So.. iTunes 7.7 is now out. As is the app store on iTunes.

Downloaded apps are stored, at least in OS X by default, under ~/Music/iTunes/Mobile Applications/

They all end with a ".ipa" extension, which is just another .zip fle. After unzipping, they decompress to and iTunesArtwork file, a iTunesMetadata.plist file and a Payload folder with the app store app.

So if/when 2.0 is jailbroken.. anyone want to try installing an app non-sandboxed? (IE, in the /Applications folder). Are they signed? (They appear to be, see below) Will this work with non-free apps?



Also, the app packages appear to have two additional folders that "normal" app packages do not, a _CodeSignature folder, and a SC_Info folder... There is also a sim link in the app package to the "CodeResources" file, which is in the _CodeSignature folder.

The CodeResources file is an XML file that contains every file in the package, along with a signature for each (presumably so if anything is modified it wont run?). There is also a rules section... See screenshot here for an example:

http://g.appleguru.org/CodeResources.png

For Windows users: the applications (.ipa files) are in the user profile, in My documents\My music\iTunes\Mobile Applications.

You can view the contents of an application by renaming it: change the extension from .ipa to .zip; then double-click the file.

__________________
iPhone 3GS / 3.1.2 JB (PwnageTool) / 04.26.08 carrier-locked, Carrier Logo Fixer / Cydia / 1000 posts on Hackint0sh

Installing Cydia programs on a phone that has no internet connection: read this.

Editing binary .plist, .strings, .nib and .xib files:
* on your computer: Windows tool / conversion website.
* on your iPhone: convert those files in a terminal with plutil (installed with Erica Utilities) or edit them with iFile (Cydia links).

I doubt it will work until the dev team figures out how to crack the signature, if they do that is.

__________________

SOLUTION: Wait for Pwnage Tool 1.2 and then upgrade to 2.0 firmware

george,

fantastic. thanks for your technical advise. this helps the community a lot.

now back to topic:

1. are these files encrypted or only signed?
2. you may put the binary into IDA to see which functions are getting used.

you may upload the binary to a place of your choice and drop me a PM, I'm gonna have a look :-)

kd rgds, nl2k

__________________
iPhone 4GB: Firm 2.0 BL 3.9 (pwned like described here)
Mac Book Pro: Leopard 10.5.4
Hack Pro: Leo 10.5.4 (Asus P5LD2 VM DH, Core2Duo 3.0, ATI Rad 2600 HD XT, HP w2207, TSSTCorp SH-S183H, Silentmaxx ST11 Big Bl, 2GB Corsair, 250GB OSX, 400GB WinXP, 250GB Backupdrive)

» latest iPhone & OSX86 News, Hints and HowTo's
» How to update "Mac OS X 10.5.3" and to "Mac OS X 10.5.4"...

In the end it matters little whether they're signed and/or encrypted. If they're signed, it's only a matter of patching the OS to ignore signatures. If they're encrypted, the key to decrypt them must be available in the phone somewhere.

It's like any other DRM scheme. Always crackable with enough patience.

Somebody should try just removing the extra folders inside the .app folder and uploading to their phone, setting correct permissions and see what happens.

__________________

Already tried it, no luck, icon shows on springboard, and when you open the app it just exits again.... no permissions error

like i said in an other thread, itunes looks in your shopping list of your itunes account, and if it´s not listed in there, you can´t do anything with it. This prevents the people from transferring the app to the phone. So i think the *.ipa is just for packaging reasons, itunes extracts the *.app folder off it and loads them on your phone. The phone itself may not check if its legit... So when we have filesystem access / jailbreak, we can enjoy the games, not caring about any encryption (at least until the next sync, maybe iTunes checks the apps everytime you sync the phone...)

Having managed to get Apps I have no license for (free ones still) onto my iPod i can safetly say that I believe the apps check for legitness themselves, as they will not load.

This is true for both paid and free apps.