Difference between revisions of "IOS app decrypt"
| Line 1: | Line 1: | ||
| + | ==ios7 2014== | ||
This wiki shows an easy method to decrypt ios apps and dump classes.<br> | This wiki shows an easy method to decrypt ios apps and dump classes.<br> | ||
1. Using MAC OS X<br> | 1. Using MAC OS X<br> | ||
| Line 20: | Line 21: | ||
</pre> | </pre> | ||
class-dump-z download link https://code.google.com/p/networkpx/wiki/class_dump_z | class-dump-z download link https://code.google.com/p/networkpx/wiki/class_dump_z | ||
| + | |||
| + | ==iOS8 2015== | ||
| + | |||
| + | iOS8 have some updates. | ||
| + | |||
| + | use Clutch to decrypt https://github.com/KJCracks/Clutch | ||
| + | |||
| + | class-dump use this link http://stevenygard.com/projects/class-dump/ | ||
| + | |||
| + | You need to copy the dump decrypted files to you mac. | ||
| + | |||
| + | The user applications are no longer located at the location /var/mobile/Applications. The application bundle is stored in the location /var/mobile/Containers/Bundle/Application (Appname.app) whereas the application data (Documents, Library, tmp folder) is stored in the location /var/mobile/Containers/Data/Application. The name of the folder (a unique ID) will also be different for the same application. So while checking an application, it is recommended to look at both the locations. | ||
| + | |||
| + | Refer to http://resources.infosecinstitute.com/ios-application-security-part-37-adapting-ios-8/ | ||
Latest revision as of 21:46, 18 August 2015
ios7 2014
This wiki shows an easy method to decrypt ios apps and dump classes.
1. Using MAC OS X
2. Using dumpdecrypted. github link https://github.com/stefanesser/dumpdecrypted
git clone git@github.com:stefanesser/dumpdecrypted.git #My phone is iOS 7, so I do not need to change the make file make
3. Upload dumpdecrypted.dylib to iphone, then ssh to iphone
iPhone:~ root# DYLD_INSERT_LIBRARIES=dumpdecrypted.dylib /var/mobile/Containers/Bundle/Application/xx-xxxx-xx/Scan.app/Scan mach-o decryption dumper
Then Scan.decrypted will be saved to current directory Run this to verify if it's decrypted.
iPhone:~ root# class-dump-z Scan.decrypted
class-dump-z download link https://code.google.com/p/networkpx/wiki/class_dump_z
iOS8 2015
iOS8 have some updates.
use Clutch to decrypt https://github.com/KJCracks/Clutch
class-dump use this link http://stevenygard.com/projects/class-dump/
You need to copy the dump decrypted files to you mac.
The user applications are no longer located at the location /var/mobile/Applications. The application bundle is stored in the location /var/mobile/Containers/Bundle/Application (Appname.app) whereas the application data (Documents, Library, tmp folder) is stored in the location /var/mobile/Containers/Data/Application. The name of the folder (a unique ID) will also be different for the same application. So while checking an application, it is recommended to look at both the locations.
Refer to http://resources.infosecinstitute.com/ios-application-security-part-37-adapting-ios-8/
