ipatool (DrWhax Fork): App Store CLI with Native FairPlay Decryption Pipeline & MCP Integration

UnfairPlay contains code originally developed in the ipatool project and its
DrWhax FairPlay research fork through commit 60208cf. That code is used under
the MIT License; see LICENSE.

The in-process AES differential-fault recovery code was adapted from the
Apache-2.0 DarkPhoenix project. See LICENSE-DARKPHOENIX.txt and the source-file
notices.

Apple, FairPlay, macOS, iOS, and App Store are trademarks of Apple Inc. This
project is independent and is not affiliated with or endorsed by Apple.

go build -o unfairplay ./cmd/unfairplay

sudo ./unfairplay collect \
  --app /Applications/App.app \
  --ipa App.ipa \
  --output App.capture

./unfairplay recover \
  --capture App.capture \
  --output App.recovery

./unfairplay decrypt \
  --input AnotherApp.ipa \
  --model App.recovery/fairplay-enrollment.bin

./unfairplay verify \
  --input AnotherApp.ipa \
  --model App.recovery/fairplay-enrollment.bin

$ brew install ipatool

$ ipatool --help
A cli tool for interacting with Apple's ipa files

Usage:
  ipatool [command]

Available Commands:
  auth                 Authenticate with the App Store
  completion           Generate the autocompletion script for the specified shell
  download             Download iOS, iPadOS, tvOS, watchOS, visionOS, and macOS app packages from the App Store
  get-version-metadata Retrieves the metadata for a specific version of an app
  help                 Help about any command
  list-purchases       List apps owned by the authenticated App Store account
  list-versions        List the available versions of an App Store app
  mcp                  Serve App Store tools over MCP using stdio
  purchase             Obtain a license for the app from the App Store
  search               Search for iOS, iPadOS, tvOS, watchOS, visionOS, and macOS apps available on the App Store

Flags:
      --format format                sets output format for command; can be 'text', 'json' (default text)
  -h, --help                         help for ipatool
      --keychain-passphrase string   passphrase for unlocking keychain
      --non-interactive              run in non-interactive session
      --verbose                      enables verbose logs
  -v, --version                      version for ipatool

Use "ipatool [command] --help" for more information about a command.

{
  "mcpServers": {
    "ipatool": {
      "command": "ipatool",
      "args": ["mcp"]
    }
  }
}

$ go build -o ipatool

$ go generate ./...
$ go test -v ./...

---
id: 10324
title: "ipatool (DrWhax Fork): App Store CLI with Native FairPlay Decryption Pipeline & MCP Integration"
cve: null
cvss: null
severity: unknown
vendor: "DrWhax / majd"
product: "ipatool / UnfairPlay"
affected_versions: null
source_domain: github.com
source_url: "https://github.com/drwhax/ipatool"
published_at: "2026-10-25T00:22:41Z"
snapshot_at: "2026-10-26T03:13:00Z"
archived_by: "Phying News (https://phying.com/item/10324)"
lang: en
---

# ipatool (DrWhax Fork / UnfairPlay): App Store CLI with Native FairPlay Decryption Pipeline & MCP Integration

*By [DrWhax (Jurre van Bergen)](https://github.com/DrWhax) & [majd (Majd Alfhaily)](https://github.com/majd) · October 25, 2026 · Source: [github.com/drwhax/ipatool](https://github.com/drwhax/ipatool) / [github.com/DrWhax/unfairplay](https://github.com/DrWhax/unfairplay)*

> [!NOTE]
> **Repository Evolution Note:** The FairPlay enrollment recovery and offline IPA decryption pipeline originally developed in the `drwhax/ipatool` research fork (through commit `60208cf`) has been extracted into the standalone companion tool **[DrWhax/unfairplay](https://github.com/DrWhax/unfairplay)**, designed to work alongside **[ipatool](https://github.com/majd/ipatool)**. Both components and their full CLI documentation are preserved below.

---

## Part 1: UnfairPlay — Native FairPlay Model Recovery & IPA Decryption (`DrWhax/unfairplay`)

UnfairPlay recovers a FairPlay model from an enrolled Mac and uses it to decrypt personalized iOS IPAs. It is a standalone Go program.

It does not log in to Apple, buy apps, or download IPAs. You can use `ipatool` or another downloader for that part.

### Provenance & Notice (`NOTICE`)

```text
UnfairPlay contains code originally developed in the ipatool project and its
DrWhax FairPlay research fork through commit 60208cf. That code is used under
the MIT License; see LICENSE.

The in-process AES differential-fault recovery code was adapted from the
Apache-2.0 DarkPhoenix project. See LICENSE-DARKPHOENIX.txt and the source-file
notices.

Apple, FairPlay, macOS, iOS, and App Store are trademarks of Apple Inc. This
project is independent and is not affiliated with or endorsed by Apple.
```

### Build

```sh
go build -o unfairplay ./cmd/unfairplay
```

### Usage

First, sign in to the native Mac App Store. Install an iPhone or iPad app and open it once. Download an encrypted IPA with the same Apple Account (e.g., via `ipatool`).

Collect the Mac state and matching IPA:

```sh
sudo ./unfairplay collect \
  --app /Applications/App.app \
  --ipa App.ipa \
  --output App.capture
```

Recover the model and validate it:

```sh
./unfairplay recover \
  --capture App.capture \
  --output App.recovery
```

Decrypt another IPA from the same enrollment:

```sh
./unfairplay decrypt \
  --input AnotherApp.ipa \
  --model App.recovery/fairplay-enrollment.bin
```

Test a model without keeping the decrypted IPA:

```sh
./unfairplay verify \
  --input AnotherApp.ipa \
  --model App.recovery/fairplay-enrollment.bin
```

Use `unfairplay doctor` to check a capture, IPA, or model. Use `unfairplay profile` to inspect a `fairplayd` binary.

### CLI Subcommands & Flags Reference (`cmd/unfairplay/main.go`)

| Subcommand | Description | Key Flags |
| --- | --- | --- |
| `collect` | Collect one private native Mac App Store enrollment bundle | `--app` (required, `.app` path), `--ipa` (matching encrypted IPA), `--output` (required, capture dir), `--installed-executable-path`, `--fairplayd` (defaults to system CoreFP framework), `--system-state` (System `SC Info` dir), `--shared-state` (Shared `SC Info` dir), `--adi-state` (Native ADI state dir), `--iomac-file` (6-byte `IOMACAddress` file), `--interface` (default `en0`), `--product-version`, `--build-version` |
| `recover` | Recover and validate a private enrollment model from a capture | `--capture` (required, private capture dir), `--output` (required, new private recovery dir) |
| `decrypt` | Decrypt a personalized IPA with a recovered enrollment model | `--input` (required, encrypted `.ipa`), `--model` (required, model file or dir), `--output` (default `<stem>.decrypted.ipa`), `--report` (default `<stem>.decrypted.json`), `--force` |
| `verify` | Validate an enrollment model against an IPA without retaining plaintext | `--input` (required, encrypted `.ipa`), `--model` (required, model file or dir) |
| `doctor` | Diagnose capture, SINF, model, and build compatibility | `--capture`, `--ipa`, `--model`, `--report` (JSON diagnostic report) |
| `profile` | Inspect an `arm64e` `fairplayd` Mach-O binary without executing it | `--binary` (required, `arm64e` or universal `fairplayd` Mach-O), `--output` (JSON profile) |

### Support & Security Notes

Verified profiles: `25G83`, `26A428`/`26A434`, and `26B118` compatibility mode. Unknown `arm64e` builds are accepted only if model recovery and full IPA validation succeed.

macOS `arm64` and Linux `amd64`/`arm64` are supported. Windows is compile-tested but cannot yet enforce the required private-file permissions.

The IPA, installed app, Mac state, hardware identity, and model must belong to the same enrollment. Account or selector mismatches are rejected.

Keep capture and model files private. Do not share `SIDB`, `SINF`, hardware data, recovery models, or decrypted apps. Decrypted IPAs are analysis files and need signing before installation.

### Releases & License

Tags matching `v*` publish binaries and `SHA256SUMS` through GitHub Actions. Tags such as `v0.2.0-rc.1` create prereleases.

License: MIT. The DarkPhoenix-derived Go code keeps its Apache-2.0 notice in `LICENSE-DARKPHOENIX.txt`.

---

## Part 2: `ipatool` — App Store CLI & MCP Server Integration

`ipatool` is a command line tool that allows you to search for iOS, iPadOS, tvOS, watchOS, visionOS, and macOS apps on the [App Store](https://apps.apple.com), and download `.ipa` or macOS `.pkg` app packages.

### Requirements

- A supported operating system (macOS, Linux, Windows or iOS).
- An Apple Account already configured to use the App Store.

### Installation

#### Linux and Windows

You can grab the latest version of `ipatool` from [GitHub releases](https://github.com/majd/ipatool/releases).

#### macOS

You can install `ipatool` using [Homebrew](https://brew.sh).

```shell
$ brew install ipatool
```

### Usage

To get started, run the following command.

```text
$ ipatool --help
A cli tool for interacting with Apple's ipa files

Usage:
  ipatool [command]

Available Commands:
  auth                 Authenticate with the App Store
  completion           Generate the autocompletion script for the specified shell
  download             Download iOS, iPadOS, tvOS, watchOS, visionOS, and macOS app packages from the App Store
  get-version-metadata Retrieves the metadata for a specific version of an app
  help                 Help about any command
  list-purchases       List apps owned by the authenticated App Store account
  list-versions        List the available versions of an App Store app
  mcp                  Serve App Store tools over MCP using stdio
  purchase             Obtain a license for the app from the App Store
  search               Search for iOS, iPadOS, tvOS, watchOS, visionOS, and macOS apps available on the App Store

Flags:
      --format format                sets output format for command; can be 'text', 'json' (default text)
  -h, --help                         help for ipatool
      --keychain-passphrase string   passphrase for unlocking keychain
      --non-interactive              run in non-interactive session
      --verbose                      enables verbose logs
  -v, --version                      version for ipatool

Use "ipatool [command] --help" for more information about a command.
```

**Note:** the tool runs in interactive mode by default. Use the `--non-interactive` flag if running in an automated environment.

### MCP tools

Run `ipatool auth login` in a terminal, then configure your MCP client to launch the stdio server:

```json
{
  "mcpServers": {
    "ipatool": {
      "command": "ipatool",
      "args": ["mcp"]
    }
  }
}
```

### Compiling

The tool can be compiled using the Go toolchain.

```shell
$ go build -o ipatool
```

Unit tests can be executed with the following commands.

```shell
$ go generate ./...
$ go test -v ./...
```

---
> 📦 **Full-Text Markdown Snapshot** archived by [Phying News](https://phying.com/item/10324) · Original source: [github.com](https://github.com/drwhax/ipatool)