vighnesh91/ipaforgeDependency-free Python CLI to unpack, inspect, edit, and rebuild iOS .ipa archives, converting plists and strings to XML while preserving Mach-O binaries and signing bundles.
#IPAForge
IPAForge is a dependency-free Python command-line tool for unpacking, inspecting, editing, and rebuilding iOS .ipa archives.
It extracts the complete archive, converts editable Apple plist and localization formats into readable XML, preserves opaque and binary content byte-for-byte, and records every conversion in ipaforge.yml so the framework can be rebuilt faithfully.
Use responsibly: IPAForge is intended for interoperability, security research, and legitimate application analysis. Respect applicable laws, licenses, and terms of service.
.ipa archives..strings files into editable XML..car, .nib, and .mom.ipaforge.yml..ipa archive containing a Payload/<AppName>.app bundle.IPAForge can be used directly as a single Python file:
python3 ipaforge.py --help
To install the ipaforge command on your PATH:
python3 ipaforge.py --install
To extract the bundled distribution files without installing them:
python3 ipaforge.py --extract
ipaforge -d MyApp.ipa
This creates a framework directory in the current working directory, normally ./MyApp/.
Modify readable XML files inside the generated framework. The original archive data and references are kept in original/; files that were converted are tracked in ipaforge.yml.
ipaforge -b MyApp
The default output is ./MyApp-signed.ipa in the current working directory.
ipaforge -d MyApp.ipa decoded-framework
ipaforge -b decoded-framework rebuilt.ipa
ipaforge -d, --decode INPUT [OUTPUT]
ipaforge -b, --build INPUT [OUTPUT]
| Option | Description |
|---|---|
-d, --decode | Decode an IPA into an editable framework directory. |
-b, --build | Build an IPA from a decoded framework directory. |
-f, --force | Overwrite an existing output directory or file. |
--no-meta | Do not write ipaforge.yml during decode. |
--keep-binary | Keep all files binary during decode; disable XML conversion. |
-c 0-9, --compression-level 0-9 | Set ZIP compression level. Default: 9. |
--no-sign | Build an intentionally unsigned archive. |
--entitlements FILE | Embed entitlements in the built signature. |
--p12 FILE | Sign with a real PKCS#12 developer certificate. |
--p12-password PASS | Password for the PKCS#12 certificate. |
--provision FILE | Embed and use a provisioning profile with --p12. |
-v, --verbose | Enable debug logging. |
-q, --quiet | Print only errors. |
--version | Display the IPAForge version. |
-h, --help | Display help. |
On Windows, the mode can be inferred automatically: an .ipa input is decoded and a framework directory is built.
Build mode signs bundles with the built-in ad-hoc signer by default. It creates CodeDirectory data for Mach-O binaries and fresh _CodeSignature/CodeResources files for application bundles.
For installation on stock iOS devices, use a real developer certificate and a compatible provisioning profile:
ipaforge -b MyApp \
--p12 developer.p12 \
--p12-password 'your-password' \
--provision embedded.mobileprovision
To embed custom entitlements:
ipaforge -b MyApp --entitlements entitlements.plist
To intentionally create an unsigned archive:
ipaforge -b MyApp --no-sign
Unsigned archives generally cannot be installed by iOS.
A decoded framework commonly contains:
MyApp/
├── Payload/
│ └── MyApp.app/
├── original/ # reference copies of signatures, profiles, and entitlements
├── readable/ # human-readable summaries for opaque formats and binaries
└── ipaforge.yml # file classifications and conversion metadata
The original/ directory and ipaforge.yml are never packaged into the rebuilt IPA.
IPAForge classifies extracted files into categories including:
native-bplist — binary property lists converted to XML and rebuilt as binary plists.legacy-strings — classic .strings files converted to XML and rebuilt as UTF-16 text.xml-plist — existing XML plist files preserved as text.opaque-compiled — proprietary compiled Apple formats preserved byte-for-byte.native-binary — Mach-O executables and libraries preserved byte-for-byte.other-binary — images, audio, DER data, and other resources preserved byte-for-byte.| Code | Meaning |
|---|---|
0 | Successful operation. |
1 | Runtime error, such as an invalid archive or signing failure. |
2 | Command-line usage error. |
141 | Standard output closed early by a pipe consumer. |
IPAForge processes untrusted archive contents. The tool applies defensive limits to individual archive members and total uncompressed archive size, but you should still inspect unknown files in an isolated environment.
Do not distribute or install applications unless you have the legal right to analyze and sign them.
Add the project's license text here before publishing to GitHub. If no license is included, GitHub users do not automatically receive permission to use, modify, or redistribute the code.
Issues and pull requests are welcome. Please include:
This README describes IPAForge 1.24.0.