getIPA

Pull an app off your own jailbroken iPhone and package it as an .ipa — in one command.

getipa connects to your device over SSH, lists your installed App Store apps (newest first) (system apps filtered out), and builds a ready-to-use IPA. It automates the manual ssh → cd → cp → zip → scp routine, and flags the one thing that routine silently gets wrong: FairPlay encryption.

A tool by rudranetra.com · website: rudranetra.com/tools/getipa · more tools at rudranetra.com/tools

Features

• Interactive – just run getipa; it asks for username, device IP and password, then shows your apps.
• Recent first – apps sorted by install/update time; system apps (com.apple.*) excluded by default.
• One-shot or scripted – flags and environment variables for automation.
• Built-in app report – permissions, entitlements, ATS settings, URL schemes, frameworks and encryption status, for a fresh extraction or any local IPA.
• Verified decryption, with self-repair – after a decrypted dump, getipa checks the main binary and frameworks. bagbak sometimes leaves a small FairPlay region untouched (cryptid=1); getipa then reads just that region from the running app with Frida (read-only), patches it in and re-verifies. If a full dump fails on an app extension, it retries with the main app only. Anything still encrypted is reported loudly.
• Encrypted or decrypted – your choice – --decrypted / --encrypted / auto. Decryption is done by bagbak, which is bundled (installed by ./install.sh).
• Hardened against a hostile device – treats everything coming back from the phone as untrusted (see Security).
• Zero dependencies – Python 3.9+ standard library and your system ssh.

Requirements

Install

With pipx (recommended):

pipx install getipa
getipa --install-bagbak     # one-time: fetches the pinned bagbak (needs Node.js/npm) for decrypted dumps

--install-bagbak runs npm ci against the lockfile shipped in the package and installs into ~/.local/share/getipa — nothing is installed globally. Skip it if you only want encrypted copies.

From a clone:

git clone https://github.com/RansomWhisker/getIPA.git
cd getIPA
./install.sh            # links getipa into ~/.local/bin AND installs the bundled bagbak

install.sh does the same pinned npm ci (see getipa_cli/npm/package-lock.json) inside the clone. Skip it with SKIP_BAGBAK=1 ./install.sh.

For decrypted IPAs you also need frida-server on the iPhone: install it from your jailbreak's package manager (Sileo / Zebra — add the Frida repo https://build.frida.re if it isn't listed), make sure it's running, and keep its version in step with the Frida version bagbak bundles. If getipa --decrypted fails, this is the first thing to check.

If the bundled install fails, it is almost always Frida's native module not downloading (network reset) or lacking a prebuilt binary for your Node version. Re-run ./install.sh, or switch to Node 20/22 LTS (nvm install 22).

Windows: use pipx install getipa (needs Python and the built-in OpenSSH client). Windows OpenSSH can't share one connection, so each step logs in separately: an SSH key (--key) is the smoothest. Password login works through a small helper but is less tested than macOS/Linux. install.sh is Unix-only.

Make sure ~/.local/bin is on your PATH (the installer tells you if it isn't).

Usage

Interactive

getipa

Username [root]: root
Device IP (just the last number works, e.g. 9 = 192.168.1.9): 9
[*] Using 192.168.1.9
Password (blank = use SSH key/prompt):

Recently installed apps (newest first):
  1. 2026-11-04 18:22  com.example.app        2.4.1      Example
  2. ...
Pick a number (or Enter to quit): 1
[+] Wrote ipas/com.example.app_2.4.1.ipa

Shorthand: typing just 9 means 192.168.1.9, and 0.5 means 192.168.0.5 (works for --host too). Full IPs and hostnames are used as typed.

Flags

getipa --host 192.168.1.9 --list                 # list only
getipa --host 192.168.1.9 -b com.example.app     # by bundle ID or name substring
getipa --host 127.0.0.1 --port 2222 --list       # USB via `iproxy 2222 22`
getipa --host 192.168.1.9 --key ~/.ssh/id_ed25519 -n 25

Environment defaults: GETIPA_HOST, GETIPA_PORT, GETIPA_USER, SSH_PASSWORD.

App report

getipa --info-file ./ipas/com.example.app_2.4.1.ipa     # offline, any IPA
getipa -b com.example.app --info                         # extract + report

== Example (com.example.app) ==
Version        2.4.1 (build 301)
Min iOS        15.0
Encrypted      YES (FairPlay, cryptid=1)
ATS            customised: {NSAllowsArbitraryLoads}  <-- insecure
Permissions    2
    NSCameraUsageDescription: Scan codes
Entitlements   2
    aps-environment: production
Frameworks     1

About encryption

Apps installed from the App Store are FairPlay-encrypted on disk. A plain file copy gives you an IPA whose main binary can't be disassembled. getIPA lets you choose:

In interactive mode, getipa asks which one you want after you pick an app.

Security

getipa talks to a device you may not fully trust (jailbroken phones run lots of third-party code), so it validates what comes back:

• Usernames/hosts are validated so they can't be parsed as ssh options (no -oProxyCommand=… tricks).
• All remote paths are shell-quoted and restricted to the app-container directories.
• The tar stream from the device is extracted defensively: no path traversal, symlinks/hardlinks/devices skipped, permissions normalised.
• Device-supplied names are sanitised before being printed or used in filenames or the bagbak command line.
• One SSH connection is opened (control socket in a private 0700 directory) and reused; passwords go to ssh via a short-lived SSH_ASKPASS helper — never on the command line, never written to disk.
• No telemetry. At runtime the only network traffic is your SSH connection (and Frida, if you ask for a decrypted dump). The bundled bagbak is pinned to an exact version with a lockfile; install.sh is the only step that downloads anything.

Good hygiene on your side: change the default alpine password, prefer SSH keys, and only run this on a trusted network. Found a vulnerability? See SECURITY.md.

Responsible use

For use only on devices you own and apps you are authorized to analyze — your own apps, security research, interoperability, and personal backup, where the law permits. Don't use it to pirate software or circumvent licensing. You are responsible for complying with applicable laws and the terms of the software you handle.

Banner and colour

On a terminal each run starts with a short logo, the version and links. It goes to stderr, so piped output and --json stay clean. Hide it with --no-banner or NO_BANNER=1; NO_COLOR=1 turns colour off and NO_ANIM=1 skips the animation.

Troubleshooting

License

MIT © Rudranetra India Private Limited — rudranetra.com