PyPI - ipa-forge - Versions diffs - 0.1.0__py3-none-any.whl - Mend

ipa-forge 0.1.0__py3-none-any.whl

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (62) hide show

ipa_forge/__init__.py +1 -0
ipa_forge/altstore/__init__.py +1 -0
ipa_forge/altstore/source.py +44 -0
ipa_forge/analysis/__init__.py +18 -0
ipa_forge/analysis/classdump.py +103 -0
ipa_forge/analysis/diff.py +127 -0
ipa_forge/analysis/security.py +72 -0
ipa_forge/analysis/strings.py +40 -0
ipa_forge/analysis/symbols.py +42 -0
ipa_forge/analysis/type_encoding.py +164 -0
ipa_forge/bundle/__init__.py +1 -0
ipa_forge/bundle/inventory.py +96 -0
ipa_forge/bundle/ipa.py +81 -0
ipa_forge/bundle/models.py +58 -0
ipa_forge/bundle/plist.py +18 -0
ipa_forge/cli/__init__.py +1 -0
ipa_forge/cli/analysis.py +225 -0
ipa_forge/cli/common.py +41 -0
ipa_forge/cli/hooks.py +357 -0
ipa_forge/cli/main.py +170 -0
ipa_forge/gui/__init__.py +1 -0
ipa_forge/gui/analysis.html +229 -0
ipa_forge/gui/app.py +304 -0
ipa_forge/gui/index.html +244 -0
ipa_forge/hooks/__init__.py +0 -0
ipa_forge/hooks/scan.py +81 -0
ipa_forge/hooks/verify.py +348 -0
ipa_forge/machO/__init__.py +1 -0
ipa_forge/machO/arch.py +94 -0
ipa_forge/machO/detect.py +50 -0
ipa_forge/machO/injector.py +99 -0
ipa_forge/machO/objc.py +534 -0
ipa_forge/manifest.py +74 -0
ipa_forge/patch/__init__.py +1 -0
ipa_forge/patch/base.py +48 -0
ipa_forge/patch/binary.py +131 -0
ipa_forge/patch/dylib.py +59 -0
ipa_forge/patch/engine.py +48 -0
ipa_forge/patch/loader.py +88 -0
ipa_forge/patch/paths.py +19 -0
ipa_forge/patch/plist.py +61 -0
ipa_forge/patch/resolver.py +37 -0
ipa_forge/patch/resource.py +135 -0
ipa_forge/patch/schema.py +118 -0
ipa_forge/patch/version.py +25 -0
ipa_forge/patches.py +76 -0
ipa_forge/pipeline.py +235 -0
ipa_forge/signing/__init__.py +1 -0
ipa_forge/signing/backend.py +111 -0
ipa_forge/signing/pipeline.py +99 -0
ipa_forge/signing/profile.py +131 -0
ipa_forge/signing/provider.py +113 -0
ipa_forge/signing/reconcile.py +27 -0
ipa_forge/validators/__init__.py +1 -0
ipa_forge/validators/archive_validator.py +25 -0
ipa_forge/validators/bundle_validator.py +27 -0
ipa_forge/validators/ipa_validator.py +39 -0
ipa_forge-0.1.0.dist-info/METADATA +914 -0
ipa_forge-0.1.0.dist-info/RECORD +62 -0
ipa_forge-0.1.0.dist-info/WHEEL +4 -0
ipa_forge-0.1.0.dist-info/entry_points.txt +2 -0
ipa_forge-0.1.0.dist-info/licenses/LICENSE +674 -0

ipa_forge/gui/analysis.html ADDED Viewed

@@ -0,0 +1,229 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <meta name="color-scheme" content="light dark" />
+    <title>ipa-forge — Reverse Engineering</title>
+    <style>
+      :root {
+        --accent: #0071e3;
+        --accent-hover: #0077ed;
+        --bg: #f5f5f7;
+        --card: #ffffff;
+        --text: #1d1d1f;
+        --text-secondary: #6e6e73;
+        --border: rgba(0, 0, 0, 0.12);
+        --shadow: 0 8px 30px rgba(0, 0, 0, 0.08);
+        --danger: #ff3b30;
+        --danger-bg: rgba(255, 59, 48, 0.12);
+        --mono-bg: #f5f5f7;
+      }
+      @media (prefers-color-scheme: dark) {
+        :root {
+          --bg: #000000;
+          --card: #1c1c1e;
+          --text: #f5f5f7;
+          --text-secondary: #98989d;
+          --border: rgba(255, 255, 255, 0.16);
+          --shadow: 0 8px 30px rgba(0, 0, 0, 0.6);
+          --accent: #0a84ff;
+          --accent-hover: #3a9bff;
+          --mono-bg: #000000;
+        }
+      }
+      * { box-sizing: border-box; }
+      body {
+        margin: 0;
+        font-family: -apple-system, "SF Pro Text", "Helvetica Neue", sans-serif;
+        background: var(--bg);
+        color: var(--text);
+        padding: 24px;
+      }
+      .card {
+        background: var(--card);
+        border-radius: 18px;
+        box-shadow: var(--shadow);
+        padding: 32px;
+        max-width: 900px;
+        margin: 0 auto;
+      }
+      h1 { font-size: 22px; margin: 0 0 4px; }
+      .subtitle { color: var(--text-secondary); font-size: 13px; margin: 0 0 20px; }
+      .subtitle a { color: var(--accent); }
+      label { display: block; font-size: 13px; font-weight: 600; margin: 14px 0 6px; }
+      select, input[type="text"], input[type="number"], input[type="file"] {
+        width: 100%;
+        padding: 10px 12px;
+        border-radius: 10px;
+        border: 1px solid var(--border);
+        background: var(--card);
+        color: var(--text);
+        font-size: 14px;
+      }
+      .row { display: flex; gap: 12px; }
+      .row > * { flex: 1; }
+      .hidden { display: none; }
+      button {
+        margin-top: 18px;
+        padding: 12px 20px;
+        border: none;
+        border-radius: 12px;
+        background: var(--accent);
+        color: #fff;
+        font-size: 14px;
+        font-weight: 600;
+        cursor: pointer;
+      }
+      button:hover { background: var(--accent-hover); }
+      button:disabled { opacity: 0.5; cursor: default; }
+      .status {
+        margin-top: 14px;
+        border-radius: 10px;
+        padding: 10px 14px;
+        font-size: 13px;
+        display: none;
+      }
+      .status.error { display: block; background: var(--danger-bg); color: var(--danger); }
+      pre {
+        margin-top: 16px;
+        background: var(--mono-bg);
+        border: 1px solid var(--border);
+        border-radius: 10px;
+        padding: 16px;
+        max-height: 60vh;
+        overflow: auto;
+        font-size: 12px;
+        line-height: 1.5;
+        white-space: pre-wrap;
+        word-break: break-word;
+      }
+    </style>
+  </head>
+  <body>
+    <div class="card">
+      <h1>ipa-forge — Reverse Engineering</h1>
+      <p class="subtitle">Read-only static analysis of an IPA. Back to <a href="/">the patcher</a>.</p>
+      <label for="action">Action</label>
+      <select id="action">
+        <option value="classdump">Class-dump (Objective-C runtime metadata)</option>
+        <option value="strings">Strings</option>
+        <option value="security">Security posture</option>
+        <option value="diff">Diff two versions</option>
+      </select>
+      <div id="fieldsSingle">
+        <label for="fileSingle">IPA</label>
+        <input type="file" id="fileSingle" accept=".ipa" />
+      </div>
+      <div id="fieldsDiff" class="hidden">
+        <label for="fileOld">Old-version IPA</label>
+        <input type="file" id="fileOld" accept=".ipa" />
+        <label for="fileNew">New-version IPA</label>
+        <input type="file" id="fileNew" accept=".ipa" />
+      </div>
+      <div id="fieldsClassdump" class="row">
+        <div>
+          <label for="className">Class name (exact)</label>
+          <input type="text" id="className" placeholder="e.g. YTPlayerViewController" />
+        </div>
+        <div>
+          <label for="classSearch">Search (regex)</label>
+          <input type="text" id="classSearch" placeholder="e.g. ^YT" />
+        </div>
+      </div>
+      <div id="fieldsStrings" class="row hidden">
+        <div>
+          <label for="minLen">Min length</label>
+          <input type="number" id="minLen" value="4" min="1" />
+        </div>
+        <div>
+          <label for="stringsSearch">Search (regex)</label>
+          <input type="text" id="stringsSearch" placeholder="e.g. https?://" />
+        </div>
+      </div>
+      <button id="runBtn">Run</button>
+      <div class="status error" id="status"></div>
+      <pre id="output" class="hidden"></pre>
+    </div>
+    <script>
+      const action = document.getElementById("action");
+      const fieldsSingle = document.getElementById("fieldsSingle");
+      const fieldsDiff = document.getElementById("fieldsDiff");
+      const fieldsClassdump = document.getElementById("fieldsClassdump");
+      const fieldsStrings = document.getElementById("fieldsStrings");
+      const runBtn = document.getElementById("runBtn");
+      const status = document.getElementById("status");
+      const output = document.getElementById("output");
+      function updateFields() {
+        const a = action.value;
+        fieldsSingle.classList.toggle("hidden", a === "diff");
+        fieldsDiff.classList.toggle("hidden", a !== "diff");
+        fieldsClassdump.classList.toggle("hidden", a !== "classdump");
+        fieldsStrings.classList.toggle("hidden", a !== "strings");
+      }
+      action.addEventListener("change", updateFields);
+      updateFields();
+      runBtn.addEventListener("click", async () => {
+        status.style.display = "none";
+        output.classList.add("hidden");
+        const a = action.value;
+        const fd = new FormData();
+        let url = "/analysis/" + a;
+        if (a === "diff") {
+          const oldFile = document.getElementById("fileOld").files[0];
+          const newFile = document.getElementById("fileNew").files[0];
+          if (!oldFile || !newFile) {
+            status.textContent = "Select both IPAs.";
+            status.style.display = "block";
+            return;
+          }
+          fd.append("old", oldFile);
+          fd.append("new", newFile);
+        } else {
+          const file = document.getElementById("fileSingle").files[0];
+          if (!file) {
+            status.textContent = "Select an IPA.";
+            status.style.display = "block";
+            return;
+          }
+          fd.append("ipa", file);
+          if (a === "classdump") {
+            const cn = document.getElementById("className").value.trim();
+            const cs = document.getElementById("classSearch").value.trim();
+            if (cn) fd.append("class_name", cn);
+            if (cs) fd.append("search", cs);
+          } else if (a === "strings") {
+            fd.append("min_len", document.getElementById("minLen").value || "4");
+            const ss = document.getElementById("stringsSearch").value.trim();
+            if (ss) fd.append("search", ss);
+          }
+        }
+        runBtn.disabled = true;
+        try {
+          const res = await fetch(url, { method: "POST", body: fd });
+          const data = await res.json();
+          if (!res.ok) {
+            status.textContent = data.error || "Request failed.";
+            status.style.display = "block";
+            return;
+          }
+          output.textContent = data.text || "(empty)";
+          output.classList.remove("hidden");
+        } finally {
+          runBtn.disabled = false;
+        }
+      });
+    </script>
+  </body>
+</html>

ipa_forge/gui/app.py ADDED Viewed

@@ -0,0 +1,304 @@
+# SPDX-License-Identifier: GPL-3.0-or-later
+"""Local web GUI wrapping the same ipa_forge.pipeline used by the CLI.
+Novice flow: pick an IPA file -> the GUI auto-detects the app and the
+matching patch set, warns (non-blocking) if the patch set targets a
+different version, then one "Patch" button produces an unsigned IPA for
+AltStore. No signing identity, no profiles, no YAML editing required.
+Single-user, local-only: request state lives in module-level dicts. The page
+is a self-contained static template (gui/index.html) with an inline fetch
+flow — no build step, works offline.
+"""
+from __future__ import annotations
+import json
+import shutil
+import tempfile
+import uuid
+from importlib.metadata import PackageNotFoundError
+from importlib.metadata import version as _installed_version
+from pathlib import Path
+from fastapi import FastAPI, File, Form, UploadFile
+from fastapi.responses import FileResponse, HTMLResponse, JSONResponse
+from ipa_forge.analysis.classdump import render_analysis
+from ipa_forge.analysis.diff import diff_analyses, render_diff
+from ipa_forge.analysis.security import analyze_security, render_security_posture
+from ipa_forge.analysis.strings import strings_in_bundle
+from ipa_forge.bundle.ipa import load_bundle, validate_and_extract
+from ipa_forge.machO.objc import analyze_bundle
+from ipa_forge.patches import find_patch_sets_for_bundle
+from ipa_forge.pipeline import PipelineError, run_pipeline
+from ipa_forge.validators.ipa_validator import IpaValidationError
+app = FastAPI(title="ipa-forge")
+_WORK_DIR = Path(tempfile.mkdtemp(prefix="ipa_forge_gui_"))
+_outputs: dict[str, tuple[Path, str]] = {}
+_OUTPUTS_MAX = 20
+# GUI textarea sanity cap -- the CLI (forge analysis strings) has no limit
+# and pipes to grep instead; a browser tab rendering a multi-million-line
+# response is a different failure mode worth guarding against here only.
+_STRINGS_GUI_LIMIT = 2000
+def _package_version() -> str:
+    try:
+        return _installed_version("ipa-forge")
+    except PackageNotFoundError:
+        return "0.1.0"
+_FORM_HTML = (
+    (Path(__file__).parent / "index.html").read_text(encoding="utf-8").replace("__VERSION__", _package_version())
+)
+_ANALYSIS_HTML = (
+    (Path(__file__).parent / "analysis.html").read_text(encoding="utf-8").replace("__VERSION__", _package_version())
+)
+@app.get("/", response_class=HTMLResponse)
+def index() -> str:
+    return _FORM_HTML
+@app.get("/analysis", response_class=HTMLResponse)
+def analysis_page() -> str:
+    return _ANALYSIS_HTML
+@app.post("/detect")
+async def detect(ipa: UploadFile = File(...)) -> JSONResponse:
+    """Analyze an uploaded IPA: bundle id, version, matching patch sets, and
+    a version-mismatch warning (informational — patching is still allowed)."""
+    request_dir = _WORK_DIR / uuid.uuid4().hex
+    request_dir.mkdir(parents=True)
+    try:
+        ipa_path = request_dir / Path(ipa.filename or "upload.ipa").name
+        ipa_path.write_bytes(await ipa.read())
+        try:
+            app_path = validate_and_extract(ipa_path, request_dir / "extracted")
+            bundle = load_bundle(app_path)
+        except (ValueError, IpaValidationError) as e:
+            return JSONResponse(status_code=400, content={"error": str(e)})
+        patch_sets = []
+        for ps in find_patch_sets_for_bundle(bundle.bundle_id):
+            match = ps.version_exact is None or ps.version_exact == bundle.version
+            patch_sets.append(
+                {
+                    "name": ps.name,
+                    "target_version": ps.version_exact or ps.version_spec,
+                    "matches": match,
+                }
+            )
+        return JSONResponse(
+            {
+                "bundle_id": bundle.bundle_id,
+                "version": bundle.version,
+                "build": bundle.build,
+                "patch_sets": patch_sets,
+                # a warning when the app has a patch set but the version differs
+                "mismatch": bool(patch_sets) and not any(p["matches"] for p in patch_sets),
+            }
+        )
+    finally:
+        shutil.rmtree(request_dir, ignore_errors=True)
+@app.post("/patch")
+async def patch(
+    ipa: UploadFile = File(...),
+    patch_set: str = Form(...),
+    identity: str | None = Form(None),
+    profile: list[UploadFile] | None = File(None),
+    dry_run: bool = Form(False),
+    no_sign: bool = Form(True),
+) -> JSONResponse:
+    """Patch an IPA with a discovered patch set. Defaults to unsigned output
+    for AltStore (no identity/profile needed); the version-mismatch warning
+    is non-blocking — the hooks gate still guards what attaches."""
+    request_dir = _WORK_DIR / uuid.uuid4().hex
+    request_dir.mkdir(parents=True)
+    try:
+        ipa_path = request_dir / Path(ipa.filename or "upload.ipa").name
+        ipa_path.write_bytes(await ipa.read())
+        from ipa_forge.patches import discover_patch_sets
+        definition = None
+        for ps in discover_patch_sets():
+            if ps.name == patch_set:
+                definition = ps.definition
+                break
+        if definition is None:
+            return JSONResponse(status_code=400, content={"error": f"unknown patch set '{patch_set}'"})
+        profile_paths: list[Path] = []
+        if not dry_run and not no_sign:
+            if not identity or not identity.strip():
+                return JSONResponse(status_code=400, content={"error": "identity is required for signed output"})
+            if not profile:
+                return JSONResponse(
+                    status_code=400, content={"error": "at least one profile is required for signed output"}
+                )
+            profile_dir = request_dir / "profiles"
+            profile_dir.mkdir()
+            for i, upload in enumerate(profile or []):
+                dest = profile_dir / f"{i}_{Path(upload.filename or 'profile.mobileprovision').name}"
+                dest.write_bytes(await upload.read())
+                profile_paths.append(dest)
+        output_path = request_dir / f"patched_{ipa_path.name}"
+        try:
+            result = run_pipeline(
+                ipa_path,
+                definition,
+                identity or "",
+                profile_paths,
+                output_path,
+                dry_run=dry_run,
+                no_sign=no_sign,
+                allow_version_mismatch=True,
+            )
+        except PipelineError as e:
+            return JSONResponse(status_code=400, content={"error": str(e)})
+        response: dict = {"manifest": json.loads(result.manifest.to_json())}
+        if result.output_path is not None:
+            token = uuid.uuid4().hex
+            final_path = _WORK_DIR / f"{token}.ipa"
+            result.output_path.replace(final_path)
+            _outputs[token] = (final_path, f"patched_{ipa_path.name}")
+            _evict_outputs()
+            response["download_url"] = f"/download/{token}"
+        return JSONResponse(response)
+    finally:
+        shutil.rmtree(request_dir, ignore_errors=True)
+def _evict_outputs() -> None:
+    while len(_outputs) > _OUTPUTS_MAX:
+        token = next(iter(_outputs))
+        path, _ = _outputs.pop(token)
+        path.unlink(missing_ok=True)
+@app.get("/download/{token}", response_model=None)
+def download(token: str) -> FileResponse | JSONResponse:
+    entry = _outputs.get(token)
+    if entry is None:
+        return JSONResponse(status_code=404, content={"error": "not found"})
+    path, display_name = entry
+    if not path.is_file():
+        return JSONResponse(status_code=404, content={"error": "not found"})
+    return FileResponse(path, filename=display_name)
+async def _extract_uploaded(request_dir: Path, ipa: UploadFile, name: str = "upload.ipa") -> Path | JSONResponse:
+    """Save + extract an uploaded IPA; returns the app path or a 400
+    JSONResponse on a structural/plist error, for the analysis endpoints
+    below to return directly."""
+    ipa_path = request_dir / Path(ipa.filename or name).name
+    ipa_path.write_bytes(await ipa.read())
+    try:
+        return validate_and_extract(ipa_path, request_dir / "extracted")
+    except (ValueError, IpaValidationError) as e:
+        return JSONResponse(status_code=400, content={"error": str(e)})
+@app.post("/analysis/classdump")
+async def analysis_classdump(
+    ipa: UploadFile = File(...),
+    class_name: str | None = Form(None),
+    search: str | None = Form(None),
+) -> JSONResponse:
+    """Read-only Objective-C class-dump view -- same engine as
+    `forge analysis classdump`, browsable without installing the CLI."""
+    request_dir = _WORK_DIR / uuid.uuid4().hex
+    request_dir.mkdir(parents=True)
+    try:
+        app_path = await _extract_uploaded(request_dir, ipa)
+        if isinstance(app_path, JSONResponse):
+            return app_path
+        analysis = analyze_bundle(load_bundle(app_path))
+        text = render_analysis(analysis, class_filter=class_name or None, search=search or None)
+        return JSONResponse({"text": text or "no matching classes/protocols/categories found"})
+    finally:
+        shutil.rmtree(request_dir, ignore_errors=True)
+@app.post("/analysis/strings")
+async def analysis_strings(
+    ipa: UploadFile = File(...),
+    min_len: int = Form(4),
+    search: str | None = Form(None),
+) -> JSONResponse:
+    """Printable-string extraction across every executable in the bundle,
+    capped at `_STRINGS_GUI_LIMIT` matches for the browser (the CLI has no
+    such cap)."""
+    request_dir = _WORK_DIR / uuid.uuid4().hex
+    request_dir.mkdir(parents=True)
+    try:
+        app_path = await _extract_uploaded(request_dir, ipa)
+        if isinstance(app_path, JSONResponse):
+            return app_path
+        found = strings_in_bundle(load_bundle(app_path), min_len=min_len)
+        if search:
+            import re
+            pat = re.compile(search)
+            found = [s for s in found if pat.search(s.value)]
+        total = len(found)
+        found = found[:_STRINGS_GUI_LIMIT]
+        text = "\n".join(f"[{s.binary}] {s.value}" for s in found)
+        if total > len(found):
+            text += f"\n… truncated ({total} total; use the CLI for the full list)"
+        return JSONResponse({"text": text or "no strings found"})
+    finally:
+        shutil.rmtree(request_dir, ignore_errors=True)
+@app.post("/analysis/security")
+async def analysis_security(ipa: UploadFile = File(...)) -> JSONResponse:
+    """PIE/encryption-flag/stack-protector/ARC posture of the main
+    executable -- detection only, this never decrypts anything."""
+    request_dir = _WORK_DIR / uuid.uuid4().hex
+    request_dir.mkdir(parents=True)
+    try:
+        app_path = await _extract_uploaded(request_dir, ipa)
+        if isinstance(app_path, JSONResponse):
+            return app_path
+        bundle = load_bundle(app_path)
+        posture = analyze_security(bundle.root / bundle.main_executable_name)
+        return JSONResponse({"text": render_security_posture(posture)})
+    finally:
+        shutil.rmtree(request_dir, ignore_errors=True)
+@app.post("/analysis/diff")
+async def analysis_diff(old: UploadFile = File(...), new: UploadFile = File(...)) -> JSONResponse:
+    """Version-to-version survey between two uploaded builds -- same engine
+    as `forge analysis diff`."""
+    request_dir = _WORK_DIR / uuid.uuid4().hex
+    (request_dir / "old").mkdir(parents=True)
+    (request_dir / "new").mkdir(parents=True)
+    try:
+        old_path = await _extract_uploaded(request_dir / "old", old, "old.ipa")
+        if isinstance(old_path, JSONResponse):
+            return old_path
+        new_path = await _extract_uploaded(request_dir / "new", new, "new.ipa")
+        if isinstance(new_path, JSONResponse):
+            return new_path
+        bundle_old = load_bundle(old_path)
+        bundle_new = load_bundle(new_path)
+        diff = diff_analyses(
+            analyze_bundle(bundle_old), analyze_bundle(bundle_new), bundle_old.info_plist, bundle_new.info_plist
+        )
+        header = f"{bundle_old.bundle_id} {bundle_old.version} -> {bundle_new.version}\n"
+        return JSONResponse({"text": header + render_diff(diff)})
+    finally:
+        shutil.rmtree(request_dir, ignore_errors=True)