Dumps decrypted iPhone Applications to a file - better solution than those GDB scripts for non working GDB versions (C) Copyright 2011-2014 Stefan Esser

Compile:

First adjust the Makefile if you have a different iOS SDK installed.

And then just: make

Usage:

Before running the decryption dumper, the dumpdecrypted.dylib should be signed.

$ security find-identity -p codesigning -v
  1) 998971859D4D2E74F "iPhone Developer: ..."
  2) CF57726A2BA2D8B57 "Mac Developer: ..."
       2 valid identities found
$ codesign -f -s 998971859D4D2E74F... dumpdecrypted.dylib
dumpdecrypted.dylib: replacing existing signature

iPod:~ root# DYLD_INSERT_LIBRARIES=dumpdecrypted.dylib /var/mobile/Applications/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/Scan.app/Scan


DISCLAIMER: This tool is only meant for security research purposes, not for application crackers.

[+] Mach-O Decryption Dumper by Stefanesser
[+] Found encrypted data at address 00002000 of length 1826816 bytes - type 1.
[+] Opening /private/var/mobile/Applications/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/Scan.app/Scan for reading.
[+] Reading header
[+] Detecting header type
[+] Executable is a FAT image - searching for right architecture
[+] Correct arch is at offset 2408224 in the file
[+] Opening Scan.decrypted for writing.
[-] Failed opening. Most probably a sandbox issue. Trying something different.
[+] Opening /private/var/mobile/Applications/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/tmp/Scan.decrypted for writing.
[+] Copying the not encrypted start of the file
[+] Dumping the decrypted data into the file
[+] Copying the not encrypted remainder of the file
[+] Closing original file
[+] Closing dump file