iOS9下iTouch6尝试对星*克dumpdecrypted砸壳的疑问

环境:iTouch6, iOS9.0

首先很感谢cycript的及时更新,在iOS9.0上可以正常使用了,于是找出来Bundle和Data文件夹下的路径,将dumpdecrypted.dylib 拷贝到Documents下,然后DYLD_INSERT_LIBRARIES,具体过程如下:

fukumateki-iPod-touch:/var/mobile/Containers/Data/Application/26EF02B5-D5B4-451B-899A-8F3B37E43E1D/Documents root# DYLD_INSERT_LIBRARIES=dumpdecrypted.dylib /var/mobile/Containers/Bundle/Application/72494DDF-F56B-49E6-8CFB-6CFDFBE628DE/Starbucks.app/Starbucks
mach-o decryption dumper

DISCLAIMER: This tool is only meant for security research purposes, not for application crackers.

[+] detected 64bit ARM binary in memory.
[+] offset to cryptid found: @0x1000b0ca8(from 0x1000b0000) = ca8
[+] Found encrypted data at address 00004000 of length 8142848 bytes - type 1.
[+] Opening /private/var/mobile/Containers/Bundle/Application/72494DDF-F56B-49E6-8CFB-6CFDFBE628DE/Starbucks.app/Starbucks for reading.
[+] Reading header
[+] Detecting header type
[+] Executable is a FAT image - searching for right architecture
[+] Correct arch is at offset 9027584 in the file
[+] Opening Starbucks.decrypted for writing.
[+] Copying the not encrypted start of the file
[+] Dumping the decrypted data into the file
[+] Copying the not encrypted remainder of the file
[+] Setting the LC_ENCRYPTION_INFO->cryptid to 0 at offset 89cca8
[+] Closing original file
[+] Closing dump file
fukumateki-iPod-touch:/var/mobile/Containers/Data/Application/26EF02B5-D5B4-451B

然后我把Starbucks.decrypted拷贝到Mac上,打开IDA,提示:
The file is encrypted. The disassembly of it will likely be useless.
Do you want to continue?

这是说明砸壳不对咯?我哪个步骤有问题呢,还是说IOS9下不能这么砸了?

群里面有人回答了,是因为itouch6是ARM64的,而我用IDA尝试打开的是ARMV7的,所以是我搞错了,结贴!