Hack a Trial Mac APP

- (NSString *)getSystemID {
    io_service_t platformExpert = IOServiceGetMatchingService(kIOMasterPortDefault,IOServiceMatching("IOPlatformExpertDevice"));
    if (!platformExpert)
        return nil;

    CFTypeRef serialNumberAsCFString = IORegistryEntryCreateCFProperty(platformExpert,CFSTR(kIOPlatformUUIDKey),kCFAllocatorDefault, 0);
    if (!serialNumberAsCFString)
        return nil;

    IOObjectRelease(platformExpert);
    return (__bridge NSString *)(serialNumberAsCFString);;
}

POST https://api.sipapp.io/2.0/trial
BODY:
{
 "id": "0911D5D6-6354-21F7-9E0A-xxxxxxxxxxxx",
 "pin": 6535
}
RESPONSE:
{
 "build": 200,
 "environment": "production",
 "match": "KeAe",
 "status": 200,
 "success": true,
 "trial": {
  "date": "2020-02-23",
  "days": 15,
  "id": "0911D5D6-6354-21F7-9E0A-xxxxxxxxxxxx",
  "name": "FaiChou-MBP",
  "remaining": 15
 },
 "version": "2.0"
}

Hello Rui,
  I am FaiChou, from China. I am a super user of Sip app. And also I am a frontend developer.
  Recently, I want to create a macOS app with free trial. I notice that many apps save their `expiredDate` or `trialStart` to local, this is a bad idea, because any script can change that value.
  So I think using `UDID + backend` mechanism is a better option. The `expiredDate` are saved in backend and app checks the expired date by passing UDID to backend.

  When I study the Sip app, I found that Sip is not using the UDID, but when I re-install it, the same id appears. Wow, how could it happen? I think `keychain` is the only way to persist id, but when I open keychain, wow, there is nothing here. So could you please teach me how this works?

Hey,

I can give you a light how this works

1) We use the kIOPlatformSerialNumberKey, basically this identifies a machine, the only way the user change this is by changing the board
2) We made some changes to this serial number, basically using some function in CryptoKit and some private keys
3) Then we save that transformed and some data locally and remote
4) Everytime a user open Sip, sip try validate that data, a check if the hash saved locally is different in the server, if that’s different, that means something changed in local, so we delete everything and the user need to start again, will need to enter the license, like you deleted the app
5) We have some algorithms to handle some edge cases, like what if the user dent have internet, what if sip servers are down etc

Hope this helps you