unfairplay README

The project's README from github.com/DrWhax/unfairplay. As one markdown file: README.md.

UnfairPlay

UnfairPlay recovers a FairPlay model from an enrolled Mac and uses it to decrypt personalized iOS IPAs. It is a standalone Go program.

It does not log in to Apple, buy apps, or download IPAs. You can use ipatool or another downloader for that part.

Use UnfairPlay only with apps you lawfully acquired and accounts and devices you control. It is intended for interoperability, preservation, and authorized research. The authors do not condone piracy, credential theft, copyright infringement, or unauthorized distribution of decrypted apps.

Build

go build -o unfairplay ./cmd/unfairplay

Usage

First, sign in to the native Mac App Store. Install an iPhone or iPad app and open it once. Download a matching encrypted IPA with the same Apple Account.

Set up reusable decryption once:

sudo ./unfairplay setup \
  --app /Applications/App.app \
  --ipa App.ipa

The saved model is private. It is tied to the Mac App Store enrollment, not to one app, so it can decrypt other personalized IPAs from the same enrollment.

Decrypt another IPA:

./unfairplay decrypt --input AnotherApp.ipa

The default model directory is inside the user configuration directory. Set UNFAIRPLAY_MODEL_DIR or pass --model to use another location.

IPAs with extensions and watch apps are decrypted in one pass. Test without keeping plaintext with:

./unfairplay verify --input AnotherApp.ipa

Convert an IPA for macOS

This requires an encrypted IPA personalized for the same Store enrollment as your saved model. Convert it with:

./unfairplay convert-ipa-macos --input App.ipa

The default output is App.macos.ipa. Use --output to choose another path or --force to replace an existing output.

The command uses a saved version-2 enrollment model. You can instead use a matching private 16-byte credential:

chmod 600 credential.bin
./unfairplay convert-ipa-macos \
  --input App.ipa \
  --credential credential.bin

The conversion:

The result is still an IPA, not a macOS installer. A macOS iOS-app wrapper or compatible installer must preserve this basic layout:

App iOS.app/
  WrappedBundle -> Wrapper/App.app
  Wrapper/App.app
  Wrapper/iTunesMetadata.plist

The converted IPA and wrapper contain a private account license. Keep them private. This feature does not decrypt, modify, re-sign, or bypass checks inside the app. Apps may still reject macOS, require unavailable hardware, or depend on services that are not present on macOS.

Advanced commands

collect and recover expose the two setup stages for diagnostics and archived captures. doctor checks a capture, IPA, or model. profile inspects an arm64e fairplayd without executing it.

sudo ./unfairplay collect --app /Applications/App.app --ipa App.ipa --output App.capture
./unfairplay recover --capture App.capture --output App.recovery

Create a code profile for an exact fairplayd binary:

./unfairplay profile --binary /path/to/fairplayd.arm64e \
  --recovery-profile-output fairplayd.recovery-profile.gz

The profile contains code locations and import names. It contains no account data and does not execute fairplayd. It helps add native support for new macOS builds, but creating it alone does not enable decryption.

FAQ

What is an enrollment?

An enrollment is the FairPlay state created when an Apple Account uses the Mac App Store on a Mac. It links the account, Mac, and FairPlay selector. setup turns that state into a reusable private model.

What are SINF, SUPF, SIDB, and SC Info?

These files are private. Do not publish or share them.

Do I need to run setup for every app?

No. One model can decrypt different IPAs personalized for the same enrollment. Each app still has its own key inside its personalized SINF.

Why might another macOS build fail?

Apple changes fairplayd code and state layouts between builds. UnfairPlay fails closed when a path is not verified. It never publishes a recovered model until the matching IPA decrypts and passes validation.

Patches and test reports are welcome. Include the macOS build, fairplayd SHA-256, UnfairPlay commit, and complete error. Never share SIDB, SINF, hardware identity, enrollment models, decrypted apps, or Apple credentials.

Can decryption run on another operating system?

Yes. Collection must start on an enrolled Mac. You can either run setup on that Mac and securely copy the resulting model, or copy a complete private collect bundle and run recover elsewhere. The bundle contains the installed license files, system SC Info state, built-in IOMACAddress, matching IPA, macOS build metadata, and hash-checked fairplayd reference bytes.

The recovered model and personalized IPAs can then be used on macOS or Linux; fairplayd is never executed. Windows builds compile, but Windows decryption is not enabled until equivalent private-file permission checks are implemented.

Support

Verified enrollment contracts: 25G83, 26A428/26A434, and 26B118. 25G83 and 26B118 use the portable semantic evaluator; native fairplayd execution is not required. Unknown arm64e builds are accepted only when model recovery and full IPA validation succeed.

The evaluator source build is recorded for audit purposes. UnfairPlay does not load or run that fairplayd binary during recovery.

macOS arm64 and Linux amd64/arm64 are supported. Windows is compile-tested but cannot yet enforce the required private-file permissions.

The IPA, installed app, Mac state, hardware identity, and model must belong to the same enrollment. Account or selector mismatches are rejected.

Keep capture and model files private. Do not share SIDB, SINF, hardware data, recovery models, or decrypted apps. Decrypted IPAs are analysis files and need signing before installation.

Releases

Run the private control matrix in QA.md before tagging a release.

Tags matching v* publish binaries and SHA256SUMS through GitHub Actions. Tags such as v0.2.0-rc.1 create prereleases.

License

MIT. Third-party notices are in NOTICE, LICENSE-DARKPHOENIX.txt, and LICENSE-MACOSFAIRFREE.txt.

unfairplay (DrWhax/unfairplay)

Searching Database…

471 ·GitHub
Unfairplay
What is this?UnfairPlay is a standalone Go command-line tool that recovers a FairPlay decryption model from an enrolled Mac and uses it to decrypt personalized iOS IPAs; it does not log into Apple or download apps itself.
Is this a CLI tool, or does it also download apps for me?It is purely a decryption CLI tool. You still need a separate downloader like 'ipatool' to actually sign into Apple and fetch encrypted IPAs; UnfairPlay only handles the FairPlay model and decryption step.
How do I get started with it?Sign into the native Mac App Store on an enrolled Mac, install and open the matching iOS app once, download the same app as an encrypted IPA with the same Apple Account, then run 'setup' once to build a reusable decryption model that works on later IPAs from that enrollment.
Do I need a Mac every time I want to decrypt an IPA?Only once: an enrolled Mac is required to collect the FairPlay state and build the model. After that, the recovered model and IPAs can be used to decrypt on macOS arm64 or Linux amd64/arm64 without ever running fairplayd; Windows compiles but decryption isn't enabled there yet.
Will it work with any random macOS build?No, only a short list of verified enrollment contracts is officially supported, and unrecognized arm64e builds are accepted only if model recovery and full IPA validation actually succeed; otherwise the tool fails closed instead of producing a broken result.
Is the recovered model or decrypted data safe to share?No. The model, SINF/SIDB state, hardware identity, and decrypted IPAs are all tied to your private Apple account enrollment and must never be published or shared with anyone.
Can it also convert an IPA to run natively on macOS?Yes, a conversion command rewrites the personalized SINF into the macOS layout so the IPA works as a macOS app wrapper, while keeping every Mach-O executable byte-identical and still encrypted.
Is this tool meant for piracy?No, the authors explicitly built it for interoperability, preservation, and authorized research, and state they do not condone piracy or unauthorized distribution of decrypted apps.
What exactly is an 'enrollment'?It is the FairPlay state created when an Apple Account uses the Mac App Store on a specific Mac, linking the account, Mac, and FairPlay selector; the 'setup' command turns that state into a reusable private model.
Do I need to run setup separately for every app?No, one recovered model can decrypt any IPA personalized for the same Store enrollment, since only the per-app key lives inside that app's own SINF license.
What are similar projects?awesome-go, ollama, go, hello-algo, kubernetes, caveman, TypeScript, frp
Which topics is it in?go
Creator
DrWhax
Size
23.8 MB
Stars
471
Updated
CommitOct 27Releasev0.1.0Oct 25
Age
1d
Commits · 90 Days