成为B条件分支而不是条件分支，以便永远不会考虑比较的结果。就如此容易。如果您想分析 AppSync Unified 的完整源代码，请访问GitHub 存储库。
Of course, as I said, many tweaks use more sophisticated schemes like server-side DRM, but none of them are failproof.
当然，正如我所说，许多调整使用更复杂的方案，如服务器端 DRM，但没有一个是防故障的。
*Please do understand that I do not condone tweak piracy. This reply is made to aid newcomers to this page and it aims to provide some insight into the current status of jailbreak detection and jailbreak tweaks DRM. Please buy the paid tweaks from the appropriate repos, they only cost a dollar or so.
*请理解，我不容忍微调盗版。此回复旨在帮助新用户访问此页面，旨在提供对越狱检测和越狱调整 DRM 的当前状态的一些见解。请从适当的 repos 购买付费调整，它们只花费一美元左右。
回答by Jorge Aguirre
It's rather simple, but you could check if the cydia app is installed (By checking if it's folder exists). If it's installed, then you do not trust the device. This leaves the risk of uncorrectly letting out jailbroken iPhones/iPads that downloaded your app from app store.
这很简单，但您可以检查是否安装了 cydia 应用程序（通过检查它的文件夹是否存在）。如果已安装，则您不信任该设备。这留下了错误释放从应用程序商店下载您的应用程序的越狱 iPhone/iPad 的风险。
