While disassembling an IPA downloaded directly from the App Store CDN, I noticed that the binary had an unusually large entropy. Looking this occurrence up confirmed my suspicion that it was encrypted, and that they were decrypted at launch time— which suggests that the decryption key is somewhere on the device. Why wouldn’t it be possible to obtain this key using a jailbroken device? Am I overlooking something critical? Thanks!

  • You can dump the decrypted program from the phone memory if your device is jailbroken. The key might be stored on some secure module and thus is unreachable directly from software.
    – morsisko
    Nov 26, 2020 at 17:45
  • @morsisko Software on the operating system (say some daemon, for example) must receive a signal when the user opens an application. This software would then, presumably, decrypt the binaries of the requested app package. I suppose the question would be whether the decryption key is obtained from this external module or whether decryption itself occurs on said external module. Nov 29, 2020 at 19:42
  • The key is not exposed to software. If that would be the case the key would be released to the public long time ago.
    – morsisko
    Nov 30, 2020 at 12:17


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.