ipaverse is a native SwiftUI macOS app that searches and downloads Apple App Store packages, inspects and re-signs DRM-free IPAs, and provides an authorized security-testing toolkit for iOS researchers.
| Tool | bahattinkoc/ipaverse — a native macOS app for searching, downloading, comparing, re-signing, and security-testing Apple platform app packages |
| Category | iOS/macOS app acquisition, codesigning, and authorized mobile security testing |
| Primary Use | Downloading App Store packages across iOS, iPadOS, macOS, tvOS, and visionOS, then inspecting and re-signing DRM-free IPAs you own or are authorized to test |
| Safe Use | The README is explicit: the security-testing features are for bug bounty programs, contracted pentests, or testing apps you own; the Evil Mode toggle is a UI guardrail, not a substitute for authorization |
| Telemetry Note | The project states it has no analytics or telemetry backend; Apple authentication traffic hits Apple's GrandSlam SRP-6a flow, and optional Frida downloads verify against pinned SHA-256 digests — defenders auditing a lab Mac can observe these bounded network paths |
ipaverse sits in an interesting niche between developer tooling and security research kit. Written in Swift 5 with a SwiftUI interface, it runs on Apple Silicon Macs under macOS 14.6 or later and is distributed as a brew install --cask ipaverse package or buildable from source via git clone and the bundled ipaverse.xcodeproj. At its core it is a full App Store client for research workflows: it searches the iOS, iPadOS, macOS, tvOS, and visionOS catalogs, acquires licenses for free apps, and downloads packages, with support for multiple Apple ID accounts, storefront switching, and version-history browsing. The repository has accumulated roughly 634 stars, which is respectable traction for a specialized macOS-native tool.
What ipaverse deliberately is not, per its own prominent README disclaimer, is a FairPlay circumvention tool. App Store downloads remain encrypted — including free apps — and downloading an app does not decrypt it. An original download only launches with its associated Apple Account license, and re-signing within the app requires a self-built, DRM-free, or lawfully decrypted IPA. The Dump Decrypted Copy function exists, but it is gated on a jailbroken USB source device running frida-server with the target app open — a research-lab configuration, not a turnkey piracy path. This framing matters for anyone evaluating the project's intent, and the author is unusually candid about it.
The download pipeline is well thought out for bulk research: you can queue individual versions or multiple apps, with two concurrent downloads tracked and interrupted jobs resumable after restart. A local-first library organizes original, imported, re-signed, and decrypted copies, groups them by version, applies source filters, and offers missing-file recovery. For someone building a corpus of app versions to diff — a common task in supply-chain and privacy research — this organizational layer is arguably the most practical feature, since version archaeology on the App Store is otherwise painful.
One of the standout capabilities is the comparison engine. For IPA copies sharing a bundle ID, ipaverse diffs metadata, entitlements, signing details, Mach-O structure, components, and resources, with A/B and line-level views. An optional deep-analysis pass adds symbols, classes, strings, and endpoint candidates, and everything is exportable as full or filtered JSON. That endpoint-candidate extraction is a genuine time-saver during the recon phase of an authorized assessment, pointing you at network interfaces worth closer inspection in an intercepting proxy.
The re-signing path is equally concrete. You can edit IPA properties and files, then sign with your own certificate and provisioning profile, either inline or from a standalone Resign window. Before signing or installing, the app reviews signing profiles, extension identities, and device readiness, then installs compatible IPAs to an iPhone or iPad over USB or Wi-Fi. Installation uses Xcode's CoreDevice path via xcrun devicectl on modern setups, with a bundled libimobiledevice fallback for older devices — a pragmatic hedge that covers hardware Apple's newer tooling has drifted away from. Wi-Fi installs require prior USB pairing and the Connect via network option enabled in Xcode's Devices window.
The Security Testing section is where ipaverse earns its security-tool label. A Security Testing Mode toggle disables ATS to permit MITM proxying, Frida Gadget injection streamlines instrumentation, and a Reverse Engineer component bundles local static analysis, an Objective-C class browser, and live Frida tooling for bypasses, method tracing, NSURLSession interception, UI hierarchy inspection, and app-data inspection. Data tools make NSUserDefaults string and number values editable, expose Keychain item metadata (deliberately not secret values), and allow listing and downloading matching sandbox files. There is also a Move to New Identity action in the Resign window for migrating apps to different signing identities.
Notably, the more invasive capabilities are locked behind an Evil Mode toggle on the main toolbar, and the README is careful to state this is a deliberate UI guardrail, not a substitute for authorization. The warning block is unambiguous: these features are meant for bug bounty programs, contracted pentests, or testing apps you own, and misuse may violate Apple's terms of service or the law. That explicitness is good hygiene for a tool in this space, and it aligns squarely with educational and authorized-professional use — nothing in the design suggests a concealed offensive intent.
Architecturally, the security and privacy model is documented in unusual detail. Authentication uses Apple's GrandSlam SRP-6a flow, where the raw password is used locally to compute the SRP proof and never sent directly. The app tries macOS's native AOSKit for Anisette data first, falling back to a third-party Anisette V3 service (operated by SideStore by default) if local generation fails; that fallback sends only a generated device identity and provisioning data, never Apple credentials or verification codes, and you can restrict generation to the local Mac or point it at your own server under Settings → Account → Advanced Sign-in Settings. Account credentials live in the macOS Keychain, with an optional Remember Me password retention.
Network egress is bounded and enumerated: Apple services for authentication, search, licensing, downloads, and artwork; GitHub only for an explicit update check and on-demand Frida downloads; and Homebrew, pip, or vendor sites for optional tool installation. Crucially, IPA extraction, patching, signing, static analysis, and report generation all happen locally, and the README states plainly that certificates, provisioning profiles, and IPA contents are never uploaded. There is no project-operated relay, analytics service, or telemetry backend. The Frida Gadget and libfrida-core binaries are not bundled in the repo but fetched from GitHub Releases on first use, verified against pinned file sizes and SHA-256 digests, and cached in Application Support — a supply-chain-conscious touch worth respecting.
The licensing situation deserves a note before you redistribute anything. While the original source carries an MIT License, the distributed binary is explicitly not MIT-only: Unicorn Engine 2.1.4 is statically linked for the App Store signing challenge under GPL-2.0, libimobiledevice and friends come in under LGPL-2.1-or-later with OpenSSL under Apache-2.0, and the on-demand Frida components fall under the wxWindows Library Licence 3.1. Anyone building a modified distribution needs to honor each component's terms.
For the practicing mobile security professional, ipaverse compresses a whole bench of utilities — an App Store downloader, IPA organizer, A/B differ, codesigning frontend, device installer, and Frida workbench — into one native Mac application. Its fit is strongest in authorized assessment contexts: bug bounty work on apps in scope, contracted penetration tests, internal red-team validation of first-party builds, and academic study of the iOS ecosystem's signing and licensing machinery. The guardrails are visible, the network behavior is documented, and the tooling assumptions (jailbroken device for decryption, your own certificates for signing) place responsibility squarely on the operator to stay within authorization boundaries.
bahattinkoc/ipaverse.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.