EthanArbuckle/fairplay-decrypt

The problem

Security researchers, reverse engineers and app-audit teams often need to inspect the actual binary of an App Store app, but the store hands you a FairPlay-encrypted IPA: shell, resources, and an arm64 slice whose pages are scrambled. The usual workaround is to jailbreak a device, install a cracking client like frida-ios-dump or Clutch, and pull the decrypted app off the phone. That means physical device access, a jailbreak, and running untrusted code inside the target process. This project flips it around: with a 16-byte credential belonging to the account that owns the IPA, it derives the page keys from the app's own SINF and SUPF records and decrypts the arm64 pages on a Mac or Linux box, offline, without a device in the loop.

What's different

The established tools are on-device dumpers (frida-ios-dump, Clutch and similar) whose approach is to intercept the decrypted image in memory after the OS has done the FairPlay step. That works broadly but requires a jailbreak and is increasingly fragile on modern iOS. This project instead attacks the container: it parses the metadata records and reproduces key derivation on the host, so decryption is a local batch job. The trade-offs are real. It only handles specific record shapes — version-3 and version-5 SUPF, 448-byte and 440-byte SINF priv records, encrypted arm64 Mach-O slices — and it still needs a valid credential, which the companion credential-retrieval tool obtains from a supported jailbroken device. So it narrows the on-device footprint to a one-time credential extraction rather than a full crack session.

Who it's for

Security teams auditing third-party iOS apps, researchers studying DRM/key-derivation, and reverse engineers who already have a jailbroken device for credential extraction and want reproducible, offline, scriptable decryption on a workstation. It is not for people who just want to read an app's strings on a non-jailbroken phone — you still need the credential path. Users on Windows, or on architectures where the IPA only ships non-arm64 slices, should look elsewhere.

Cost of adoption

Python 3.9+ and the requirements file; macOS additionally needs Xcode and ldid to build the credential-retrieval bundle. A jailbroken device is a hard prerequisite for obtaining credentials. The project is five days old, the README is short and explicitly scoped, and no license is declared — a real problem if you plan to use it commercially or redistribute it. Legality and App Store terms are on you to assess; the README says nothing about them.

Verdict

This is a brand-new project, not an established one: 5 days old, ~1,944 stars, and roughly 357 stars per day in its first tracked week. It never hit the daily trending board and only drew a modest 24-point Hacker News thread, so the spike looks driven by novelty and topic rather than broad adoption. The technical approach is clean and narrow, but an undeclared license, a single-platform jailbreak dependency and a very short track record mean it is something to evaluate in a sandbox, not depend on.