# Rev IOS Dump

Dump decrypted iOS app binaries (砸壳) from jailbroken devices using frida-ios-dump.

- Repository: https://github.com/P4nda0s/reverse-skills (2339 stars)
- Category: Mobile
- License: see repository
- Last updated: 2026-05-06
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add P4nda0s/reverse-skills --skill rev-ios-dump -g -a claude-code -y`
Codex: `npx skills add P4nda0s/reverse-skills --skill rev-ios-dump -g -a codex -y`
Cursor: `npx skills add P4nda0s/reverse-skills --skill rev-ios-dump -g -a cursor -y`
Gemini CLI: `npx skills add P4nda0s/reverse-skills --skill rev-ios-dump -g -a gemini-cli -y`

## Description

Dump decrypted iOS app binaries (砸壳) from jailbroken devices using frida-ios-dump. Activate when the user wants to decrypt an iOS app, dump an IPA from a device, or extract a decrypted Mach-O binary for reverse engineering.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# rev-ios-dump - iOS App Decryption (砸壳)

Dump decrypted iOS application binaries from jailbroken devices for security analysis and reverse engineering.

---

## Overview

iOS apps distributed via the App Store are encrypted with Apple's FairPlay DRM. To perform static analysis (IDA/Ghidra/Hopper), the binary must first be decrypted at runtime, commonly called "砸壳" (dumping the shell). This skill uses Frida to instrument the running process and dump the decrypted Mach-O from memory.

---

## Prerequisites

| Requirement | Details |
|-------------|---------|
| Jailbroken iOS device | With SSH access enabled |
| frida-server | Installed and running on the device |
| Python 3 | On the host machine |
| frida + frida-tools | `pip3 install frida frida-tools` |
| USB or network access | SSH connection to the device |

### Verify frida-server is Running

```bash
# Check frida-server on device via SSH
ssh mobile@<device_ip> "ps aux | grep frida-server"

# If not running, start it
ssh mobile@<device_ip> "/usr/sbin/frida-server -D &"

# Verify from host
frida-ls-devices
frida-ps -H <device_ip>
```

---

## Tool: frida-ios-dump

Repo: `https://github.com/P4nda0s/frida-ios-dump`

### Installation

```bash
git clone https://github.com/P4nda0s/frida-ios-dump.git
cd frida-ios-dump
pip3 install -r requirements.txt

# Build the TypeScript agent (required before first run)
npm install --ignore-scripts
npx frida-compile dump.ts -o dist/dump.js
```

Note: This version uses a TypeScript-based Frida agent. The `dist/dump.js` must be compiled before `dump.py` can run.

---

## Step-by-Step Workflow

### Step 1: Identify Target App Bundle ID

Use one of these methods on the device:

```bash
# Method 1: List running apps via Frida
frida-ps -H <device_ip> -a

# Method 2: SSH into device and check
ssh mobile@<device_ip> "find /var/containers/Bundle/Application -name Info.plist -exec plutil -p {} \; 2>/dev/null | grep CFBundleIdentifier"
```

The rest: https://github.com/P4nda0s/reverse-skills/blob/HEAD/skills/rev-ios-dump/SKILL.md