How to detect “IAP crackers”?

Question

I found out that many users use so-called "IAP crackers" instead of purchasing the items in in-app purchase (IAP). I also learned that Zynga Poker and Pokerist already detect IAP crackers and prevent the fake IAP. I would like to detect which phone is using IAP cracker. For Cydia hacking tool, I could find it with Application path.

But for I don't believe iAP crackers fall into specific applications. I think I can check that by calling "Url Scheme" but I don't know the name. Is there anybody who knows how?

Answer 1

To detect IAP Cracker you can simply check for installed package with NSFileManager. I've tried it with Cydia to detect a jailbreak and it works fine.

As Cydia is automaticly installed on every jailbroken device, you can check for Jailbreak like this:

if ([[NSFileManager defaultManager] fileExistsAtPath:@"/Applications/Cydia.app"]){

   NSLog(@"Jailbreak detected");
}

IAP Cracker is just some package, that is also installed in your system, you can check for it too.

if ([[NSFileManager defaultManager] fileExistsAtPath:@"/Library/MobileSubstrate/DynamicLibraries/iap.dylib"]){

   NSLog(@"IAP Cracker detected");
}

Does anybody knows if it's violating some Apple guidelines?

Answer 2

Apple stated this problem here: In-App Purchase Receipt Validation on iOS

As described in the text, validate your transactions after they have completed and you should be fine (hopefully).

Answer 3

Will be submitting this in an app this week (May 2015). So will see if Apple approves

+(BOOL)isJailbroken {
#if (TARGET_IPHONE_SIMULATOR)
    return NO;
#endif

#ifndef IS_APP_EXTENSION

    NSURL* url = [NSURL URLWithString:@"cydia://package/com.example.package"];
    BOOL doesHaveCydia = [[UIApplication sharedApplication] canOpenURL:url];
    if (doesHaveCydia) {
        return YES;
    }
    NSError* error=nil;
    NSArray* files = [[NSFileManager defaultManager] contentsOfDirectoryAtPath:@"/System" error:&error];
    //NSLog(@"blah %i error %@",(int)[files count], error);

    if (error==nil) {
        //A non-jailbroken device will have an operation not permitted error.
        //Jailbroken device should have a list of files and a nil error.
        if (files) {
            NSLog(@"jailbreak? %i",(int)[files count]);
        }
        return YES;
    }
    return NO;
#else
    return NO;
#endif
}

Answer 4

You should try system("dpkg -l | grep iapCracker > /var/tmp/logiap.txt"); then fill a NSString with the content of logiap.txt and check if the string cointain something. But I don't know if apple allow you to do this ;)

Answer 5

I just found a $20 component on BinPress that claims to provide this protection for you. In fact, it was reading their description that prompted me to search for IAP Cracker and led me to this question!

From a quick read through the description it seems worth trying at least as a cheap barrier to these attacks.

This component provides protection against tools that bypass in-app purchases and unlock premium content for free, such as the most popular 'iAP Cracker'. Protection is managed via a hosted receipt verification service hosted on our servers. It comes with both proven security and reliability against cracking tools and is meant to be as easy as possible to integrate for the developer.

'In-app purchase verification' is for those who don't maintain a server and want to avoid managing purchase verification themselves – it's a huge time saver: Implementing it is as easy as inserting a few extra lines of code (see below). From then on, the server will do its magic and it'll verify each receipt with an Apple server. It'll also provide you with a count of purchases made.

Answer 6

The NSFileManager method, written by @Morpheus2002 was not working for me, and might be violating Apple's guidelines. To check if Cydia is installed and therefore if the device is jailbroken, you can check if you can open cydia://home URL scheme as suggested @MarkJohnson:

if (![[UIApplication sharedApplication] canOpenURL:[NSURL URLWithString:@"cydia://home"]]) {
    NSLog(@"Jailbreak is not detected");
} else {
    NSLog(@"Jailbreak is detected");
}