In order to remove the encryption from an iOS binary on the App Store, it first has to be executed on a ARM capable device. Is there a way to do this without access to a device?
-
Yes, that's correct– NederealmCommented Mar 23, 2015 at 14:29
Add a comment
|
2 Answers
In order to remove the iOS app encryption (called FairPlay), you'd need to do one of the following:
- Run the app on a physical ARM device and dynamically decrypt it.
- Run the app on a virtual ARM device and dynamically decrypt it.
- Statically decrypt the app.
Number 1 is the most common approach used, but it's out of the question since you're asking how to decrypt the app without access to a physical device.
Number 2 seems to currently be out of the question since the only emulator I was able to find that supposedly "supported" iOS is iEmu, which is now defunct.
Number 3 is theoretically possible, but based on my Googling, nobody has yet written a static decrypter for FairPlay.
N.B. iOS-based reverse engineering is definitely not my area of expertise, so perhaps someone can provide a better answer and/or correct any incorrect assumptions I've made above.
answered Mar 25, 2015 at 20:47
-
IDAPRO has an ARM emulator called QEMU. Will it sucessfully load the app to the point it can be decrypted? Note: I haven't yet purchase the latest IDAPro, so no chance to try it out Commented Mar 26, 2015 at 5:34
-
2To answer this you need to have detailed knowledge of fairplay on apps. I think the research available publicly all let the iOS loader decrypt the encrypted sections and dump them from memory once decrypted. This accomplishes what 99.9% of researchers need. Few people have exploring the DRM itself as a goal. Perhaps they rely on the UID key? A quick check would be to diff the same apps encrypted sections on two different devices of the same model. It would mean Apple would need to dynamically sign apps per device though and store UID keys, which they've said they don't do. Maybe GID? Hmm... Commented Mar 26, 2015 at 8:31
-
I have just done a similar check - took an IPA extracted from the different iOS device. It installed to my device without a problem, but when I tried to run it I was asked to enter iTunes password (did not do that), and there was interesting line in syslog:
kernel[0] <Notice>: AppleFairplayTextCrypterSession::fairplayOpen() failed, error -42004com.apple.xpc.launchd[1] (UIKitApplication:THE_APP_PACKAGE_NAME[0xdc32][203]) <Warning>: FairPlay decryption failed on binary.So I think we can confirm that applications are re-encrypted for each user.– MarSoftCommented Dec 6, 2018 at 14:16 -
Looks like app encryption is linked to iTunes account, not to specific device. Details here: roughlydrafted.com/RD/RDM.Tech.Q1.07/… (they seemingly use the same FairPlay encryption for songs and for apps)– MarSoftCommented Dec 6, 2018 at 14:19
My answer What you can actually do is to look for "cracked IPA apps", which basically mean they are decrypted (FairPlay encryption removed). There are many sites like this one (AppAddict).
Note
I had to do that since I upgraded my jailbroken device to iOS 8.4 (Pangu jailbreak). The iOS8.4 jailbreak disabled debugger tools like Clutch, which I used to decrypt binaries. Maybe the iOS 9.0 jailbreak allows them to work again.
I couldn't even get to decrypt some older versions of Facebook or Tinder. That's when you really rely on the community to have uploaded their cracked binaries.
Please note that I am not supporting piracy. Linking cracked IPA resources is meant for reverse engineering and research purpose. In this point of view I find it helpful to provide decrypted ("cracked") binaries of free apps to the community (via AppAddict for instance).
