While disassembling an IPA downloaded directly from the App Store CDN, I noticed that the binary had an unusually large entropy. Looking this occurrence up confirmed my suspicion that it was encrypted, and that they were decrypted at launch time— which suggests that the decryption key is somewhere on the device. Why wouldn’t it be possible to obtain this key using a jailbroken device? Am I overlooking something critical? Thanks!

  • You can dump the decrypted program from the phone memory if your device is jailbroken. The key might be stored on some secure module and thus is unreachable directly from software.
    – morsisko
    Nov 26 '20 at 17:45
  • @morsisko Software on the operating system (say some daemon, for example) must receive a signal when the user opens an application. This software would then, presumably, decrypt the binaries of the requested app package. I suppose the question would be whether the decryption key is obtained from this external module or whether decryption itself occurs on said external module. Nov 29 '20 at 19:42
  • The key is not exposed to software. If that would be the case the key would be released to the public long time ago.
    – morsisko
    Nov 30 '20 at 12:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.