Skip to content

v2.4.0

Choose a tag to compare

View all tags
@bahattinkoc bahattinkoc released this 07 Sep 13:53
· 18 commits to main since this release
v2.4.0
ec382a9

ipaverse 2.4

Version 2.4 is a major update focused on authorized iOS security research, safer IPA processing, improved re-signing, and broader device compatibility.

What’s New

Reverse Engineer Workspace

  • Added local static security analysis with severity-based findings.

  • Detects exposed secrets, insecure configurations, suspicious endpoints, entitlements, anti-analysis techniques, and common cryptographic issues.

  • Sensitive values are redacted by default.

  • Reports can be exported as Markdown or JSON.

  • Added an Objective-C class browser with optional method resolution through radare2.

  • Added live Frida-powered tools:

    • SSL pinning, jailbreak detection, and biometric bypass helpers
    • Method tracing with argument and return-value logging
    • NSURLSession request and response interception
    • Live UI hierarchy inspection and on-device element highlighting
    • Editable NSUserDefaults values
    • Keychain metadata inspection
    • Sandbox database and plist file downloads

  • Added a Tools section for managing optional utilities such as radare2, Ghidra, Hopper, mitmproxy, Frida CLI, Objection, and libimobiledevice tools.

Frida and Decryption

  • Added optional Frida Gadget injection for testing re-signed apps on non-jailbroken devices.
  • Added Dump Decrypted Copy for authorized analysis using a jailbroken source device with frida-server.
  • Improved dumping of encrypted frameworks and embedded libraries.
  • Frida binaries are downloaded only when needed, verified using pinned file sizes and SHA-256 hashes, and cached locally.
  • Added clearer guidance for apps that terminate after detecting Frida.

Re-signing Improvements

  • Added a standalone Resign window.
  • Added Move to New Identity for migrating bundle identifiers and App Groups across plist files, configuration files, and compatible binary strings.
  • Added framework removal support.
  • Improved certificate and provisioning-profile compatibility checks.
  • Improved handling of malformed IPAs, executable discovery, binary string replacement, and signing failures.
  • Added source tags for re-signed and decrypted apps.

Device Installation

  • Added USB installation support for devices running iOS/iPadOS 16 and earlier through a bundled libimobiledevice fallback.
  • Improved device discovery, connection-state handling, and compatibility checks.
  • Added clearer warnings for minimum OS requirements and Apple Account-bound FairPlay apps.
  • Fixed “Any Mac” Archive builds attempting to link the arm64-only Unicorn library as x86_64.

Evil Mode

Security-sensitive features are now protected behind Evil Mode, including:

  • Reverse Engineer
  • Frida Gadget injection
  • Dump Decrypted Copy
  • Security Testing Mode
  • Move to New Identity
  • Framework removal

Disabling Evil Mode also terminates active live instrumentation sessions.

Security and Reliability

  • Added safer archive extraction with size, entry-count, path-traversal, and symlink protections.
  • Improved temporary-file cleanup and Frida session lifecycle management.
  • Added stricter process matching before attaching to a running app.
  • Improved sensitive-data redaction in debug network logs.
  • Fixed several race conditions, pipe deadlocks, signing errors, and malformed-IPA edge cases.
  • Updated privacy, licensing, security, contribution, and usage documentation.

Requirements

  • Apple Silicon Mac
  • macOS 14.6 or later
  • Device installation supports iPhone and iPad over USB or Wi-Fi
  • Live Frida features require a compatible connected device or a Gadget-injected app
  • Decrypted-copy dumping requires a jailbroken source device with frida-server
Assets 4
Loading