Massive Start-To-Finish Cracking and Releasing Guide
This guide way made by: _Ky_!
Rather than have 90 guides and new crackers not knowing where to start, I decided to write this one massive guide that will take you from the very beginning of having a jailbroken iPhone and a purchased app, to releasing a ******* APP package and ******* IPA package with all the bells and whistles.
Who can follow this guide?
My attempt is to make this as easy as possible for anyone to do, but note that I
am going to assume that you are computer literate, you know what 'ssh' is, and you know the basics of working on a UNIX command line such as the Mac, Linux, or iPhone terminal. If I've already lost you, I recommend reading up on some of these things and playing around before attempting something this in-depth

.
What do I need?
1: A jailbroken iPhone or iPod Touch with the 2.0 firmware. Jailbreaking is outside the scope of this guide -- consult Google if you need to do this. Also, I'll be referring to this device as an iPhone throughout this tutorial -- but if you have an iPod Touch, it's all the same
2: A few packages from Cydia:
OpenSSH, GNU Debugger, and Link Identity Editor. If you're not working on a Mac with Developer Tools installed, you'll also want the
iPhone 2.0 Toolchain.
3: A network connection. Your computer needs to be able to connect to your phone for this process, so you'll want them both on the same network.
4: A file transfer application that supports SFTP (also known as SSH-FTP). WinSCP for Windows is good, as are Transmit (Shareware, but excellent) and Cyberduck (Free) for Mac, and gFTP for Linux. Test it by setting up a connection to your iPhone (get your iPhone's IP address from Settings --> Wi-Fi --> Right-arrow next to your wifi conneciton --> IP Address) over the SFTP protocol. The username for the connection is 'root', and the default password is 'alpine'.
5: A terminal application. Mac users can find theirs in /Applications/Utilities, Linux users already know where theirs is, and Windows users can download PuTTY. Mac/Linux users can get an ssh connection by typing '
ssh root@1.2.3.4' where 1.2.3.4 is the IP address of the phone, then typing 'alpine' for the password. Windows users will use PuTTY's interface to set up the connection, then type 'root' when asked what user to sign in as. Test this now -- I'll assume you can already do this in the guide.
6: A hex editor. 0xED is a fantastic free one for Mac. Windows and Linux users can find their own -- there are no less than 60 out there for each platform.
7: A legitimately purchased app from the app store! You can ONLY crack apps that you personally have already bought yourself, because cracking requires running the app on your phone before it's *******. There is NO POSSIBLE WAY to crack an app that was given to you by someone else, unless they also feel like giving you their iTunes account name and password.
8: Last but not least, you need to know my shorthand. Just know that wherever I type 'ProgName', you should substitute for the name of the program you're trying to crack
Got all that? Let's get started! [Cracking the App]
1: Make a folder on your desktop called "working".
2: Open your SFTP client and connect to your iPhone (if you can't connect, wake up the screen). Navigate to /var/mobile/Applications. You'll see a bunch of folders with extremely long, gibberish names. Go into each of these until you find the one that has the .app you'd like to crack. Once you've found it, download the entire .app, along with the "iTunesArtwork" file (if you intend to make an IPA release), to your "working" folder.
3-4 (Mac users with Dev Tools ONLY): You can skip to step 4 and follow it locally on your computer in the Terminal window. It's far more convenient

. Skip everything about copying files to the iPhone.
3: in your SFTP program, navigate to /var/root. Open the ProgName.app folder you just downloaded (Mac users will have to right-click -->
Show Package Contents to do this) and find the file that is simply named ProgName. This is the executable. Upload it to /var/root on your phone.
4: Open an SSH connection to your phone with the terminal program. Navigate to /var/root by typing
and pressing Enter (note that you should already be there -- we're just playing it safe). Now we need to get all the info about the encryption on ProgName. Type the following:
Code:
otool -l ProgName.app/ProgName | grep crypt
5: The last step will have given you at least three lines, each starting with crypt and ending with a number. They look something like this:
Code:
cryptoff 4096
cryptsize 163840
cryptid 1
Your 'cryptoff' should match this one -- it should be 4096. If it's not, stop here. Your app is a new beast we haven't encountered yet, and it can't be ******* with this method. 'cryptsize' is a very important number we'll be working with soon -- yours will probably not match mine. 'cryptid' should be a 1 at this point, meaning the app is encrypted. In this step, we'll be changing that to a 0.
Open up your Hex editor and load your local copy of ProgName.app/ProgName. In nearly all Hex editors, the left side of the window will have a bunch of numbers that are simply indicies -- numbers that tell you where you are in the file. Scroll down until you get to number 800 (which may be written as 000800, 0x00800, or a variety of other ways). The right side of the window should show you what the text at this location looks like. Look for a bunch of lines that all start with
/System/Library/Frameworks. Now look above them until you find the first one. Somewhere not far above where that first one starts, you'll find a pair of hexadecimal digits that are '01'. There will be more than one of these -- refer to my screenshot to get an idea of about where to look:

Once you find the pair that you think is it, change it to '00' instead of '01' (
NOTE: OVERWRITE the 01, do NOT 'insert' the 00 before or after it!) and save.
6: Repeat steps 3-4. If your 'cryptid' is now showing a 0, you've done it correctly! If not, no sweat. Go back to your hex editor and change that pair back to '01' (or just download a fresh copy of the unaltered .app from your phone again) and look for another 01 in the same area to try. Keep doing this until you can get that cryptid to 0 -- this is a learned skill!
7: Time for some calculations. Take the number you got for 'cryptsize' in step 5 and add 8192 to it. Got that? Great! Now convert that number to hexadecimal. A quick way to do this is pasting it into this website:
[Only Registered and Activated Users Can See Links. Click Here To Register...] . That was easy, right?
8: Now comes the fun part: we're going to break iTunes' DRM on your app. Open an SSH connection to your phone again (if you still have it from before, just type 'cd' and press enter to go back to /var/root). If you can, widen your terminal window a bit, because you're about to deal with some long lines of text. On your phone, run the program you want to crack. Once it's running, type the following into your ssh connection and press Enter:
You'll get a massive list of every running process on your phone. It looks similar to this:
Code:
PID TT STAT TIME COMMAND
1 ?? s 0:00.00 /sbin/launchd
12 ?? s 0:00.00 /usr/sbin/mDNSResponder -launchd
13 ?? s 0:00.00 /usr/sbin/notifyd
14 ?? s 0:00.00 /usr/sbin/syslogd
15 ?? s 0:00.00 /usr/sbin/configd
19 ?? s 0:00.00 /usr/sbin/update
20 ?? s 0:00.00 /usr/libexec/lockdownd
23 ?? s 0:00.00 /System/Library/PrivateFrameworks/IAP.framework/Support/iapd
24 ?? s 0:00.00 /usr/sbin/fairplayd
28 ?? s 0:00.00 /System/Library/PrivateFrameworks/CoreTelephony.framework/Support/CommCenter
29 ?? s 0:00.00 /usr/sbin/BTServer
819 ?? s 0:00.00 /usr/sbin/mediaserverd
1325 ?? s 0:00.00 /System/Library/CoreServices/SpringBoard.app/SpringBoard
1327 ?? s 0:00.00 /var/stash/Applications.1SLxl9/MobilePhone.app/MobilePhone
1695 ?? s 0:00.00 /var/stash/Applications.1SLxl9/MobileMail.app/MobileMail
1705 ?? s 0:00.00 /System/Library/Frameworks/SystemConfiguration.framework/SCHelper
1790 ?? s 0:00.00 /var/mobile/Applications/3015A1D1-0421-31A2-2DD9-15E0A2F235A1/iJezzball.app/iJezzball
1791 ?? s 0:00.00 /usr/libexec/launchproxy /usr/sbin/sshd -i
1792 ?? 0:00.00 /usr/sbin/sshd -i
1797 ?? s 0:00.00 /usr/libexec/amfid
1793 s000 s 0:00.00 -sh
1798 s000 + 0:00.00 ps ax
The very first column that says PID is what we're interested in. PID stands for Process ID, and it's a number that gets assigned to each running process. One of these processes is the currently running app, so scan down through the final column (COMMAND) until you find your app. In my case, the app I ran is iJezzball, and its pid is 1790. Make a note of your PID.
In your terminal window, type the following -- but
replace the letters PID with the actual PID number you just found:
So, for example, I would type:
And the app on my iPhone freezes, and this is what happens in the terminal window:
Code:
GNU gdb 6.3.50.20050815-cvs (Sun Jul 27 11:34:56 UTC 2008)
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB. Type "show warranty" for details.
This GDB was configured as "--host=arm-apple-darwin9 --target=".
warning: --arch option not supported in this gdb.
/private/var/root/1790: No such file or directory.
Attaching to process 1790.
Reading symbols for shared libraries . done
warning: Unable to read symbols from "iJezzball" (not yet mapped into memory).
Reading symbols for shared libraries ................................................ done
warning: Unable to read symbols from "iJezzball" (not yet mapped into memory).
0x32446f68 in mach_msg_trap ()
(gdb)
Once you're at the (gdb) prompt, enter the following line. Replace the letters STEPSEVEN with the hexadecimal number we ended up with in step 7

:
Code:
dump memory dump.bin 0x2000 0xSTEPSEVEN
Now press enter, and if all goes well, all you'll see is a (gdb) prompt. At this point, just enter 'quit' and answer 'y' to the question it asks. You'll be back at the normal SSH prompt and the program on your iPhone will spring back to life
Before we move on, though, let's check ourselves. Type
Code:
ls -l | grep dump.bin
at the command prompt and take note of the number that appears just before the date. This number absolutely must match the 'cryptsize' number from step 3, or you've done something wrong! If it doesn't match, there is absolutely no chance that continuing on with this guide will work. You need to start over at step 1.. sorry
9: Fire up your SFTP client again and navigate to /var/root. Now there should be a file called 'dump.bin' there. Download this to your "working" folder.
10: Here comes the excitement! We're about to crack the program. Open dump.bin up in your hex editor. Go to Edit --> Select All and then Edit --> Copy to copy the entire contents of this file to your clipboard. Now open ProgName.app/ProgName (if it's not already open) and find offset 0x1000 just like you found offset 0x800 before. Click on the exact spot the hex editor says 1000 is. Note my screenshot:

Also note that the status bar at the bottom verifies that I'm on offset 1000.
IMPORTANT: your Hex editor MUST be in
overwrite mode for this, NOT insert. Each hex editor is different, so do what you can to make sure that when you type, you're overwriting what's there -- not inserting before it.
Paste the contents of your clipboard to this spot and save.
11: Time to test our ******* app! Fire up your SFTP client again and navigate to /Applications . Upload your entire ProgName.app to this folder.
Now open an SSH connection and type the following commands. This will "sign" your ******* program as well as set the appropriate permissions on it. Remember to replace ProgName with the actual program name!
Code:
cd /Applications
chmod -R 775 ProgName.app
ldid -s ProgName.app/ProgName
If you haven't done this to install a ******* .app before, we're going to need to create two folders for the program to store its data in:
Code:
mkdir Documents /var/mobile/Documents
chmod 777 Documents /var/mobile/Documents
Finally, type the following to restart your phone's interface so it reads the new programs in:
Code:
killall SpringBoard
NOTE: When SpringBoard restarts, it reads the apps in /Applications in FIRST, then it reads all the applications that were installed with the App Store or iTunes. It will only show apps that it didn't already find in /Applications. This means that you do NOT need to delete your original purchased app from your phone, and NO information will be erased from it. The iPhone will simply try to launch the version in /Applications when you tap the icon.
And now you can tap the icon for your program, and if it runs, you've done everything correctly! The program is *******! But you're not done yet...
12: Delete ProgName.app from your "working" folder. Open your SFTP client and download your signed, ******* ProgName.app from the /Applications folder. You're now free to delete ProgName.app from /Applications entirely, and restart SpringBoard with your favorite method ('killall SpringBoard' again works just fine) to get your paid, legit version back.
13: Open the new ProgName.app folder in your "working" folder (again, mac users right-click and
Show Package Contents). Delete the following two folders if they appear in there:
SC_Info and
_CodeResources. SC_Info and potentially _CodeResources contain highly sensitive iTunes account information -- like your account name, real name, and other things Apple can use to sue the crap out of you until you're forced to sell your firstborn child.
It is very important that you trash these. (Note that it's not been confirmed that _CodeResources contains sensitive info, but it is not required for the app to run, so we might as well trash it anyway.)
14: Pop open a beer. You, my friend, have just ******* your very first app. Now let's find out how to release it!
Creating a .APP release
This is definitely the easier of the two ways to release a ******* app, and it can be as simple as two steps. Let's get started:
1: When an App Store application is installed into the /Applications folder, it misses the iPhone's process of rounding the corners of the icon and adding the glassy shine. Sometimes this is fine, because occasionally, as with programs like Trism, the icon in the package
already has rounded corners. If your program already has rounded corners, you can skip to step 8 now. The rest of you, continue on! (Note that your icon doesn't HAVE to have rounded corners, but it's a bad release if it doesn't. You went to all this trouble to crack it, now release it right!)
2: Open iTunes on your computer and find your application in the iTunes Music Store. On the application's page, find the app icon at the top-left corner of the page and right-click it. Now choose "Copy iTunes Store URL". Your clipboard now contains something like this:
Code:
http://phobos.apple.com/WebObjects/MZStore.woa/wa/viewSoftware?id=284962368&mt=8
3: Paste that somewhere (in your browser or a text editor) and replace the section that says
with this:
Code:
ax.phobos.apple.com.edgesuite.net
Go to the resulting URL in your browser.
4: Do a search on that page for the text:
Safari users will have to right-click the page and select "View Source" before searching for the above text.
Once the text is found, copy the entire URL it's in to your clipboard. For example, this is the URL I ended up with:
Code:
http://a1.phobos.apple.com/us/r30/Purple/fe/c1/bc/mzl.gpjkgpje.100x100-75.jpg
5: Paste the URL from the last step into your browser again, but change the end "jpg" to "png". The image that loads will be the official, Apple-provided, rounded-corner and glass-shined icon for the program. Save it to your computer.
6: The only thing wrong with the icon is that it's not the correct size! It's currently 100x100 pixels, but needs to be shrunken down to 57x57. Use your favorite image editing application to do this -- Photoshop if you have it, but if not, any program that can resize a .png file and save it while keeping the corners transparent will work. When you save this file, save it as 'Icon.png' -- with a capital 'I'. This file is case-sensitive.
7: Open up your ******* and signed .app that you saved to your "working" folder in the last tutorial and look for a file called Icon.png there. Rename it to Icon-square.png, then copy your new Icon.png into the folder.
8: Now it's time to pack it all up! Simply zip the ProgName.app folder up (either zip or rar is fine), and then rename it to ProgName.app.zip (or rar, if you used that method). Having .app.zip is a good naming convention that tells people that this is NOT an ipa file.
9: Upload your file to a popular, ANONYMOUS file-sharing service. Mediafire.com is great with no wait times for people who don't have a subscription to Rapidshare.com, but those who do pay for that downloading site tend to prefer that. Note that Rapidshare is
horrible for free users, so it might be a good idea to either use just Mediafire, or upload it to both services. Post the shared file URL to our releases forum!
Creating a .IPA release
While IPA files are harder to put together than .APP, many people prefer them because of how easy they make it to install your application. Note that you should build your IPA with the ORIGINAL Icon.png in the app package, so copy that back if you'd replaced it with the rounded-corners icon from the .APP release tutorial.
For this part of the guide, I'm going to redirect you to my IPA guide. Remember to use the iTunesArtwork file that you got in step 2 of the cracking tutorial!
Continue here:
[Only Registered and Activated Users Can See Links. Click Here To Register...]
Thanks for reading!
Credits to _Ky_ for making this tutorial & Sony from Haklabs for discovering how to rip the rounded-corners icon from the iTunes Music Store.