如何检测 iOS 应用程序正在越狱手机上运行?
如果我希望我的应用程序在越狱的 iPhone 上表现不同,我将如何确定这一点?
If I want my app to behave differently on a jailbroken iPhone, how would I go about determining this?
如果你对这篇内容有疑问,欢迎到本站社区发帖提问 参与讨论,获取更多帮助,或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱,如果其他用户或者作者回复了您的评论,将不能在第一时间通知您!
发布评论
评论(17)
这取决于你所说的越狱是什么意思。 在简单的情况下,您应该能够查看 Cydia 是否已安装并进行操作 - 就像
对于被黑客攻击的内核一样,它涉及更多一点(很多)。
It depends what you mean by jailbreak. In the simple case, you should be able to see if Cydia is installed and go by that - something like
For hacked kernels, it's a little (lot) more involved.
这是一个代码,结合了我针对此需求找到的一些答案,将为您提供更高的成功率:
This is a code that combine some answers I found for this need, and will give you much higher success rate :
普通手机不允许检查文件路径
/Applications/Cydia.app
? 我从未听说过苹果公司检测到这一点并拒绝其应用程序,但苹果公司是不可预测的。 Cydia 有 一个 URL 方案 cydia://,可以使用 UIApplicationcanOpenURL:
进行合法检查Checking the file path
/Applications/Cydia.app
is not allowed on a normal phone? I've never heard of Apple detecting this and rejecting an app for it, but Apple is unpredictable. Cydia has a URL scheme cydia:// which can be legally checked with UIApplicationcanOpenURL:
检查内核是否损坏并没有那么复杂。
越狱使得内核对签名代码的签名检查始终报告代码签名正确,未破解的手机无法运行签名错误的代码。
因此,请在应用程序中包含一个签名错误的单独可执行文件。 它可能只是一个具有 main() 和返回值的 3 行程序。 编译可执行文件而不进行代码签名(在“项目设置”->“构建”中将其关闭),并使用“codesign”命令行实用程序使用不同的密钥对其进行签名。
让您的应用程序执行单独的可执行文件。 如果您的程序在运行带有错误签名的单独可执行文件时无法获取返回值,那么它肯定会被监禁。 如果单独的可执行文件返回 A-OK,则手机肯定已越狱。
Checking if the kernel is broken isn't THAT much more involved.
Jailbreaking makes the kernel's signature check of signed code always report that code is signed correctly, unbroken phones cannot run code with a bad signature.
So, include a separate executable in the app with a bad signature. It could just be a 3-line program that has main() and a return value. Compile the executable without code signing (turn it off in Project Settings->Build) and sign it with a different key using the "codesign" commandline utility.
Have your app exec the separate executable. If your program can't get the return value when running the separate executable with the bad sig, it's definitely jailed. If the separate executable returns A-OK, the phone is definitely jailbroken.
我在 Swift 2.3 中重新设计了 @Yossi 提供的解决方案
I reworked in Swift 2.3 the solution provided by @Yossi
您可以通过检查以下内容来检测设备是否越狱:
有一个开源库 I根据各种文章和书籍创建。 在 GitHub 上尝试!
You can detect if a device is JailBroken or not by checking for the following:
There is an open source library I created from various articles and books. Try it out on GitHub!
我所知道的最复杂的方法是使用 objc_copyImageNames() 函数。 它返回当前加载的库的列表,并且由于大多数人在越狱设备上都有 MobileSubstrate,并且大多数 iAP 破解工具都依赖于它,因此至少会显示一些 MobileSubstrate 库。
The most sophisticated method I know is using
objc_copyImageNames()
function. It returns a list of currently loaded libraries and since most people have MobileSubstrate on jailbroken devices and most iAP crack tools depend on it, at least some MobileSubstrate libraries will show up.对于 Swift 4 及以上版本,请使用以下代码:
在appdelegate中添加以下代码:
在Appdelegate方法内部,编写如下代码
Please use following code for Swift 4 and above:
Add the following code in the appdelegate:
Inside Appdelegate methods, write code as below
我不知道为此存在任何“API”。 如果有的话,那么越狱屏蔽产品会很快掩盖它们。
正如很多人指出的那样,这是一场猫捉老鼠的游戏。 当两位玩家都成为专家之后,一切就取决于谁先走一步。 (拿着设备的人。)
我在 Zdziarski 的新书《Hacking and Securing iOS Apps》中发现了许多检测越狱的好建议。 (就我个人而言,我为 O'Reilly 电子书支付了更多费用,因为它们允许复制和粘贴。)
不,我不隶属于出版商。 但我确实发现这是一本好书。 我不喜欢仅仅发布黑客的错误以便他们可以修复它们,所以我想我应该参考这本书。
I am not aware of any "APIs" that exist for this. If there were, then a jailbreak-masking product would quickly cover them up.
As lots of people point out, it is a cat-and-mouse game. And after both players become expert, it all comes down to who gets the first move. (Person holding the device.)
I found many good suggestions for detecting jailbreak in Zdziarski's new book "Hacking and Securing iOS Apps". (Personally, I paid more for the O'Reilly eBook because they permit copy-and-paste.)
No, I am not affiliated with the publishers. But I did find it a good book. I don't like to just publish hackers' mistakes so they can fix them, so I thought I'd point to the book.
尝试通过您的应用程序执行未签名的代码。
越狱设备通常具有以下特征:
仅仅检查文件是否存在进行越狱检测注定会失败。
这些检查很容易被绕过。
Try executing unsigned code through your application.
A jailbroken devices usually has the following characteristics:
Just checking file existence for jailbreak detection is doomed to fail.
These checks are easy to bypass.
要检查的一些常见文件:
/Library/MobileSubstrate/MobileSubstrate.dylib
/Applications/Cydia.app
/var/cache/apt
/var/lib/apt
/var/lib/cydia
/var/log/syslog
/var/tmp/cydia.log
/bin /bash
/bin/sh
/usr/sbin/sshd
/usr/libexec/ssh-keysign
/etc /ssh/sshd_config
/etc/apt
大多数检查 Cydia 相关文件。
Some common files to check for:
/Library/MobileSubstrate/MobileSubstrate.dylib
/Applications/Cydia.app
/var/cache/apt
/var/lib/apt
/var/lib/cydia
/var/log/syslog
/var/tmp/cydia.log
/bin/bash
/bin/sh
/usr/sbin/sshd
/usr/libexec/ssh-keysign
/etc/ssh/sshd_config
/etc/apt
Most check for Cydia related files.
我建议寻找“vanilla”iPhone 上不存在的文件。 我见过的所有越狱工具包都安装了 ssh。 这可能是手机越狱的一个很好的指标。
I'd suggest looking for files that aren't present on a "vanilla" iPhone. All jailbreak kits I've seen install ssh. That might be a good indicator of a jailbroken phone.
我们所做的是,我们已经有了一个 RSS 提要来与我们的用户进行交流 (Stocks Live),我们放了一条新闻,内容如下:
然后你处理用户交互并做适当的事情,比如表现不同等等......
What we did is, we already have an RSS feed to communicate with our users (Stocks Live), we put a news item that states something like this:
Then you process the user interaction and do what is appropriate, like behaving different etc...
尝试查找 cydia 或越狱设备创建的文件。 或者尝试写入应用程序黑盒之外的文件。 如果您成功做到这一点,则该设备已被入侵/越狱:)
Try to find a file which cydia or jailbroken device create. Or try to write in a file outside the app's blackbox. If you succeed to do that, the device is compromised/jailbroken :)
Apple 目前不提供检查越狱的合法方法。
您可以尝试自定义工具来执行此操作,例如JailbreakDetectionService
。 并且可以阅读检查越狱的现代方法 。
另外,也许您可以通过 获得有关验证设备的信息 Firebase 或 Apple
根据我的经验, ,lib IOSSecuritySuite 提供越狱误报检查,但它也可以帮助您。
常见越狱文件路径:
Apple don't provide a legal way to check for jailbreak at this moment.
You can try custom tools to do this, like JailbreakDetectionService
. And may read a modern way to check for jailbreak.
Also maybe you get an info about validating device via Firebase or Apple
In my experience, the lib IOSSecuritySuite provides falsepositive checks for jailbreak, but it also can help you.
Common jailbreak file paths:
这是我的解决方案:
第 1 步
第 2 步:在启动屏幕视图控制器(或您第一次调用的任何 VC)内的
viewDidLoad()
中调用它:Here's my solutions:
Step 1
Step 2: Call it inside
viewDidLoad()
inside your launch screen view controller(or whatever VC you are calling for the first time):