AloneMonkey/frida-ios-dump

What it does

frida-ios-dump attaches Frida to an app running on a jailbroken iOS device, dumps the decrypted Mach-O binaries and frameworks from memory, collects app resources over SSH/SFTP, and repackages everything into an IPA that preserves directory structure, permissions and symlinks. It is aimed at reverse engineers, security researchers and iOS developers who need a readable copy of an app's binaries.

The current code targets Frida 17.x (documented with 17.23.3) and Python 3.10+. Because Frida 17 no longer ships the Objective-C bridge for Python-loaded scripts, dump.py bundles frida-objc-bridge with frida.Compiler before injection; no separate agent build step is needed (README usage).

Quick start

Prerequisites: a jailbroken, unlocked device with Frida installed, an SSH service reachable from the host, and matching Frida versions on device and host. Python 3.10+ and Node.js/npm are needed on the host.

python3 -m venv .venv
source .venv/bin/activate
python -m pip install --upgrade -r requirements.txt
npm install

Windows PowerShell equivalent:

python -m venv .venv
.\.venv\Scripts\python.exe -m pip install -r requirements.txt
npm install

Then connect the device over USB and list installed apps:

python dump.py -l

Export by display name or bundle identifier:

python dump.py 'Display name'
python dump.py Bundle.identifier

By default the script reaches device SSH over Frida's USB channel, so no iproxy or local port forwarding is required; -p selects a non-default device SSH port. Default credentials are root/alpine; use -u/-P for a different account or -K for a private key. SSH aliases from ~/.ssh/config are accepted via -H (SSH setup).

For network-only setups, --remote HOST[:PORT] selects the Frida endpoint (default port 27042) and --device-id picks one of several USB devices (device selection). An existing local TCP forwarding can be used with --ssh-transport tcp. Verbose output and separate agent/transfer timeouts are available for diagnosis (diagnostics).

On success the tool prints per-module dump lines and writes an IPA (for example Aftenposten.ipa) to the temp directory shown at the start of the run (sample output).

Constraints

• Requires a jailbroken device with Frida and SSH running; keep the device unlocked during startup and dumping.
• Host and device Frida versions must match; the documented target is 17.23.3 / 17.x. Python 2 is not supported (support notes).
• --remote and --device-id are mutually exclusive, and remote mode cannot be combined with --ssh-transport usb.
• Authenticating over SSH/SCP requires the host public key in the device's ~/.ssh/authorized_keys, or a usable password/key configuration.
• The full Windows workflow has not yet been tested on a Windows host, though IPA packaging avoids external zip/chmod/tar commands there.
• Exporting an app is a legal/ethical concern; the tool itself is MIT-licensed but does not grant rights to redistribute extracted binaries.

HotRepo's take

No HotRepo ranking, star-history or discussion records are available for this repository, so there is no in-site trend to report. The project's value is technical: it maintains a working Frida 17-compatible dump pipeline with bundled Objective-C bridge, parallel binary and resource downloads, direct USB SSH, and documented regression tests on both host and agent sides (tests). Those are concrete reasons to pick it over older dumpdecrypted-era scripts, provided the jailbreak and matching Frida versions are in place.