中文版

fairplay-decrypt 是 Ethan Arbuckle 开源的 FairPlay 离线解密工具（GitHub：https://github.com/EthanArbuckle/fairplay-decrypt ，2026-10-19 发布，几天内涨到 1.6k+ star）。它和 frida-ios-dump 那类传统砸壳工具的思路完全不同：不在越狱机上逐个运行 App dump 内存，而是先从越狱设备提取一个可复用的 16 字节账号凭证，之后所有解密都在电脑上（macOS / Linux）离线完成。

它解决什么问题

传统砸壳流程里，越狱机是全程的主力：每个 App 都要装到越狱机上、实际运行、再从内存里把解密后的代码抠出来。fairplay-decrypt 把越狱机的角色降级成”取票口”：

• 每个 Apple ID 只需上机提取一次凭证
• 凭证对应的是账号而非单个 IPA——同一账号名下所有 IPA 共用这一个凭证，批量解密
• 解密过程纯离线，不联网、不依赖设备在线

使用流程

第一步：提取凭证。需要一台越狱 iPhone（支持 iOS 10+），通过 USB 连接、开 root SSH，主机装好 Python、idevice_id、iproxy，设备上至少装有一个 App Store 应用，然后运行：

• make
• python3 credential-retrieval/retrieve.py --output-dir 输出目录

生成 credential.bin。如果设备上有多个账号的应用，可以用 --ipa 或 --sinf 指定要提取哪个账号的凭证。

第二步：装环境（Python 3.9+ 和 C 编译器）：

• python3 -m venv .venv
• . .venv/bin/activate
• python -m pip install -r requirements.txt
• make

macOS 上 make 会顺带编译凭证提取组件，需要 Xcode 和 ldid；Linux 上只编解密器。

第三步：解密：

• python decrypt.py 加密的.ipa 解密后的.ipa --credential credential.bin

--credential 省略时默认读当前目录的 ./credential.bin；输出路径不能是已存在的文件。

原理简述

工具读取 IPA 内的 SINF 与 SUPF 记录，结合账号凭证推导每一页的解密密钥，解密被加密的 arm64 页面，最后清掉 Mach-O 的 cryptid 标志——产物就是未加密的 IPA，可以拿去签名、侧载或静态分析。

支持范围与注意事项

• 支持 version-3 和 version-5 的 SUPF
• 支持 448 字节和 440 字节的 SINF priv 记录（440 字节的必须以 8 个零字节结尾）
• 仅支持加密的 arm64 Mach-O 切片
• 凭证只能解自己账号的 IPA：哪个 Apple ID 买的/下载的，就得用哪个 ID 的凭证，解不了别人的应用
• 越狱设备这道坎没有绕开，只是从”每个 App 一次”降到”每个账号一次”
• 项目非常新（刚开源一周、暂无正式 Release），生产环境使用前建议先拿小应用验证

配合之前整理的《iOS 砸壳 IPA / 安卓 MOD 资源整理》（https://meekshark.cn/648.html ）一起看，iOS 侧载与砸壳这条线就完整了。

English Version

fairplay-decrypt is an open-source FairPlay offline decryption tool by Ethan Arbuckle (GitHub: https://github.com/EthanArbuckle/fairplay-decrypt , released 2026-10-19, 1.6k+ stars within days). Its approach differs fundamentally from traditional dumpers like frida-ios-dump: instead of running every app on a jailbroken device and dumping decrypted code from memory, it extracts a reusable 16-byte account credential from a jailbroken device once, then performs all decryption offline on your computer (macOS / Linux).

What problem it solves

In the classic workflow, the jailbroken device does all the work: every app must be installed on it, actually launched, and its decrypted code pulled from memory. fairplay-decrypt demotes the jailbroken device to a one-time ticket office:

• Each Apple ID only needs to go through credential extraction once
• The credential is tied to the account, not to individual IPAs — every IPA owned by that account shares the same credential, enabling bulk decryption
• Decryption is fully offline: no network, no device required afterwards

Usage

Step 1: retrieve the credential. You need a jailbroken iPhone (iOS 10+ supported) connected over USB with root SSH access; the host needs Python, idevice_id, and iproxy, and the device must have at least one App Store app installed. Then run:

• make
• python3 credential-retrieval/retrieve.py --output-dir

This produces credential.bin. If the device has apps from multiple accounts, use --ipa or --sinf to select which account’s credential to extract.

Step 2: set up (Python 3.9+ and a C compiler):

• python3 -m venv .venv
• . .venv/bin/activate
• python -m pip install -r requirements.txt
• make

On macOS, make also builds the credential-retrieval bundle and requires Xcode and ldid; on Linux it builds the decryptor only.

Step 3: decrypt:

• python decrypt.py encrypted.ipa decrypted.ipa --credential credential.bin

If --credential is omitted, ./credential.bin is used. The output path must not already exist.

How it works

The decryptor reads the IPA’s SINF and SUPF records, derives per-page keys from the account credential, decrypts the encrypted arm64 pages, and clears the Mach-O cryptid flag. The result is an unencrypted IPA ready for signing, sideloading, or static analysis.

Support and caveats

• Supports version-3 and version-5 SUPF
• Supports 448-byte and 440-byte SINF priv records (a 440-byte record must end in eight zero bytes)
• Encrypted arm64 Mach-O slices only
• A credential only decrypts IPAs owned by its account — the Apple ID that bought/downloaded the app must match; you cannot decrypt someone else’s apps
• The jailbroken-device requirement is not eliminated, just reduced from “once per app” to “once per account”
• Very new project (open-sourced a week ago, no releases yet) — test with a small app before relying on it

Pair this with the earlier roundup “iOS Decrypted IPA / Android MOD Resources” (https://meekshark.cn/648.html ) for the full iOS sideloading and decryption picture.