How to detect IAPFree and IAPCracker

Question

I was looking for a way to detect people using IAPCracker in my application.

Lately I found this useful post How to detect “LocallAPStore" - new iap cracker and used it to protect some of my in-app-purchases.

Now I found a new source of cracking in-app-...you know. So I installed this new tweak called IAPFree which was a new way of cracking IAPs. I tested it on some apps and my own app and it worked, which is not good!

enter image description here

I tried to detect it by the same way as the IAPCracker:

if ([[NSFileManager defaultManager] fileExistsAtPath:@"/Library/MobileSubstrate/DynamicLibraries/iap.dylib"]){
    NSLog(@"IAP Cracker detected");
}

But the name of the file was unfortunately changed to "iapfree.core.dylib" (I opened IFile and found the file in the same directory).

Now I thought I could simply replace the directory. However, it doesn't worked! I used this code to detect it somehow:

if ([[NSFileManager defaultManager] fileExistsAtPath:@"/Library/MobileSubstrate/DynamicLibraries/iapfree.core.dylib"]){
    NSLog(@"IAPfree detected");
}else{
NSLog(@"No IAPFree found");
}

I thought this would be an random error and I tried it with other files in the same directory. They did worked!

I can't figure out whats the problem with this file. I think it could be caused by the ".core.", but actually I don't know.

Do you know how to solve the problem or detect it in another way?

In the future, please post 320x480 screenshots. We don't need to see the Retina image, for something like this. A smaller image helps keep your question more readable. Thanks. — Nate, Mar 06 '13 at 22:03

il Malvagio Dottor Prosciutto · Answer 1 · 2013-03-11T08:44:58.547

The best way (also the only way "Apple approved") to solve the issue is to check the in app purchase receipts with an external server, not the presence of a cracker! There're lots of 3rd party services doing that quite easily and some even for free.

As alternative you can just check the receipts locally as shown here and here (full disclosure, it's my blog ;) ). It have some advantage (simpler, works even if the validating server is offline or not reachable) but of course new cracking systems may fool it.

Here an bit of code: when you check the paymentQueue (callback of the inApp protocol), you can do something like this:

- (void)paymentQueue:(SKPaymentQueue *)queue updatedTransactions:(NSArray *)transactions
{
    for (SKPaymentTransaction *transaction in transactions)
    {
        switch (transaction.transactionState)
        {
            case SKPaymentTransactionStatePurchased:
            case SKPaymentTransactionStateRestored:
            {
                [self checkReceipt:[_productIdentifierList objectAtIndex:0] transazione:transaction];
                [self finishPaymentTransaction:transaction];
            }

                break;

            case SKPaymentTransactionStateFailed:
            {
                [UIView msgBox:@"Transaction Error" title:@"Errore"];
                [self finishPaymentTransaction:transaction];
            }
                break;

            default:
                break;
        }           
    }
}

- (void) checkReceipt:(SKProduct *)prodotto transazione:(SKPaymentTransaction *)transaction
{
    NSString*ricevuta = [[NSString alloc] initWithData:transaction.transactionReceipt encoding:NSUTF8StringEncoding];

    NSRange hackTest = [transaction.transactionIdentifier rangeOfString:@"com.urus.iap"];   // ok if this not found
    NSRange hackTest2 = [transaction.transactionIdentifier rangeOfString:@"PUT HERE YOUR INAPP ID"];    // TODO: PUT HERE YOUR INAPP ID
    if (hackTest.location == NSNotFound && hackTest2.location == NSNotFound)
    {
        // it pass the local test: receipt is probably good
    }
    else
    {
        // invalid receipt, fake for sure, cancel buying...
    }
}

please note that you have to put your inApp code in the "hackTest2" check: so if you have more than one product you may made a loop...

oh, I realized that I'm using parse features and I could use that too to make a deal with the server! By the way, could you eventually make some examples how to use this in another way for those who don't use parse or servers.Thank you anyway. — MasterRazer, Mar 06 '13 at 14:43
I edit the answer to add a bit of code: please again remember this's a lesser solution, to be used only if for some reasons you can't have/afford a test server. — il Malvagio Dottor Prosciutto, Mar 11 '13 at 08:48
Hey, You said, there're some 3rd party services doing that quite easily and some even for free, can you please name some FREE services ? I want them for my product. — Ankur, Jul 19 '14 at 10:28

score -1 · Answer 2 · answered Jun 04 '13 at 15:31

-1

Check also for "IAPFreeService.dylib"

Hope this helps.

answered Jun 04 '13 at 15:31

thierryb

3,660
4
42
58

How to detect IAPFree and IAPCracker

2 Answers2