2.1K ·GitHub
What is this?
A command-line tool that decrypts FairPlay-encrypted App Store IPA files by independently deriving the decryption keys from a 16-byte account credential, instead of relying on an external keychain or service.
A command-line tool that decrypts FairPlay-encrypted App Store IPA files by independently deriving the decryption keys from a 16-byte account credential, instead of relying on an external keychain or service.Is this a GUI app or a command-line tool?It's a command-line tool built in C and Python, split into two steps: a credential-retrieval binary and a separate decryptor, with no graphical interface.
It's a command-line tool built in C and Python, split into two steps: a credential-retrieval binary and a separate decryptor, with no graphical interface.How do I actually decrypt an IPA with this?Build the project with Python 3.9+ and a C compiler via make, retrieve a credential.bin from a jailbroken device using the credential-retrieval step, then run the decryptor on the IPA; it reads ./credential.bin unless you pass --credential.
Build the project with Python 3.9+ and a C compiler via make, retrieve a credential.bin from a jailbroken device using the credential-retrieval step, then run the decryptor on the IPA; it reads ./credential.bin unless you pass --credential.What do I need installed before building it?Python 3.9+ and a C compiler. On macOS, make additionally builds the credential-retrieval bundle, which requires Xcode and ldid.
Python 3.9+ and a C compiler. On macOS, make additionally builds the credential-retrieval bundle, which requires Xcode and ldid.Do I need a jailbroken iPhone to use this?Yes, to generate credential.bin — the credential-retrieval step only works on a supported jailbroken device; decryption itself just needs that resulting file.
Yes, to generate credential.bin — the credential-retrieval step only works on a supported jailbroken device; decryption itself just needs that resulting file.Can the decryptor run on Linux, or only macOS?Decryption runs on both macOS and Linux; only building the credential-retrieval bundle (the Xcode/ldid part) is macOS-specific.
Decryption runs on both macOS and Linux; only building the credential-retrieval bundle (the Xcode/ldid part) is macOS-specific.What exactly does the decryptor do to an IPA?It reads the IPA's SINF and SUPF records to derive the FairPlay page keys, decrypts the encrypted arm64 Mach-O pages, and clears the cryptid flag.
It reads the IPA's SINF and SUPF records to derive the FairPlay page keys, decrypts the encrypted arm64 Mach-O pages, and clears the cryptid flag.What FairPlay record formats are supported?Version-3 and version-5 SUPF structures, plus 448-byte and 440-byte SINF priv records (440-byte records must end in eight zero bytes).
Version-3 and version-5 SUPF structures, plus 448-byte and 440-byte SINF priv records (440-byte records must end in eight zero bytes).What happens if the output file already exists?The decryptor refuses to run if the chosen output path already exists, so it won't overwrite existing files.
The decryptor refuses to run if the chosen output path already exists, so it won't overwrite existing files.Can I decrypt an IPA without owning the app's Apple account?No — the 16-byte credential used for decryption belongs to the account that purchased the IPA, so you need that account's credential to derive the keys.
No — the 16-byte credential used for decryption belongs to the account that purchased the IPA, so you need that account's credential to derive the keys.What are similar projects?badnotes, raptor, ablation, vmp-lazy-unpack, awesome-reverse-engineering, Seep-Reverse-Lab, 0, ipatool
badnotes, raptor, ablation, vmp-lazy-unpack, awesome-reverse-engineering, Seep-Reverse-Lab, 0, ipatoolWhich topics is it in?ios-jailbreak, cracking, piracy, binary-analysis, security-research, cryptography, apple, reverse-engineering, cybersecurity, security-tools, offline, c
ios-jailbreak, cracking, piracy, binary-analysis, security-research, cryptography, apple, reverse-engineering, cybersecurity, security-tools, offline, c