tinyapps.org / blog

Working around Apple's arbitrary limitations, #

or Extracting IPA files from an iPhone

A recent Fantastical update hid previously-paid-for functionality behind a subscription paywall with account creation nags.

Since iTunes backups have long excluded IPAs and Apple Configurator 2 or iMazing only download the latest IPA from Apple, I used an iPhone 6 running iOS 12 to download the previous version (happily, the new version was iOS 13-only) then extracted the IPA for copying to an iPhone 6S running iOS 13:

1. While Fantastical no longer appears in App Store searches performed under iOS 12, the last compatible version can be downloaded (assuming it is associated with your account) via App Store → Updates → Account icon → Purchased → My Purchases → Search → Fantastical → Download icon → "Download"

2. Install and run checkra1n, connecting the iPhone 6 to the Mac via USB cable when prompted. Jailbreaking only takes a minute or two.

3. Install Homebrew

4. user@Mac ~ % brew install usbmuxd

5. user@Mac ~ % iproxy 4444 44

6. In a new Terminal tab: user@Mac ~ % ssh root@localhost -p 4444
   root@localhost's password: alpine

7. iPhone6:~ root# find /var/containers/Bundle/Application/ -name Fantastical
   /var/containers/Bundle/Application/C5CC3023-C8E7-4AEB-8536-363B96BDB725/Fantastical.app/Fantastical

8. iPhone6:~ root# exit

9. user@Mac ~ % mkdir Payload

10. user@Mac ~ % scp -P 4444 -r root@localhost:/var/containers/Bundle/Application/C5CC3023-C8E7-4AEB-8536-363B96BDB725/Fantastical.app Payload/

11. user@Mac ~ % zip -r Fantastical.ipa Payload/

12. Find Fantastical.ipa in the Mac's current directory. It can be installed on the iPhone 6S running iOS 13 via:

    • iTunes 12.9.5.5: drag Fantastical.ipa onto device name under "Devices" heading in left pane

    • Apple Configurator 2.12.1: double click iPhone icon → drag Fantastical.ipa onto "Apps"

    • Xcode 11.1: Windows → "Devices & Simulators" → click iPhone icon → drag Fantastical.ipa into box under "INSTALLED APPS"

    • iMazing 2.12.0: click iPhone 6S icon → Apps → Copy to Device → browse to recovered Fantastical.ipa → "Select"

Notes & Sources

• checkra1n FAQ: "Q: Can I ssh into my device? A: Yes! An SSH server is deployed on port 44 on localhost only. You can expose it on your local machine using iproxy via USB."

• SSH Over USB

• Sahmoe's reply (which was "stolen from Superuser on Discord") to How to connect to iphone via ssh via wire, without installing cydia, using checkra1n

• Extracting the IPA File and Local Data Storage of an iOS Application

• Why is the default root password alpine?

• See frida-ios-dump for pulling a decrypted IPA instead

/misc | Feb 01, 2020

Subscribe or visit the archives.