Yet another tool to decrypt iOS apps using r2frida.
Frida 17 supported (tested on 17.9.1)
- Jailbroken iOS device
- Frida 17 supported (tested on 17.9.1) installed on the device (e.g. via Cydia/Sileo)
- radare2 installed on the host
- r2frida installed on the host
- Python >= 3.6
- Node.js >= 20 (for the r2frida agent plugin)
pip install r2flutchr2pm -ci r2flutchgit clone https://github.com/as0ler/r2flutch.git
cd r2flutch
./install.shThe install.sh script installs pip dependencies, builds the r2frida agent
plugin (npm install), and installs the package.
Note: The default transport is SSH, which requires a
config.jsonfile with device credentials (see SSH Transport below). To use the original Frida-based transfer without a config file, add-t fridato any command.
r2flutch -lBundle Identifier Name
----------------------------------------------------
com.aimharder.mainapp AimHarder
com.apple.AppStore App Store
com.apple.calculator Calculator
com.apple.camera Camera
com.apple.mobilesafari Safari
...
43 applications found
The list is sorted alphabetically by bundle identifier and includes the application display name. No SSH connection or config file is needed for this command.
r2flutch -i com.aimharder.mainapp[ℹ] SSH connection established to root@127.0.0.1:2222
[ℹ] Open Application Process com.aimharder.mainapp
Listing application content: 100%|███████████████| 1528/1528 [00:02<00:00, 615files/s]
[ℹ] Loading all modules
[ℹ] Decrypting module AimHarder
[ℹ] Module AimHarder decrypted successfully
Copying application bundle: 100%|████████████████| 1206/1206 [00:11<00:00, 106file/s]
[ℹ] Creating IPA file at ./AimHarder.ipa
[ℹ] IPA file saved at ./AimHarder.ipa
[✓] SUCCESS - r2flutch Decryption Complete!
r2flutch com.aimharder.mainappThe decrypted binary is saved to the current directory. Use -o to change the
output location:
r2flutch -o /tmp/decrypted com.aimharder.mainappr2flutch -t frida -i com.aimharder.mainappPass -d to see detailed internal messages (memory offsets, temp paths,
library loading, patching details):
r2flutch -d -i com.aimharder.mainappr2flutch supports two transport modes for downloading files from the device:
| Flag | Transport | Description |
|---|---|---|
-t ssh |
SSH (default) | Downloads files over SFTP. Faster and more reliable for large bundles. |
-t frida |
Frida | Downloads files through r2frida commands (original behavior). |
SSH transport requires a config.json file with the device credentials:
{
"ssh": {
"host": "192.168.1.100",
"port": 22,
"username": "root",
"password": "alpine"
}
}The fields host, username and password are required. port defaults
to 22 if omitted.
By default r2flutch looks for config.json in the current directory. Use -c
to specify a custom path:
r2flutch -c /path/to/config.json -i com.example.appA sample config file is provided at config.json.example.
To use the original Frida-based file transfer (no config file needed):
r2flutch -t frida -i com.example.appusage: r2flutch [-h] [-d] [-o OUTPUT] [-i] [-l] [-t {ssh,frida}] [-c CONFIG] [target]
r2flutch (by Murphy)
positional arguments:
target Bundle identifier of the target app
options:
-h, --help show this help message and exit
-d, --debug Show debug messages
-o OUTPUT, --output OUTPUT Path where output files will be stored.
-i, --ipa Generate an IPA file
-l, --list List the installed apps
-t {ssh,frida}, --transport Transport for file transfer: ssh (default) or frida
-c CONFIG, --config CONFIG Path to config.json file (default: config.json)
Run the test suite with coverage:
bash run_tests.shOr directly with pytest:
python3 -m pytest test/ -verror: This feature requires an iOS Developer Disk Image to be mounted;
run Xcode briefly or use ideviceimagemounter to mount one manually
Solution: Open Xcode and let it detect the connected device.
error: Cannot attach: Need Gadget to attach on jailed iOS;
its default location is: ~/.cache/frida/gadget-ios.dylib
Solution: Download the gadget from the Frida releases page and place it in the expected path:
curl -L https://github.com/frida/frida/releases/download/<VERSION>/frida-gadget-<VERSION>-ios-universal.dylib.gz \
-o gadget.dylib.gz
gunzip gadget.dylib.gz
mkdir -p ~/.cache/frida
mv gadget.dylib ~/.cache/frida/gadget-ios.dylibERROR: plugin.ts:10:17: Could not resolve "frida-objc-bridge"
ERROR: r2frida-compile: Compilation failed
Solution: Install the agent dependencies:
cd r2flutch/agent
npm install