Decrypting the iOS 18 Root Filesystem

In previous iOS versions (10 through 17), Apple left the root filesystem (contained within a .dmg file) unencrypted but set to read-only. This approach made it relatively easy for hackers and users to access the filesystem and extract assets.

This tutorial will guide you through the process of decrypting these files.

Requirements

  • A Mac running macOS 12 Monterey or later
  • The decryption key for the file you wish to decrypt (available on resources such as The Apple Wiki)

Steps to Decrypt the Root Filesystem

Begin by downloading the iOS 18 IPSW file corresponding to the root filesystem you intend to decrypt. Beta releases can be found on IPSW.dev, while public releases can be found on IPSW.me.

After downloading the appropriate IPSW file, change its extension from .ipsw to .zip and extract it by pressing Command + O. This action will open the file in Archive Utility, initiating the extraction process.

Once the extraction is complete, navigate to the folder created by Archive Utility, which will typically bear the same name as the IPSW file.

Inside the extracted folder, locate the root filesystem, which will be a .dmg.aea file. This file is usually the largest in size (approximately 6 GB). Copy the file by pressing Command + C, and paste it onto your desktop for ease of access. For clarity, consider renaming it to something memorable, such as root.dmg.aea.

Next, navigate to The Apple Wiki Firmware Keys page to find the decryption key.

On that page, navigate to the section labeled 18.x under “Firmware versions,” and select the specific version of iOS 18 you are decrypting. This information is typically organized in a table format, so if you are using the VoiceOver screen reader, be prepared to use table navigation commands to access it.

Once you locate the appropriate version page, find the section that states “Key:”. Use Shift along with the left and right arrow keys to select the decryption key, then copy it. This key is usually presented as a base64 string ending with an equals sign.

Now, open the Terminal application. You can do this by navigating to the Utilities folder or using Spotlight to search for “Terminal.”

In the Terminal, type the following command:

cd ~/desktop

Next, input the following command, replacing with the actual decryption key and with the name of your .dmg.aea file:

aea decrypt -i .dmg.aea -o .dmg -key-value ‘base64:’

You have successfully completed the process!

1 thought on “Decrypting the iOS 18 Root Filesystem”

Leave a Comment