ios 위변조 탐지 로직

1.앱 변조를 위한 디버깅 탐지

	//1.디버깅 탐지
	#include <stdio.h>
	#include <sys/types.h>
	#include <unistd.h>
	#include <sys/sysctl.h>
	#include <stdlib.h>
	static int is_debugger_present(void)
	{
	int name[4];
	struct kinfo_proc info;
	size_t info_size = sizeof(info);
	info.kp_proc.p_flag = 0;
	name[0] = CTL_KERN;
	name[1] = KERN_PROC;
	name[2] = KERN_PROC_PID;
	name[3] = getpid();
	if (sysctl(name, 4, &info, &info_size, NULL, 0) == -1) {
	perror("sysctl");
	exit(-1);
	}
	return ((info.kp_proc.p_flag & P_TRACED) != 0);
	}
	int main(int argc, char * argv[]) {
	NSString * appDelegateClassName;
	@autoreleasepool {
	// Setup code that might create autoreleased objects goes here.
	appDelegateClassName = NSStringFromClass([AppDelegate class]);
	printf("Looping forever");
	fflush(stdout);
	while (1)
	{
	sleep(1);
	if (is_debugger_present())
	{
	printf("Debugger detected! Terminating...\n");
	return -1;
	}
	printf(".");
	fflush(stdout);
	return UIApplicationMain(argc, argv, nil, appDelegateClassName);
	}
	}
	}

view raw a.c hosted with ❤ by GitHub

 

2.플랫폼 위변조 체크

	2.플랫폼 변조 체크
	if ([self isJailbroken] ) {
	UIAlertView *noticeAlert=[[UIAlertView alloc]initWithTitle:@"알림" message:@"변조가 의심되는 기기 입니다. 확인 후 다시 실행해 주세요." delegate:nil cancelButtonTitle:@"닫 기" otherButtonTitles:nil];
	[noticeAlert setTag:0];
	[noticeAlert show];
	exit(0);
	}
	- (BOOL)isJailbroken{
	#if !(TARGET_IPHONE_SIMULATOR)
	if ([[NSFileManager defaultManager] fileExistsAtPath:@"/Applications/Cydia.app"]){
	return YES;
	}else if([[NSFileManager defaultManager] fileExistsAtPath:@"/Library/MobileSubstrate/MobileSubstrate.dylib"]){
	return YES;
	}else if([[NSFileManager defaultManager] fileExistsAtPath:@"/bin/bash"]){
	return YES;
	}else if([[NSFileManager defaultManager] fileExistsAtPath:@"/usr/sbin/sshd"]){
	return YES;
	}else if([[NSFileManager defaultManager] fileExistsAtPath:@"/etc/apt"]){
	return YES;
	}
	else if([[NSFileManager defaultManager] fileExistsAtPath:@"/private/var/lib/apt/"]){
	return YES;
	}
	else if([[UIApplication sharedApplication] canOpenURL:[NSURL URLWithString:@"cydia://package/com.example.package"]]){
	return YES;
	}
	NSError *error;
	NSString *stringToBeWritten = @"This is a test.";
	[stringToBeWritten writeToFile:@"/private/jailbreak.txt" atomically:YES
	encoding:NSUTF8StringEncoding error:&error];
	if(error==nil){
	//Device is jailbroken
	return YES;
	} else {
	[[NSFileManager defaultManager] removeItemAtPath:@"/private/jailbreak.txt" error:nil];
	}
	if([[UIApplication sharedApplication] canOpenURL:[NSURL URLWithString:@"cydia://package/com.example.package"]]){
	//Device is jailbroken
	return YES;
	}
	#endif
	//All checks have failed. Most probably, the device is not jailbroken
	return NO;
	}

view raw b.c hosted with ❤ by GitHub

 

*참고 사이트

https://aboutsc.tistory.com/218

https://www.coredump.gr/articles/ios-anti-debugging-protections-part-2/

 

*빌드모드 변경

https://stackoverflow.com/questions/27252898/ios-detect-if-app-is-running-from-xcode

https://cinema4dr12.tistory.com/879