yashsingh1/xdaforums huggingface dataset:
[Java for Android App Development] m11kkaa:
In C terms aggressive optimization would be the O2 or O3 compiler flag.

optimized code is faster and harder readable same time.

The problem with proguard seems to be that he still preserves class and method structures.

But at least private methods could be combined etc.

I hope that there is a flag for this but I'm not a proguard expert.
[Java for Android App Development] tudor007:
Re

Yes, I own the phone.

How can I prevent root, adb and bootloader unlocks? I haven't find references on this, at least until now. Anyways, looks like what I need :)
[Java for Android App Development] m11kkaa:
well, preventing root is simple: install the latest android version :D and use a user build, not userdebug.

then you could disable adb, and maybe even sideloading apps.(with a custom rom).

But all that is useless if you can't prevent them unlocking the bootloaer or flashing other roms this way.

For that you'd need support from the manufacturer so this would be a option for big companies only :D
[Java for Android App Development] giuliomvr:
Can you flash a "custom" rom? To make your app a system app. If yes, I would make a check if the device has been rooted, and if yes, uninstall the app/or block it, or whatever you want. You could do this by setting up a receiver for the broadcast sent when the device has been booted(called something like BOOT_COMPLETED) and check whether the device has been rooted. If not, simply quit the service.
[Java for Android App Development] tudor007:
Re

Thx for ur answer GalaxyInABox.

The phone is rooted by me. And I have already converted the app in system app. On this stage is invisible for file managers like Astro, but on the other hand, there are a bunch of apps that can manage system apps (converting back to user app, backing up the app), hence the app can be copied and installed later on another device, which I am trying to avoid.
[Java for Android App Development] rogier666:
Denying access to your app when it detects root is free advertising for RootCloak.
[Java for Android App Development] ExoComet:
The only foolproof way to protect your apps from piracy is to run some critical app logic on a secure server (not on the phone/device where the app is installed) and not even include that logic in the installation for your app. In the same server call where you run this application logic you also need to call the google license check API. If the license check fails, you don't execute the app logic and return an error response.

I know there's been lots of controversy about this, but the fact is that the google license check is only insecure if you do it from the client or without running any app logic on your server.

It doesn't need to be a lot of logic that you run on the server side, just something that is unique and would make your app unusable without it, and would be difficult or (ideally) impossible to reverse engineer based on studying the inputs and outputs for different calls.

It can be something you run as part of initializing your app at launch time, or something that you run when a user loads from a save, if you are worried about users experiencing a hiccup due to network latency.

Another very effective way to protect your apps is to load static data for your app from a secure server, or to use the server to save user data.

Doing the google license check on a secure server without running any app logic along with the check is better than nothing, but won't give 100% protection and your app might be cracked. But, it's better than nothing.

Of course, this does require that your users are online (at least at the time you do the check). It's really a personal choice you need to make but especially if there are other features in your game or app that clearly require online access (i.e. real-time online leaderboards, trading with other players, etc), most of your users will be understanding. You can also power these online features using the same types of server calls. I don't have empirical data for this, but IMHO I think that the additional revenue you get when your game or app is not pirated will totally offset any loss due to users not buying your app because it is online only. You can also charge more for your app if it isn't pirated.

I've setup a framework using Amazon cloud servers to use these techniques for a game that I'm working on, and it's working great for me and is very fast and responsive.

It's occurred to me that the cloud based framework I created for my game could be reused for pretty much any game or app. Would anyone be interested if I shared it with you so that you could also use it?
[Java for Android App Development] TheStabbinator:
I've used lucky patcher for a long time for granular permission control in applications, since, just as it can do illegal things like patching out verification code, it can also patch out things like, one I do a lot is disabling network connectivity in apps with "social" or "cloud" features that I don't use, or removing activities that cause excessive wakelocks.

It's not like you're game developers blocking gameguardian - at least with that apps there's an excuse. AFAIK there's no use for them other than memory editing games which obviously some devs would want to prevent(it's still extremely sketchy behavior to do so by detecting the app.) But Lucky Patcher has a dozen legitimate uses, and some grey-area ones like blocking ads(I don't do that and I'm not going to argue here about whether it is okay to do so, that is off the topic.)

For an app to check if lucky patcher is installed and refuse to run if it is, is entirely unethical. You have a right to protect your app from piracy, but that doesn't include telling the user what other software they can have installed or whether their phone can be rooted. Those are not your decisions to make, you don't get a say on mobile any more than PC developers get a say whether users install a web browser(since they play such a large role in piracy, after all!) The very notion that you should is rancid entitlement and exemplary of the anti-consumer attitude that keeps mobile in the dark ages.
[Java for Android App Development] zelendel:
Lucky patcher is even banned here so how ethical can the app be. There are other ways to do what you want.
[Java for Android App Development] ExoComet:
The other thing is that if you put in this logic/hack for specifically defending against Lucky Patcher, it's not a very productive use of time as in a few months there will be another new exploit you will need to defend against. And this will go on ad-infinitum. The only way to protect your apps from piracy is to run some critical code and do license verification on a secure server.
[Java for Android App Development] m11kkaa:
sounds like xbox always on, or the old copy protection from assassins creed :)

These failed hard because users don't want to connect to the internet to use a application.
[Java for Android App Development] ExoComet:
Are you a professional software engineer, or are you a pirate yourself? I wonder based on your response.

What's up with these strange complaints about apps needing to be 100% offline? Do you do a lot of back-country backpacking wilderness exploration where you are totally off the grid?

A game developer can make their own decisions based on market factors whether it will be more profitable for them to have an online only game vs. not. You can choose whether or not you want to buy such a game and that's your business.

But, your reply to my post really doesn't make much sense. Just don't buy the game if you are going to be spending a significant percentage of your time in an area where you don't have internet access, and can't handle it if you can't play the game during that time.

I really don't understand the argument you are making. Could you give some more specifics as to the issue at hand?

---------- Post added at 05:54 AM ---------- Previous post was at 05:50 AM ----------

Also, I'm not sure if you noticed - but you seem to be online while you replied to my post. So, how exactly can you be saying that a requirement of being online is somehow "bad"? Anytime you are on this forum you are online, are you not?

I really don't get this.
[Java for Android App Development] m11kkaa:
I just wanted to say that users don't want to give a app permissions to connect to the internet if there if the app in theory wouldn't need this.

a example: why would a calculator need internet to execute calculations?

In this case it's not a privacy question - it's about usability. You always want to use your calculator - even if you don't have a internet connection.

about my example from game development: assassins creed introduced a technology where the game data is loaded from server to prevent pirating. The users were so annoyed from the need of being online that they cancelled the technology.

Same for the XBox gaming console.

The problem is that most users don't always have a internet connection, that's why this approach doesn't work.
[Java for Android App Development] rogier666:
Go on a trip and check what data costs. Nobody wants to pay international roaming charges for traffic that serves no other purpose than DRM.
[Java for Android App Development] Jonny:
The app would only need to connect to the internet and remote server once for verification, after that then your all set and don't need to connect to the internet.
[Java for Android App Development] Jonny:
Step 1: Buy a cheap, local, Pay-as-you-go SIM card.

Step 2: Profit! :highfive:
[Java for Android App Development] m11kkaa:
his idea was to put algorythms of the app on the server.

If you just do some verification I can easily edit that function which makes it useless.
[Java for Android App Development] rogier666:
Depends on which country you go and how long you're gonna stay there. Outside europe and america buying a local sim can take a long time with lots of paperwork. And of course those are the countries where roaming is more expensive than anywhere and free WiFi is non-existent.
[Java for Android App Development] zeroprobe:
I've recently had success protecting against LuckyPatcher. See the guide I've posted at the bottom of this question.

http://stackoverflow.com/questions/10585961/way-to-protect-from-lucky-patcher-play-licensing-android
[Java for Android App Development] m11kkaa:
well that might work for now but once it get's known lucky patcher can easily remove this code.
[Java for Android App Development] zeroprobe:
I also say to customize it in your own way. Put different fakes in there, I keep checking LuckyPatcher every release so hopefully I'll stay on top of it myself.

I've put all the places that need to be modded so it should be easy to mix the code up yourselves.
[Java for Android App Development] m11kkaa:
since it always will be a gome of cat-and-mouse we should create sth like a mailing list so devs get informed as soon as possible about it.
[Java for Android App Development] zeroprobe:
My app is holding up fine with the latest version of LuckyPatcher.
[Java for Android App Development] MattMatt0240:
Stumbled across this the other day [URL=" http://www.apkprotect.com/" ]Apk Protect[/URL]. Thought I'd share.
[Java for Android App Development] capripio:
Detect on Purchasing time

How about detect Freedom on click of buy button, basically user can use free version but when he/she tried to buy it ask to uninstall freedom as per your thread said.
[Java for Android App Development] Quinny899:
You can do that just fine, I did that in some of my apps

On a related note, I had a thought of how to beat the cracked play store and "hack all" types of IAP cracks, and it's actually very simple

Create a second IAP for a silly amount of money and have nowhere to buy it in the app. On start, check if it's purchased. If it is, you know that the person is cracking all IAPs, as it's not possible to actually buy it, and do something
[Java for Android App Development] capripio:
Interesting

Interesting, I have got another one. instead of activate app with in-app offer buyers to buy plugin which activate the app. and run plugin to check if its validate. and you can activate app then. since buying apps are only done with google play store's servers it should do the trick.
[Java for Android App Development] Quinny899:
The check that they've been bought is far worse than IAPs though, all it takes is a modified play store
[Java for Android App Development] :
[MENTION=3563640]Quinny899[/MENTION]

you should mention that there are better other ways to protect your app

example

1.

App uses eg LuckyPatcher to create modified APK

app will work but then eg call feature will not since it's a modified apk

2.

use a signature check + obfuscate the code to prevent the patcher from patching it.

3. check if classes.dex has been tampered with. eg signature check

4.

check wether a classes.odex has been created by eg lucky patcher (G2Tweaksbox) developer made this pretty fast when he's app was first cracked.

then he protected the app with obfuscation. when the obfuscation was cracked with lucky patcher he updated so if there would be an "odex" file and xposed activated it wouldn't work in "full mode" that did make he's app not pirated (until he made it free)

5.

Check wether the app was installed from google play or not. if it isn't some features might not work or the app just close itself down.
[Java for Android App Development] defim:
1) is not needed anymore

2-5) could be hacked by the xposed part of the patcher

So a quick check if this is module is loaded: compare the signature of your app with another, eg the default launcher. If they are the same (which is impossible) the crack module is loaded
[Java for Android App Development] Falenone:
I understand that piracy is bad and everything. I buy apps that I find good and play nice on mobile. What I mean about that is if your app asks me to buy something every now and then and without buying a thing the game is rather grind for days than enjoyment with a wall of unskippable, full screen intrusive ads lasting 30 seconds I'm going to use LP to block ads in your app and cheat iaps without ever feeling bad that I don't support the dev. A prime example of crappy developer is Zynga. Their games are especially bad. There are many many more of them but that one came to my mind first. It's Google too who need to make some changes to the store so it can be more like Steam Store where you have extensive search options and is indie developer friendly. Right now it's pretty hard to find great apps by great developers unless you read Android Authority website. I will never understand why it is mobile that has the "pay for every tap, watch a wall of intrusive ads advertising cheetah mobile crap".
[Java for Android App Development] Quinny899:
I agree wholeheartedly, IAPs that ruin games are terrible. But this guide it's for that, for a start they handle IAPs differently anyway

It's aimed at independent or small teams who want to protect their apps from having 90% of their users pirate or similar
[Java for Android App Development] arun483:
That's pretty nice to hear but would you like to share app name? I am a reverse engineer but I mean no harm to any developer either here or those big time sellers on play store. I don't support or encourage piracy in any way. I would like to test your app if you give me permission.
[Java for Android App Development] Quinny899:
// Package names // App names
"com.dimonvideo.luckypatcher", // Lucky patcher
"com.chelpus.lackypatch", // Another lucky patcher
"com.forpda.lp", // And another
"com.android.vending.billing.InAppBillingService.LUCK",// Lucky patcher 5.6.8
"cc.madkite.freedom", // Freedom
"org.creeplays.hack" // CreeHack

Is what I use in my apps

For Lucky Patcher, don't just check it exists, do this:

try{
PackageManager pm = getPackageManager();
Intent intent=pm.getLaunchIntentForPackage(p[x]);
if(a(this, intent)){
return false;
}
}catch(Exception e){
}
public static boolean a(Context ctx, Intent intent) {
final PackageManager mgr = ctx.getPackageManager();
List<ResolveInfo> list =
mgr.queryIntentActivities(intent,
PackageManager.MATCH_DEFAULT_ONLY);
return list.size() > 0;
}

Because Lucky Patcher can hide its existence from getPackageInfo, but cannot hide it from being launched or the app wouldn't work
[Java for Android App Development] arun483:
Yes ChelpuS changes package name time to time so would you keep stacking uppackage names to look from? Other pirates may clone application(LP) with different package name just to serve the purpose. What then? We gotta find another way around. We can't run away from piracy 100% but surely we can slow it down using the methods described in the thread. You might have heard where there is will there a way. And ChelpuS looks like one filled with will. BTW good luck with your fight against Lucky Patcher. I must say that I really enjoyed reading the whole thread
[Java for Android App Development] Quinny899:
If a pirate goes as far as cloning LP (especially as you can check for the LUCK Play Store service), then they can have the IAP for free, they worked for it.
[Java for Android App Development] :
yes unless it's iap.

yes that's indeed a better way, I wouldn't think one should add package name check, same was with su as chainfire said it's stupid to implement hard coded check or something similar for "files" since it won't last for long, same goes with luck patch tool, better check for startup service or nothing at all. I know gamevil does this check, and if it is started game won't run. but if it isn't running game will work just fine. so it's a good conclusion.
[Java for Android App Development] Quinny899:
I mean for an IAP. If they go that far out of their way, they can have it. My methods are meant to block people who just blindly use LP without knowing how it works
[Java for Android App Development] mrYoussef135:
The users who crack or install pirated apps, are the ones who actually won't buy them anyway, it's not a matter of lack of money or saving economy, but rather a lack of ethics and morals.

It's stealing they know it as we know it.
[Java for Android App Development] :
Well usually they already paid for it. If it's a paid app.

If it's free and uses iap then no they most likely won't.

If it uses a separate pro key. No they won't. Or if you'll only need key and they updated yes they will.

I bought jota key since he does indeed have a great text edit, though I dislike his method of checking your system. Hence if running cm it'll fail to verify. (And it was on sell)

And he's protection technique is hard. Uses obfuscation and "reflection" I believed someone said. I've looked into his app (half year ago) for me that was a totall mess I had no idea what was doing what. Code is just a mess but protection wise it's good. Not many will patch his app.

Poweramp uses good protection too. If tampered it won't start just gives you a toast telling you to get a original version. (I probably have paid for like 10+ keys) of this app.

I usually look into some apps for fun to see how good their protection is. But thus two apps (specific) is too advanced for me.

Must know how to use ida to play with and I can't. I must admit they've worked hard on their protection I haven't even seen one custom power amp for long which actually works modified.

Titanium backup is good to, it doesn't break any functionality if tampered with (unless the patcher did a bad job) but he uses some good checks. Let's say if patch works with no tampering to the app itself it gives full features.

If it's applied as a custom apk it will fail and act like free version. Which is a great idea btw even if you assuming you patched it properly you won't know due to its tamper technique.

---------- Post added at 08:55 PM ---------- Previous post was at 08:48 PM ----------

I know how it works, how to bypass the stuff (like gamevill)

Sad thing is xposed is a ***** now these days too :( can't have it and play zenonia

Unless I build it from source > change required files names (destination) though it might be breaking everytime else for xposed which is a *****. So if I'd succeed to let's say rename it to dummyxposed.jar and all the commands I'd have to do the same for every single app I'd use to it load dummyxposed and I'm not going to do that. Takes too much time.
[Java for Android App Development] :
I know how it works, how to bypass the stuff (like gamevill)

Sad thing is xposed is a ***** now these days too :( can't have it and play zenonia

Unless I build it from source > change required files names (destination) though it might be breaking everytime else for xposed which is a *****. So if I'd succeed to let's say rename it to dummyxposed.jar and all the commands I'd have to do the same for every single app I'd use to it load dummyxposed and I'm not going to do that. Takes too much time.
[Java for Android App Development] crazyfool_1:
This. My philosophy exactly.

That being said I use encryption and reflection to slow down users who try apps like LuckyPatcher. A dedicated person could figure out where the validation happens etc but an app like LuckyPatcher not so much. As for Xposed, haven't looked into it for ages but I did write a post back in the day about how I stopped people using it to unlock one of my apps (verified with the dev of Xposed at the time). Not sure if that info is still relevant, depands how Xposed currently patches methods.

In my opinion though, build features for the users who are willing to pay. People who use LuckyPatcher weren't gonna pay anyways, people who download a cracked APK weren't gonna pay anyways. And crackers are gonna crack :)
[Java for Android App Development] mrYoussef135:
Do you use encryption and reflection in LVL logic such as LicenseChecker and LicenseValidator or on some other parts of your app logic ?

I would like to hear some thoughts on how to protect against automatic patchers such as lucky patcher.

There is a subset of users I call "Lazy buyers" They don't mind buy an app they like; but once they get the pro version using those easy patchers , they start postponing until they forget about it .
[Java for Android App Development] Quinny899:
There's also a group of people who would maybe buy the app if LP doesn't work and cracks don't exist. If you have a small enough userbase that cracks don't exist immediately, it makes sense to block LP to maybe get these users to buy it instead
[Java for Android App Development] crazyfool_1:
Right now I use it in other parts of my app like places where I check if the trial is expired or if the unlocker app (if there is one) is installed or where I check if the unlock iap was purchased.

To be honest I don't put a lot of effort into it anymore, and I'm not regularly checking if there's a patch for it. I look at it as if someone has to create a crack specifically for my app my job is done.

My main concern was Xposed because it made it farrrr to easy for people to abuse it and use it for cracking apps.

Yeah I get that thinking, makes sense. I just personally don't see it as a good way to use my time mainly because LP exists and cracks will exist.

Also my personal opinion is the idea that a person who is willing to install LP or some dodgy APK of your app would be willing to pay if those options weren't available is bogus. I don't believe I've ever met one of those people.
[Java for Android App Development] Quinny899:
I've spoken to those people, they do exist
[Java for Android App Development] crazyfool_1:
Then I stand corrected haha :)
[Java for Android App Development] :
There's a reason why I bought jota key ;)

Also It was on sale lol.

Also some apps might not even be available to buy full version in one country is silly. .
[Java for Android App Development] MaaarZ:
If you are developing an Xposed module you can hook into LP and remove your app's entry from it's application list, making it impossible to patch your app while your module is active.
[Java for Android App Development] Quinny899:
That's quite a clever way of doing it
[Java for Android App Development] rogier666:
I wonder how that would work out. One Xposed module trying to break past another (Sudohide)...