P4nda0s rev-ios-dump - iOS App Decryption (砸壳)
Dump decrypted iOS application binaries from jailbroken devices for security analysis and reverse engineering.
Overview
iOS apps distributed via the App Store are encrypted with Apple's FairPlay DRM. To perform static analysis (IDA/Ghidra/Hopper), the binary must first be decrypted at runtime — commonly called "砸壳" (dumping the shell). This skill uses Frida to instrument the running process and dump the decrypted Mach-O from memory.
Prerequisites
| Requirement | Details |
|---|---|
| Jailbroken iOS device | With SSH access enabled |
| frida-server | Installed and running on the device |
| Python 3 | On the host machine |
| frida + frida-tools | pip3 install frida frida-tools |
| USB or network access | SSH connection to the device |
Verify frida-server is Running
# Check frida-server on device via SSH
ssh mobile@<device_ip> "ps aux | grep frida-server"
# If not running, start it
ssh mobile@<device_ip> "/usr/sbin/frida-server -D &"
# Verify from host
frida-ls-devices
frida-ps -H <device_ip>
Tool: frida-ios-dump
Repo: https://github.com/P4nda0s/frida-ios-dump
Installation
git clone https://github.com/P4nda0s/frida-ios-dump.git
cd frida-ios-dump
pip3 install -r requirements.txt
# Build the TypeScript agent (required before first run)
npm install --ignore-scripts
npx frida-compile dump.ts -o dist/dump.js
Note: This version uses a TypeScript-based Frida agent. The dist/dump.js must be compiled before dump.py can run.
Step-by-Step Workflow
Step 1: Identify Target App Bundle ID
Use one of these methods on the device:
# Method 1: List running apps via Frida
frida-ps -H <device_ip> -a
# Method 2: SSH into device and check
ssh mobile@<device_ip> "find /var/containers/Bundle/Application -name Info.plist -exec plutil -p {} \; 2>/dev/null | grep CFBundleIdentifier"
Or use CocoaTop on the device to identify the running process and its Bundle ID.
Step 2: Ensure Target App is Running
The target app must be running on the device. frida-ios-dump attaches to the live process to dump decrypted memory.
Step 3: Execute Dump
cd frida-ios-dump
python3 dump.py -H <device_ip> -u mobile -P <password> <bundle_id>
Parameters:
| Flag | Description |
|---|---|
-H |
Device IP address |
-u |
SSH username (typically mobile) |
-P |
SSH password (typically alpine on fresh jailbreak) |
<bundle_id> |
Target app Bundle ID (e.g., app.ish.iSH) |
Example:
python3 dump.py -H 192.168.1.100 -u mobile -P alpine app.ish.iSH
Step 4: Verify Output
A successful dump produces a .ipa file in the current directory:
ls -la *.ipa
# Unzip to inspect
unzip -o <app_name>.ipa -d dumped_app/
# Verify decryption — cryptid should be 0
otool -l dumped_app/Payload/<AppName>.app/<BinaryName> | grep -A4 LC_ENCRYPTION_INFO
If cryptid 0 is shown, the binary is successfully decrypted.
Troubleshooting
| Error | Cause | Fix |
|---|---|---|
Failed to spawn |
App not installed or wrong Bundle ID | Verify Bundle ID with frida-ps -H <ip> -a |
Unable to connect to remote frida-server |
frida-server not running or port blocked | Start frida-server on device, check firewall |
SSH connection refused |
SSH not enabled or wrong credentials | Verify SSH access: ssh mobile@<ip> |
Timeout waiting for process |
App crashed or not fully launched | Launch app manually first, then retry |
frida.ServerNotRunningError |
frida-server version mismatch | Match frida-server version to host frida version |
cryptid 1 in output |
Dump failed, binary still encrypted | Ensure app is running during dump, retry |
Permission denied |
SSH key/password issue | Check -u and -P flags, or use SSH key auth |
Version Mismatch Fix
frida-server and host frida must be the same major version:
# Check host version
frida --version
# Download matching frida-server from:
# https://github.com/frida/frida/releases
# Choose: frida-server-<version>-ios-arm64.xz
Output Usage
After obtaining the decrypted IPA:
- Static analysis — Load the decrypted Mach-O into IDA/Ghidra/Hopper
- Class dump — Extract ObjC headers:
class-dump <binary> > headers.h - String analysis — Search for sensitive strings, URLs, keys
- Frida hooking — Use with
rev-fridaskill for dynamic analysis - Symbol recovery — Use with
rev-symbolskill for stripped binary analysis
Notes
- The device must remain unlocked and the app must stay in the foreground during the dump process.
- For apps with multiple frameworks, frida-ios-dump will dump all encrypted frameworks within the app bundle.
- Some apps with advanced jailbreak detection may terminate before the dump completes — consider bypassing jailbreak detection first.