Decrypt application's encrypted binaries on macOS when SIP-enabled (macOS 11.2.3 or below). Even if it can decrypt all applications, some iOS apps won't be possible to run on the mac, even after decryption.
This works well and compiles for iOS nicely, if you want use it at iOS devices, you can use build-ios.sh (Thanks @dlevi309).
This project support macOS 15.0-15.2 https://github.com/34306/decrypted , using CVE-2025-24204, https://github.com/FFRI/CVE-2025-24204/tree/main
CVE-2025-24204 is a vulnerability that allows reading any process memory on SIP-enabled macOS systems. The root cause of this vulnerability stems from adding an excessively powerful entitlement (com.apple.system-task-ports.read) to the gcore binary.
> git clone https://github.com/paradiseduo/appdecrypt.git
> cd appdecrypt
> chmod +x build-macOS_arm.sh
> ./build-macOS_arm.sh
> ./appdecrypt
Version 2.1
appdecrypt is a tool to make decrypt application encrypted binaries on macOS when SIP-enabled.
Examples:
mac:
appdecrypt /Application/Test.app /Users/admin/Desktop/Test.app
iPhone:
appdecrypt /var/containers/Bundle/Application/XXXXXX /tmp
USAGE: appdecrypt encryptMachO_Path decryptMachO_Path
ARGUMENTS:
<encryptApp_Path> The encrypt app file path.
<decrypt_Path> The path output file.
OPTIONS:
-h, --help Show help information.
--ignore-ios-check Decrypt the app even if M1 can't run it.> ./appdecrypt /Applicaiton/Test.app /Users/admin/Desktop/Test.app
Success to copy file.
Dump /Applications/Test.app/Wrapper/Test.app/Test Success
Dump /Applications/Test.app/Wrapper/Test.app/PlugIns/TestNotificationService.appex/TestNotificationService Success
Dump /Applications/Test.app/Wrapper/Test.app/Frameworks/trackerSDK.framework/trackerSDK Success
Dump /Applications/Test.app/Wrapper/Test.app/Frameworks/AgoraRtcKit.framework/AgoraRtcKit Success
> cd /Users/admin/Desktop/Test.app
> ls
WrappedBundle Wrapper
> cd Wrapper
> ls
BundleMetadata.plist Test.app iTunesMetadata.plistFirst you should connect jailbreak iPhone with USB.
> brew install ldid
> git clone https://github.com/paradiseduo/appdecrypt.git
> cd appdecrypt
> chmod +x build-iOS.sh
> ./build-iOS.sh
> scp -P 2222 appdecrypt root@127.0.0.1:/tmp
// In iPhone shell
> cd /tmp
> ./appdecrypt
Version 2.1
appdecrypt is a tool to make decrypt application encrypted binaries on macOS when SIP-enabled.
Examples:
mac:
appdecrypt /Applicaiton/Test.app /Users/admin/Desktop/Test.app
iPhone:
appdecrypt /var/containers/Bundle/Application/XXXXXX /tmp
USAGE: appdecrypt encryptMachO_Path decryptMachO_Path
ARGUMENTS:
<encryptApp_Path> The encrypt app file path.
<decrypt_Path> The path output file.
OPTIONS:
-h, --help Show help information.// In iPhone shell
> ./appdecrypt /var/containers/Bundle/Application/5B5D4E97-E760-4AC5-BFEE-F0FF72EBB19E /tmp
Success to copy file.
Dump /var/containers/Bundle/Application/5B5D4E97-E760-4AC5-BFEE-F0FF72EBB19E/KingsRaid.app/KingsRaid Success
Dump /var/containers/Bundle/Application/5B5D4E97-E760-4AC5-BFEE-F0FF72EBB19E/KingsRaid.app/Frameworks/FBSDKGamingServicesKit.framework/FBSDKGamingServicesKit Success
Dump /var/containers/Bundle/Application/5B5D4E97-E760-4AC5-BFEE-F0FF72EBB19E/KingsRaid.app/Frameworks/FBLPromises.framework/FBLPromises Success
Dump /var/containers/Bundle/Application/5B5D4E97-E760-4AC5-BFEE-F0FF72EBB19E/KingsRaid.app/Frameworks/FBSDKShareKit.framework/FBSDKShareKit Success
Dump /var/containers/Bundle/Application/5B5D4E97-E760-4AC5-BFEE-F0FF72EBB19E/KingsRaid.app/Frameworks/GoogleUtilities.framework/GoogleUtilities Success
Dump /var/containers/Bundle/Application/5B5D4E97-E760-4AC5-BFEE-F0FF72EBB19E/KingsRaid.app/Frameworks/FBSDKLoginKit.framework/FBSDKLoginKit Success
Dump /var/containers/Bundle/Application/5B5D4E97-E760-4AC5-BFEE-F0FF72EBB19E/KingsRaid.app/Frameworks/nanopb.framework/nanopb Success
Dump /var/containers/Bundle/Application/5B5D4E97-E760-4AC5-BFEE-F0FF72EBB19E/KingsRaid.app/Frameworks/FBSDKCoreKit.framework/FBSDKCoreKit Success
Dump /var/containers/Bundle/Application/5B5D4E97-E760-4AC5-BFEE-F0FF72EBB19E/KingsRaid.app/Frameworks/Protobuf.framework/Protobuf Success
> cd Payload
> ls
BundleMetadata.plist KingsRaid.app/ iTunesMetadata.plist
> tar -cvf /tmp/dump.tar ./
// In mac shell
> cd ~/Desktop
> scp -P 2222 root@127.0.0.1:/tmp/dump.tar .
dump.tarThis was discovered independently when analyzing kernel sources, but it appears that the technique was first introduced on iOS :
https://github.com/JohnCoates/flexdecrypt
but now works on macOS:
https://github.com/meme/apple-tools/tree/master/foulplay
This software is released under the GPL-3.0 license.
