KJCracks / Clutch

Fast iOS executable dumper

3.7k stars 649 forks source link

Dump appears to be successful, IDA complains #232

Open mariopepe opened 5 years ago

mariopepe commented 5 years ago

General information:

iOS version: 12.1
Command used: example: clutch -d

What happens:

I successfully dumped an ipa file through Clutch on iOS 12.1, it goes onto /var/tmp/ , I copy it on my mac, I open the binary file with IDA but still get this message: "The file is iOS-encrypted. Its disassembly will likely be useless. Do you still want to continue?"

Why does this happen? Thanks a lot

App Info:

Price: Free (no in-app purchase)
I feel like (95% sure) it is made through Google Flutter, it contains more than 10 executables (of course it is also available for Android).

Tatsh commented 5 years ago

I can't test this but whoever does is going to need to know the app name, version, bundle ID, etc.

mariopepe commented 5 years ago

@Tatsh I updated the issue with the requested information, sorry, if something is still missing I will add it.

To be honest i think that even if you would try it on another iOS version, it would still be relevant. Maybe is an app specifica problem. I'm not a pro user, but the app structure looks very "unusual": there are at least 10 different executables (like facebook sdk, crypto, audioplayer, etc...), maybe it is just the way Google Flutter app are done...

mariopepe commented 5 years ago

To be honest i'm checking and checking again the clutch process and probably it was not successful. I'm not a PRO user enough to be certain about that, if you agree I would close this issue because maybe there are problems with iOS 12 and not the app