iOS IPA Re-packagin/Re-signing of an AppStore app

Question

Problem description

I need to control an arbitrary application on an iOS device, my plan is to inject an executable to the IPA ( where remote control logic is implemented ) and then re-package it.

Since the application should run in a controlled environment ( a specific device ), I plan on using my provisioning profile with my development certificate for re-packaging/signing.

To begin with, I am trying to re-package the 3rd party app w/o Injecting any code, this is done is the following manner:

 1. Unzip the existing IPA
 2. Copy the provisioning profile to %APP_NAME%.app/embedded.mobileprovisioning
 3. export CODESIGN_ALLOCATE="/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/codesign_allocate"
 4. signcode --force --deep -s "%Dev Cert Name%" "%Path/To/APP_NAME%.app"
 5. zip the re-signed code back together

The Above is working great for an applications I manually build using Xcode, however, when using IPAs downloaded from the AppStore this doesn't work with the following device log error:

<Debug>: AppleFairplayTextCrypterSession::fairplayOpen() failed, error -42112

Inspecting the 'Mach-O' Executable of the application, I have verified that the "Code Signature" section of the relevant architecture was fully changed ( by the 'signcode' tool ).

Questions

• Why can't I re-package the app I have downloaded from the AppStore while the an app I manually create w/ Xcode is successfully re-packaged/signed?
• How can I re-package/sign an AppStore app using my development certificate & provisioning profile?
• How does FairPaly distinguish between an app I manually produce ( using Xcode ) to an app downloaded from the appstore? what residuals does an appstore app has that a manually made app does not ?

References

• https://stackoverflow.com/questions/25737711/ios-undocumented-api-using-uiautomation-framework-on-ios7
• http://macsecurity.net/view/55/
• https://developer.apple.com/library/mac/documentation/Darwin/Reference/ManPages/man1/codesign.1.html

Answer 1

Apps from the AppStore are not just signed, the binary is also encrypted.

App Store binaries are signed by both their developer and Apple. This encrypts the binary so that decryption keys are needed in order to make the binary readable. When iOS executes the binary, the decryption keys are used to decrypt the binary into a readable state where it is then loaded into memory and executed. iOS can tell the encryption status of a binary via the cryptid struture member of LC_ENCRYPTION_INFO MachO load command. If cryptid is a non-zero value then the binary in encrypted.