android - Google in app purchase and cracking -

i developed app that's become popular , cracked it. know if know, first of all: how?, if know workaround avoid this. app using in-app purchase per google example unlock premium features in way:

 private iabhelper mhelper;          if (!ispro(getactivity())) {             mhelper = new iabhelper(getactivity(), kkk);             mhelper.enabledebuglogging(true);             mhelper.startsetup(new iabhelper.oniabsetupfinishedlistener() {                 public void oniabsetupfinished(iabresult result) {                      if (!result.issuccess()) {                         return;                     }                      // have been disposed of in meantime? if so, quit.                     if (mhelper == null) return;                      // iab set up. now, let's inventory of stuff own.                     mhelper.queryinventoryasync(mgotinventorylistener);                 }             });         }      iabhelper.queryinventoryfinishedlistener mgotinventorylistener = new iabhelper.queryinventoryfinishedlistener() {         public void onqueryinventoryfinished(iabresult result, inventory inventory) {              // have been disposed of in meantime? if so, quit.             if (mhelper == null) return;              // failure?             if (result.isfailure()) {                 return;             }              purchase pro = inventory.getpurchase(pro_string);             settingsprovider.putsecboolean(getactivity(), "pro", pro != null && verifydeveloperpayload(pro));         }     };      iabhelper.oniabpurchasefinishedlistener mpurchasefinishedlistener = new iabhelper.oniabpurchasefinishedlistener() {         public void oniabpurchasefinished(iabresult result, purchase purchase) {             if (mhelper == null) return;              if (result.isfailure()) {                 return;             }              if (purchase.getsku().equals(pro_string)) {                 settingsprovider.putsecboolean(getactivity(), "pro", true);             }         }     };      boolean verifydeveloperpayload(purchase p) {         string payload = p.getdeveloperpayload();         return true;     }      @override     public void ondestroy() {         super.ondestroy();         if (mhelper != null) {             mhelper.dispose();             mhelper = null;         }     } 

and purchase process:

mpro.setonclicklistener(new view.onclicklistener() {         @override         public void onclick(view v) {             randomstring randomstring = new randomstring(36);             string payload = randomstring.nextstring();              if (mhelper != null) mhelper.flagendasync();             mhelper.launchpurchaseflow(getactivity(), pro_string,                     iabhelper.item_type_inapp, rc_request,                     mpurchasefinishedlistener, payload);         }     }); 

---

ok, in someway cracked it. means content available in pro version free without paid. maybe can share experience , suggest way avoid this?

and also, know how can done? thanks

brief explanation

android applications quite easy crack. first of all, if not using obfuscation on code (proguard, dexguard, ..), code can read , understood using tools jd-gui. in cases, smali code pretty easy understand well.

the obfuscation won't save cracking. there de-obfuscators available on market, high pitched reverse engineering skill still able figure out how bypass (or google's) protection.

finally, there luckypatcher. perhaps famous tool cracking android apps' protection. targets types of protections (google's lvl, iaps, advertising networks, ..) , tries remove them on statistical basis. in fact, not guaranteed 100%, in vast majority of cases work fine.

how secure, then?

you can't. there no perfect 100% security, in mobile environment. can do, however, trying make cracker's work difficult possible.

a few ideas:

1. always obfuscate. won't damage app (if configured correctly), , yet layer of protection code.
2. use dexguard's tampering detection function. decrease chances app gets cracked 2 days after update released.

there few more, add them recall them all.