--- id: 10324 title: "ipatool (DrWhax Fork): App Store CLI with Native FairPlay Decryption Pipeline & MCP Integration" cve: null cvss: null severity: unknown vendor: "DrWhax / majd" product: "ipatool / UnfairPlay" affected_versions: null source_domain: github.com source_url: "https://github.com/drwhax/ipatool" published_at: "2026-10-25T00:22:41Z" snapshot_at: "2026-10-26T03:13:00Z" archived_by: "Phying News (https://phying.com/item/10324)" lang: en --- # ipatool (DrWhax Fork / UnfairPlay): App Store CLI with Native FairPlay Decryption Pipeline & MCP Integration *By [DrWhax (Jurre van Bergen)](https://github.com/DrWhax) & [majd (Majd Alfhaily)](https://github.com/majd) · October 25, 2026 · Source: [github.com/drwhax/ipatool](https://github.com/drwhax/ipatool) / [github.com/DrWhax/unfairplay](https://github.com/DrWhax/unfairplay)* > [!NOTE] > **Repository Evolution Note:** The FairPlay enrollment recovery and offline IPA decryption pipeline originally developed in the `drwhax/ipatool` research fork (through commit `60208cf`) has been extracted into the standalone companion tool **[DrWhax/unfairplay](https://github.com/DrWhax/unfairplay)**, designed to work alongside **[ipatool](https://github.com/majd/ipatool)**. Both components and their full CLI documentation are preserved below. --- ## Part 1: UnfairPlay — Native FairPlay Model Recovery & IPA Decryption (`DrWhax/unfairplay`) UnfairPlay recovers a FairPlay model from an enrolled Mac and uses it to decrypt personalized iOS IPAs. It is a standalone Go program. It does not log in to Apple, buy apps, or download IPAs. You can use `ipatool` or another downloader for that part. ### Provenance & Notice (`NOTICE`) ```text UnfairPlay contains code originally developed in the ipatool project and its DrWhax FairPlay research fork through commit 60208cf. That code is used under the MIT License; see LICENSE. The in-process AES differential-fault recovery code was adapted from the Apache-2.0 DarkPhoenix project. See LICENSE-DARKPHOENIX.txt and the source-file notices. Apple, FairPlay, macOS, iOS, and App Store are trademarks of Apple Inc. This project is independent and is not affiliated with or endorsed by Apple. ``` ### Build ```sh go build -o unfairplay ./cmd/unfairplay ``` ### Usage First, sign in to the native Mac App Store. Install an iPhone or iPad app and open it once. Download an encrypted IPA with the same Apple Account (e.g., via `ipatool`). Collect the Mac state and matching IPA: ```sh sudo ./unfairplay collect \ --app /Applications/App.app \ --ipa App.ipa \ --output App.capture ``` Recover the model and validate it: ```sh ./unfairplay recover \ --capture App.capture \ --output App.recovery ``` Decrypt another IPA from the same enrollment: ```sh ./unfairplay decrypt \ --input AnotherApp.ipa \ --model App.recovery/fairplay-enrollment.bin ``` Test a model without keeping the decrypted IPA: ```sh ./unfairplay verify \ --input AnotherApp.ipa \ --model App.recovery/fairplay-enrollment.bin ``` Use `unfairplay doctor` to check a capture, IPA, or model. Use `unfairplay profile` to inspect a `fairplayd` binary. ### CLI Subcommands & Flags Reference (`cmd/unfairplay/main.go`) | Subcommand | Description | Key Flags | | --- | --- | --- | | `collect` | Collect one private native Mac App Store enrollment bundle | `--app` (required, `.app` path), `--ipa` (matching encrypted IPA), `--output` (required, capture dir), `--installed-executable-path`, `--fairplayd` (defaults to system CoreFP framework), `--system-state` (System `SC Info` dir), `--shared-state` (Shared `SC Info` dir), `--adi-state` (Native ADI state dir), `--iomac-file` (6-byte `IOMACAddress` file), `--interface` (default `en0`), `--product-version`, `--build-version` | | `recover` | Recover and validate a private enrollment model from a capture | `--capture` (required, private capture dir), `--output` (required, new private recovery dir) | | `decrypt` | Decrypt a personalized IPA with a recovered enrollment model | `--input` (required, encrypted `.ipa`), `--model` (required, model file or dir), `--output` (default `.decrypted.ipa`), `--report` (default `.decrypted.json`), `--force` | | `verify` | Validate an enrollment model against an IPA without retaining plaintext | `--input` (required, encrypted `.ipa`), `--model` (required, model file or dir) | | `doctor` | Diagnose capture, SINF, model, and build compatibility | `--capture`, `--ipa`, `--model`, `--report` (JSON diagnostic report) | | `profile` | Inspect an `arm64e` `fairplayd` Mach-O binary without executing it | `--binary` (required, `arm64e` or universal `fairplayd` Mach-O), `--output` (JSON profile) | ### Support & Security Notes Verified profiles: `25G83`, `26A428`/`26A434`, and `26B118` compatibility mode. Unknown `arm64e` builds are accepted only if model recovery and full IPA validation succeed. macOS `arm64` and Linux `amd64`/`arm64` are supported. Windows is compile-tested but cannot yet enforce the required private-file permissions. The IPA, installed app, Mac state, hardware identity, and model must belong to the same enrollment. Account or selector mismatches are rejected. Keep capture and model files private. Do not share `SIDB`, `SINF`, hardware data, recovery models, or decrypted apps. Decrypted IPAs are analysis files and need signing before installation. ### Releases & License Tags matching `v*` publish binaries and `SHA256SUMS` through GitHub Actions. Tags such as `v0.2.0-rc.1` create prereleases. License: MIT. The DarkPhoenix-derived Go code keeps its Apache-2.0 notice in `LICENSE-DARKPHOENIX.txt`. --- ## Part 2: `ipatool` — App Store CLI & MCP Server Integration `ipatool` is a command line tool that allows you to search for iOS, iPadOS, tvOS, watchOS, visionOS, and macOS apps on the [App Store](https://apps.apple.com), and download `.ipa` or macOS `.pkg` app packages. ### Requirements - A supported operating system (macOS, Linux, Windows or iOS). - An Apple Account already configured to use the App Store. ### Installation #### Linux and Windows You can grab the latest version of `ipatool` from [GitHub releases](https://github.com/majd/ipatool/releases). #### macOS You can install `ipatool` using [Homebrew](https://brew.sh). ```shell $ brew install ipatool ``` ### Usage To get started, run the following command. ```text $ ipatool --help A cli tool for interacting with Apple's ipa files Usage: ipatool [command] Available Commands: auth Authenticate with the App Store completion Generate the autocompletion script for the specified shell download Download iOS, iPadOS, tvOS, watchOS, visionOS, and macOS app packages from the App Store get-version-metadata Retrieves the metadata for a specific version of an app help Help about any command list-purchases List apps owned by the authenticated App Store account list-versions List the available versions of an App Store app mcp Serve App Store tools over MCP using stdio purchase Obtain a license for the app from the App Store search Search for iOS, iPadOS, tvOS, watchOS, visionOS, and macOS apps available on the App Store Flags: --format format sets output format for command; can be 'text', 'json' (default text) -h, --help help for ipatool --keychain-passphrase string passphrase for unlocking keychain --non-interactive run in non-interactive session --verbose enables verbose logs -v, --version version for ipatool Use "ipatool [command] --help" for more information about a command. ``` **Note:** the tool runs in interactive mode by default. Use the `--non-interactive` flag if running in an automated environment. ### MCP tools Run `ipatool auth login` in a terminal, then configure your MCP client to launch the stdio server: ```json { "mcpServers": { "ipatool": { "command": "ipatool", "args": ["mcp"] } } } ``` ### Compiling The tool can be compiled using the Go toolchain. ```shell $ go build -o ipatool ``` Unit tests can be executed with the following commands. ```shell $ go generate ./... $ go test -v ./... ``` --- > 📦 **Full-Text Markdown Snapshot** archived by [Phying News](https://phying.com/item/10324) · Original source: [github.com](https://github.com/drwhax/ipatool)