DrWhax/unfairplay

A single-purpose Go tool for iOS reverse engineering: it extracts the FairPlay decryption model from a Mac tied to your Apple Account and reuses it to decrypt IPA files. It is only worth your time if you already download apps legally and want to inspect or research them.

The problem

You have an IPA you downloaded from the App Store and you want to look at its contents — strings, assets, Mach-O structure — but the binary is FairPlay-encrypted, so static analysis gives you nothing useful. Normally that means chasing scattered write-ups, private frameworks and one-off scripts on the same Mac, with no clear way to know whether a recovered model actually works before you depend on it. UnfairPlay turns this into a small command sequence: collect gathers the Mac state and one matching installed app plus its IPA, recover extracts and validates the model, and decrypt applies that model to further IPAs from the same enrollment. The output is an unsigned analysis copy rather than a runnable app.

What's different

The design is built around enrollment matching. The IPA, installed app, Mac state, hardware identity and model must all belong to the same Apple Account and enrollment, and the tool rejects account or selector mismatches. That constraint is the practical value: instead of a blind decryption attempt that produces garbage, you get an explicit validation step (verify decrypts without keeping the output) and a doctor subcommand to inspect captures and models. The README also documents exactly which builds were verified (25G83, 26A428/26A434, and 26B118 compatibility mode); unknown arm64e builds are accepted only if recovery and full IPA validation succeed.

The second notable choice is portability. macOS arm64 and Linux amd64/arm64 are supported, so model recovery happens on a Mac but decryption can move to Linux. The cost is upfront setup: you must sign in to the native Mac App Store, install an iOS app, open it once, and download the same app's encrypted IPA — steps the tool deliberately does not automate. It also does not log in to Apple, buy apps or download IPAs; ipatool or a similar downloader is still your responsibility. Windows builds are compile-tested but cannot enforce the private-file permissions the project requires, so it is not a working path there.

Who should try it

Good fit: a security researcher or reverse engineer with a Mac, a legitimate Apple Account and a lawful reason to inspect an app they have downloaded, who wants repeatable decryption for several IPAs from the same enrollment. Also reasonable if you need the recovered model on Linux for a separate analysis pipeline.

Poor fit: anyone without an enrolled Mac or without an owned/downloaded IPA to start from, since the tool intentionally does not source apps for you. It is also a poor choice if you expect to install results directly — decrypted IPAs are analysis files and need signing before installation — or if you are on Windows. The strict same-enrollment rule means mixing captures, accounts or hardware will be rejected rather than loosely tolerated.

Requirements and limitations

Setup is the main friction: you need a native Mac App Store login, an installed and opened iOS app, and a matching encrypted IPA, plus sudo for the collect step. The enrollment must stay consistent; a capture from one account or machine will not decrypt another's IPA. Treat captures, SIDB/SINF data, hardware identifiers, recovered models and decrypted apps as private material — the README explicitly warns against sharing any of them.

Ongoing upkeep centers on macOS build compatibility: only a handful of builds are listed as verified, and the unknown-arm64e fallback depends on validation succeeding rather than on a documented guarantee. Note that this is an interception/recovery workflow for FairPlay, not a general DRM research framework; portability to future macOS releases is not established in the documentation. See the project instructions for the exact commands and release-tagging behavior.

HotRepo's take

The repository was created on 2026-10-25 and hit #2 on the NEW-REPOSITORY board (not the overall Trending board) on 2026-10-26 with 151 total stars, per HotRepo's single recorded snapshot. That is one dated observation, not a growth series, so persistence and long-term maintenance cannot yet be judged. Before relying on it, verify that your macOS build appears in the documented verified profiles or that the unknown-build fallback passes full IPA validation on your hardware.