Skip to content

docs: explain what a decrypted IPA is and how to get one #35

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
tkgstrator wants to merge 1 commit into from
Closed

docs: explain what a decrypted IPA is and how to get one #35

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
41 changes: 37 additions & 4 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -180,9 +180,40 @@ and install via TrollStore.
For devices where TrollStore is unavailable. Install the patched IPA with
[Sideloadly](https://sideloadly.io/) or [AltStore](https://altstore.io/).

Requires a **decrypted** KIOU IPA (e.g. obtained via [palera1n](https://palera.in/) +
Filza, or [TrollDecrypt](https://github.com/donato-fiore/TrollDecrypt)). The
App Store download is FairPlay-encrypted and cannot be patched directly.
Requires a **decrypted** KIOU IPA. KEB never ships KIOU itself — you supply
your own legally-obtained copy.

<details>
<summary>What "decrypted" means, and why it's required</summary>

Every app on the App Store is shipped **FairPlay-encrypted**: the main
executable and its frameworks (here, `UnityFramework`) are stored as
ciphertext on disk, and the kernel only decrypts them in memory at launch,
on the device the purchase is tied to. A plain App Store / iMazing download
is therefore encrypted.

The patch pipeline rewrites `UnityFramework` **on disk before signing** — it
locates hook sites by their machine-code prologue and overwrites them with
`B <cave>`. Against an encrypted binary those bytes are meaningless
ciphertext, so the recipe can neither find nor patch them. The input IPA
**must be decrypted first**.

A *decrypted* IPA is one whose Mach-O slices have had the FairPlay layer
stripped (the `cryptid` flag cleared and the encrypted pages dumped in their
plaintext form). You make one **once per app version**, on a device that can
already run KIOU:

- **[TrollDecrypt](https://github.com/donato-fiore/TrollDecrypt)** (needs
TrollStore) — dumps a decrypted `.ipa` straight to the Files app. Easiest.
- **[palera1n](https://palera.in/) + Filza** — jailbreak, then pull the
decrypted bundle off disk.
Comment on lines +208 to +209
- Any on-device FairPlay dumper works; the only requirement is that the
resulting `.ipa` is decrypted.

Drop the result at `assets/<version>/Kiou-<version>.ipa` so that
`make ipa TARGET_VERSION=<version>` picks it up.

</details>

```sh
make chinlan FINALPACKAGE=1
Expand Down Expand Up @@ -236,7 +267,9 @@ the RVAs will drift.
(`$THEOS` set). Kiou Engine Bridge is pure Objective-C — no Orion,
no Swift runtime.
- iOS 15.0–26, arm64.
- For the jailed (sideload) path: a decrypted copy of the KIOU `.ipa`.
- For the jailed (sideload) path: a decrypted copy of the KIOU `.ipa`
(see [Patched IPA (Sideload)](#patched-ipa-sideload) for what that means
and how to obtain one).

### Developer hooks

Expand Down