Rev Ios Dump

rev-ios-dump - iOS App Decryption (砸壳)

Dump decrypted iOS application binaries from jailbroken devices for security analysis and reverse engineering.

---

Overview

iOS apps distributed via the App Store are encrypted with Apple's FairPlay DRM. To perform static analysis (IDA/Ghidra/Hopper), the binary must first be decrypted at runtime — commonly called "砸壳" (dumping the shell). This skill uses Frida to instrument the running process and dump the decrypted Mach-O from memory.

---

Prerequisites

Verify frida-server is Running

# Check frida-server on device via SSH
ssh mobile@<device_ip> "ps aux | grep frida-server"

# If not running, start it
ssh mobile@<device_ip> "/usr/sbin/frida-server -D &"

# Verify from host
frida-ls-devices
frida-ps -H <device_ip>

---

Tool: frida-ios-dump

Repo: https://github.com/P4nda0s/frida-ios-dump

Installation

git clone https://github.com/P4nda0s/frida-ios-dump.git
cd frida-ios-dump
pip3 install -r requirements.txt

# Build the TypeScript agent (required before first run)
npm install --ignore-scripts
npx frida-compile dump.ts -o dist/dump.js

Note: This version uses a TypeScript-based Frida agent. The dist/dump.js must be compiled before dump.py can run.

---

Step-by-Step Workflow

Step 1: Identify Target App Bundle ID

Use one of these methods on the device:

# Method 1: List running apps via Frida
frida-ps -H <device_ip> -a

# Method 2: SSH into device and check
ssh mobile@<device_ip> "find /var/containers/Bundle/Application -name Info.plist -exec plutil -p {} \; 2>/dev/null | grep CFBundleIdentifier"

Or use CocoaTop on the device to identify the running process and its Bundle ID.

Step 2: Ensure Target App is Running

The target app must be running on the device. frida-ios-dump attaches to the live process to dump decrypted memory.

Step 3: Execute Dump

cd frida-ios-dump

python3 dump.py -H <device_ip> -u mobile -P <password> <bundle_id>

Parameters:

Example:

python3 dump.py -H 192.168.1.100 -u mobile -P alpine app.ish.iSH

Step 4: Verify Output

A successful dump produces a .ipa file in the current directory:

ls -la *.ipa

# Unzip to inspect
unzip -o <app_name>.ipa -d dumped_app/

# Verify decryption — cryptid should be 0
otool -l dumped_app/Payload/<AppName>.app/<BinaryName> | grep -A4 LC_ENCRYPTION_INFO

If cryptid 0 is shown, the binary is successfully decrypted.

---

Troubleshooting

Version Mismatch Fix

frida-server and host frida must be the same major version:

# Check host version
frida --version

# Download matching frida-server from:
# https://github.com/frida/frida/releases
# Choose: frida-server-<version>-ios-arm64.xz

---

Output Usage

After obtaining the decrypted IPA:

1. Static analysis — Load the decrypted Mach-O into IDA/Ghidra/Hopper 2. Class dump — Extract ObjC headers: class-dump <binary> > headers.h 3. String analysis — Search for sensitive strings, URLs, keys 4. Frida hooking — Use with rev-frida skill for dynamic analysis 5. Symbol recovery — Use with rev-symbol skill for stripped binary analysis

---

Notes

• The device must remain unlocked and the app must stay in the foreground during the dump process.
• For apps with multiple frameworks, frida-ios-dump will dump all encrypted frameworks within the app bundle.
• Some apps with advanced jailbreak detection may terminate before the dump completes — consider bypassing jailbreak detection first.