About the author. I’m Colin Xiao — an independent reverse engineer, mostly working solo on contract jobs. I dig into compiled code of every kind, including but not limited to: Android and iOS apps, x86/x64/ARM native binaries, packers and obfuscators, DRM and license checks, network protocols and APIs, crypto and signature algorithms, malware, game binaries, and embedded/IoT firmware. I also handle large-scale data collection and vulnerability research. If you have any project in mind, I’d be glad to take it on — whatever it is, as long as it’s within my wheelhouse. Just reach out. You can reach me on X at @colinxiao_lab or on Telegram at https://t.me/ColinXiao666.

This research is published for educational and defensive purposes. The target sample is anonymized throughout.

iOS App Decryption with dumpdecrypted

0. Install dumpdecrypted.dylib

Download it from https://github.com/stefanesser/dumpdecrypted/archive/master.zip and copy it to the device under /var/mobile/.

1. Decrypt from the command line

You can SSH into the device, or just use an on-device terminal app:

DYLD_INSERT_LIBRARIES=dumpdecrypted.dylib /var/containers/Bundle/Application/877B345E-2058-40C1-B800-4622800D7165/NetworkSniffer.app/NetworkSniffer

The dumper runs and prints:

mach-o decryption dumper

Decryption succeeded

The decrypted file is written to the current working directory as <target binary>.decrypted. Remove the .decrypted suffix and fix permissions:

chmod -R 777 <binary>

Verify the shell is gone — the cryptid must be 0:

otool -l <binary> | grep crypt

2. “Killed: 9” while decrypting

This usually means the dylib isn’t signed. Sign it:

security find-identity -v -p codesigning  # list available local certificates

codesign --force --verify --verbose --sign "iPhone Developer:" dumpdecrypted.dylib  # sign the dylib

Colin Xiao — I take on contract reverse-engineering work, and writeups like this are how I show what I can do. If you need help with anything in this space — including but not limited to the areas I cover above — I’m available. No project is too big or too small — if it’s reverse engineering and I can do it, I’ll take it. DM me on X (@colinxiao_lab) or Telegram (@ColinXiao666).

Get in touch