Skip to content

Strange unique case of an app exiting unexpectedly the helper #35

Description

@nextline0085

With my current iDevice running with Taurine jailbreak, trying to decrypt Cult of the Lamb (https://apps.apple.com/us/app/cult-of-the-lamb/id1639580858) crashes the helper with exit code 132.

C:\Users\User>ipadecrypt --redact decrypt https://apps.apple.com/us/app/cult-of-the-lamb/id1639580858
  ✓ ipadecrypt v0.7.2 · mobile@192.168.1.94 iOS 14.7.1 arm64 iPhone10,4 (unknown)
  ✓ signed in as ###### (###### storefront)
  ✓ found com.devolverdigital.cultofthelamb on App Store
  ✓ cached com.devolverdigital.cultofthelamb_1.4.13.ipa
  ✓ patched Info.plist
  ✓ MinimumOSVersion 16.0 → 14.7.1
  ✓ installed → /var/containers/Bundle/Application/CA9C0F69-5C1B-4C07-A1D1-88CDDC955883/CultOfTheLamb.app
    · spawned com.devolverdigital.cultofthelamb via SBS (pid=1871)
    · decrypted main CultOfTheLamb (16.0 KB)
    · symtab patches: 2 (Diagnostics::error ret)
  ✗ assemble: helper exit 132
  ✓ uninstalled com.devolverdigital.cultofthelamb

I am currently confused why this specific app causes the helper to exit, because most Apple Arcade game with a higher version that the current iDevice don't support (currently tested iOS 15 and iOS 17) can be decrypted without any problems. I also tried to decrypt a separate app named Infomaniak kDrive (https://apps.apple.com/ch/app/infomaniak-kdrive/id1482778676?l=en-GB) that requires at least iOS 16 (the same minimum required version for this game) that did work, except of possible bug regression after an update that may relates to issue #23 and may have unintentionally broke some Framework decryption. --no-verify can be passed but it will simply crash itself due to critical missing Frameworks after the sideloading and attempts to open the app.

C:\Users\User>ipadecrypt --redact decrypt https://apps.apple.com/us/app/infomaniak-kdrive/id1482778676
  ✓ ipadecrypt v0.7.2 · mobile@192.168.1.94 iOS 14.7.1 arm64 iPhone10,4 (unknown)
  ✓ signed in as ###### (###### storefront)
  ✓ found com.infomaniak.drive on App Store
  ✓ cached com.infomaniak.drive_5.13.1.ipa
  ✓ patched Info.plist
  ✓ MinimumOSVersion 16.0 → 14.7.1
  ✓ installed → /var/containers/Bundle/Application/41CB0AE2-7B32-45EB-87F4-9AA3937C8AAB/kDrive.app
    · spawned com.infomaniak.drive via SBS (pid=2811)
    · decrypted main kDrive (3.5 MB)
    · symtab patches: 2 (Diagnostics::error ret)
    · target trapped: EXC_CRASH (skips=0 pac_strips=0)
    · decrypted Frameworks/AppLock.framework/AppLock (48.0 KB)
    · decrypted Frameworks/Atlantis.framework/Atlantis (192.0 KB)
    · decrypted Frameworks/DesignSystem.framework/DesignSystem (16.0 KB)
    · decrypted Frameworks/DeviceAssociation.framework/DeviceAssociation (32.0 KB)
    · decrypted Frameworks/DifferenceKit.framework/DifferenceKit (96.0 KB)
    · decrypted Frameworks/InAppTwoFactorAuthentication.framework/InAppTwoFactorAuthentication (144.0 KB)
    · decrypted Frameworks/InfomaniakBugTracker.framework/InfomaniakBugTracker (240.0 KB)
    · decrypted Frameworks/InfomaniakConcurrency.framework/InfomaniakConcurrency (48.0 KB)
    · decrypted Frameworks/InfomaniakCoreCommonUI.framework/InfomaniakCoreCommonUI (272.0 KB)
    · decrypted Frameworks/InfomaniakCoreDB.framework/InfomaniakCoreDB (16.0 KB)
    · decrypted Frameworks/InfomaniakCoreSwiftUI.framework/InfomaniakCoreSwiftUI (576.0 KB)
    · decrypted Frameworks/InfomaniakCoreUIKit.framework/InfomaniakCoreUIKit (80.0 KB)
    · decrypted Frameworks/InfomaniakDeviceCheck.framework/InfomaniakDeviceCheck (48.0 KB)
    · decrypted Frameworks/InfomaniakNotifications.framework/InfomaniakNotifications (48.0 KB)
    · decrypted Frameworks/InfomaniakOnboarding.framework/InfomaniakOnboarding (80.0 KB)
    · decrypted Frameworks/InterAppLogin.framework/InterAppLogin (128.0 KB)
    · decrypted Frameworks/KSuite.framework/KSuite (64.0 KB)
    · decrypted Frameworks/KSuiteUtils.framework/KSuiteUtils (48.0 KB)
    · decrypted Frameworks/LocalizeKit.framework/LocalizeKit (32.0 KB)
    · decrypted Frameworks/MaterialOutlinedTextField.framework/MaterialOutlinedTextField (32.0 KB)
    · decrypted Frameworks/MyKSuite.framework/MyKSuite (144.0 KB)
    · decrypted Frameworks/Nuke.framework/Nuke (416.0 KB)
    · decrypted Frameworks/Realm.framework/Realm (3.8 MB)
    · decrypted Frameworks/RealmSwift.framework/RealmSwift (656.0 KB)
    · decrypted Frameworks/SwiftRegex.framework/SwiftRegex (16.0 KB)
    · decrypted Frameworks/_LottieStub.framework/_LottieStub (16.0 KB)
    · decrypted Frameworks/kDriveCore.framework/kDriveCore (3.1 MB)
    · decrypted Frameworks/kDriveResources.framework/kDriveResources (368.0 KB)
    · decrypted Frameworks/Lottie.framework/Lottie (1.8 MB)
    · target dlopen unresolved  inject skipped
    · bundle done: 29 framework(s) decrypted
    · spawned /var/containers/Bundle/Application/41CB0AE2-7B32-45EB-87F4-9AA3937C8AAB/kDrive.app/PlugIns/kDriveActionExtension.appex/kDriveActionExtension via ptrace (pid=2812)
    · decrypted main kDriveActionExtension (1.9 MB)
    · spawned /var/containers/Bundle/Application/41CB0AE2-7B32-45EB-87F4-9AA3937C8AAB/kDrive.app/PlugIns/kDriveShareExtension.appex/kDriveShareExtension via ptrace (pid=2814)
    · decrypted main kDriveShareExtension (1.9 MB)
    · spawned /var/containers/Bundle/Application/41CB0AE2-7B32-45EB-87F4-9AA3937C8AAB/kDrive.app/PlugIns/kDriveFileProvider.appex/kDriveFileProvider via ptrace (pid=2816)
    · decrypted main kDriveFileProvider (160.0 KB)
  ✓ decrypted 33 image(s): 4 main, 29 framework (47.3 MB → C:\Users\Public\com.infomaniak.drive_5.13.1.decrypted.ipa)
  ✗ verify failed: 8 still encrypted
    Payload/kDrive.app/Frameworks/InfomaniakLogin.framework/InfomaniakLogin still encrypted (cryptid != 0)
    Payload/kDrive.app/Frameworks/InfomaniakCoreUIResources.framework/InfomaniakCoreUIResources still encrypted (cryptid != 0)
    Payload/kDrive.app/Frameworks/Sentry.framework/Sentry still encrypted (cryptid != 0)
    Payload/kDrive.app/Frameworks/InfomaniakDI.framework/InfomaniakDI still encrypted (cryptid != 0)
    Payload/kDrive.app/Frameworks/Alamofire.framework/Alamofire still encrypted (cryptid != 0)
    Payload/kDrive.app/Frameworks/InfomaniakCore.framework/InfomaniakCore still encrypted (cryptid != 0)
    Payload/kDrive.app/Frameworks/NukeUI.framework/NukeUI still encrypted (cryptid != 0)
    Payload/kDrive.app/Frameworks/VersionChecker.framework/VersionChecker still encrypted (cryptid != 0)
  ✓ uninstalled com.infomaniak.drive

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't workinghelp wantedExtra attention is needed

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions