Way to protect from Lucky Patcher / play licensing [closed]

Answer 1

Lucky Patcher work in rooted device. i check the phone is rooted or not.in my first activity i check if phone is root, my app locked Otherwise my app opening.

check is root with bellow method :

    private static boolean isRooted() {
    return findBinary("su");
}



public static boolean findBinary(String binaryName) {
    boolean found = false;
    if (!found) {
        String[] places = {"/sbin/", "/system/bin/", "/system/xbin/", "/data/local/xbin/",
                "/data/local/bin/", "/system/sd/xbin/", "/system/bin/failsafe/", "/data/local/"};
        for (String where : places) {
            if ( new File( where + binaryName ).exists() ) {
                found = true;
                break;
            }
        }
    }
    return found;
}

Answer 2

As a professional IT engineer and general power user (Linux, Windows, Android, OS X, iOS) as comfortable in command line interfaces as graphical, I use the tools at my disposal to achieve my ends. I could not imagine using an Android device that isn't rooted, and I'm normally loaded with a plethora of utilities that require it. At the very least, I enjoy the freedom of controlling the obligatory bloatware that normally comes with my favourite device, inserting my own system apps, and making legitimate modifications for aesthetics, comfort, and convenience.

I have been forced down some dodgy avenues just to achieve proper functionality in apps whose authors choose to cripple rooted users. Being told that my device has 'unauthorised modifications' by (for instance) Virgin TV Anywhere makes my blood boil, and I'll happily break their code and contravene some license agreements if it's the only option available to me in pursuit of expected functionality.

In this regard, I agree that you're inviting a lot of users, whether through indignant spite or mere utility, to foil your efforts should you choose such a draconian path as the aforementioned media application. This might even encourage piracy of your app altogether when 'fixed' versions of your code become more prevalent as torrents than your legitimate sales.

Personally, I always go for the paid option, even when I'm forced to swallow my sense of security and break it with tools I scarcely trust in order to make it work. For many, though, the initial exposure they'll have to your product is through nefarious channels, and they're hardly going to go paying for the legitimate and hopelessly crippled version.

I understand why some coders are forced to make these choices, and its good to see sensible questions asked about the right way to protect intellectual property.

It is even more reassuring to see sense in the answers.

Just my tuppence.

Answer 3

Only way I have heard of is to do server verification... have your app contact a server and verify they purchased your app.

This is about in-app billing through Google, Why is signature verification on remote server more secure than on device?

Some good info on the dev site about Google Play in general here and in-app billing specifically here

Unfortunately I'm not finding much else...

Answer 4

Base on the fact that LuckyPatcher uses odex replacement for its hacking purpose. I think the modest way to defeat its current implmentation is to compile your important piece of code in separate dex, and load it via DexClassLoader.

Ref: http://android-developers.blogspot.pt/2011/07/custom-class-loading-in-dalvik.html

Answer 5

The way I do it, is to keep an eye in the package name of lucky patcher, in case they change it. So at runtime I check if it is installed, and I simply do not allow to use my app if this one is actually installed on the phone, even if they purchased the app. I warn the user and kill my app. So he will have to find another way to crack it. The worse I can get is that he has to buy my app and will sure put 1 bad review. But honestly, I prefer 1 bad review from a hacker than 1000 pirated copies a day.

Answer 6

If they have a rooted device the can hide the su binary to use the app too checking root is the best method unless your can be used with the non rooted version of freedom and then you will need to fix that. Putting a check for hacking tool like game killer is going to stop lazy people but not one that can decompile an change the string to another.