Aart's "Chess for Android" has a twin!

[asimpereira]

Well you could always have a license check, like the Chessbase app for Android does. Unless the hacker can manage to remove the code which checks your server, but I think its probably difficult if you obfuscate it. If the app is unable to check the license with the server, it can simply self destruct!

And ofcourse, Proguard is a must.

But I agree, reverse engineering is not too difficult (atleast modifying the manifest) and there are many free tools out there.

There are generally two concerns:
1. Somebody reverse engineering the code and modifying it or you losing the competitive edge. But in my personal experience obfuscated code (with proguard) is quite difficult to reverse engineer.
Are you saying the "smali" source code was completely readable?

2. Somebody can simply take the apk file, modify the AndroidManifest and then release it as a new package; which seems to have been the case with Aart's app (unless somehow his code was leaked).
But I am sure if the developer complains to Google (http://support.google.com/bin/request.p ... pe=lr_dmca), the Developer account may itself will be permanently closed (in some cases)
Yeah but I accidentally came across this app, so finding violations may be tricky. But as the fake app's popularity rises, I am sure it will be discovered and punished.

I don't think any other platform is 100% full proof.

From what I've discovered during the development of Houdini for Android, it is just a matter of minutes to take any Android App, disassemble it automatically and recompile a slightly modified version.

There is a public, freely available tool that produces "smali" source code which can then simply be modified and recompiled. The tool also automatically removes the most common software protection schemes that are proposed by the Android SDK.

The bottom-line is that there is just zero protection for an Android App, which is a rather disappointing situation.

Robert

[Houdini]

Well you could always have a license check, like the Chessbase app for Android does. Unless the hacker can manage to remove the code which checks your server, but I think its probably difficult if you obfuscate it. If the app is unable to check the license with the server, it can simply self destruct!

And ofcourse, Proguard is a must.

Proguard obfuscates the smali, but it doesn't really stop anything. An HTTP server check will still need to use an HTTP server call, you just comment out the lines and return "true" as result of the function call...
The problem is that the smali sources can be directly compiled to a fully featured Android App, which means that the hacking doesn't even have to be done at a very low level.

Robert

P.S. Proguard was developed by Eric Lafortune, my lab partner during my engineering studies at the Leuven University - it's a small world

[asimpereira]

Lab partner?.. ha, nice!

Out of curiosity I ran the baksmali jar on my release apk and I could not figure out anything important. Ofcourse Google does suggest obfuscating important string constants else they are quite visible. And I think its best to have your copyright images/sensitive data either in a proprietary or native format.

In many cases, these anti-hacking measures create more problems, especially for the regular user!

Anyways, nothing can stop a determined hacker! And if the hacker is really so determined, that means the app must really worth his time! I feel good

[Angrim]

If you want to mostly stop this sort of thing, have the next version of your program do some non-obvious checks that the copyright notice/program name is unmodified, and then fail silently if it is modified. ie. calculate a checksum on it, and reduce search depth to 2 if it is modified. Or have it change the value of a queen to -1, stuff like that. Then it won't be obvious to the casual crook that their changes failed, and they will publish a version with their name in the copyright field which will play vastly worse.
A skilled hacker could still work around this, but most cases it's someone with no real skills who decompiles, searches for the copyright string and program name, changes those, and recompiles.

[JVMerlino]

If you want to mostly stop this sort of thing, have the next version of your program do some non-obvious checks that the copyright notice/program name is unmodified, and then fail silently if it is modified. ie. calculate a checksum on it, and reduce search depth to 2 if it is modified. Or have it change the value of a queen to -1, stuff like that. Then it won't be obvious to the casual crook that their changes failed, and they will publish a version with their name in the copyright field which will play vastly worse.
A skilled hacker could still work around this, but most cases it's someone with no real skills who decompiles, searches for the copyright string and program name, changes those, and recompiles.

This is exactly what Johan de Koning did when we wanted to put "copy protection" into The King for Chessmaster (known as the "opk" number). He said that he didn't like the idea of just preventing the engine from working. So if the security check failed, the engine would only search to depth 3, but would still (to the untrained eye) be functioning just fine.

jm

[asimpereira]

One more Chess for Android clone! Not good..
https://play.google.com/store/apps/deta ... rkra.chesx