fairplay-decrypt: offline FairPlay IPA decryption

gist

Ethan Arbuckle's fairplay-decrypt is a C and Python tool that decrypts FairPlay-protected App Store IPAs offline on macOS or Linux. It needs a 16-byte credential for the Apple account that owns each app, which a companion retriever pulls from a jailbroken iOS device over USB SSH, tested on iOS 14, 15 and 18. The decryptor reads each IPA's SINF and SUPF license records, derives page keys, decrypts the encrypted arm64 pages and clears the cryptid flag. Arbuckle published the repository on October 19, 2026, without a license file or tagged releases.

ideas

• One credential unlocks every app an account owns. The README asks for a 16-byte credential per owning account, and the retrieval guide calls it reusable; decryption itself then runs on a Mac or Linux machine without the device.
• Credential retrieval needs a jailbroken device with root access. The host needs Python, idevice_id, iproxy and USB SSH, and the device must have root SSH key access and at least one App Store app installed under the target account.
• The device side runs only native programs. The retriever does not install Python or the Frida instrumentation toolkit on the phone, and it picks the first installed app with a supported license unless told which IPA or SINF to use.
• Format support is narrow and stated. The decryptor handles version-3 and version-5 SUPF records, 448-byte and 440-byte SINF priv records, and encrypted arm64 Mach-O slices; a 440-byte record must end in eight zero bytes.
• Builds split by platform. On macOS, make also builds the credential-retrieval bundle and needs Xcode and ldid; on Linux it builds only the decryptor.

quotes