2 ms·
While code signing and verification is the way, you should also include a step on your own and not rely on the OS to do that for you. Apple’s code signing has b
by reactordev 3y ago
While code signing and verification is the way, you should also include a step on your own and not rely on the OS to do that for you. Apple’s code signing has been bypassed a few times. Granted they patch it, however one can include a script that enables developer mode in a terminal process that can then disable code signing (enable in-secure apps via developer-mode AppleScript).
It’s impossible to get past inspection on the Apple Store due to that extra script in the app bundle but a downloaded dmg off the web…
- alin23 3y agoYes, I was referring to the fact that I do a manual code sign check in my own code. Otherwise, Gatekeeper will be happy to run any cracker-signed app, they even found ways to staple forged notarization tickets. Manual code sign checks can only be cracked by patching the binary, which requires a lot more effort than swizzling some methods in a dylib. Or by process injection with Frida, but that requires disabling SIP which most people won’t do just for a cracked app.