p4nda0s/reverse-skills/rev-ios-dump

rev-ios-dump - iOS App Decryption (砸壳)

Dump decrypted iOS application binaries from jailbroken devices for security analysis and reverse engineering.

Overview

iOS apps distributed via the App Store are encrypted with Apple's FairPlay DRM. To perform static analysis (IDA/Ghidra/Hopper), the binary must first be decrypted at runtime — commonly called "砸壳" (dumping the shell). This skill uses Frida to instrument the running process and dump the decrypted Mach-O from memory.

Prerequisites

Verify frida-server is Running

# Check frida-server on device via SSH
ssh mobile@<device_ip> "ps aux | grep frida-server"
 
# If not running, start it
ssh mobile@<device_ip> "/usr/sbin/frida-server -D &"
 
# Verify from host
frida-ls-devices
frida-ps -H <device_ip>

Tool: frida-ios-dump

Repo: https://github.com/P4nda0s/frida-ios-dump

Installation

git clone https://github.com/P4nda0s/frida-ios-dump.git
cd frida-ios-dump
pip3 install -r requirements.txt
 
# Build the TypeScript agent (required before first run)
npm install --ignore-scripts
npx frida-compile dump.ts -o dist/dump.js

Note: This version uses a TypeScript-based Frida agent. The dist/dump.js must be compiled before dump.py can run.

Step-by-Step Workflow

Step 1: Identify Target App Bundle ID

Use one of these methods on the device:

# Method 1: List running apps via Frida
frida-ps -H <device_ip> -a
 
# Method 2: SSH into device and check
ssh mobile@<device_ip> "find /var/containers/Bundle/Application -name Info.plist -exec plutil -p {} \; 2>/dev/null | grep CFBundleIdentifier"

Or use CocoaTop on the device to identify the running process and its Bundle ID.

Step 2: Ensure Target App is Running

The target app must be running on the device. frida-ios-dump attaches to the live process to dump decrypted memory.

Step 3: Execute Dump

cd frida-ios-dump
 
python3 dump.py -H <device_ip> -u mobile -P <password> <bundle_id>

Parameters:

Example:

python3 dump.py -H 192.168.1.100 -u mobile -P alpine app.ish.iSH

Step 4: Verify Output

A successful dump produces a .ipa file in the current directory:

ls -la *.ipa
 
# Unzip to inspect
unzip -o <app_name>.ipa -d dumped_app/
 
# Verify decryption — cryptid should be 0
otool -l dumped_app/Payload/<AppName>.app/<BinaryName> | grep -A4 LC_ENCRYPTION_INFO

If cryptid 0 is shown, the binary is successfully decrypted.

Troubleshooting

Version Mismatch Fix

frida-server and host frida must be the same major version:

# Check host version
frida --version
 
# Download matching frida-server from:
# https://github.com/frida/frida/releases
# Choose: frida-server-<version>-ios-arm64.xz

Output Usage

After obtaining the decrypted IPA:

1. Static analysis — Load the decrypted Mach-O into IDA/Ghidra/Hopper
2. Class dump — Extract ObjC headers: class-dump <binary> > headers.h
3. String analysis — Search for sensitive strings, URLs, keys
4. Frida hooking — Use with rev-frida skill for dynamic analysis
5. Symbol recovery — Use with rev-symbol skill for stripped binary analysis

Notes

• The device must remain unlocked and the app must stay in the foreground during the dump process.
• For apps with multiple frameworks, frida-ios-dump will dump all encrypted frameworks within the app bundle.
• Some apps with advanced jailbreak detection may terminate before the dump completes — consider bypassing jailbreak detection first.