rev-ios-dump - iOS App Decryption (砸壳)

Dump decrypted iOS application binaries from jailbroken devices for security analysis and reverse engineering.

---

Overview

iOS apps distributed via the App Store are encrypted with Apple's FairPlay DRM. To perform static analysis (IDA/Ghidra/Hopper), the binary must first be decrypted at runtime, commonly called "砸壳" (dumping the shell). This skill uses Frida to instrument the running process and dump the decrypted Mach-O from memory.

---

Prerequisites

Requirement	Details
Jailbroken iOS device	With SSH access enabled
frida-server	Installed and running on the device
Python 3	On the host machine
frida + frida-tools	pip3 install frida frida-tools
USB or network access	SSH connection to the device

Verify frida-server is Running

# Check frida-server on device via SSH
ssh mobile@<device_ip> "ps aux | grep frida-server"

# If not running, start it
ssh mobile@<device_ip> "/usr/sbin/frida-server -D &"

# Verify from host
frida-ls-devices
frida-ps -H <device_ip>

---

Tool: frida-ios-dump

Repo: https://github.com/P4nda0s/frida-ios-dump

Installation

git clone https://github.com/P4nda0s/frida-ios-dump.git
cd frida-ios-dump
pip3 install -r requirements.txt

# Build the TypeScript agent (required before first run)
npm install --ignore-scripts
npx frida-compile dump.ts -o dist/dump.js

Note: This version uses a TypeScript-based Frida agent. The dist/dump.js must be compiled before dump.py can run.

---

Step-by-Step Workflow

Step 1: Identify Target App Bundle ID

Use one of these methods on the device:

# Method 1: List running apps via Frida
frida-ps -H <device_ip> -a

# Method 2: SSH into device and check
ssh mobile@<device_ip> "find /var/containers/Bundle/Application -name Info.plist -exec plutil -p {} \; 2>/dev/null | grep CFBundleIdentifier"