How to crack immich

I have to admit I am also running an immich instance as a photo backup solution for me and some family relatives and friends.

Since immich started with this nasty “UNLICENSED” banner on the webapp it was my task to teach immich a lesson and develop a crack for it 🙂

Cracking immich involves a two step process. First we need to modify the javascript sources served to the browser, and we need to patch sources on the server side which also validates the activation serial server-side.

The goal of this crack is to provide an easy way to crack activate immich without modifying the actual sources and building immich ourself, we want to continue using their official docker image and also future versions of it.

The webapp part will do network requests to https://buy.immich.app and https://pay.futo.org

These hosts can be changed during build-time by defining environment variables PUBLIC_IMMICH_BUY_HOST and PUBLIC_IMMICH_PAY_HOST

Sadly we receive already compiled sources from them and setting these environment variables on the docker container will not change the baked-in urls in the sources anymore.

Let’s modify the sources on the fly on our apache2 reverse proxy with the following configuration:

ProxyPass / http://localhost:3001/ nocanon
ProxyPassReverse / http://localhost:3001/

<Location /_app/immutable/chunks/>
    RequestHeader unset Accept-Encoding

    AddOutputFilterByType SUBSTITUTE text/javascript

    Substitute "s|https://buy.immich.app|https://immich-crack.brunner.ninja|"
    Substitute "s|https://pay.futo.org|https://immich-crack.brunner.ninja|"
</Location>

We have to setup a domain where immich will do the serial number checks, lets use immich-crack.brunner.ninja in this example.

Create a textfile at the relative path api/v1/activate/IMSV-AAAA-AAAA-AAAA-AAAA-AAAA-AAAA-AAAA-AAAA in this new domain and put the string IMSV-OIDA in it

Next create another file api/users/me/license and put OIDA into this file.

Then add a entrypoint: directive to the docker-compose.yml like this:

name: immich

services:
  immich-server:
    container_name: immich_server
    image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release}
    # extends:
    #   file: hwaccel.transcoding.yml
    #   service: cpu # set to one of [nvenc, quicksync, rkmpp, vaapi, vaapi-wsl] for accelerated transcoding
    entrypoint: bash -c "sed -i 's#throw .*Invalid license key#//#g' dist/services/server.service.js && ./start.sh"
    volumes:

This will patch the server sources every time the immich server boots up.

Now the final part: Let’s try to activate immich with the following fake serial:

IMSV-AAAA-AAAA-AAAA-AAAA-AAAA-AAAA-AAAA-AAAA

If every step worked and my tutorial is not outdated, you should be greeted with a success popup:

When you go into administrative settings you will also see the new license there: