Determining if an iPhone is Jail broken Programmatically

Question

How do you determine (programmatically) if an iPhone/iPod is:

1. Jail broken
2. Running a cracked copy of your software

Pinch Media can detect if a phone is jail broken or the software running is cracked, does anyone know how they do this? Are there any libraries?

Solution 1

Here is one of the ways to detect if your app was cracked.

In short: the cracking usually requires changing the Info.plist. Since it's regular file you have access to, it's pretty easy to determine such changes.

Solution 2

Detecting a jailbroken phone is as easy as checking for the presence of /private/var/lib/apt/ folder. Although this doesn't detect Installer-only users, by now most have have installed Cydia, Icy or RockYourPhone (all of which use apt)

To detect pirated users, the easiest way is to check for the presence of a SignerIdentity key in your app's Info.plist. Since advanced crackers can easily find the standard [[[NSBundle mainBundle] infoDictionary] objectForKey: @"SignerIdentity"] checks, it is best to obscure these calls using the Objective C runtime available via #import <objc/runtime.h> or use alternative equivalents.

Solution 3

Just to expand on zakovyrya's reply, you could use the following code:

if ([[[NSBundle mainBundle] infoDictionary] objectForKey: @"SignerIdentity"] != nil) {
  // Jailbroken
}

HOWEVER, the person jailbreaking your app can hexedit your program and as such, they could edit the string @"SignerIdentity" to read @"siNGeridentity" or something else which would return nil, and thus pass.

So if you use this (or any of the other suggestions from http://thwart-ipa-cracks.blogspot.com/2008/11/detection.html):

• Don't expect it to work forever
• Don't use this information to break/hinder your app in any way (otherwise they'll have cause to hexedit it, so your app won't know it is jailbroken)
• Probably wise to obfuscate this bit of the code. For example, you could put the base64 encoded reversed string in your code, and then decode it in the app by reversing the process.
• Validate your validation later in your code (e.g. when I said SignerIdentity, did it actually say SignerIdentity or siNGeridentity?)
• Don't tell people on a public website like stackoverflow how you do it
• Keep in mind it is only a guide and is not fool-proof (nor cracker-proof!) - with great power comes great responsibility.

Solution 4

To expand on yonel's and Benjie's comments above:

1) Landon Fuller's method relying on encryption check, linked above by yonel, seem to be the only one still not defeated by automated cracking tools. I would not be overly worried about Apple changing the state of the LC_ENCRYPTION_INFO header any time soon. It does seem to have some unpredictable effects on jailbroken iphones (even when the user has purchased a copy...)

At any rate, I would not take any rash action against a user based on that code...

2) To complement Benjie's comment re. obfuscation (an absolute necessity when dealing with any string values in your anti-piracy code): a similar but perhaps even easier way is to always check a salted hashed version of the value you are looking for. For example (even though that check is no longer efficient), you would check each MainBundle's key name as md5(keyName + "some secret salt") against the appropriate constant... Rather basic, but sure to defeat any attempt at locating the string.

Of course, this requires you to be able to indirectly query the value you want to compare (for example by going through an array containing it). But this is most often the case.

View more solutions

Comments

[JoshJordan]

Apple knows how to determine that :p

[Richard Stelling]

If your interested in this question why not support the Area 51 proposal for a jail-breaking Stack Exchange site

[Cœur]

Possible duplicate of How do I detect that an iOS app is running on a jailbroken phone?

[Lily Ballard]

Unfortunately, there's a workaround that breaks this detection mechanism. Once the app is installed, the SignerIdentity key is no longer necessary, so the cracker can simply ssh into their jailbroken phone and edit the plist to remove it.

[Edward Ashak]

So this checks the SignerIdentity on your App bundle, but what about the case that the app is not hacked or anything but the device is JailBroken, How would you detect that ?

[user14128401]

Ask it as a question on SO and someone will answer :)

[Basil Bourque]

Is the Landon Fuller method still workable nowadays, with iOS 7?

[Cœur]

@KevinBallard do you have any recommendation for detecting common jailbreaks in 2017?

[Lily Ballard]

@Cœur Nope, I haven't looked into this since writing that comment.