IOS app decrypt

From Hawk Wiki
Jump to: navigation, search

ios7 2014

This wiki shows an easy method to decrypt ios apps and dump classes.
1. Using MAC OS X
2. Using dumpdecrypted. github link

git clone

#My phone is iOS 7, so I do not need to change the make file

3. Upload dumpdecrypted.dylib to iphone, then ssh to iphone

iPhone:~ root# DYLD_INSERT_LIBRARIES=dumpdecrypted.dylib /var/mobile/Containers/Bundle/Application/xx-xxxx-xx/ mach-o decryption dumper

Then Scan.decrypted will be saved to current directory Run this to verify if it's decrypted.

iPhone:~ root# class-dump-z Scan.decrypted

class-dump-z download link

iOS8 2015

iOS8 have some updates.

use Clutch to decrypt

class-dump use this link

You need to copy the dump decrypted files to you mac.

The user applications are no longer located at the location /var/mobile/Applications. The application bundle is stored in the location /var/mobile/Containers/Bundle/Application ( whereas the application data (Documents, Library, tmp folder) is stored in the location /var/mobile/Containers/Data/Application. The name of the folder (a unique ID) will also be different for the same application. So while checking an application, it is recommended to look at both the locations.

Refer to