as0ler/r2flutch

Tool to decrypt iOS apps using r2frida

r2flutch

Yet another tool to decrypt iOS apps using r2frida.

Requirements

It requires to install Frida on the Jailbroken iOS device:

• Jailbroken device
• Frida installed on the device. (e.g. via Cydia) https://frida.re/docs/ios/#with-jailbreak
• radare2 installed. https://github.com/radareorg/radare2
• r2frida installed. https://github.com/nowsecure/r2frida

Installation

• Using PIP:

pip install r2flutch

• Using r2pm:

r2pm -ci r2flutch

Usage

• Run r2flutch -l to list all the installed apps.

• Run r2flutch -i <App Bundle> to pull a decrypted IPA from the device.

• Run r2flutch <App Bundle> to pull the decrypted app binary from the device.

Troubleshooting

Issue #1: Xcode isn't open.

error: This feature requires an iOS Developer Disk Image to be mounted; run Xcode briefly or use ideviceimagemounter to mount one manually Cannot spawn: This feature requires an iOS Developer Disk Image to be mounted; run Xcode briefly or use ideviceimagemounter to mount one manually

Solution: Run Xcode

Issue #2: Gadget isn't installed

error: Cannot attach: Need Gadget to attach on jailed iOS; its default location is: /Users/mak/.cache/frida/gadget-ios.dylib

Solution: 2 steps

1. Visit https://github.com/frida/frida/releases
2. download and extract (gunzip) i.e: we'll do this for frida-gadget-15.1.10-ios-universal.dylib.gz but make sure to get the latest

• curl -L https://github.com/frida/frida/releases/download/15.1.10/frida-gadget-15.1.10-ios-universal.dylib.gz -o frida-gadget-15.1.10-ios-universal.dylib.gz
• gunzip frida-gadget-15.1.10-ios-universal.dylib.gz
• mkdir -p ~/.cache/frida
• mv frida-gadget-15.1.10-ios-universal.dylib ~/.cache/frida/gadget-ios.dylib

r2flutch's Issues

ERROR - Failed to copy file: .gitkeep

iOS: 14.6
Device: iphone 7
Jailbrake tool: checkrain

radare2: 5.5.4

MacBook-Pro-di-xspam:jan xspam$ r2flutch -i com.adobe.PSMobile
[+] Open Application Process com.adobe.PSMobile
resumed spawned process.
[+] Mount Application Bundle
Mounted io on /r2f at 0x0
[+] Set block size to 0x400000

[+] Loading all modules
[+] Dumping Module PS Express at 0x104b1d000 (0x1000 Bytes)
Dumped 4096 bytes from 0x104b1d000 into /var/folders/s1/t_833fyx34n_5r4xvjmd6kzr0000gn/T/r2flutch-diqkax00/dump/PS Express
File 'PS Express' created. (size: 101806432 bytes)
[+] Writing decrypted data to file /var/folders/s1/t_833fyx34n_5r4xvjmd6kzr0000gn/T/r2flutch-diqkax00/bin/PS Express at 0x21000
[+] Patching cryptid at offset 0x11b0
[+] Module /var/folders/s1/t_833fyx34n_5r4xvjmd6kzr0000gn/T/r2flutch-diqkax00/bin/PS Express successfully decrypted
[+] Copy application bundle to: /var/folders/s1/t_833fyx34n_5r4xvjmd6kzr0000gn/T/r2flutch-diqkax00/Payload/PS Express.app
[+] Copy App Bundle to disk
15%|█████████████████████▋ | 613/4069 [01:03<03:24, 16.90it/s][x] ERROR - Failed to copy file: .gitkeep
100%|███████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████| 4069/4069 [14:24<00:00, 4.71it/s]
[+] Creating IPA file at ./PS Express.ipa
[+] IPA file saved at ./PS Express.ipa
[*] SUCCESS - r2flutch Decryption Complete!

Cannot open target process

For all applications...

Any suggestion ?

Spotify and GenshinInpact not decrypting

ERROR - Cannot open target process

$ r2flutch -d -i uk.co.llamasoft.gridrunner
[+] Open Application Process uk.co.llamasoft.gridrunner
[r] Cannot open 'frida://launch/usb/644ceeafa65960cb3a2249b2f6a8b7702381d15b/uk.co.llamasoft.gridrunner'
[x] ERROR - Cannot open target process: uk.co.llamasoft.gridrunner

iOS: 10.3.3 (14G60)
Device: iPad mini 2 (ME277B/A)
Jailbrake tool: sockH3lix

radare2: 5.4.2 (via brew)

Error Dumping Application

When attempting to dump an application I ran into this error. Any suggestions on how to proceed?

r2flutch XXXXX
[+] Open Application Process XXXXX
resumed spawned process.
[+] Mount Application Bundle
Mounted io on /r2f at 0x0
[+] Set block size to 0x80000

Invalid address (XXXXXw)
|ERROR| Invalid command 'mdj /r2f/AppBundle/assets/node_modules/@XXXX' (0x6d)