Return to Answer

If the IPA file is straight from iTunes/iPhone (without any modification), the code section in the binary (as indicated by the Info.plist) is encrypted with FairPlay (Apple's proprietary DRM). If you are unsure, you can check whether the cryptid bit is set with otool (see this page).

otool -arch armv7 -l thebinary | grep crypt

(where thebinary is the executable binary - see the app's Info.plist, CFBundleExecutable key)

Pre Decryption:

if cryptid is 0, you can proceed on to the Post Decryption section. Otherwise, you will need to decrypt the app. The typical method in brief (with a jailbroken iOS device) is to

1. Install otool, gdb and ldid from Cydia
2. Install the IPA on an authorized device
3. Run otool on the binary to get information such as the size of the encrypted payload
4. Launch the app and suspend it immediately
5. Use gdb to dump the payload (beginning from 0x2000) gdb -p <process id> then dump output.bin 0x2000 0xNNNN where NNNN is the sum of the beginning (0x2000) and the payload size
6. Create a new file, using the first 0x1000 bytes of the original binary, and appended with the dump file
7. Use ldid to sign the new binary, and change the cryptid to 0 (so that iOS won't decrypt the decrypted app again)

There are many tools of dubious purposes (piracy) which automates the process, however the above is the gist of how the process is done.

Post Decryption:

You can begin reverse engineering the code when you have access to an unencrypted copy of the binary.

One possible tool is IDA Pro (Free version does not support ARM). It may still be quite messy since much of iOS's code works with objc_sendMsg(). This IDA plugin may help: https://github.com/zynamics/objc-helper-plugin-ida

When you are patching functions, an easier way to work (if you know Objective-C) is to use MobileSubstrate to hook the relevant functions. See Dustin Howett's theos if you would like to try this method.

Useful Links:

More about the decryption process: http://iphonedevwiki.net/index.php/Crack_prevention

Getting otool: https://apple.stackexchange.com/questions/21256/i-cant-find-otool-on-my-jailbroken-ipod

Signing with ldid (since the original signature is made invalid after editing) http://www.saurik.com/id/8

For newer devices

Some of the tools (gdb in my base) are not working reliably on the iPhone 5S / iOS7. Currently a method that works is to use a popular open-source cracking software "Clutch". The actual cracking process can be found here: https://github.com/KJCracks/Clutch/blob/master/Classes/Binary.m

iOS 11

Bishop Fox's bfdecrypt, used together with their bfinject should work for iOS 11.

If the IPA file is straight from iTunes/iPhone (without any modification), the code section in the binary (as indicated by the Info.plist) is encrypted with FairPlay (Apple's proprietary DRM). If you are unsure, you can check whether the cryptid bit is set with otool (see this page).

otool -arch armv7 -l thebinary | grep crypt

(where thebinary is the executable binary - see the app's Info.plist, CFBundleExecutable key)

Pre Decryption:

if cryptid is 0, you can proceed on to the Post Decryption section. Otherwise, you will need to decrypt the app. The typical method in brief (with a jailbroken iOS device) is to

1. Install otool, gdb and ldid from Cydia
2. Install the IPA on an authorized device
3. Run otool on the binary to get information such as the size of the encrypted payload
4. Launch the app and suspend it immediately
5. Use gdb to dump the payload (beginning from 0x2000) gdb -p <process id> then dump output.bin 0x2000 0xNNNN where NNNN is the sum of the beginning (0x2000) and the payload size
6. Create a new file, using the first 0x1000 bytes of the original binary, and appended with the dump file
7. Use ldid to sign the new binary, and change the cryptid to 0 (so that iOS won't decrypt the decrypted app again)

There are many tools of dubious purposes (piracy) which automates the process, however the above is the gist of how the process is done.

Post Decryption:

You can begin reverse engineering the code when you have access to an unencrypted copy of the binary.

One possible tool is IDA Pro (Free version does not support ARM). It may still be quite messy since much of iOS's code works with objc_sendMsg(). This IDA plugin may help: https://github.com/zynamics/objc-helper-plugin-ida

When you are patching functions, an easier way to work (if you know Objective-C) is to use MobileSubstrate to hook the relevant functions. See Dustin Howett's theos if you would like to try this method.

Useful Links:

More about the decryption process: http://iphonedevwiki.net/index.php/Crack_prevention

Getting otool: https://apple.stackexchange.com/questions/21256/i-cant-find-otool-on-my-jailbroken-ipod

Signing with ldid (since the original signature is made invalid after editing) http://www.saurik.com/id/8

For newer devices

Some of the tools (gdb in my base) are not working reliably on the iPhone 5S / iOS7. Currently a method that works is to use a popular open-source cracking software "Clutch". The actual cracking process can be found here: https://github.com/KJCracks/Clutch/blob/master/Clutch/Binary.m

iOS 11

Bishop Fox's bfdecrypt, used together with their bfinject should work for iOS 11.

If the IPA file is straight from iTunes/iPhone (without any modification), the code section in the binary (as indicated by the Info.plist) is encrypted with FairPlay (Apple's proprietary DRM). If you are unsure, you can check whether the cryptid bit is set with otool (see this page).

otool -arch armv7 -l thebinary | grep crypt

(where thebinary is the executable binary - see the app's Info.plist, CFBundleExecutable key)

Pre Decryption:

if cryptid is 0, you can proceed on to the Post Decryption section. Otherwise, you will need to decrypt the app. The typical method in brief (with a jailbroken iOS device) is to

1. Install otool, gdb and ldid from Cydia
2. Install the IPA on an authorized device
3. Run otool on the binary to get information such as the size of the encrypted payload
4. Launch the app and suspend it immediately
5. Use gdb to dump the payload (beginning from 0x2000) gdb -p <process id> then dump output.bin 0x2000 0xNNNN where NNNN is the sum of the beginning (0x2000) and the payload size
6. Create a new file, using the first 0x1000 bytes of the original binary, and appended with the dump file
7. Use ldid to sign the new binary, and change the cryptid to 0 (so that iOS won't decrypt the decrypted app again)

There are many tools of dubious purposes (piracy) which automates the process, however the above is the gist of how the process is done.

Post Decryption:

You can begin reverse engineering the code when you have access to an unencrypted copy of the binary.

One possible tool is IDA Pro (Free version does not support ARM). It may still be quite messy since much of iOS's code works with objc_sendMsg(). This IDA plugin may help: https://github.com/zynamics/objc-helper-plugin-ida

When you are patching functions, an easier way to work (if you know Objective-C) is to use MobileSubstrate to hook the relevant functions. See Dustin Howett's theos if you would like to try this method.

Useful Links:

More about the decryption process: http://iphonedevwiki.net/index.php/Crack_prevention

Getting otool: https://apple.stackexchange.com/questions/21256/i-cant-find-otool-on-my-jailbroken-ipod

Signing with ldid (since the original signature is made invalid after editing) http://www.saurik.com/id/8

For newer devices

Some of the tools (gdb in my base) are not working reliably on the iPhone 5S / iOS7. Currently a method that works is to use a popular open-source cracking software "Clutch". The actual cracking process can be found here: https://github.com/KJCracks/Clutch/blob/master/Classes/Binary.m

If the IPA file is straight from iTunes/iPhone (without any modification), the code section in the binary (as indicated by the Info.plist) is encrypted with FairPlay (Apple's proprietary DRM). If you are unsure, you can check whether the cryptid bit is set with otool (see this page).

otool -arch armv7 -l thebinary | grep crypt

(where thebinary is the executable binary - see the app's Info.plist, CFBundleExecutable key)

Pre Decryption:

if cryptid is 0, you can proceed on to the Post Decryption section. Otherwise, you will need to decrypt the app. The typical method in brief (with a jailbroken iOS device) is to

1. Install otool, gdb and ldid from Cydia
2. Install the IPA on an authorized device
3. Run otool on the binary to get information such as the size of the encrypted payload
4. Launch the app and suspend it immediately
5. Use gdb to dump the payload (beginning from 0x2000) gdb -p <process id> then dump output.bin 0x2000 0xNNNN where NNNN is the sum of the beginning (0x2000) and the payload size
6. Create a new file, using the first 0x1000 bytes of the original binary, and appended with the dump file
7. Use ldid to sign the new binary, and change the cryptid to 0 (so that iOS won't decrypt the decrypted app again)

There are many tools of dubious purposes (piracy) which automates the process, however the above is the gist of how the process is done.

Post Decryption:

You can begin reverse engineering the code when you have access to an unencrypted copy of the binary.

One possible tool is IDA Pro (Free version does not support ARM). It may still be quite messy since much of iOS's code works with objc_sendMsg(). This IDA plugin may help: https://github.com/zynamics/objc-helper-plugin-ida

When you are patching functions, an easier way to work (if you know Objective-C) is to use MobileSubstrate to hook the relevant functions. See Dustin Howett's theos if you would like to try this method.

Useful Links:

More about the decryption process: http://iphonedevwiki.net/index.php/Crack_prevention

Getting otool: https://apple.stackexchange.com/questions/21256/i-cant-find-otool-on-my-jailbroken-ipod

Signing with ldid (since the original signature is made invalid after editing) http://www.saurik.com/id/8

For newer devices

Some of the tools (gdb in my base) are not working reliably on the iPhone 5S / iOS7. Currently a method that works is to use a popular open-source cracking software "Clutch". The actual cracking process can be found here: https://github.com/KJCracks/Clutch/blob/master/Classes/Binary.m

iOS 11

Bishop Fox's bfdecrypt, used together with their bfinject should work for iOS 11.

If the IPA file is straight from iTunes/iPhone (without any modification), the code section in the binary (as indicated by the Info.plist) is encrypted with FairPlay (Apple's proprietary DRM). If you are unsure, you can check whether the cryptid bit is set with otool (see this page).

otool -arch armv7 -l thebinary | grep crypt

(where thebinary is the executable binary - see the app's Info.plist, CFBundleExecutable key)

Pre Decryption:

if cryptid is 0, you can proceed on to the Post Decryption section. Otherwise, you will need to decrypt the app. The typical method in brief (with a jailbroken iOS device) is to

1. Install otool, gdb and ldid from Cydia
2. Install the IPA on an authorized device
3. Run otool on the binary to get information such as the size of the encrypted payload
4. Launch the app and suspend it immediately
5. Use gdb to dump the payload (beginning from 0x2000) gdb -p <process id> then dump output.bin 0x2000 0xNNNN where NNNN is the sum of the beginning (0x2000) and the payload size
6. Create a new file, using the first 0x1000 bytes of the original binary, and appended with the dump file
7. Use ldid to sign the new binary, and change the cryptid to 0 (so that iOS won't decrypt the decrypted app again)

There are many tools of dubious purposes (piracy) which automates the process, however the above is the gist of how the process is done.

Post Decryption:

You can begin reverse engineering the code when you have access to an unencrypted copy of the binary.

One possible tool is IDA Pro (Free version does not support ARM). It may still be quite messy since much of iOS's code works with objc_sendMsg(). This IDA plugin may help: https://github.com/zynamics/objc-helper-plugin-ida

When you are patching functions, an easier way to work (if you know Objective-C) is to use MobileSubstrate to hook the relevant functions. See Dustin Howett's theos if you would like to try this method.

Useful Links:

More about the decryption process: http://iphonedevwiki.net/index.php/Crack_prevention

Getting otool: https://apple.stackexchange.com/questions/21256/i-cant-find-otool-on-my-jailbroken-ipod

Signing with ldid (since the original signature is made invalid after editing) http://www.saurik.com/id/8

For newer devices

Some of the tools (gdb in my base) are not working reliably on the iPhone 5S / iOS7. Currently a method that works is to use a popular open-source cracking software "Clutch". The actual cracking process can be found here: https://github.com/KJCracks/Clutch/blob/master/Classes/Binary.m

If the IPA file is straight from iTunes/iPhone (without any modification), the code section in the binary (as indicated by the Info.plist) is encrypted with FairPlay (Apple's proprietary DRM). If you are unsure, you can check whether the cryptid bit is set with otool (see this page).

otool -arch armv7 -l thebinary | grep crypt

(where thebinary is the executable binary - see the app's Info.plist, CFBundleExecutable key)

Pre Decryption:

if cryptid is 0, you can proceed on to the Post Decryption section. Otherwise, you will need to decrypt the app. The typical method in brief (with a jailbroken iOS device) is to

1. Install otool, gdb and ldid from Cydia
2. Install the IPA on an authorized device
3. Run otool on the binary to get information such as the size of the encrypted payload
4. Launch the app and suspend it immediately
5. Use gdb to dump the payload (beginning from 0x2000) gdb -p <process id> then dump output.bin 0x2000 0xNNNN where NNNN is the sum of the beginning (0x2000) and the payload size
6. Create a new file, using the first 0x1000 bytes of the original binary, and appended with the dump file
7. Use ldid to sign the new binary, and change the cryptid to 0 (so that iOS won't decrypt the decrypted app again)

There are many tools of dubious purposes (piracy) which automates the process, however the above is the gist of how the process is done.

Post Decryption:

You can begin reverse engineering the code when you have access to an unencrypted copy of the binary.

One possible tool is IDA Pro (Free version does not support ARM). It may still be quite messy since much of iOS's code works with objc_sendMsg(). This IDA plugin may help: https://github.com/zynamics/objc-helper-plugin-ida

When you are patching functions, an easier way to work (if you know Objective-C) is to use MobileSubstrate to hook the relevant functions. See Dustin Howett's theos if you would like to try this method.

Useful Links:

More about the decryption process: http://iphonedevwiki.net/index.php/Crack_prevention

Getting otool: https://apple.stackexchange.com/questions/21256/i-cant-find-otool-on-my-jailbroken-ipod

Signing with ldid (since the original signature is made invalid after editing) http://www.saurik.com/id/8

For newer devices

Some of the tools (gdb in my base) are not working reliably on the iPhone 5S / iOS7. Currently a method that works is to use a popular open-source cracking software "Clutch". The actual cracking process can be found here: https://github.com/KJCracks/Clutch/blob/master/Classes/Binary.m