1

I recently downloaded one apk from a custom apkstore from my country. You can download the app for free but you need to pay to use some functionalities. I cracked the app jumping over all the activation mechanism just changing a boolean 'isActivated' flag which is used in an 'if'. I did this just for curiosity because I don't need this app, but I'm wondering how can you avoid this trick.

It looks almost impossible to me. I have read you can put sensitive code in C using NDK, but you always need to say in java something like (if activation == completed) in some point. The activation mechanism looks pretty complex but I don't changed it at all, so all the thing is in the conditional. I know you can use some obfuscator but that usually just change the name of the variables and make some permutations. If somebody know how to avoid or to protect the 'if' please let me know.

EDITED

Let me add that the apk is a remote control for my country custom digital TV decoders. The idea is that you can use your phone with infrared as a remote control. In this case the functionalities are in the apk, so a mechanism online with some session token seems inneffective to me because I can just ignore the token and call the functions, besides off course is annoying to have a remote control always online.

Improve this question
3
  • 3
    The short answer is you really can't at the client level. Even that C code can be read and reverse engineered. All any sort of DRM does is slow an attacker down. In order to really and truly prevent something like this, the logic would need to exist on a server some place where the user would not have access to it, which may not be reasonable for some use cases.
    – Dan Landberg
    Jan 8, 2021 at 20:15
  • It's not possible.
    – user253751
    Jan 8, 2021 at 20:16
  • @DanLandberg That should be an answer :)
    – vidarlo
    Jan 8, 2021 at 20:40

1 Answer 1

Reset to default
2

TL;DR: there seems no definite way to prevent it. The following thoughts may, often as a combination of anti-reverse-engeneer-measures - slow down an attack to a level that makes attacking to labourous, but do not specifically address (only) the conditional "if" (I am not aware of such) but hardening in general.

Concepts have been proposed such as "Hardened Anti-Reverse Engineering System" (HARES), with the software code only being decrypted by the processor at the last possible moment before execution (A. Greenberg, Wired 2015). This does not specificall address an "if" statement, but one may not be able anymore to find also the "if"-statement. I havn't followed up on HARES, and more recent discussions include hardening for mobile banking apps (M. Rupp on cryptomathic.com) and a more general discussion on softwareengineering.stackexchange.com.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .