[peterkelly]

They use a jailbroken device to obtain a decrypted copy of the application binary, then re-sign it with their own developer certificate, and submit. There's no recompilation needed.