IPAAutoDec

IPAAutoDec is a tool that decrypts IPA files on a jailbroken iOS device via SSH. It handles the entire workflow from uploading the IPA, installing it, decrypting the binaries, and repackaging it as a decrypted IPA file.

For the details on how to use the tool, see the Anvil's blog post - Locked Up But Not Locked Out: iOS App Pentesting Without Jailbreak.

Features

• Automated Workflow: Handles the complete decryption process end-to-end
• Dependency Management: Automatically checks and installs required tools (appinst, fouldecrypt)
• SSH Integration: Connects to the jailbroken iOS device via SSH (default creds root:alpine)
• Binary Decryption: Decrypts all Mach-O binaries in the app bundle and extensions
• IPA Repackaging: Creates a properly structured decrypted IPA file and pulls it back from the iOS device

Requirements

On Your Computer

• sshpass - for password-based SSH authentication
• scp and ssh
• Network access to the jailbroken iOS device

On Your iOS Device

• Jailbroken iOS device (rootful or rootless)
• SSH access enabled (OpenSSH or similar)

Installation

1. Clone or download this repository:

git clone https://github.com/anvilsecure/IPAAutoDec
cd IPAAutoDec

2. Ensure the script is executable:

chmod +x ipa_auto_dec.sh

Usage

Basic Usage (default root credentials)

./ipa_auto_dec.sh -h <device_ip> -i <path_to_ipa_file>

Full Example

./ipa_auto_dec.sh \
  -h 192.168.1.100 \
  -l 22 \
  -u username \
  -p password \
  -i MyApp.ipa

Command-Line Options

Option	Description	Required	Default
-h	Device IP address or hostname	Yes	-
-i	Path to the IPA file to decrypt	Yes	-
-l	SSH port number	No	22
-u	SSH username	No	root
-p	SSH password	No	alpine
-a	Custom path to appinst .deb file	No	Use com.linusyang.appinst_1.1.4_iphoneos-arm64.deb for rootless jailbreak, nodelete-com.linusyang.appinst.deb for rootful
-b	Bundle identifier (auto-detected if not provided)	No	Extracted from IPA

Workflow

The tool performs the following steps automatically:

1. Dependency Check: Verifies and installs required tools (unzip, fouldecrypt, appinst)
2. Upload: Transfers the IPA file to the device
3. Installation: Installs the IPA using appinst
4. Decryption:
   • Locates the installed app
   • Copies app structure to temporary Payload directory
   • Decrypts all Mach-O binaries using fouldecrypt
   • Signs binaries with ldid
5. Repackaging: Creates a new IPA file with decrypted binaries
6. Download: Pulls the decrypted IPA back to your computer

Troubleshooting

Problem: Cannot connect to device

• Verify device IP address is correct
• Ensure SSH is enabled on the device
• Check that device and computer are on the same network
• Verify firewall isn't blocking SSH port

Problem: appinst/fouldecrypt/zip/etc. installation fails

• Check that dpkg and apt-get are working on the iOS device
• Try installing manually with dpkg -i and apt-get install -y unzip
• Mind the versions - com.linusyang.appinst_1.1.4_iphoneos-arm64.deb/moe.misty.fouldecrypt_0.0.3_iphoneos-arm64.deb for rootless jailbreaks, nodelete-com.linusyang.appinst.deb/moe.misty.fouldecrypt_0.0.3_iphoneos-arm.deb for rootful

Problem: Decryption fails

• Verify fouldecrypt is properly installed
• Check that the app is actually encrypted
• Ensure sufficient disk space on device

How Decryption Works

The tool uses fouldecrypt to decrypt Mach-O binaries. It:

• Finds all _CodeSignature directories in the app bundle
• Identifies Mach-O binaries in each directory
• Decrypts each binary (fouldecrypt outputs to /tmp/)
• Moves decrypted binaries to the correct location in Payload structure
• Signs binaries with ldid

Acknowledgments

• appinst by Linus Yang - for IPA installation
• fouldecrypt by Misty - for binary decryption