seoxys.com» Cocoa

Growing iPhone Development Into A Viable Business

kenneth — Wed, 08 Apr 2009 20:28:00 +0000

When one hears stories from iPhone developers, they’re either from the lucky ones who made insane amounts of money and laugh all the way to the bank, or rather from disappointed developers who consider their efforts a failure.

The latter tend to blame the App Store for the failure of their application(s). Granted, the App Store is a harsh market which has both its advantages and its flaws. But, in my humble opinion, a good craftsman never blames his tools.

The App Store has trends that can be analyzed, and if you’re going to be developing for the iPhone, you need to learn how to adapt. I have learnt this first-hand through experimentation, and have learnt many valuable lessons along the way.

Last September, while working on a much bigger iPhone game, I thought it would be cool to create a quick one-trick application for viewing jokes. I never envisioned that iLaugh would become my most lucrative app that would keep me going while I develop the aforementioned game.

The Y-Axis shows daily revenue in US dollars.

Let’s leave the end of the graph (Feb-Apr) aside for a minute, we’ll get back to it.

You can see the initial release spikes, typical of the App Store, and then a very depressing downwards trend right after release. For the second release, 1.1, I upped the price from $0.99 to $1.99. Which slightly lowered the initial spike revenue. But at that stage, I had a much more mature app which unfortunately, due to lack of effective marketing stagnated at a sub-$20 daily revenue.

But in February, I made pretty much the best decision I have ever made. That, of course, was to release a Lite version. I initially thought it would be a nearly cost-free way to get some free advertising for the premium version. The main reason I put ads inside the Lite version was actually not to create revenue, but rather to give users a reason to upgrade. But, other than that, the Lite version was an identical, fully functional copy of the premium version.

As you can see, it did a pretty decent job of advertising the premium version. Since the mid-Feb release of iLaugh Lite, daily revenue for iLaugh has been much higher than it previously was.

Fortunately, iLaugh Lite became quite popular on the iTunes App Store, and while never entering the global top 100, it has charted as high as #29 on the Entertainment chart, and has been in the top 40 entertainment apps nearly since its release.

While this did have some unexpected consequences, like bringing my entire server down due to excessive traffic which brought the iLaugh service down and forced me to upgrade to a better server, the benefits were pretty clear.

This graph shows daily iLaugh Lite downloads.

This equates to about 100,000 monthly downloads.

Here’s a graph that shows the web-service traffic this generates (since each joke is fetched from my server, this gives me a pretty good overview of the actual usage of the app). Unfortunately, I only started using this particular analytics package on March 2nd, so that’s when the graph starts.

To date, iLaugh has served over 6 million jokes, and it’s going at about one million per week.

So far I left out one pretty important thing: ad revenue. But one always leaves the best for last, right? So here goes:

As the installed user-base for iLaugh Lite grows, so does daily ad revenue. Currently, I’m seeing pretty good numbers. I have around 6 million monthly ad impressions, and as you can see in the above graph, I’m seeing around $100 daily ad revenue.

While these aren’t mind-shattering numbers, I think they give a pretty good overview of what one can achieve as an average developer for the iPhone platform.

3 Easy Tips to Prevent a Binary Crack

kenneth — Fri, 27 Jun 2008 11:14:17 +0000

When coding anti-piracy prevention measures, your goal should be to keep honest users honest.
It is important to make the user experience pleasing and simple for your paid customers.

While in an ideal world, people would buy everything legally, reality is very different.
Most people, if tempted with an easy free way to get your app, will pirate even though they know it is wrong.

Here are three easy tips that will help your app resist to binary cracks, but do not take much work to implement.

Strip debug symbols
PT_DENY_ATTACH
Checksum your binary

You can grab the sample code for the first two tips.

Strip debug symbols

Stripping debug symbols will remove all the method names from the executable, which makes it a lot harder for anyone to reverse-engineer your app using gdb. (I showed how this is usually done here) Now, instead of seeing all your method names, which method the app is currently in, and instead of being able to breakpoint the app at that spot, they’ll only see hexadecimal addresses.

You can still get around this by class-dumping the executable and getting new method’s hex addresses from there, (although they might be off by a certain difference which you’d have to calculate) but this already makes it a lot harder for crackers to attack.

So, without further ado, here’s how you do this: Apple’s documentation has a detailed explanation, so instead of rewriting it myself, I’ll just copy-paste it here:

Xcode provides several built-in options for stripping executables of their debugging symbols. One of these is the Strip Linked Product build setting. While typically set, it has no effect unless the Deployment Postprocessing setting is also set. Deployment Postprocessing is a master switch that enables the action of a host of other build settings. It’s approximately analogous to running the xcodebuild tool with the install command.

Again, open the target build settings and turn on debugging symbols for the Release configuration. Open the project build settings; in the Release configuration, enable both Strip Linked Product (if it isn’t on already) and Deployment Postprocessing. Your project settings should now resemble those shown in Table 2.

Build Setting Value

Deployment Postprocessing YES

Strip Linked Product YES

PT_DENY_ATTACH

Behind this barbaric name is a very useful flag which lets you prevent gdb from attaching to your app. Ever tried debugging iTunes? Give it a try now, but be prepared for a disappointment, it crashes gdb when it tries to attach to it.

One step further in protecting your app after striping debug symbols is to activate PT_DENY_ATTACH. Note that this doesn’t make stripping debug symbols useless. While in theory it does, there are ways to get around it.

Activating this protection is really easy, and only involves editing your main.m.

//
//  main.m
//  ProtectionSample
//
//  Created by Kenneth Ballenegger on 2008/06/27.
//  Copyright Azure Talon 2008. All rights reserved.
//

#import <Cocoa/Cocoa.h>
#include <sys/ptrace.h>

int main(int argc, char *argv[])
{
    //Build settings -> Other C Flags: -DDEBUG
#ifdef DEBUG
    //do nothing
#else
    ptrace(PT_DENY_ATTACH, 0, 0, 0);
#endif
    return NSApplicationMain(argc,  (const char **) argv);
}

This code should be pretty self-explanotary…

You need to have a flag that differs for release build and debug builds. You want to be able to debug your app while you code it. That’s why I set Other C Flags for the Debug build settings to “-DDEBUG” and used an #ifdef to activate it only for release builds.

Test it if it works quickly, fire up terminal and try to use gdb.

seoMac:~ kenneth$ gdb /Users/kenneth/Desktop/ProtectionSample/build/Release/ProtectionSample.app/Contents/MacOS/ProtectionSample
GNU gdb 6.3.50-20050815 (Apple version gdb-952) (Sat Mar 29 03:33:05 UTC 2008)
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-apple-darwin"...Reading symbols for shared libraries ..... done

(gdb) r
Starting program: /Users/kenneth/Desktop/ProtectionSample/build/Release/ProtectionSample.app/Contents/MacOS/ProtectionSample
Reading symbols for shared libraries ++++....................................................................... done

Program exited with code 055.
(gdb)

Congratulations, it works! Your app cannot be loaded into gdb anymore. (Note: there are workarounds. Experienced hackers who really want to will still manage to get in.)

Checksum your binary

The last tip for today is of a different kind, and it is probably the most effective of the three.

Basically, all you need to do is to checksum your binary. Put the md5 somewhere in your .app, preferably well hidden. Preferably use a salted hash, or double-hash it. Make it hard for a potential hacker to figure out how to get the correct hash for a given hash. Hide the file in which you store this hash well, or store it in your Info.plist. Where you store it doesn’t matter, but you can’t put it in the binary. Preferably set up a build script that will re-generate the new hash at every build (when your binary changes), so you don’t have to do it yourself.

In your code, check the stored hash against the binary, and if they are different, it means the binary has been modified. In that case, display an error message asking to re-download the app from your site, and quit.

Registration Schemes: Asymmetrical Cryptography

kenneth — Sat, 05 Apr 2008 22:13:05 +0000

One challenge that most developers face when nearing release of their first application is how to implement registration and piracy protection. This three-part article will describe three common types of registration schemes: Serial Numbers, Asymmetrical Cryptographic Keys and Product Activation.

Part Two: Asymmetrical Cryptography

Asymmetrical Cryptographic Keys are a great way to secure you app, because the code used to generate serials is not included in your app, thus removing the risk of a keygen. Using a private key, you sign (or encrypt) some of the user’s details. You then use this singed data as the key to your software, either in the form of a serial, a file, or even an image with the data embedded. You then verify that the signature is valid using the public key in your app.

Example

Start off by generating a set of private and public RSA keys. You can do this by using the following in Terminal.app:

openssl genrsa -out private.pem 2048 openssl rsa -in private.pem -out public.pem -outform PEM -pubout

You can use different size keys. Using a shorter key, such as 512 will make your software more vulnerable to brute-force attack, but has the advantage of making the signature smaller (Which is useful if you wish to display it in the form of a Serial Number).

I believe I used the following set of keys. The keys are also included as files in the source code of this example (available at the bottom of this article).

Next, we will create the generator. We will start by concatenating the details (full name and email address) into a single string:

First Last+email@address.com

Then, we will use RSA to sign this string using the private key generated above:

lFZpwJ6GPLXz8sDez033RIxJsN072lOEa0qF+8hQ5KCcZEPQqSBU4MKbW+UJxIfSmKMOBYnVfy/wwAoSxTtqn2JIuAPEJvsTlb0mGH5u7mpxH+FDj2TicoBKephWv7UXP9k10OPA45247+j/u4yKT1UZcq7WjChQ3JoE3wBtEoFucQm8vLk/VqvNaBM1TyNEgwT8FmrKlbK1FNUI8nQ0QOEJ9P8oMAblkWE5kALZZqWnAs6xE7c73sex73t5FvxYRqRDzRDzkjTwK0anXCv8dmeLvnaaHAFcfD5llx09oa89q+wzWucE7V1TsPRYKH1sZsSz5G2xTt2pZrjIoTw5ew==

Note: for this sample app, I explicitly turned off creating newlines in the base64 signature.

The code used for this generator is:

-(IBAction)generate:(id)sender
{
    NSData *privateKeyData = [NSData dataWithContentsOfURL:[NSURL fileURLWithPath:[[NSBundle mainBundle] pathForResource:@"private" ofType:@"pem"]]];
    NSData *publicKeyData = [NSData dataWithContentsOfURL:[NSURL fileURLWithPath:[[NSBundle mainBundle] pathForResource:@"public" ofType:@"pem"]]];
    NSString *details = [NSString stringWithFormat:@"%@+%@", [name stringValue], [email stringValue]];

    SSCrypto *crypto = [[SSCrypto alloc] initWithPublicKey:publicKeyData privateKey:privateKeyData];
    [crypto setClearTextWithString:details];

    NSData *signedTextData = [crypto sign];
    NSString *string = [signedTextData encodeBase64WithNewlines:NO];

    [serial setStringValue:string];

    [crypto release];
}

As you can see, I used Septicus Software’s great SSCrypto framework for this task… It makes things so much easier… Unfortunately it doesn’t support base32 or DSA, which would both have helped make more human-friendly keys.

The other piece needed is the validator, used in your software to validate serial numbers. Include only the public key in your app, and use RSA to verify the key.

-(IBAction)validate:(id)sender
{
    NSData *publicKeyData = [NSData dataWithContentsOfURL:[NSURL fileURLWithPath:[[NSBundle mainBundle] pathForResource:@"public" ofType:@"pem"]]];
    NSString *details = [NSString stringWithFormat:@"%@+%@", [name stringValue], [email stringValue]];
    NSData *number = [[[serial stringValue] dataUsingEncoding:NSUTF8StringEncoding] decodeBase64WithNewLines:NO];

    SSCrypto *crypto = [[SSCrypto alloc] initWithPublicKey:publicKeyData];
    [crypto setCipherText:number];

    [crypto verify];

    if([[crypto clearTextAsString] isEqualToString:details])
        NSRunAlertPanel(@"Result", @"Good serial!", @"OK", nil, nil);
    else
        NSRunAlertPanel(@"Result", @"Wrong serial!", @"OK", nil, nil);

    [crypto release];
}

Important Note: In this sample code, I included both the generator and the validator in the same application. I included the private.pem file in the bundle. You should never do this. If the private key is ever leaked, it compromises the whole security of your application.

Making it safer

You can easily make it more secure by combining this technique with the technique explained in Part One. Instead of simple concatenating the details as I did here, you could use all the techniques applied in Part One, such as using a hash instead, or doing ROT13 on it, or rearranging the order of the characters.

Another thing you should do is to hardcode and obfuscate your public key. Having it as a file in the bundle makes you vulnerable to key substitution. (Basically, a cracker would replace the public key in your app by a different key they created using a private key they know, thus making their licenses valid instead of yours.)

Form Factors

While you may not realize it at first sight, this has become one of the most common methods in Mac shareware, thanks to the open-source framework AquaticPrime. AquaticPrime uses this technique behind the scenes, by embedding the signature in a plist file. AquaticPrime is a very easy way to use this. Unfortunately, if you decide to use AquaticPrime.framework in your app, it is very easy to replace the .framework file with a malicious one that will always claim your licenses are valid.

To date, as far as I know, there isn’t any HackuaticPrime.framework yet, but this might one day become a problem with AquaticPrime gaining popularity thanks to it’s extreme simplicity of implementation.

Update: Devon in the comments suggests implementing a hash check of the framework, which is a simple way of checking the framework’s integrity. Of course, there are still ways to get around it, but this makes it one step more difficult.

Another common form factor for Asymmetrical Cryptographic Keys is custom URL schemes. That’s actually a very clever and convenient way of doing it. To register, the users get to simple click on a link which looks like this: (All the user sees is a nice “Click here to register” link)

myapp://name:email:key

Another clever, but controversial form factor is Agile Web Solution’s 1Password License “Cards”.

And of course, if you find a way to make short base32 signatures (I hear DSA makes short signatures), you can even use longer Serial Numbers.

AHJ53-5HGJZ-8DG8R-284DF-56FJB-74FH4-FJUEH

Sample Code

The code used in this article can be downloaded here.
As always, licensed under MIT license. If you do use it, mention it in the About Box or readme.txt.

Part One: Serial Numbers
The next part will be coming soon.

Interviews and Podcasts

kenneth — Sat, 15 Mar 2008 09:58:13 +0000

iAppblog recently interviewed me on the new iPhone SDK, Apple’s business model, and whether we will see Exces for iPhone. It’s an interesting read, so be sure to go have a look

Last week, I also participated in the MacSB podcst episode 4. It was really interesting and instructive to have a chat with some really cool other developers: Mike Lee, John Fox, Danny Greg, and our host, Steve Scotty.

NanoLifeSaver

kenneth — Sat, 23 Feb 2008 23:06:43 +0000

I bring to you, NanoLifeSaver.

NanoLifeSaver is a slick Core Animation screensaver.

(This last one is a movie, Click to Play)

Download NanoLifeSaver

Credit goes to Scott Stevenson for coming up with the original animation code.

R.I.P. Hijack

kenneth — Fri, 22 Feb 2008 14:27:05 +0000

Disappointingly, codename: Hijack / Spool is no more.

I have posted about this project before, and it was really something I was excited about.

Back in the day where I actually had time, I was a forum freak and was active in more than 10 forums… This would have been the dream app for me.

Unfortunately, Hijack has just been open-sourced. Which means that the project is essentially dead.

Hacking mac apps: Direct Mail

kenneth — Tue, 18 Dec 2007 23:02:36 +0000

Update: I rewrote this post with better language and better explanations. Please read the newer version first.

In this post, I will describe how to hack a mac shareware app.

The reason for this is to push the developers to create stronger protection, and to show common weaknesses in licensing code.

Before each hack is published, I get the concerned developer’s approval, and send them a note describing the hack, and suggesting ways to improve their protection. I also leave them some time to patch their app before I publish the hack.

I have no intention of promoting piracy, and this not meant to be used as a guide for would-be pirates to get those for free. What follows if of highly technical nature, and is intended for fellow developers.

Today is up: Direct Mail, a great app from e3 software useful for anyone doing mailing lists or press releases.

I did this hack on version 1.8.3, because it isn’t the latest.

First thing to do, is to class-dump the executable, which results in an interesting find:

@interface CAppDelegate : NSObject
{
    BOOL _registered;   // 4 = 0x4
    NSString *_registeredName;  // 8 = 0x8
    SUUpdater *sparkleUpdater;  // 12 = 0xc
}

+ (id)sharedDelegate;
+ (void)applyIconsToChangeStatusMenu:(id)fp8;
- (id)init;
- (BOOL)registered;
- (id)registeredName;
- (void)setRegisteredName:(id)fp8;
- (BOOL)validateMenuItem:(id)fp8;
- (void)loadRegistration;
- (BOOL)isValidCode:(id)fp8 forName:(id)fp12;
- (void)saveRegistrationCode:(id)fp8 forName:(id)fp12;
- (id)sparkleUpdater;
- (void)doPrefs:(id)fp8;
- (void)doRegister:(id)fp8;
- (void)doPurchase:(id)fp8;
- (BOOL)alertShowHelp:(id)fp8;
- (void)doAbout:(id)fp8;
- (void)doReportBug:(id)fp8;
- (void)doConnectionDoctor:(id)fp8;
- (void)openAppWebsite;
- (void)openRegisterWebsite;
- (void)runKRM;
- (id)lookupKagiAffiliate;
- (void)showPurchaseThankYou:(id)fp8;
- (void)showFirstRunAlert;
- (void)applicationWillFinishLaunching:(id)fp8;
- (void)applicationDidFinishLaunching:(id)fp8;
- (BOOL)crashReporterShouldDisplayException:(id)fp8;

@end

Now, there’s different ways to hack this. You could just edit the ivar _registered upon launch. Other option would be to hack registered or isValidCode:forName: to always return true.

I’m going to go with a slightly more complicated way, and hack the methods which call isValidCode:forName:.

Let’s set a breakpoint when isValidCode is called. Disassemble the whole thing, and check where isValidCode:forName: is called. For me, it returns at 0x00008fdc. Run. It hits the breakpoint immediately. Continue once, to let it finish its setting up etc. Now, using the app, go to the register menu and try to register (with a properly-formatted email-address). It will hit the breakpoint again. Do a nexti. You now are in “0x0002ffb7 in -[CRegisterPanelController doOK:] ()”

Let’s disassemble this method:

0x0002ff50 <-[CRegisterPanelController doOK:]+0>: push %ebp 0x0002ff51 <-[CRegisterPanelController doOK:]+1>: mov %esp,%ebp 0x0002ff53 <-[CRegisterPanelController doOK:]+3>: push %edi 0x0002ff54 <-[CRegisterPanelController doOK:]+4>: push %esi 0x0002ff55 <-[CRegisterPanelController doOK:]+5>: push %ebx 0x0002ff56 <-[CRegisterPanelController doOK:]+6>: sub $0x1c,%esp 0x0002ff59 <-[CRegisterPanelController doOK:]+9>: mov 0x8(%ebp),%edi 0x0002ff5c <-[CRegisterPanelController doOK:]+12>: mov 0x22091c,%eax 0x0002ff61 <-[CRegisterPanelController doOK:]+17>: mov %eax,0x4(%esp) 0x0002ff65 <-[CRegisterPanelController doOK:]+21>: mov 0x221fa4,%eax 0x0002ff6a <-[CRegisterPanelController doOK:]+26>: mov %eax,(%esp) 0x0002ff6d <-[CRegisterPanelController doOK:]+29>: call 0x21f395 0x0002ff72 <-[CRegisterPanelController doOK:]+34>: mov %eax,%esi 0x0002ff74 <-[CRegisterPanelController doOK:]+36>: mov 0xc(%edi),%edx 0x0002ff77 <-[CRegisterPanelController doOK:]+39>: mov 0x221428,%eax 0x0002ff7c <-[CRegisterPanelController doOK:]+44>: mov %eax,0x4(%esp) 0x0002ff80 <-[CRegisterPanelController doOK:]+48>: mov %edx,(%esp) 0x0002ff83 <-[CRegisterPanelController doOK:]+51>: call 0x21f395 0x0002ff88 <-[CRegisterPanelController doOK:]+56>: mov %eax,%ebx 0x0002ff8a <-[CRegisterPanelController doOK:]+58>: mov 0x8(%edi),%edx 0x0002ff8d <-[CRegisterPanelController doOK:]+61>: mov 0x221428,%eax 0x0002ff92 <-[CRegisterPanelController doOK:]+66>: mov %eax,0x4(%esp) 0x0002ff96 <-[CRegisterPanelController doOK:]+70>: mov %edx,(%esp) 0x0002ff99 <-[CRegisterPanelController doOK:]+73>: call 0x21f395 0x0002ff9e <-[CRegisterPanelController doOK:]+78>: mov %ebx,0xc(%esp) 0x0002ffa2 <-[CRegisterPanelController doOK:]+82>: mov %eax,0x8(%esp) 0x0002ffa6 <-[CRegisterPanelController doOK:]+86>: mov 0x22084c,%eax 0x0002ffab <-[CRegisterPanelController doOK:]+91>: mov %eax,0x4(%esp) 0x0002ffaf <-[CRegisterPanelController doOK:]+95>: mov %esi,(%esp) 0x0002ffb2 <-[CRegisterPanelController doOK:]+98>: call 0x21f395 0x0002ffb7 <-[CRegisterPanelController doOK:]+103>: test %al,%al 0x0002ffb9 <-[CRegisterPanelController doOK:]+105>: jne 0x2ffc7 <-[CRegisterPanelController doOK:]+119> 0x0002ffbb <-[CRegisterPanelController doOK:]+107>: add $0x1c,%esp 0x0002ffbe <-[CRegisterPanelController doOK:]+110>: pop %ebx 0x0002ffbf <-[CRegisterPanelController doOK:]+111>: pop %esi 0x0002ffc0 <-[CRegisterPanelController doOK:]+112>: pop %edi 0x0002ffc1 <-[CRegisterPanelController doOK:]+113>: pop %ebp 0x0002ffc2 <-[CRegisterPanelController doOK:]+114>: jmp 0x21f444 0x0002ffc7 <-[CRegisterPanelController doOK:]+119>: mov 0x22091c,%eax 0x0002ffcc <-[CRegisterPanelController doOK:]+124>: mov %eax,0x4(%esp) 0x0002ffd0 <-[CRegisterPanelController doOK:]+128>: mov 0x221fa4,%eax 0x0002ffd5 <-[CRegisterPanelController doOK:]+133>: mov %eax,(%esp) 0x0002ffd8 <-[CRegisterPanelController doOK:]+136>: call 0x21f395 0x0002ffdd <-[CRegisterPanelController doOK:]+141>: mov %eax,%esi 0x0002ffdf <-[CRegisterPanelController doOK:]+143>: mov 0xc(%edi),%edx 0x0002ffe2 <-[CRegisterPanelController doOK:]+146>: mov 0x221428,%eax 0x0002ffe7 <-[CRegisterPanelController doOK:]+151>: mov %eax,0x4(%esp) 0x0002ffeb <-[CRegisterPanelController doOK:]+155>: mov %edx,(%esp) 0x0002ffee <-[CRegisterPanelController doOK:]+158>: call 0x21f395 0x0002fff3 <-[CRegisterPanelController doOK:]+163>: mov %eax,%ebx 0x0002fff5 <-[CRegisterPanelController doOK:]+165>: mov 0x8(%edi),%edx 0x0002fff8 <-[CRegisterPanelController doOK:]+168>: mov 0x221428,%eax 0x0002fffd <-[CRegisterPanelController doOK:]+173>: mov %eax,0x4(%esp) 0x00030001 <-[CRegisterPanelController doOK:]+177>: mov %edx,(%esp) 0x00030004 <-[CRegisterPanelController doOK:]+180>: call 0x21f395 0x00030009 <-[CRegisterPanelController doOK:]+185>: mov %ebx,0xc(%esp) 0x0003000d <-[CRegisterPanelController doOK:]+189>: mov %eax,0x8(%esp) 0x00030011 <-[CRegisterPanelController doOK:]+193>: mov 0x220788,%eax 0x00030016 <-[CRegisterPanelController doOK:]+198>: mov %eax,0x4(%esp) 0x0003001a <-[CRegisterPanelController doOK:]+202>: mov %esi,(%esp) 0x0003001d <-[CRegisterPanelController doOK:]+205>: call 0x21f395 0x00030022 <-[CRegisterPanelController doOK:]+210>: movl $0x219530,0x8(%esp) 0x0003002a <-[CRegisterPanelController doOK:]+218>: mov 0x220784,%eax 0x0003002f <-[CRegisterPanelController doOK:]+223>: mov %eax,0x4(%esp) 0x00030033 <-[CRegisterPanelController doOK:]+227>: mov 0x221fb4,%eax 0x00030038 <-[CRegisterPanelController doOK:]+232>: mov %eax,(%esp) 0x0003003b <-[CRegisterPanelController doOK:]+235>: call 0x21f395 0x00030040 <-[CRegisterPanelController doOK:]+240>: mov 0x220780,%edx 0x00030046 <-[CRegisterPanelController doOK:]+246>: mov %edx,0x4(%esp) 0x0003004a <-[CRegisterPanelController doOK:]+250>: mov %eax,(%esp) 0x0003004d <-[CRegisterPanelController doOK:]+253>: call 0x21f395 0x00030052 <-[CRegisterPanelController doOK:]+258>: mov 0x4(%edi),%edx 0x00030055 <-[CRegisterPanelController doOK:]+261>: mov 0x220900,%eax 0x0003005a <-[CRegisterPanelController doOK:]+266>: mov %eax,0xc(%ebp) 0x0003005d <-[CRegisterPanelController doOK:]+269>: mov %edx,0x8(%ebp) 0x00030060 <-[CRegisterPanelController doOK:]+272>: add $0x1c,%esp 0x00030063 <-[CRegisterPanelController doOK:]+275>: pop %ebx 0x00030064 <-[CRegisterPanelController doOK:]+276>: pop %esi 0x00030065 <-[CRegisterPanelController doOK:]+277>: pop %edi 0x00030066 <-[CRegisterPanelController doOK:]+278>: pop %ebp 0x00030067 <-[CRegisterPanelController doOK:]+279>: jmp 0x21f395

We now are at this line: “0x0002ffb7 <-[CRegisterPanelController doOK:]+103>: test %al,%al”

That, in the right, is assembly code. This is basically some kind of “if” statement. (a TEST followed by a JNE (jump if not equal)).

What interests me is the next line: “0x0002ffb9 <-[CRegisterPanelController doOK:]+105>: jne 0x2ffc7 <-[CRegisterPanelController doOK:]+119>”

If we just reverse this test (turn the JNE into a JE (jump if equal)), any invalid code will be considered valid, and vice-versa. Let’s examine the memory for this statement.

(gdb) x/x 0x0002ffb9 0x2ffb9 <-[CRegisterPanelController doOK:]+105>: 0xc4830c75

Now, I’m working on a intel machine. And for some dumb reason, every block of four bytes is inverted. What this means, is that the byte that interests me is the rightmost one: 0x75. This is what a JNE looks like. Do some more tests by setting breakpoints until you find a JE, and read the memory for it: you will find that a JE is 0x74.

Let’s test if our theory is correct by editing the memory live, before we edit it in the binary. Do the following:

(gdb) set {char}0x0002ffb9=0x74 (gdb) x/x 0x0002ffb9 0x2ffb9 <-[CRegisterPanelController doOK:]+105>: 0xc4830c74 (gdb) disassemble 0x0002ffb7 Dump of assembler code for function -[CRegisterPanelController doOK:]: [...edited out...] 0x0002ff99 <-[CRegisterPanelController doOK:]+73>: call 0x21f395 0x0002ff9e <-[CRegisterPanelController doOK:]+78>: mov %ebx,0xc(%esp) 0x0002ffa2 <-[CRegisterPanelController doOK:]+82>: mov %eax,0x8(%esp) 0x0002ffa6 <-[CRegisterPanelController doOK:]+86>: mov 0x22084c,%eax 0x0002ffab <-[CRegisterPanelController doOK:]+91>: mov %eax,0x4(%esp) 0x0002ffaf <-[CRegisterPanelController doOK:]+95>: mov %esi,(%esp) 0x0002ffb2 <-[CRegisterPanelController doOK:]+98>: call 0x21f395 0x0002ffb7 <-[CRegisterPanelController doOK:]+103>: test %al,%al 0x0002ffb9 <-[CRegisterPanelController doOK:]+105>: je 0x2ffc7 <-[CRegisterPanelController doOK:]+119> 0x0002ffbb <-[CRegisterPanelController doOK:]+107>: add $0x1c,%esp 0x0002ffbe <-[CRegisterPanelController doOK:]+110>: pop %ebx 0x0002ffbf <-[CRegisterPanelController doOK:]+111>: pop %esi 0x0002ffc0 <-[CRegisterPanelController doOK:]+112>: pop %edi 0x0002ffc1 <-[CRegisterPanelController doOK:]+113>: pop %ebp 0x0002ffc2 <-[CRegisterPanelController doOK:]+114>: jmp 0x21f444 0x0002ffc7 <-[CRegisterPanelController doOK:]+119>: mov 0x22091c,%eax [...edited out...] End of assembler dump. (gdb)

Here we change the byte for the JNE, then test if we changed it correctly by re-reading it.

Then we disassemble the whole method again to see if the JNE was changed correctly. And yes — tah-da — - it now says JE. Perfect. Continue. You are now registered. To make this change permanent: do “x/8x 0x0002ffb9”. You will get 24 bytes of data. Open the binary in your favorite hex editor and find the bytes outputted by gdb. If you’re on intel, don’t forget you have to reverse all the blocks of four bytes before searching. When you find it, edit the 0x75 into 0x74. Bravo! You have now made the change permanent.

We are not finished yet. As you will now notice if you run the program, it makes your code valid, but you get an error message each launch, and you have to re-do the entering a code process every time. This is because the first check at launch doesn’t happen in doOk:.

Continue and quit normally (using cmd-Q in Direct Mail). Launch it again by doing run. But this time, don’t continue after hitting the breakpoint at launch. Do nexti. Ok, so now we are in loadRegistration. Disassemble this method. Similarly, there’s a JE this time, just after the call to isValidCode:forName: Turn this into a JNE by changing the 0x74 into a 0x75 at this location in memory. If you disassemble the method again, you can see that the JE turned into a JNE. Like before, change this in the binary.

Well Done! You have now fully hacked Direct Mail 1.8.3.

By now, the developer has probably fixed this security flaw, so you can’t use this to get this app for free. If you like it, buy it. It’s a great piece of software! Think about the poor developers who have to feed their family.

You can download the trial version here

An introduction to Sean Collins

kenneth — Thu, 22 Nov 2007 08:59:12 +0000

From: Sean Collins
Date: July 23, 2007 4:32:35 PM EDT
To: [anonymous@gmail.com]
Subject: Aquatic Prime

I recently read your blog post about Aquatic prime, after I was hunting around inside another application.

I would like to perhaps exchange some notes, because I think I might have found at least an individual application that uses the PHP authentication of the AquaticPrime framework, and I suspect that it would be vulnerable to SQL Injection attacks, as well as using what I believe to be, a cookie that never expires that is baked into the executable, which could lead to some other interesting things.

Let me know if you’d be interested in a chat!

Thank You,
Sean Collins

1:42:24 PM seanwdp: [Hey], it’s Sean C
1:42:48 PM anonymous: hey sean.
1:43:10 PM seanwdp: The app in question is called Exces
1:43:22 PM seanwdp: part of that MacHeist deal they were doing a week ago
1:43:35 PM anonymous: ok
1:43:58 PM anonymous: and what can you do exactly? (re-reading your email)
1:44:13 PM seanwdp: I don’t have any POC just yet, just some leads.
1:44:41 PM seanwdp: just looking through the executable, found some little things
1:45:04 PM seanwdp: the app uses the PHP part of the AP framework
1:45:14 PM seanwdp: to do registration keys and such
1:45:20 PM anonymous: k
1:45:44 PM seanwdp: let me give you the executable dump
1:45:55 PM anonymous: k
1:47:27 PM anonymous: can i just strings it?
1:47:57 PM seanwdp: yeah, already did and sent it to you as a txt
1:48:52 PM seanwdp: one of the stings contains his license check
1:48:53 PM anonymous: ok
1:48:59 PM seanwdp: it’s a PHP script
1:49:09 PM seanwdp: if you connect to it with just a browser you get a bunch of mysql errors
1:49:10 PM anonymous: http://www.seosoft.info/app_rsrc/exces_licence_check.plist.php
1:49:13 PM anonymous: yeah i see
1:49:14 PM seanwdp: exactly
1:49:23 PM seanwdp: so I think that the cookie is a few lines below
1:49:25 PM seanwdp: that has the login data
1:49:43 PM anonymous: and that is based on the AP sample code you think?
1:49:52 PM seanwdp: I’m not entirely sure
1:49:59 PM seanwdp: If it is the AP sample code
1:50:02 PM seanwdp: that’s pretty bad
1:50:11 PM seanwdp: I was going from the thinking that he tried to extend the AP
1:50:18 PM anonymous: so have you actually tried to inject anything?
1:50:32 PM seanwdp: I’ve been looking for a way to feed it some bad data
1:50:38 PM seanwdp: I was doing some pretty simple stuff
1:50:47 PM seanwdp: the license key I think is through stenography
1:50:57 PM seanwdp: so I was trying to see what it takes as a dragging source
1:51:12 PM seanwdp: see if I could craft some bad data, then capture the packets
1:51:22 PM anonymous: heh ok
1:51:30 PM seanwdp: What makes me wonder, is the fact that he has another part, his bug reporting
1:51:39 PM anonymous: ap uses real encryption though
1:51:51 PM seanwdp: right
1:51:52 PM anonymous: no stenagraphy no faking
1:52:13 PM seanwdp: but my thinking is that the app will send a user/pass
1:52:30 PM seanwdp: since you get the error about not having a user or database selected
1:52:35 PM seanwdp: when you visit that register page
1:53:22 PM anonymous: what user/pass?
1:53:28 PM anonymous: a bit confused
1:53:44 PM seanwdp: okay. Know how you visit that registration page with a regular browser?
1:53:53 PM anonymous: y
1:54:10 PM seanwdp: notice those mysql errors
1:54:16 PM anonymous: right right
1:54:22 PM seanwdp: Line 2 is the host
1:54:27 PM seanwdp: line 3 is the database
1:54:46 PM anonymous: looks like he’s on a dreamhost box
1:54:50 PM seanwdp: right
1:54:59 PM seanwdp: I’m thinking those variables
1:55:02 PM seanwdp: the PHP ones
1:55:22 PM seanwdp: that set the host, database name, and possibly user/password combo are in the app
1:55:26 PM anonymous: ok
1:55:32 PM anonymous: i’d be real surprised
1:55:36 PM seanwdp: as would I
1:55:48 PM anonymous: in fact i doubt its likely at all
1:56:05 PM anonymous: knowing dreamhost (used to be a customer) they firewall off the mysql server
1:56:24 PM anonymous: the info would be embedded in the php
1:56:33 PM anonymous: it looks to me as if the guy has a f-ed up php
1:56:45 PM anonymous: either the mysql server is down, or something is misconfigured
1:56:52 PM anonymous: i dont think the username password are in the app
1:56:56 PM anonymous: unless you’ve found them?
1:57:08 PM seanwdp: only guesses at this point, nothing jumped out in the strings
1:57:14 PM anonymous: what happens when you packet sniff?
1:57:23 PM seanwdp: still trying to get that running
1:57:27 PM anonymous: ok
1:57:29 PM seanwdp: I might have to do what you did
1:57:33 PM seanwdp: with the code injection
1:57:37 PM seanwdp: just force it to connect
1:57:43 PM anonymous: ah
1:57:54 PM anonymous: so it doesn’t connect to that url normally?
1:58:02 PM anonymous: until you register it perhaps?
1:58:05 PM seanwdp: yeah
1:58:08 PM seanwdp: and there’s a cookie
1:58:13 PM seanwdp: expires never
1:58:27 PM seanwdp: I wondered if that might be a good lead.
1:58:33 PM anonymous: AP is designed for client side validation
1:58:39 PM anonymous: he’s doing it server side too perhaps
1:59:03 PM seanwdp: I mean the guy just sold like 100k licenses or something
1:59:09 PM anonymous: no shit?
1:59:11 PM seanwdp: yeah
1:59:12 PM seanwdp: macheist
1:59:16 PM seanwdp: so I mean, it’s gotta work
1:59:19 PM anonymous: heh
1:59:20 PM anonymous: yeha
1:59:24 PM anonymous: unless it is a dead url
1:59:29 PM anonymous: isn’t used any more
1:59:33 PM anonymous: or is in there to throw you off
1:59:34 PM seanwdp: true, maybe he baked a new version for macheist
1:59:39 PM anonymous: maybe
1:59:53 PM seanwdp: I dunno, I can’t imagine him being too smart
2:00:06 PM seanwdp: his app just hands off the dirty work to disk utility
2:00:09 PM anonymous: i’d _hope_ he is if he’s releasing an encryption app
2:00:11 PM anonymous: ah
2:00:12 PM anonymous: haha
2:00:19 PM seanwdp: yet still manages to have a “limit” of 10gb
2:00:26 PM seanwdp: for his “vaults”
2:00:48 PM seanwdp: it’s right in the code, he calls hdiutil
2:01:03 PM seanwdp: all he’s got is a pretty GUI
2:01:31 PM anonymous: yeah
2:01:35 PM anonymous: another Disco app
2:01:38 PM seanwdp: yep.
2:02:00 PM seanwdp: At least Disco has “ismoke”
2:02:05 PM seanwdp:
2:03:30 PM seanwdp: so what are your thoughts?
2:04:17 PM anonymous: i dunno. i’d be really surprised if the app relies on it for registration
2:04:30 PM anonymous: AP is vulnerable once you have it in your hands.
2:04:44 PM anonymous: it just depends on how much work the guy has done to obfuscate it
2:04:56 PM anonymous: and even then you can always find (and then replace) the public key used
2:05:04 PM seanwdp: right
2:05:11 PM seanwdp: but what about the risks to his website
2:05:20 PM anonymous: i’d be surprised if there are any
2:05:28 PM anonymous: it could just be the mysql server is fubared
2:05:32 PM anonymous: something is misconfigured
2:05:41 PM anonymous: hard to say
2:05:50 PM anonymous: any badly written php could be vulnerable
2:05:54 PM seanwdp: right
2:06:04 PM anonymous: to find out for sure you need to sniff the packets and find out what it sends
2:06:07 PM seanwdp: well I mean he has a bug reporter, where all the stuff is sent using the $_GET array
2:06:19 PM anonymous: any suspicious looking printf style strings?
2:06:32 PM anonymous: stuff that could be a http url request?
2:06:47 PM anonymous: “%@&%@&%@” type stuff?
2:07:01 PM seanwdp: lemme see
2:07:09 PM anonymous: you could try hacking the bug reporter
2:07:11 PM seanwdp: I swear I saw some
2:07:22 PM anonymous: if that is vulnerable then the license check probably is too
2:07:27 PM seanwdp: yeah
2:07:40 PM seanwdp: I mean, it’s much easier to crack the bug reporter
2:07:52 PM seanwdp: since I guess the database connection info is in the script
2:07:56 PM seanwdp: *not guess
2:07:59 PM seanwdp: it is
2:08:07 PM anonymous: that makes no sense
2:08:08 PM anonymous: why do that?
2:08:16 PM seanwdp: pulled it out of a php book
2:08:16 PM anonymous: easier for it to be server side
2:08:24 PM anonymous: if he has to change the password he’d be fucked
2:08:26 PM seanwdp: right, that’s what I’m saying
2:08:27 PM anonymous: or whatever
2:08:34 PM seanwdp: he’s probably got a mysql_connect.php
2:08:46 PM seanwdp: that has a username, password, host, and all that
2:08:54 PM anonymous: but even then he’d have to jump through hoops to expose his mysql server to the world
2:08:59 PM anonymous: by default DH firewalls it
2:09:07 PM anonymous: so you have to assume he knows how to do that at least
2:09:12 PM seanwdp: yeah
2:09:21 PM anonymous: which is inconsistent with him putting his password in the client
2:09:31 PM seanwdp: it would be
2:09:46 PM seanwdp: it’s just that you don’t get the same error reporting on the bug page as the license page
2:10:15 PM seanwdp: but that could be because someone wrote the bug script better
2:10:24 PM seanwdp: and it doesn’t give out those errors to the user
2:10:38 PM seanwdp: meanwhile someone far dumber left the error reporting on, for the license script
2:11:59 PM anonymous: well focus on the bug reporter see if you can capture what it sends
2:12:05 PM anonymous: i’d be interested to see that
2:15:46 PM seanwdp: yeah
2:15:58 PM seanwdp: I’m pretty sure it just sends three or four variables
2:16:06 PM seanwdp: the PHP script gets them and off they go into the database
2:16:12 PM seanwdp: since they’re right in the url
2:16:23 PM seanwdp: http://www.seosoft.info/app_rsrc/bug_send.php?
lang=%@&product=Exces&name=%@&email=
%@&description=%@&explanation=%@
2:16:52 PM anonymous: yeah
2:17:15 PM anonymous: so do some injection
2:24:07 PM seanwdp: I’ll let you know what I come up with
2:24:20 PM anonymous: cool
2:24:26 PM seanwdp: work finally threw up their hands and let me run our stuff on Apache
2:24:39 PM seanwdp: the guy running the server (win2003) has NFC
2:24:47 PM seanwdp: and i don’t like or care about IIS
2:24:56 PM seanwdp: thing spent more time broken then up and running

‘Nuff said.

Excellent LangSwitch Review

kenneth — Mon, 16 Jul 2007 21:03:43 +0000

LangSwitch just got reviewed 5/5 by softpedia.

This is mainly a little tool that I created for myself, it turns out that people actually like and use it.

~~Maybe~~ this will motivate me to improve it: add Locales support, Undo, better drag-and-drop support. Drag-and-drop on the application icon support, and lotsa other cool stuff.

Build Setting	Value
Deployment Postprocessing	YES
Strip Linked Product	YES