Skip to content

Instantly share code, notes, and snippets.

@pookjw
Last active August 14, 2025 20:04
Show Gist options
  • Select an option

  • Save pookjw/ff7a1891317da00e4ef51a91e42d4e68 to your computer and use it in GitHub Desktop.

Select an option

Save pookjw/ff7a1891317da00e4ef51a91e42d4e68 to your computer and use it in GitHub Desktop.
#import <Foundation/Foundation.h>
#import <AppleArchive/AppleArchive.h>
extern void * AAAssetExtractorCreate(const char *, void *, unsigned long);
extern int AAAssetExtractorSetParameterPtr(void *, int, void *);
extern int AAAssetExtractorSetParameterCallback(void *, int, void *);
extern void AAAssetBuilderDestroy(void *);
extern size_t AAAssetExtractorWrite(void *, void *, ssize_t);
BOOL foo(void) {
return NO;
};
int main(int argc, const char * argv[]) {
@autoreleasepool {
AAByteStream sourceFileStream = AAFileStreamOpenWithPath("/Volumes/Data 1/iOS18.6_OTAs/iPhone17,2_KEY_[wb2vJvryQhC836Xl6yf9lLHm37NfWtvQ1w17GgtilgI=]_83ec3d717ba475a22ef24a6daf0a7b9c2b56993cc302f443e4222dd7901b83a4.aea", O_RDONLY, 0);
assert(sourceFileStream != NULL);
AAByteStream decryptedFileStream = AAFileStreamOpenWithPath("/Volumes/Data 1/iOS18.6_OTAs/decrypted.aar", O_RDWR | O_CREAT | O_TRUNC, 0);
assert(decryptedFileStream != NULL);
AEAContext context = AEAContextCreateWithEncryptedStream(sourceFileStream);
assert(context != NULL);
NSData *data = [[NSData alloc] initWithBase64EncodedString:@"wb2vJvryQhC836Xl6yf9lLHm37NfWtvQ1w17GgtilgI=" options:0];
assert(AEAContextSetSymmetricKey(context, data.bytes, data.length) == 0);
AAByteStream decryptionStream = AEADecryptionInputStreamOpen(sourceFileStream, context, 0, 0);
assert(decryptionStream != NULL);
assert(AAByteStreamProcess(decryptionStream, decryptedFileStream) > 0);
AAByteStreamClose(sourceFileStream);
AEAContextDestroy(context);
//
off_t offset = 0;
void *extractor = AAAssetExtractorCreate("/Volumes/Data 1/iOS18.6_OTAs/decrypted_out", &offset, 0x4000000000000002);
assert(extractor != NULL);
assert(AAAssetExtractorSetParameterPtr(extractor, 105, "/Volumes/Data 1/iOS18.6_OTAs/src_empty") == 0);
assert(AAAssetExtractorSetParameterCallback(extractor, 104, foo) == 0); // Filter
char bytes[0x40000];
size_t size = 0x40000;
while (true) {
size = AAByteStreamPRead(decryptedFileStream, bytes, size, offset);
if (size == 0) break;
ssize_t result = AAAssetExtractorWrite(extractor, bytes, size);
if (result == 0) break;
offset += result;
size = result;
}
AAAssetBuilderDestroy(extractor);
AAByteStreamClose(decryptionStream);
}
return EXIT_SUCCESS;
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment