iOS App Dumping

What Is App Dumping?

1. Software Unpacking

2. How dumping works

   • App packing
   • App unpacking
     1. Static dumping
        • Decrypting a non-running app once the packed app’s encryption algorithm and logic are known
        • High difficulty
        • Easily altered once cracked
     2. Dynamic dumping
        • Start from the executable image in the memory space of a running process
        • Dump the in-memory contents to complete the unpacking
        • Relatively simple, and bypasses the encryption altogether

3. How iOS apps run

   • App shell
   • MachO
   • DYLD
   • Shared cache libraries
     • Dynamic libraries

Dumping tools

1. iFunBox

2. Clutch

   • Clutch-Github
   • Introduction article

3. dumpdecrypted

4. frida-iOS-dump

5. Hopper

   • Hopper

6. Software

Further questions

1. How well do you know the iOS/macOS kernel?

Relatively safe: the cost of cracking > the payoff after cracking