Starting with iOS 18, Apple has introduced encryption for certain components within their IPSW files, notably the root filesystem—which contains the core system files of iOS. This change has made it necessary to manually decrypt the root filesystem to access or analyze it.
In this guide, you’ll learn how to decrypt the root filesystem from an iOS IPSW file using a Mac.
To get started, make sure you’re using a Mac running macOS 12 Monterey or later. You’ll also need the iOS IPSW file that contains the root filesystem you want to decrypt. You can find beta releases at IPSW.dev and public releases at IPSW.me.
Once you’ve downloaded the IPSW file, change its file extension from .ipsw to .zip, then unzip it. Inside, locate the root filesystem file, which is typically the largest file with a .dmg.aea extension. For ease of use, copy this file to your desktop or another convenient location.
Next, you’ll need the decryption key for the file. Visit the Firmware Keys section of The Apple Wiki and select the appropriate iOS version, such as 26.x. Locate your device in the table, then find the “Root Filesystem” row. Copy the base64-encoded decryption key associated with that entry. If you’re using VoiceOver, the firmware keys are laid out in a table format, so table navigation commands may be helpful when browsing.
To simplify file path input in the Terminal, open Finder and navigate to the location of your .dmg.aea file. Select the file and press Command+C to copy its path, then return to Terminal and paste it. Now, you’re ready to run the decryption command:
aea decrypt -i <input-file> -o <output-file> -key-value 'base64:<decryption-key>'
Replace <input-file> with the full path to your .dmg.aea file, <output-file> with the desired name of the decrypted output, and <decryption-key> with the key you retrieved earlier. Once completed, you’ll have access to the decrypted root filesystem.