Extract IPA from iPhone in one command

Pulling an app off a jailbroken iPhone usually means a pile of manual steps: SSH in, find the app folder, copy it, zip it, copy it back. And after all that, the IPA often turns out to be encrypted, so it’s useless for analysis.

I built getipa to do all of it in one command. It’s free and open source.

What you need

• A jailbroken iPhone with OpenSSH running, on the same Wi-Fi as your computer
• Python 3.9 or newer
• For decrypted IPAs only: Node.js, and frida-server running on the phone

Only use it on apps and devices you own or are authorised to test.

Install

pipx install getipa
getipa --install-bagbak

The second command is a one-time step. It installs bagbak, the tool that decrypts the app. Skip it if you only want raw copies.

Use it

Just run:

getipa

It asks for three things:

1. Username: usually root (on some newer jailbreaks, mobile)
2. Device IP: you can type just the last number. 9 becomes 192.168.1.9 or a full IP of your device
3. Password: the one you set on the phone for SSH.

Then you see your apps, newest first, with Apple’s system apps hidden:

Listed installed application (installed first) excluding system apps

Pick one, then choose how to extract it:

• Decrypted IPA (recommended): ready to analyse
• Encrypted IPA: a fast raw copy.

Your IPA is saved in the ipas folder where you ran the command.

IPA gets saved in the folder

Why “decrypted” matters

Apps from the App Store are encrypted on the phone (Apple calls it FairPlay). A plain copy gives you a file whose main code you can’t read. getipa checks for this and tells you, so you never waste time on a dead file. With bagbak, it dumps the app while it runs, and you get the real code.

Get RansomWhisker’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

If the decrypted option fails, the usual cause is frida-server not running on the phone. Install it from Sileo or Zebra, start it, and try again.

Handy options

getipa --list                       # just show the apps
getipa -b com.example.shop          # pick an app by bundle ID
getipa --decrypted                  # decrypted only
getipa --encrypted                  # raw copy only
getipa --info                       # print permissions and settings after extracting
getipa --info-file app.ipa          # report on an IPA you already have

Safety

getipa never sends anything anywhere except over your own SSH connection. It opens a single SSH session, extracts files defensively, and keeps your password out of command lines and files.

Links

• getipa on GitHub: https://github.com/RansomWhisker/getIPA
• More tools by Rudranetra: https://rudranetra.com/tools

Built by Rudranetra.