42

I've been searching this site and more, but I haven't had much luck. I want to decompile an app to see how part of it works, and I've tried multiple programs. I've tried Hopper, IDA, and some other program that ended up not doing anything at all. Hopper and IDA both produce assembly code (I believe that's what it is, I'm not too familiar with reverse engineering and things like that) which gives me function names and produces un-readable code. I have IDA Pro with Hex-Rays included (Hex-Rays is supposedly a decompiler) but the Hex-Rays tab in IDA Pro is producing even more unreadable junk.

IDA Pro:

IDA Pro

I used iFunBox to extract the app file from the IPA from my phone. I might be doing something wrong here, so if anyone has any experience decompiling apps or converting assembly code to human readable code, that'd be really nice and helpful.

Thanks.

Improve this question
7
  • IDA produces ARM disassembly for iPhone apps. These might help you : 1 2 3 4
    – Dominik Antal
    Apr 18, 2014 at 11:03
  • hint: Hex-Rays is not the same as Hex view
    – Igor Skochinsky ♦
    Apr 19, 2014 at 2:45
  • I realized that as soon as I posted this but I for reason forgot to edit it. Either way, the Hex-Rays plugin isn't showing up in the plugin menu.
    – user94584392
    Apr 23, 2014 at 19:28
  • If you are searching for an easy tutorial to decrypt the iOS binary and to resign it again have a look at: reverseengineeringapps.blogspot.de .
    – David L-R
    Dec 13, 2014 at 15:52
  • A little off topic, but I was wondering if someone can point me in the right direction to protect an app and its content from being decompiling? I have some resources that I want to protect if the app is ever decompiled so wondering if this encryption by apple would suffice or should I go and do something?
    – Fidel Morales
    Sep 24, 2018 at 17:30

1 Answer 1

Reset to default
47

iOS applications are protected by a Apple's DRM system. That system encrypts certain segment(s) of the application. The keys to that encryption are, as far as I know, unique per device or per device platform. I haven't spent much to with FairPlay so I don't know what the encryption keys are but I suspect it's either the GID key or the UID key. I would suspect it's the latter.

In order to get the application decrypted you need a jailbroken device in order to run your own unsigned code on it. Be aware that jailbreaking your device may void your Apple warranty. There's generally three common methods of dumping the plaintext of an application, they all rely on the fact that an application must be decrypted by the loader when the application is loaded into memory. Two of them require you to install something like OpenSSH which is available via Cydia. You could go with anything that gives you a shell and is remotely accessible but SSH is nice, standard and also provides a good way of pulling and pushing binaries.

Beware of the fact that the default root password on all devices is "alpine" so make sure to change that. I would advice that, unless you really know what you're doing, keep your research device only on a local network and don't expose it to the Internet.

  • The easiest method is to use an application made for cracking applications, such as Crackulous or Clutch which will dump a decrypted version of the application for you. This method is simple but unreliable and uninteresting as it probably teaches you the least.

  • The second method is to use a debugger and either attach it to the application either after load or before. You then break the debugger and dump the code section of the application to flash. Then you stick this dump back into the encrypted application, overwriting the encrypted part. You might want to also update any encryption flags. This method teaches you more about what's going on.

  • The third method is by far the best right now in my opinion. It consists of a dynamic library written by Stefan Esser called DumpDecrypted. This library is added as a library which is forced into all created processes by the loader. On load the library dumps a decrypted version of the binary to flash for you. This method requires that you have the ability to build libraries for iOS which generally means you need the SDK. It only decrypts the part of FAT binaries that are loaded by the loader so you might get one or more code sections that remain encrypted but they should all perform the same functionality just for different platforms. This method is very reliable as the extra library is harder to spot by the application unless it's specifically looking for it. You can get around that by renaming the library and so on.

Once the application is decrypted on the device you can pull it back via the SSH server by using for example SCP or SFTP. Then you can start decompiling it using something like Hex-Rays ARM decompiler preferably or Hopper.

Here's a short paper on working with iOS applications. I think Pedram Amini's old 2009 article is a good introduction to what's going on.

Improve this answer
3
  • As Apple tends to stomp down hard on jail-broken devices and their owners, I'd rather not advise a self confessed Total Beginner to have a go at it. Next thing you know, this person's iPhone is dead and Apple will refuse to help.
    – Jongware
    Apr 18, 2014 at 19:02
  • That's a good point.
    – Peter Andersson
    Apr 18, 2014 at 19:09
  • My phone is actually jailbroken and has been jailbroken for a few years now (not the same iPhone though, I've upgraded over the years). I know what I'm doing for the most part but I've never explored this area until now so yes, you could call me a beginner when it comes to reverse engineering and things of that nature. @PeterAndersson - thanks for the great answer!
    – user94584392
    Apr 23, 2014 at 19:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.