Can you break this jar?
So, I spent the weekend cooking up a "Data Integrity Protection" library in B4J.
In theory, any changes to the original source and/or compiled code should completely invalidate its use. As an example, such changes could be removing an ad banner.
It shouldn't matter if the jar file was directly hacked or if it was reversed engineered, my solution should provide the same level of protection.
UPDATE:In theory, any changes to the original source and/or compiled code should completely invalidate its use. As an example, such changes could be removing an ad banner.
It shouldn't matter if the jar file was directly hacked or if it was reversed engineered, my solution should provide the same level of protection.
Regarding Erel's concerns, I decided to recompile the app without using obfuscation at all. In case this library is ever released, you should know that its cornerstone rests on a master password. You, the developer, should be the one to decide the method of embedding/providing this password to the application (not to the user). The only two ways that come to my mind would be either via obfuscation or http request/authentication.
That said, the goal of this challenge is to help me understand how strong can this library be, assuming that the user/hacker doesn't get his hands on the master password.
Because it would be very bad for us all to have anyone messing with the default obfuscation method, I'm providing you this app's master password: 123456
That said, the goal of this challenge is to help me understand how strong can this library be, assuming that the user/hacker doesn't get his hands on the master password.
Because it would be very bad for us all to have anyone messing with the default obfuscation method, I'm providing you this app's master password: 123456
The challenge:
Consider a small app, sponsored by McDonald's, that reveals the hidden location of Atlantis, given that you're able provide a certain secret code.
Your mission, should you choose to accept it, is to:
1. Remove the McDonald's ad.
2. Obtain the secret code.
Remember, although the master password was provided above, you have to pretend you have no access to it. Everything else is yours to hack.
How to do it?Your mission, should you choose to accept it, is to:
1. Remove the McDonald's ad.
2. Obtain the secret code.
Remember, although the master password was provided above, you have to pretend you have no access to it. Everything else is yours to hack.
You can either use a Hex Editor and make direct changes the compiled class file or reverse engineer it using one of the many decompiler available on-line.
To make things easier, I'll even provide part of the source code:
To make things easier, I'll even provide part of the source code:
B4X:
Dim HackMe as String
...
...
HackMe = "Hack me if you can!"
...
...
If HackMe <> "Hack me if you can!" Then
label1.Text = "Congratulations! Your secret code is: " & [...]
End IfJar File: http://www.ninjadynamics.com/stuff/hackme.zip
Unzip both files to your directory of choice.
Run the app from the command line (java -jar hackme.jar 123456) or use the batch file.
Tools:Run the app from the command line (java -jar hackme.jar 123456) or use the batch file.
May the odds be always in your favor! Happy hacking!
@Roycefer, @MarcoRome, @Informatix, I'd like to draw your attention to this thread.
Last edited: