PROTECT YOUR Windows Phone APP AGAINST (casual) PIRACY

published on: 1/23/2012 | Views: N/A | Tags: GetStarted

As you already know, a pirated xap of your app was probably uploaded to p2p networks after 1 day from publication, and is now illegally used by lots of people.

In the meantime MS will introduce the server-side-encryption (hopefully soon), hacking a xap is so simple that it is done by automated web applications.

Anyway, you can now turn piracy to your advantage! With this code, you can detect if your app was hacked using the "automated" method, and if so just open the Marketplace pointing to your "real" app.

Basically, an hacked xap is identical as your original xap, lacking a file called WMAppPRHeader.xml (the DRM file), so the phone considers it as a homebrew one and runs it as "full" on unlocked devices.

Just add this code when your app starts and you will be safe for 99.99% of times (this will not protect against reverse engineering and dedicated app attack, but if this happens your app will be famous !). It is a good idea to obfuscate the code too, but first of all implements this trick!

using System.Xml.Linq;
using Microsoft.Phone.Controls;
using System.Linq;
using System.Collections.Generic;
using Microsoft.Phone.Marketplace;
using Microsoft.Phone.Tasks;
using System.Collections.ObjectModel;
using Coding4Fun.Phone.Controls.Data;
 
public static bool IsHacked()
{
    try
    {
        if (Debugger.IsAttached == true) //then WMAppPRHeader.xml file will be added during AppHub certification only! So this has to be skipped during development.
            return false;

        //scramble WMAppPRHeader.xml file name to make life a little harder in case of reverse engineering
        string fl = "xxx" + "W" + "xxxx" + "M" + "xxxx" + "A" + "xxxx" + "p" + "xxxpxxx" + "PxR" + "xxxxx" + "Hxxxxxxx" + "exxxxxxa" + "xxxx" + "d" + "xxxx" + "xxxxe" + "rxx" + "xxx";
        fl = fl.Replace("x", string.Empty) + "." + "x" + "m" + "l";
        XDocument doc = XDocument.Load(fl); //is hacked, this file is missing or empty!!!
        return false;
    }
    catch (Exception)
    {
        MessageBox.Show("This app was pirated and is not safe to use, please download the original one from Marketplace.");
        MarketplaceDetailTask marketplaceDetailTask = new MarketplaceDetailTask();

        //ProcutdID will be changed after APpHub certification, so has to be read from manifest!

        marketplaceDetailTask.ContentIdentifier = PhoneHelper.GetAppAttribute("ProductID").Replace("{", string.Empty).Replace("}", string.Empty).Trim(); //download Coding4Fun toolkit for this helper
        marketplaceDetailTask.ContentType = MarketplaceContentType.Applications;
        marketplaceDetailTask.Show();
 
        return true;
     }
}

Hope it helps.

You can also follow us on Twitter @winphonegeek

Venetasoft

About the author:

Published apps:

Turbo Camera Turbo camera is the fastest camera App on the Marketplace. Faster than the fastest iPhone4S camera App (on a Nokia Lumia 800 ;). Just keep down the phone camera button to start taking lightning fast consecutive pictures!

Security Toolkit Top Seller: 4th on WPCentral Holiday Gift Guide ranking, raccomanded by WP7AppList, 1st on Tools Category - Italy. Turn your Windows Phone into the ultimate security and surveillance device! Record mp4 motion detected video and stream live to your pc over Wi-Fi.

Ultimate Recorder Turn your phone into a professional digital voice recorder. Implements the most wanted features missing on other voice recorder apps!

Motion Cam Motion and audio sensor, record mp4 video, send alert email with snapshot and share all via SkyDrive/email.

Intrusion Alarm Use the built-in phone camera and microphone to detect movements and noises in the surrounding area. When a motion or audio activity is detected, an alarm email is sent to you, a snaphot is saved into the phone picture library and an alarm sound is played.

Cam Broadcaster Live stream your phone cam/mic to a pc over wifi ! Start/stop recording from phone or remote pc console.

WebCam Viewer Live stream your pc webcam to your Windows Phone over local wifi ! See and take snaphots to who is using your notebook!

K.I.T.T. Simulates KITT's voice synthesizer and it is based on the hit TV-Series called Knight Rider.

Young Frankenstein A nostalgic, hilarious spoof-tribute to classic horror films (1974), and in particular, of Mary Shelley's classic novel.

Hal 9000 free Turn your Windows Phone 7 into HAL 9000 from Stanley Kubrick's landmark science-fiction movie 2001: A Space Odissey!!

Style Magazine Insert your photo on the cover of a famous style magazine!Be a model! Prove to your friends how famous you really are!Choose from tabloid covers like Vogue, Elle, GQ etc..

Comments

RATE THIS, so we can publish other tricks !!

posted by: Venetasoft on 1/23/2012 3:03:11 PM

Please if you liked this trick, rate it 5 stars (at the beginning of the article page) !!!

Will not pass certification

posted by: Dan Ardelean on 1/23/2012 5:32:17 PM

Using this method the application will not pass certification process

Performance

posted by: BlackLight on 1/23/2012 6:28:12 PM

Hi,

Good method. However, my app is already pretty slow to load. Adding this code will probably add another half a second maybe?

Much Appreciated.

FileExist

posted by: Holger on 1/23/2012 8:09:01 PM

Is it not possible to only check if the file exist instead of loading it?

OF COURSE IT WILL PASS CERTIFICATION !!!

posted by: Venetasoft on 1/23/2012 8:21:21 PM

In the past to have this code pass certification we have to add a date check, skipping if Now < (Now + 15 days), just for certification duration time.

Now this code will pass certification without the need of postponing the check, we are using it with 'Security Toolkit' (the pirated xap is everywhere, but works as trial :D) !!!

AppHub beta testers use the signed version of your app exactly as final user does, so WMAppPRHeader.xml is now added first of all.

Re: FileExist

posted by: Venetasoft on 1/23/2012 8:28:30 PM

It is a little safer to check its integrity too (hackers could make it blank or add extra lines, we don't know exactly as DRM protection and this file are related each other, so we prefer to be sure it is integral anyway ;).

As we will know about other tricks used by hackers, we will improve this code to check specific xml nodes/attributes/values hacking, that's why we prefer to load the entire XML DOM.

posted by: KooKiz on 1/23/2012 8:38:18 PM

Techniques like + "." + "x" + "m" + "l" are useless. The compiler detects that you're concatening constants, and rewrites it as + ".xml"

Cert answers needed...

posted by: bc3tech on 1/24/2012 6:36:05 AM

can we get a solid answer on a couple of things? 1) Will this method make it through cert? 2) What happens to Private Beta submissions using this? Do they get detected as "hacked" or legit?

Re: Cert answers needed...

posted by: Venetasoft on 1/24/2012 12:49:40 PM

1) nostrong text problem for certification 2) dont know, try to submit and per us know ;)

Easy to bypass

posted by: Ben on 1/27/2012 5:11:24 PM

You just have to open the xap (as a zip), add the xml file and you're ready to go. Pretty useless I think...

And finally your scrambling method's pretty useless too. Reflector gives

string fl = "xxxWxxxxMxxxxAxxxxpxxxpxxxPxRxxxxxHxxxxxxxexxxxxxaxxxxdxxxxxxxxerxxxxx"; var fl = fl.Replace("x", string.Empty) + ".xml";

Re: Easy to bypass

posted by: Venetasoft on 1/27/2012 6:03:17 PM

This code is intended to be adopted by developers who never thought about piracy and want to protect their apps against CASUAL piracy (as title says). We are using this code (little modified to make our app as trial in case of hacking) in all our apps and worked with all cracked xap we can find on the web.

Of course can be improved, I encourage all of you, code-protection-gurus, to post your ideas and code :).

THIS CODE WORKS, PASS CERTIFICATION and PROTECT YOUR APP 99,999% of times. This is enought for me.

It works!

posted by: Rob on 1/27/2012 6:30:21 PM

Worked with my app also !!!! Tried with 3MktPlace automatic cracking tool too ;)

Thank you sooooooooo much for sharing this code !!!

Question

posted by: Martin on 1/27/2012 9:39:42 PM

How did you managed to get your app Security Suite to Marketplace? I created an app MyCam for taking pictures under lockscreen and they rejected it twice for certification, because 'it looks like this app propagates spying'. Creating audio and video recording apps for saving to SkyDrive was in plan too, I even had working demo before they released SkyDrive final API - in October 2011, but the failure with MyCam certification effectively stopped all my attempts :(

Re: Martin

posted by: Venetasoft on 1/28/2012 4:44:01 AM

Hello Martin, this is OT here, please send me an email to david[at]venetasoft.it, I'll be happy to share my experience with you :)

Use #if DEBUG instead

posted by: Paul Marques on 1/28/2012 5:22:02 PM

This is definitely worth adding to your apps coupled with some good obfuscation.

Using the #if DEBUG instead of checking the Debugger.IsAttached means you can test your app on your device away from visual studio. I found this useful when determining app usability over a period. Thats the only change I would make to the code above + enclose in an internal class.

Paul Marques ByteMarq Ltd http://www.bytemarq.com

Our Apps -> http://www.windowsphone.com/en-US/search?q=bytemarq

Not working?

posted by: Jandieg on 3/12/2012 1:08:48 AM

I added this some days ago, passed certification but now users say it can't run. Has anyone had issues?

Working perfectly

posted by: Rob on 3/26/2012 3:30:12 AM

Maybe you inserted some wrong code, we are using this (little modified) without any problems :)