Using LC_ENCRYPTION_INFO for basic crack detection on 64bit systems?

Question

I was using LC_ENCRYPTION_INFO to check if binary is encrypted/compressed or not. I was using this to guess the possibility of the app being a pirated copy.

On ARM64 devices I see that this no longer works and I started to get false positives. Do you have any experience on this one? What could have been changed in ARM64? (it works on iPhone 5 iOs 9beta, but not on iPhone 5s and 6 8.4)

I found that this happens only with ARM64 binary. Would you please try it on an ARM64 device with ARM64 build? It cannot find `LC_ENCRYPTION_INFO` command while iterating through the commands. — frankish, Jul 15 '15 at 10:38
possible duplicate of [Executable encryption check anti piracy measure](http://stackoverflow.com/questions/7038143/executable-encryption-check-anti-piracy-measure) — Giuseppe Lanza, Jul 15 '15 at 14:58
@GiuseppeLanza This is not a duplicate question. That question you linked shows the answer for 32bit devices. This question is aimed to solve that question for 64 bit devices. — frankish, Jul 15 '15 at 14:59
look at my answer. there is the answer that i posted that gives you the 64 bit case. — Giuseppe Lanza, Jul 15 '15 at 15:00

score 3 · Accepted Answer · edited May 23 '17 at 11:58

please refer to this answer: https://stackoverflow.com/a/22292104/1754559

This code won't work successfully on a 64-bit device like the iPhone 5s. The header has been changed from mach_header to mach_header_64 and the command ID is now LC_ENCRYPTION_INFO_64.

What I did was to read the header and then see what the magic number was. If it's MH_MAGIC_64 then you're on a 64-bit device and you need to use the mach_header_64 struct and look for LC_ENCRYPTION_INFO_64 (defined as 0x2C) instead of LC_ENCRYPTION_INFO.

to check if you are on a 32 bit or 64 bit you can get the size of a pointer. if it is 4 you are on a 32 bit device else it will be 8

Using LC_ENCRYPTION_INFO for basic crack detection on 64bit systems?

1 Answers1