> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/ios-appsec/ipa-file-structure.md).

# IPA File Structure

An **`.ipa` (iOS App Archive)** file is the packaged distribution format for iOS applications. It is essentially a **ZIP archive** containing all the resources, code, and metadata required for an iOS app to install and run.

You can think of an `.ipa` similar to an Android `.apk` file, but specific to Apple’s iOS ecosystem.

* File extension: `.ipa`
* Container format: **ZIP archive**
* Typical distribution: via App Store, TestFlight, MDM, or internal builds.

### Extracting an `.ipa`

To inspect its contents, rename and unzip it.

```bash
unzip MyApp.ipa -d MyApp_extracted
```

You’ll now see a structure like:

```
Payload/
└── MyApp.app/
    ├── Info.plist
    ├── embedded.mobileprovision
    ├── PkgInfo
    ├── MyApp (binary executable)
    ├── Frameworks/
    ├── PlugIns/
    ├── Assets.car
    ├── Base.lproj/
    ├── Resource files (.storyboardc, .nib, .png, .json, etc.)
    ├── _CodeSignature/
    │   └── CodeResources
    └── ...
iTunesMetadata.plist
iTunesArtwork
```

***

## Structure

#### **`Payload`**

This is the **main directory** inside any `.ipa` file.

It contains **exactly one `.app` folder**, which holds all of the compiled app data.

#### **`MyApp.app`**

This is the **actual application bundle**. Every iOS app is packaged as a **bundle directory** ending with `.app`.

**`.plist`**  Files

Holds metadata and configuration settings for the app.

* Format: Binary or XML property list (`.plist`).
* Important keys:
  * `CFBundleIdentifier` — unique app ID.
  * `CFBundleVersion` / `CFBundleShortVersionString` — version info.
  * `NSAppTransportSecurity` — network security rules (ATS).
  * `CFBundleURLTypes` — custom URL schemes.
  * `UIBackgroundModes`, `LSApplicationQueriesSchemes`, etc.
* **Use during static analysis:** You extract permissions, ATS exceptions, URL schemes, and check for insecure configurations.

**`embedded.mobileprovision`**

* The **provisioning profile** is embedded into the app.
* Contains:
  * Signing certificate and entitlements.
  * Team identifiers.
  * AppID and distribution method (Development / Ad Hoc / Enterprise / App Store).
  * Expiration date.
* Command to decode:

```bash
security cms -D -i embedded.mobileprovision > prov.plist
plutil -p prov.plist
```

* **Use during static analysis:** Check if the app is signed with the **development profile** (`get-task-allow=true`) or production. Inspect **entitlements** (like Keychain groups, iCloud, and associated domains).

**`PkgInfo`**

* Small file containing a code for the package type and creator.
* Often contains `APPL????` (standard for iOS apps).
* **Use:** rarely important, but can confirm app type.

**`MyApp` (the binary)**

* The **main Mach-O executable binary**.
* This is where actual compiled code resides.
* Can be **ARM64** or **Universal** binary.

To inspect:

```bash
file MyApp.app/MyApp
```

```
otool -l MyApp.app/MyApp | grep LC_ENCRYPTION_INFO
```

* **Use during static analysis:**
* Identify if the binary is encrypted (FairPlay).
* Extract function names, strings, hardcoded URLs, API keys.
* Use tools like `class-dump`, `hopper`, `ghidra`, or `radare2`.

**`Frameworks/`**

* Contains any **custom or third-party dynamic libraries** (`.framework` or `.dylib`).
* Example:

  ```
  Frameworks/
  ├── FirebaseAnalytics.framework/
  ├── GoogleUtilities.framework/
  └── CustomLib.dylib
  ```
* **Use:** Inspect these for hardcoded secrets, debug symbols, and outdated SDKs. You can also check if they are **encrypted or obfuscated**.

**`PlugIns/` (optional)**

* Contains **app extensions** (like widgets, share extensions, notification services).
* Each sub-extension is another `.appex` bundle with its own `Info.plist` and binary.

Example:

```
PlugIns/
└── NotificationService.appex/
    ├── Info.plist
    └── NotificationService
```

* **Use:** Analyze each extension separately — they often have separate entitlements and permissions.

**`Assets.car` and resource folders**

* `Assets.car`: compiled assets (images, icons, colours, etc.).
* `.lproj` folders: localized resources (strings, storyboards).
* `.storyboardc` / `.nib`: compiled UI layout files.

To inspect:

```bash
strings Assets.car | grep http
```

or use a GUI tool like `AssetCatalogTinkerer`.

* **Use:** Sometimes sensitive URLs or debug endpoints are embedded in localized resources or storyboards.

**`_CodeSignature/`**

* Contains the app’s **digital signature**.
* `CodeResources` lists all files in the bundle with their hash.

**Use:** Confirms integrity, signing issues, or tampering if a hash mismatch occurs.

#### **iTunesMetadata.plist** (optional)

* Metadata for iTunes/App Store distribution (app name, genre, Apple ID, etc.)
* Usually found only in downloads `.ipa` from iTunes, not enterprise/internal builds.