paradiseduo / appdecrypt

appdecrypt is a tool to make decrypt application encrypted binaries on macOS when SIP-enabled (macOS 11.3 or below)

appdecrypt

Decrypt application's encrypted binaries on macOS when SIP-enabled (macOS 11.2.3 or below). Even if it can decrypt all applications, some iOS apps won't be possible to run on the mac, even after decryption.

This works well and compiles for iOS nicely, if you want use it at iOS devices, you can use build-ios.sh (Thanks @dlevi309).

How to use

On mac with M1 CPU

> git clone https://github.com/paradiseduo/appdecrypt.git
> cd appdecrypt
> chmod +x build-macOS_arm.sh
> ./build-macOS_arm.sh
> ./appdecrypt
Version 2.1

appdecrypt is a tool to make decrypt application encrypted binaries on macOS when SIP-enabled.

Examples:
    mac:
        appdecrypt /Application/Test.app /Users/admin/Desktop/Test.app
    iPhone:
        appdecrypt /var/containers/Bundle/Application/XXXXXX /tmp

USAGE: appdecrypt encryptMachO_Path decryptMachO_Path

ARGUMENTS:
  <encryptApp_Path>     The encrypt app file path.
  <decrypt_Path>        The path output file.

OPTIONS:
  -h, --help              Show help information.
  --ignore-ios-check      Decrypt the app even if M1 can't run it.

For Example

> ./appdecrypt /Applicaiton/Test.app /Users/admin/Desktop/Test.app
Success to copy file.
Dump /Applications/Test.app/Wrapper/Test.app/Test Success
Dump /Applications/Test.app/Wrapper/Test.app/PlugIns/TestNotificationService.appex/TestNotificationService Success
Dump /Applications/Test.app/Wrapper/Test.app/Frameworks/trackerSDK.framework/trackerSDK Success
Dump /Applications/Test.app/Wrapper/Test.app/Frameworks/AgoraRtcKit.framework/AgoraRtcKit Success
> cd /Users/admin/Desktop/Test.app
> ls
WrappedBundle Wrapper
> cd Wrapper
> ls
BundleMetadata.plist Test.app            iTunesMetadata.plist

On Jailbreak iPhone with arm64 CPU

First you should connect jailbreak iPhone with USB.

> brew install ldid
> git clone https://github.com/paradiseduo/appdecrypt.git
> cd appdecrypt
> chmod +x build-iOS.sh
> ./build-iOS.sh
> scp -P 2222 appdecrypt [email protected]:/tmp

// In iPhone shell
> cd /tmp
> ./appdecrypt
Version 2.1

appdecrypt is a tool to make decrypt application encrypted binaries on macOS when SIP-enabled.

Examples:
    mac:
        appdecrypt /Applicaiton/Test.app /Users/admin/Desktop/Test.app
    iPhone:
        appdecrypt /var/containers/Bundle/Application/XXXXXX /tmp

USAGE: appdecrypt encryptMachO_Path decryptMachO_Path

ARGUMENTS:
  <encryptApp_Path>     The encrypt app file path.
  <decrypt_Path>        The path output file.

OPTIONS:
  -h, --help              Show help information.

For Example

// In iPhone shell
> ./appdecrypt /var/containers/Bundle/Application/5B5D4E97-E760-4AC5-BFEE-F0FF72EBB19E /tmp
Success to copy file.
Dump /var/containers/Bundle/Application/5B5D4E97-E760-4AC5-BFEE-F0FF72EBB19E/KingsRaid.app/KingsRaid Success
Dump /var/containers/Bundle/Application/5B5D4E97-E760-4AC5-BFEE-F0FF72EBB19E/KingsRaid.app/Frameworks/FBSDKGamingServicesKit.framework/FBSDKGamingServicesKit Success
Dump /var/containers/Bundle/Application/5B5D4E97-E760-4AC5-BFEE-F0FF72EBB19E/KingsRaid.app/Frameworks/FBLPromises.framework/FBLPromises Success
Dump /var/containers/Bundle/Application/5B5D4E97-E760-4AC5-BFEE-F0FF72EBB19E/KingsRaid.app/Frameworks/FBSDKShareKit.framework/FBSDKShareKit Success
Dump /var/containers/Bundle/Application/5B5D4E97-E760-4AC5-BFEE-F0FF72EBB19E/KingsRaid.app/Frameworks/GoogleUtilities.framework/GoogleUtilities Success
Dump /var/containers/Bundle/Application/5B5D4E97-E760-4AC5-BFEE-F0FF72EBB19E/KingsRaid.app/Frameworks/FBSDKLoginKit.framework/FBSDKLoginKit Success
Dump /var/containers/Bundle/Application/5B5D4E97-E760-4AC5-BFEE-F0FF72EBB19E/KingsRaid.app/Frameworks/nanopb.framework/nanopb Success
Dump /var/containers/Bundle/Application/5B5D4E97-E760-4AC5-BFEE-F0FF72EBB19E/KingsRaid.app/Frameworks/FBSDKCoreKit.framework/FBSDKCoreKit Success
Dump /var/containers/Bundle/Application/5B5D4E97-E760-4AC5-BFEE-F0FF72EBB19E/KingsRaid.app/Frameworks/Protobuf.framework/Protobuf Success
> cd Payload
> ls
BundleMetadata.plist  KingsRaid.app/  iTunesMetadata.plist
> tar -cvf /tmp/dump.tar ./


// In mac shell
> cd ~/Desktop
> scp -P 2222 [email protected]:/tmp/dump.tar .
dump.tar

Principle

This was discovered independently when analyzing kernel sources, but it appears that the technique was first introduced on iOS :

https://github.com/JohnCoates/flexdecrypt

but now works on macOS:

https://github.com/meme/apple-tools/tree/master/foulplay

LICENSE

This software is released under the GPL-3.0 license.

Stargazers over time

appdecrypt's Issues

可以帮忙打包一个X86的二进制文件吗？

谢谢

This app not support dump on M1 Mac. Because machO PLATFORM is IOS!

What does this mean?

Universal binary segmentation fault

When fed with a universal binary like this:

% file Shadowrocket
Shadowrocket: Mach-O universal binary with 2 architectures: [arm_v7:
- Mach-O executable arm_v7] [arm64]
Shadowrocket (for architecture armv7):	Mach-O executable arm_v7
Shadowrocket (for architecture arm64):	Mach-O 64-bit executable arm64

The release version will get a segmentation fault:

zsh: segmentation fault  ./appdecrypt "/.../Shadowrocket.app" 

The debug version trips over an assertion:

appdecrypt/dump.swift:112: Assertion failed
zsh: trace trap  .build/debug/appdecrypt "/.../Shadowrocket.app"

where the code at line 112 is:

    assert(header.pointee.magic == MH_MAGIC_64)

This is likely to be the reason of #18, too.

I don't know the exact mechanism of encryption with a universal binary. I guess there should be some implementation to automatically extract the matching architecture only, or just throws an error message warning user about the existence of universal binaries.

apps are still encrypted!

I was able to successfully use appdecrypt on my m1 mac but the output binaries are still encrypted anyway!
I used otool to check and cryptid is still 1.

decrypt fail

Dump /var/containers/Bundle/Application/AA24AA4E-DF06-4D35-B314-0B120A7DE876/XXX.app/XXX fail, because of mmap fail with Invalid argument
other framework Success.
Why? How to do?

can't connecting to Iphone

When I run ./build-macOS_arm.sh I get an error

When I run ./build-macOS_arm.sh I get the following error:

error: terminated(1): /usr/bin/xcrun --sdk macosx --show-sdk-platform-path output:
xcrun: error: unable to lookup item 'PlatformPath' from command line tools installation
xcrun: error: unable to lookup item 'PlatformPath' in SDK '/Library/Developer/CommandLineTools/SDKs/MacOSX.sdk'

Failed to copy file - iOS

Running on iOS (Procursus bootstrap) results in this error occurring:

xcrun: error: unable to find utility "xctest"

error: terminated(72): /usr/bin/xcrun --sdk macosx --find xctest output:
xcrun: error: unable to find utility "xctest", not a developer tool or in PATH

Macos version: 11.5.1
device: macbook pro with apple silicon(M1)
how to fix it? thx!

zsh: segmentation fault ./appdecrypt /Users/madstsk/.myWirdFiles/sideload/HCR2/Payload/hcrwc-iOS.app

This is how I have done it.

1. Got an IPA from my iPhone using iMazing
2. Renamed it to a .zip
3. Decompressed the zip file.
4. Ran the command: appdecrypt % ./appdecrypt /Users/madstsk/.myWirdFiles/sideload/HCR2/Payload/hcrwc-iOS.app /Users/madstsk/.myWirdFiles/sideload/HCR2-decrypted.app
5. Got this output: zsh: segmentation fault ./appdecrypt /Users/madstsk/.myWirdFiles/sideload/HCR2/Payload/hcrwc-iOS.app
   I have tried to chmod -R 777 the parentfolder.

Error while building

error: 'appdecrypt': Invalid manifest
/Users/user/appdecrypt/Package.swift:3:8: error: no such module 'PackageDescription'
import PackageDescription
       ^

iPhone:~ root# appdecrypt /var/containers/Bundle/Application/6EAF497A-E921-4BB7-9006-F7FB6D813003/ ./ Success to copy file. Dump /var/containers/Bundle/Application/6EAF497A-E921-4BB7-9006-F7FB6D813003/QQNews.app/QQNews fail, because of encrypted fail with Operation not permitted

iPhone:~ root# appdecrypt /var/containers/Bundle/Application/6EAF497A-E921-4BB7-9006-F7FB6D813003/ ./
Success to copy file.
Dump /var/containers/Bundle/Application/6EAF497A-E921-4BB7-9006-F7FB6D813003/QQNews.app/QQNews fail, because of encrypted fail with Operation not permitted

Error with UnsafeMutableRawPointer when compiling on arm Mac

I just bought an M1 Mac air just to decrypt IPA apps. I installed Xcode on it (version 13.0, the latest available for macOS 11.3). When trying to run the build-macOS_arm.sh script, I get the following error:

/Users/n/appdecrypt/Sources/appdecrypt/dump.swift:191:18: error: value of optional type 'UnsafeMutableRawPointer?' must be unwrapped to a value of type 'UnsafeMutableRawPointer'
            free(base)
                 ^
/Users/n/appdecrypt/Sources/appdecrypt/dump.swift:191:18: note: coalesce using '??' to provide a default when the optional value contains 'nil'
            free(base)
                 ^
                      ?? <#default value#>
/Users/n/appdecrypt/Sources/appdecrypt/dump.swift:191:18: note: force-unwrap using '!' to abort execution if the optional value contains 'nil'
            free(base)
                 ^
                     !

How can I fix this ? Thanks !

`Killed: 9` on jailbroken iOS

I used precompiled binary from https://github.com/paradiseduo/appdecrypt/releases/download/2.1/appdecrypt_arm64_iOS.zip

在Mac上破壳IPA运行时间过长，且无报错

如题，时间过长指30分钟。
Mac信息：
MacBook Air (M1, 2020)，macOS Big Sur 11.5.2;
IPA信息：
明日方舟，版本1.5.60，来源：借由 Apple Configurator 2 下载的适用于 iPhone 的 IPA 文件，MacO文件大小：159.6MB；
Appdecrypt 安装方式：
通过 Release 界面下载，解压后置于/usr/local/bin
终端界面如下：
Last login: Sat Aug 28 21:15:40 on ttys000
yy@YYdeMacBook-Air ~ % appdecrypt /Users/yy/Desktop/Arknights/Payload/arknights.app /Users/yy/Downloads

This also works perfectly on iOS

Sorry for creating an issue, I just wanted to let you know that this actually works fully on iOS. Unlike flexdecrypt, it doesn't require spawning the executable, and after a couple of tests to confirm this works, I've been able to decrypt + install the final ipa's with no issues.

I created a repo with my build configuration and a pre-compiled binary under releases if you wan't to try this out and maybe integrate iOS support into the main repo. https://github.com/dlevi309/appdecrypt-ios

Always freezes

Hello. Every time I try to use the process freezes at the beginning. M1 Max.

Decrypt IPA occur error

I tried to decrypt IPA "JW library" but it occurred error. Here is what I done:
1.rename .ipa to zip and unzip it
2.mkdir on Desktop and name it "payload"
3.decrypt app where in unzipped floder

here is error message I received:

Execute and release in the download directory

~bug

./appdecrypt /Applications/test.app /Users/us/Downloads/

After this operation, an exception was found, and ctrl+c was used to abort. However, it was still found that more than half of the download directory files were lost.

mmap failed！

iphone567:/tmp root# ./appdecrypt /private/var/containers/Bundle/Application/90F191CD-4192-45A0-9B53-BF1E15098F3E/ /tmp
Success to copy file.
Dump /private/var/containers/Bundle/Application/90F191CD-4192-45A0-9B53-BF1E15098F3E/neighborhood.app/neighborhood fail, because of mmap fail with Invalid argument
Dump /private/var/containers/Bundle/Application/90F191CD-4192-45A0-9B53-BF1E15098F3E/neighborhood.app/PlugIns/NotificationService.appex/NotificationService fail, because of mmap fail with Invalid argument

too many app decrypt failed!

release的2.1 iOS版本无法运行，Killed: 9

2.0版本是可用的，main分支自己编译的版本也是可用的，2.1版本无法运行😅

Cannot Allocate Memory

hey get this error msg..

success copy file.
cannot allocate memory