|
1 | 1 | # VFDecrypt |
2 | 2 |
|
3 | | -[VFDecrypt](https://www.theiphonewiki.com/wiki/VFDecrypt) is used to decrypt Apple iOS root filesystem images. Root filesystem images inside IPSW files are encrypted for iOS >= 9. Since iOS 10, root filesystem images are not encrypted and VFDecrypt is no longer required. |
| 3 | +[VFDecrypt](https://www.theiphonewiki.com/wiki/VFDecrypt) is used to decrypt Apple iOS root filesystem images. |
| 4 | +Root filesystem images inside IPSW files are encrypted for iOS >= 9. |
| 5 | +Since iOS 10, root filesystem images are not encrypted and VFDecrypt is no longer required. |
4 | 6 |
|
5 | | -Decrypting root filesystem images requires the decryption key. This is provided for most root filesystem images version by the community at [The iPhone Wiki](https://www.theiphonewiki.com/wiki/Firmware_Keys). |
| 7 | +Decrypting root filesystem images requires the decryption key. |
| 8 | +This is provided for most root filesystem images version by the community at [The iPhone Wiki](https://www.theiphonewiki.com/wiki/Firmware_Keys). |
6 | 9 |
|
7 | | -There are several VFDecrypt builds available on the Internet. We've used and updated the implementation [here](https://github.com/trailofbits/iverify-oss/tree/master/vendor/vfdecrypt). We've updated `vfdecrypt.c` to support OpenSSL >= 1.1.0 and the `Makefile` to be OS-dependent. |
| 10 | +There are several VFDecrypt builds available on the internet. |
| 11 | +We've used and updated the implementation [here](https://github.com/trailofbits/iverify-oss/tree/master/vendor/vfdecrypt). |
| 12 | +We've updated `vfdecrypt.c` to support OpenSSL >= 1.1.0 and the `Makefile` to be OS-dependent. |
8 | 13 |
|
9 | | -You build `vfdecrypt` using |
| 14 | +### Dependencies |
| 15 | + |
| 16 | +To build and run vfdecrypt locally, you need to install the following dependencies: |
| 17 | + |
| 18 | +* macOS |
10 | 19 |
|
| 20 | +```console |
| 21 | +brew install openssl make |
11 | 22 | ``` |
12 | | -make |
| 23 | + |
| 24 | +* Ubuntu/Debian |
| 25 | + |
| 26 | +```console |
| 27 | +sudo apt-get update |
| 28 | +sudo apt-get install -y build-essential libssl-dev coreutils |
| 29 | +``` |
| 30 | + |
| 31 | +* Fedora/RHEL/CentOS |
| 32 | + |
| 33 | +```console |
| 34 | +sudo dnf install -y gcc gcc-c++ make openssl-devel coreutils |
13 | 35 | ``` |
14 | 36 |
|
15 | | -You runn `vfdecrypt` by passing it the root filesystem key, the root filesystem image and the output (decrypted) file: |
| 37 | +* Arch Linux |
16 | 38 |
|
| 39 | +```console |
| 40 | +sudo pacman -S base-devel openssl coreutils |
17 | 41 | ``` |
| 42 | + |
| 43 | +You build `vfdecrypt` using |
| 44 | + |
| 45 | +```console |
| 46 | +make |
| 47 | +``` |
| 48 | + |
| 49 | +You run `vfdecrypt` by passing it the root filesystem key, the root filesystem image and the output (decrypted) file: |
| 50 | + |
| 51 | +```console |
18 | 52 | ./vfdecrypt -i ~/Projects/store/out/iPhone5,1_9.3_13E237/058-25512-331.dmg -k 2a66fd6377af8f60d5e300ac3aa8d9c44a1c0dee94579ad3f8a26515debbf381bb971ae8 -o decrypted.dmg |
19 | 53 | ``` |
20 | 54 |
|
21 | 55 | iExtractor runs `vfdecrypt` as part of the `bin/decrypt_fs` and `scripts/decrypt_fs` scripts. |
22 | 56 |
|
23 | 57 | The usage inside iExtractor: |
24 | 58 |
|
25 | | -``` |
| 59 | +```console |
26 | 60 | docker run -v "<input_absolute_path>":/in -v "<output_absolute_path>":/out -t ghcr.io/malus-security/vfdecrypt:latest -k<rootfs_key> /in /out > /dev/null 2>&1 |
27 | 61 | ``` |
0 commit comments