Device and method for executing protected iOS software modules
A device comprising a hardware processor and memory storing an application of an application package comprising a first version and a second version of the application, the first version being intended to be executed on a genuine device and the second version on a jailbroken device. The hardware processor determines a jailbreak status of the device, i.e. genuine or jailbroken and derives a key based on at least the jailbreak status. In case the device is genuine, the hardware processor deciphers using the key at least a first part of the first version and executes, the first version using the first deciphered part, for example a jump table used to execute CFG flattened code. In case the jailbreak status is jailbroken, the hardware processor deciphers using the key at least a first part of the second version and executes the second version using the second deciphered part, for example comprising executable instructions.
1. A method for executing code of an application of an application package comprising a first version and a second version of the application, the first version intended to be executed on a genuine device and the second version intended to be executed on a jailbroken device, the method comprising in a device:
determining by at least one hardware processor a jailbreak status of the device;
computing by the at least one hardware processor an integrity value for the code;
deriving by the at least one hardware processor a decryption key based on at least the jailbreak status and the integrity value; and
in case the jailbreak status indicates that the device is genuine:
decrypting by the at least one hardware processor using the decryption key at least a first part of the first version stored in a memory of the device to obtain a first processed part; and
executing, by the at least one hardware processor using the first processed part, the first version; and
in case the jailbreak status indicates that the device is jailbroken:
decrypting by the at least one hardware processor using the decryption key at least a second part of the second version stored in the memory to obtain a second processed part; and
executing by the at least one hardware processor the second processed part.
2. The method of claim 1 , wherein the at least first part comprises a jump table.
3. The method of claim 2 , wherein the jump table is used with Control Flow Graph flattened code.
4. The method of claim 2 , wherein the jump table is stored in a data section of the first version of the application.
5. The method of claim 1 , wherein the second part comprises enciphered executable instructions.
6. A device for executing code of an application, the device comprising:
memory storing an application package comprising a first version and a second version of the application, the first version intended to be executed on a genuine device and the second version intended to be executed on a jailbroken device; and
at least one hardware processor configured to:
determine a jailbreak status of the device;
compute an integrity value for the code;
derive a decryption key based on at least the jailbreak status and the integrity value; and
in case the jailbreak status indicates that the device is genuine:
decrypt, using the decryption key, at least a first part of the first version stored in the memory of the device to obtain a first processed part; and
execute, using the first processed part, the first version; and
in case the jailbreak status indicates that the device is jailbroken:
decrypt, using the decryption key, at least a second part of the second version stored in the memory to obtain a second processed part; and
execute the second processed part.
7. The device of claim 6 , wherein the at least first part comprises a jump table.
8. The device of claim 7 , wherein the jump table is used with Control Flow Graph flattened code.
9. The device of claim 7 , wherein the jump table is stored in a data section of the first version of the application.
10. The device of claim 6 , wherein the second part comprises enciphered executable instructions.