- Installs
- 1.1K
- Last 24h
- —
- Trending rank
- —
- Security
- Not audited
Install
Works with every agent the skills CLI supports.
npx skills add https://github.com/p4nda0s/reverse-skills --skill rev-ios-dump- 01
Install
Run the command in your project. The CLI asks which agents to install for.
- 02
Describe the task
Ask your agent for something this skill covers. It loads rev-ios-dump automatically when relevant.
- 03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.
SKILL.md
The instructions your agent reads when the skill is triggered.
rev-ios-dump - iOS App Decryption (砸壳)
Dump decrypted iOS application binaries from jailbroken devices for security analysis and reverse engineering.
Overview
iOS apps distributed via the App Store are encrypted with Apple's FairPlay DRM. To perform static analysis (IDA/Ghidra/Hopper), the binary must first be decrypted at runtime — commonly called "砸壳" (dumping the shell). This skill uses Frida to instrument the running process and dump the decrypted Mach-O from memory.
Prerequisites
| Requirement | Details |
|---|---|
| Jailbroken iOS device | With SSH access enabled |
| frida-server | Installed and running on the device |
| Python 3 | On the host machine |
| frida + frida-tools | pip3 install frida frida-tools |
| USB or network access | SSH connection to the device |
Verify frida-server is Running
# Check frida-server on device via SSH
ssh mobile@<device_ip> "ps aux | grep frida-server"
# If not running, start it
ssh mobile@<device_ip> "/usr/sbin/frida-server -D &"
# Verify from host
frida-ls-devices
frida-ps -H <device_ip>
Tool: frida-ios-dump
Repo: https://github.com/P4nda0s/frida-ios-dump
Installation
git clone https://github.com/P4nda0s/frida-ios-dump.git
cd frida-ios-dump
pip3 install -r requirements.txt
# Build the TypeScript agent (required before first run)
npm install --ignore-scripts
npx frida-compile dump.ts -o dist/dump.js
Note: This version uses a TypeScript-based Frida agent. The dist/dump.js must be compiled before dump.py can run.
Step-by-Step Workflow
Step 1: Identify Target App Bundle ID
Use one of these methods on the device:
# Method 1: List running apps via Frida
frida-ps -H <device_ip> -a
# Method 2: SSH into device and check
ssh mobile@<device_ip> "find /var/containers/Bundle/Application -name Info.plist -exec plutil -p {} \; 2>/dev/null | grep CFBundleIdentifier"
Or use CocoaTop on the device to identify the running process and its Bundle ID.
Step 2: Ensure Target App is Running
The target app must be running on the device. frida-ios-dump attaches to the live process to dump decrypted memory.
Step 3: Execute Dump
cd frida-ios-dump
python3 dump.py -H <device_ip> -u mobile -P <password> <bundle_id>
Parameters:
| Flag | Description |
|---|---|
-H | Device IP address |
-u | SSH username (typically mobile) |
-P | SSH password (typically alpine on fresh jailbreak) |
<bundle_id> | Target app Bundle ID (e.g., app.ish.iSH) |
Example:
python3 dump.py -H 192.168.1.100 -u mobile -P alpine app.ish.iSH
Step 4: Verify Output
A successful dump produces a .ipa file in the current directory:
ls -la *.ipa
# Unzip to inspect
unzip -o <app_name>.ipa -d dumped_app/
# Verify decryption — cryptid should be 0
otool -l dumped_app/Payload/<AppName>.app/<BinaryName> | grep -A4 LC_ENCRYPTION_INFO
If cryptid 0 is shown, the binary is successfully decrypted.
Troubleshooting
| Error | Cause | Fix |
|---|---|---|
Failed to spawn | App not installed or wrong Bundle ID | Verify Bundle ID with frida-ps -H <ip> -a |
Unable to connect to remote frida-server | frida-server not running or port blocked | Start frida-server on device, check firewall |
SSH connection refused | SSH not enabled or wrong credentials | Verify SSH access: ssh mobile@<ip> |
Timeout waiting for process | App crashed or not fully launched | Launch app manually first, then retry |
frida.ServerNotRunningError | frida-server version mismatch | Match frida-server version to host frida version |
cryptid 1 in output | Dump failed, binary still encrypted | Ensure app is running during dump, retry |
Permission denied | SSH key/password issue | Check -u and -P flags, or use SSH key auth |
Version Mismatch Fix
frida-server and host frida must be the same major version:
# Check host version
frida --version
# Download matching frida-server from:
# https://github.com/frida/frida/releases
# Choose: frida-server-<version>-ios-arm64.xz
Output Usage
After obtaining the decrypted IPA:
- Static analysis — Load the decrypted Mach-O into IDA/Ghidra/Hopper
- Class dump — Extract ObjC headers:
class-dump <binary> > headers.h - String analysis — Search for sensitive strings, URLs, keys
- Frida hooking — Use with
rev-fridaskill for dynamic analysis - Symbol recovery — Use with
rev-symbolskill for stripped binary analysis
Notes
- The device must remain unlocked and the app must stay in the foreground during the dump process.
- For apps with multiple frameworks, frida-ios-dump will dump all encrypted frameworks within the app bundle.
- Some apps with advanced jailbreak detection may terminate before the dump completes — consider bypassing jailbreak detection first.
FAQ
What does the rev-ios-dump skill do?
Dump decrypted iOS app binaries (砸壳) from jailbroken devices using frida-ios-dump. Activate when the user wants to decrypt an iOS app, dump an IPA from a device, or extract a decrypted Mach-O binary for reverse engineering.
How do I install rev-ios-dump?
Run npx skills add https://github.com/p4nda0s/reverse-skills --skill rev-ios-dump in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/rev-ios-dump/ (personal) or .claude/skills/rev-ios-dump/ (project).
Which AI agents can use rev-ios-dump?
Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.
Is rev-ios-dump safe to install?
No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.
Who maintains rev-ios-dump?
It is published by p4nda0s in p4nda0s/reverse-skills. It has 1,150 recorded installs.
More from p4nda0s/reverse-skills
rev-frida
p4nda0s/reverse-skills
Generate Frida hook scripts using modern Frida API. Activate when the user wants to write Frida scripts, hook functions at runtime, trace calls or arguments or return values, intercept native or ObjC or Java methods, dump memory or exports, or handle native module load timing for Android and other targets.
rev-struct
p4nda0s/reverse-skills
Reconstruct data structures by analyzing memory access patterns across functions
rev-symbol
p4nda0s/reverse-skills
Restore function symbols by analyzing code patterns, strings, constants, and cross-references
rev-idapython
p4nda0s/reverse-skills
IDAPython and IDALib script reference for reverse engineering. Activate when the user needs to write IDAPython scripts in IDA, use IDALib for headless analysis, operate on IDB databases, debug with IDA, manipulate memory/registers, traverse functions/blocks/instructions, work with Hex-Rays decompiler API, handle obfuscation, or batch-process binaries.
rev-dex-dumper
p4nda0s/reverse-skills
Dump DEX files from a running Android app for unpacking/deobfuscation. Activate when the user wants to unpack an Android APK, dump DEX from memory, extract decrypted DEX files, or defeat class-loading packing.
rev-unicorn-debug
p4nda0s/reverse-skills
Debug and emulate specific code fragments or functions using the Unicorn engine. Activate when the user wants to emulate a function with Unicorn, trace binary execution without running the full program, decrypt or decode data by emulating the algorithm, or bypass environment dependencies (JNI, syscalls, libc) during emulation.
Popular mobile skills
design-mobile-apps
designed-by-ai/skills
Design mobile app screens with Sleek, edit Sleek projects, and implement their designs in React Native or HTML.
ios-design
uizze.sh
Design and review iOS UI/UX for iPhone apps in SwiftUI, UIKit, or React Native. Use for mobile app design, screen redesigns, navigation flows, typography, forms, keyboard and safe-area layout, and accessibility checks. Apply Apple Human Interface Guidelines and consult real product references through the optional Uizze connection.
vercel-react-native-skills
vercel-labs/agent-skills
React Native and Expo best practices for building performant mobile apps. Use when building React Native components, optimizing list performance, implementing animations, or working with native modules. Triggers on tasks involving React Native, Expo, mobile performance, or native platform APIs.
animate-expo
emilkowalski/skills
Build animations in React Native and Expo, making the decisions in the order that determines whether they feel right — should it animate, which thread it runs on, which properties, spring or timing, how the gesture hands off, how it degrades. Writes the implementation with Reanimated, Gesture Handler, Expo Router and expo-haptics. Use when animating anything in an Expo app, adding gestures, sheets, screen transitions, press feedback or haptics, or fixing motion that stutters on device. For web animation use animate.
xcode-project-setup
firebase/agent-skills
Safely modifies Xcode projects (.pbxproj) to add Swift Packages and link files. Use this skill whenever an iOS project needs dependencies installed (e.g. Firebase, Alamofire).
firebase-remote-config-basics
firebase/agent-skills
Manages Firebase Remote Config templates, feature flags, loading strategies, and SDKs (Android, iOS). Use when downloading/deploying remoteconfig JSON templates, managing version history/feature flags, setting in-app defaults, fetchAndActivate(), real-time listeners, or SDK setup. Don't use for Firebase Hosting, Auth, Firestore, Data Connect, Crashlytics, or App Hosting.