Prevent an app from being debugged?

Question

Hi all,

is there a way to prevent an app from being debugged when installed from the store? It seems that our app was hacked using a debugger.

Are there any guidelines to write non-hackable apps?

We are using in-app purchases and store the current game state in a local settings file (which is encrypted).

Thanks

Jürgen

Answer 1

No you cannot. Your code runs in a lower integrity level than a debugger. If you want to secure the game state, put it on a server.

---

---

Visual C++ MVP

Answer 2

That does not help. You can use the debugger to manipulate the data sent/received to/from the server.

How do other developers solve this problem?

e.g. when I do an in-app purchase, you can easily step into the correct code branch, to simulate a successful order.

Any ideas?

Answer 3

There is no way to block this completely. You can pinvoke IsDebuggerPresent to limit activity when a native debugger is attached, but somebody with a debugger could override that.

As Sheng says, the only way to fully protect your data is to keep it on the server. For the in-app purchase case you can pass the signed receipt to the server so the server can confirm that the purchase was valid. See Validating receipts .

--Rob

Answer 4

I'm not happy with this answer. Yes, I can put the game state on the server, but when the user uses a Debugger, it is easy to fake the data in the game or the answer from the server.

I think Microsoft should protect all Store apps from being debugged. This is a big security problem for us.

How do other developers solve this problem?

Jürgen

Answer 5

Whatever check you put in your code can be removed even before your code runs (see DRM and the game industry on Wikipedia). You can't really do anything to the user's machine when your code is not running. See another discussion about this at http://social.msdn.microsoft.com/forums/windowsapps/en-US/7ae29f15-331b-4fa0-a26e-5ef1a3278b68/securing-windows-8-trial-apps-in-app-purchases.

---

---

Visual C++ MVP