iPhone 应用程序编译代码中包含的信息有多安全？
我正在和一些朋友讨论这个问题，我们开始思考这个问题。有人在购买您的应用程序后是否可以访问实际 Objective-C 代码中包含的 URL 或其他值？
我们最初的感觉是否定的，但我想知道是否有人以某种方式拥有明确的知识？
我确实知道 .plist 文件很容易获得。
示例可能如下：
- 保存在字符串中的 URL 值
- API 密钥和秘密值
I was discussing this with some friends and we began to wonder about this. Could someone gain access to URLs or other values that are contained in the actual objective-c code after they purchase your app?
Our initial feeling was no, but I wondered if anyone out there had definitive knowledge one way or the other?
I do know that .plist files are readily available.
Examples could be things like:
-URL values kept in a string
-API key and secret values
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
是的，可以使用
strings工具（参见此处），实际上使用class-dump-x提取类信息非常容易（查看此处）。只是一些值得深思的东西。
编辑：隐藏秘密信息的一种简单但不安全的方法是对其进行混淆，或将其切成小块。
以下代码：
将生成“Hello, World!”使用
字符串工具。像这样编写代码：
将显示键入的字符，但不一定按顺序显示。
再说一次：很容易做到，但不太安全。
Yes, strings and information are easily extractable from compiled applications using the
stringstool (see here), and it's actually even pretty easy to extract class information usingclass-dump-x(check here).Just some food for thought.
Edit: one easy, albeit insecure, way of keeping your secret information hidden is obfuscating it, or cutting it up into small pieces.
The following code:
will produce "Hello, World!" using the
stringstool.Writing your code like this:
will show the characters typed, but not necessarily in order.
Again: easy to do, but not very secure.
当您购买应用程序时，它会以“FooBar.ipa”的形式保存在您的硬盘上；该文件实际上是 Zip 格式。您可以解压它并检查内容，包括在可执行文件中搜索字符串。试试吧！代码中的常量值不会以任何方式压缩、加密或加扰。
When you purchase an app it is saved on your hard disk as "FooBar.ipa"; that file is actually in Zip format. You can unzip it and inspect the contents, including searching for strings in the executable. Try it! Constant values in your code are not compressed, encrypted, or scrambled in any way.
我知道这个问题已经得到了回答，但我也想提出我自己的建议。
再次请记住，所有混淆技术都不是 100% 安全的，因此不是最好的，但它们通常“足够好”（取决于您想要混淆的内容）。这意味着坚定的破解者无论如何都能够读取您的字符串，但这些技术可能会阻止“休闲破解者”。
我的另一个建议是用简单的异或来“加密”字符串。这是非常快的，如果您通过 App Store 销售应用程序，则不需要任何授权（它不属于需要授权才能导出的算法类别）。
在 Cocoa 中有很多用于执行 XOR 的代码片段，例如： http://iphonedevsdk.com/forum/iphone-sdk-development/11352-doing-an-xor-on-a-string.html
您使用的密钥可能是任何字符串，无论是无意义的字符/字节序列还是有意义的使读者困惑的东西（例如使用方法名称，例如“stringWithContentsOfFile：usedEncoding：error：”）。
I know this has already been answered, but I want to give my own suggestion too.
Again, please remember that all obfuscation techniques are never 100% safe, and thus are not the best, but often they are "good enough" (depending on what you want to obfuscate). This means that a determined cracker will be able to read your strings anyways, but these techniques may stop the "casual cracker".
My other suggestion is to "crypt" the strings with a simple XOR. This is incredibly fast, and does not require any authorization if you are selling the app through the App Store (it does not fall into the categories of algorithms that require authorization for exporting them).
There are many snippets around for doing a XOR in Cocoa, see for example: http://iphonedevsdk.com/forum/iphone-sdk-development/11352-doing-an-xor-on-a-string.html
The key you use could be any string, be it a meaningless sequence of characters/bytes or something meaningful to confuse readers (e.g. use name of methods, such as "stringWithContentsOfFile:usedEncoding:error:").