forked fromparadiseduo/appdecrypt
- Notifications
You must be signed in to change notification settings - Fork0
appdecrypt is a tool to make decrypt application encrypted binaries on macOS when SIP-enabled
License
NotificationsYou must be signed in to change notification settings
LK26/appdecrypt
Folders and files
| Name | Name | Last commit message | Last commit date | |
|---|---|---|---|---|
Repository files navigation
Decrypt application encrypted binaries on macOS when SIP-enabled (macOS 11.3 or below).
This works well and compiles for iOS nicely, if you want use it at iOS devices, you can use build-ios.sh (Thanks @dlevi309).
> git clone https://github.com/paradiseduo/appdecrypt.git>cd appdecrypt> chmod +x build-macOS_arm.sh> ./build-macOS_arm.sh> ./appdecryptVersion 2.1appdecrypt is a tool to make decrypt application encrypted binaries on macOS when SIP-enabled.Examples: mac: appdecrypt /Applicaiton/Test.app /Users/admin/Desktop/Test.app iPhone: appdecrypt /var/containers/Bundle/Application/XXXXXX /tmpUSAGE: appdecrypt encryptMachO_Path decryptMachO_PathARGUMENTS:<encryptApp_Path> The encrypt app file path.<decrypt_Path> The path output file.OPTIONS: -h, --help Showhelp information.
> ./appdecrypt /Applicaiton/Test.app /Users/admin/Desktop/Test.appSuccess to copy file.Dump /Applications/Test.app/Wrapper/Test.app/Test SuccessDump /Applications/Test.app/Wrapper/Test.app/PlugIns/TestNotificationService.appex/TestNotificationService SuccessDump /Applications/Test.app/Wrapper/Test.app/Frameworks/trackerSDK.framework/trackerSDK SuccessDump /Applications/Test.app/Wrapper/Test.app/Frameworks/AgoraRtcKit.framework/AgoraRtcKit Success>cd /Users/admin/Desktop/Test.app> lsWrappedBundle Wrapper>cd Wrapper> lsBundleMetadata.plist Test.app iTunesMetadata.plist
First you should connect jailbreak iPhone with USB.
> brew install ldid> git clone https://github.com/paradiseduo/appdecrypt.git>cd appdecrypt> chmod +x build-iOS.sh> ./build-iOS.sh> scp -P 2222 appdecrypt root@127.0.0.1:/tmp// In iPhone shell>cd /tmp> ./appdecryptVersion 2.1appdecrypt is a tool to make decrypt application encrypted binaries on macOS when SIP-enabled.Examples: mac: appdecrypt /Applicaiton/Test.app /Users/admin/Desktop/Test.app iPhone: appdecrypt /var/containers/Bundle/Application/XXXXXX /tmpUSAGE: appdecrypt encryptMachO_Path decryptMachO_PathARGUMENTS:<encryptApp_Path> The encrypt app file path.<decrypt_Path> The path output file.OPTIONS: -h, --help Showhelp information.
// In iPhone shell> ./appdecrypt /var/containers/Bundle/Application/5B5D4E97-E760-4AC5-BFEE-F0FF72EBB19E /tmpSuccess to copy file.Dump /var/containers/Bundle/Application/5B5D4E97-E760-4AC5-BFEE-F0FF72EBB19E/KingsRaid.app/KingsRaid SuccessDump /var/containers/Bundle/Application/5B5D4E97-E760-4AC5-BFEE-F0FF72EBB19E/KingsRaid.app/Frameworks/FBSDKGamingServicesKit.framework/FBSDKGamingServicesKit SuccessDump /var/containers/Bundle/Application/5B5D4E97-E760-4AC5-BFEE-F0FF72EBB19E/KingsRaid.app/Frameworks/FBLPromises.framework/FBLPromises SuccessDump /var/containers/Bundle/Application/5B5D4E97-E760-4AC5-BFEE-F0FF72EBB19E/KingsRaid.app/Frameworks/FBSDKShareKit.framework/FBSDKShareKit SuccessDump /var/containers/Bundle/Application/5B5D4E97-E760-4AC5-BFEE-F0FF72EBB19E/KingsRaid.app/Frameworks/GoogleUtilities.framework/GoogleUtilities SuccessDump /var/containers/Bundle/Application/5B5D4E97-E760-4AC5-BFEE-F0FF72EBB19E/KingsRaid.app/Frameworks/FBSDKLoginKit.framework/FBSDKLoginKit SuccessDump /var/containers/Bundle/Application/5B5D4E97-E760-4AC5-BFEE-F0FF72EBB19E/KingsRaid.app/Frameworks/nanopb.framework/nanopb SuccessDump /var/containers/Bundle/Application/5B5D4E97-E760-4AC5-BFEE-F0FF72EBB19E/KingsRaid.app/Frameworks/FBSDKCoreKit.framework/FBSDKCoreKit SuccessDump /var/containers/Bundle/Application/5B5D4E97-E760-4AC5-BFEE-F0FF72EBB19E/KingsRaid.app/Frameworks/Protobuf.framework/Protobuf Success>cd Payload> lsBundleMetadata.plist KingsRaid.app/ iTunesMetadata.plist> tar -cvf /tmp/dump.tar ./// In mac shell>cd~/Desktop> scp -P 2222 root@127.0.0.1:/tmp/dump.tar.dump.tar
This was discovered independently when analyzing kernel sources, but it appears that the technique was first introduced on iOS :
https://github.com/JohnCoates/flexdecrypt
but now works on macOS:
https://github.com/meme/apple-tools/tree/master/foulplay
This software is released under the GPL-3.0 license.
About
appdecrypt is a tool to make decrypt application encrypted binaries on macOS when SIP-enabled
Resources
License
Stars
Watchers
Forks
Packages0
No packages published
Languages
- Swift86.1%
- Shell13.9%