The iPhone Wiki - User contributions [en]

Talk:Main Page

2017-10-09T15:21:22Z

Detiac:

{{Talk Archive}}

== Baseband Chip Page Titles ==
For the baseband chip page titles, I think we should stick with the model number despite the marketing name. Pages:
* [[S-Gold 2|PMB8876]] marketed "S-Gold 2"
* [[X-Gold 608|PMB8878]] marketed "X-Gold 608"
* [[XMM 6180]] marketed "X-Gold 618"
* [[MDM6600]] (unknown marketing name)
* [[MDM6610]] (unknown marketing name)
* [[MDM9x00]] (unknown marketing name)
--[[User:5urd|5urd]] 21:35, 8 May 2012 (MDT)
:I'm leaning more towards the marketing names, since I think people are more familiar with them and they've been in use for a long time. We've always referred to the iPhone 2G's baseband as the "S-Gold 2" and the iPhone 3G/3GS's baseband as the "X-Gold 608." (By the way, it sounds like Qualcomm "markets" their chips by model number. [http://www.qualcomm.com/media/releases/2011/02/14/qualcomm-announces-commercial-availability-gobi3000-modules]) --[[User:Dialexio|Dialexio]] 00:11, 9 May 2012 (MDT)
:I created most of these newer pages and always used the model number (without space). So I agree with that in general. Changing old ones is a totally different story though, where we need more consent. I would be for it (and create a redirect on the marketing names). --[[User:Http|http]] 01:52, 9 May 2012 (MDT)

== Baseband downgrade possibility: Attempt for 04.11.08/04.12.01 to 04.10.01 ==
'''0x1''' There is no downgrade possibility; according to the most basis of fact in how baseband works as explained by dear MuscleNerd and there is signature checks as well as bootloader's chain of trust that I'm not going to repeat them again, but for this topic I start from iTunes error 1,-1,11

'''0x2''' iTunes error 1,-1,11 :
We will get this error whenever we want to do something with BB which is not allowed by apple. you can read about these error in detail from here[http://theiphonewiki.com/wiki/index.php?title=ITunes_Errors].
Going deeper, this error raise by baseband's bootloader whenever you attempt to downgrade BB (in this case), this happens inside the NOR so this is why we can not exploit it easily from the outside.
Another reason for this error (and in here the most important one that I wanted to discuss) is that apple no longer signing that firmware.

'''0x3''' The situation that there is no BB installed on iPhone! :
I could restore my iPhone4 in the case of there will be no BB at all. I called it reset my BB. There will be no Wifi, no BT.
At the first time (a few months since I've started to work on) I thought it is dead (as apple confirmed this also). But I could restore it only to stock firmware with the latest one.
So for who stays in 04.11.08 it may lead to do upgrade to 04.12.01 permanently with the latest iOS, now is 5.1.1 and before for me was 5.0.1, so be sure what you are doing and then go to reset the BB.
So back to the game, if there was no BB then there is no bootloeader inside the NOR to stuck BB update process but I do not know that in this case what happened to "sectable" also known as "locktable" which is the master accountable to unlock the carrier, any way I think so only firmware signature checking by apple will be remain in "restore verify process" by iTunes. because as mentioned earlier, "currentBB"(BB to be updated) is allowed to be update by "comingBB" (BB to be updating to) only if :
1. "currentBB" < "comingBB" (= are you the most recent/lastest BB?)
2. "comingBB" is now signing by apple (=if so, does apple sign you? Are you eligible?)
Huum... What happens if "currentBB"="null/zero/no matter"? Could we eliminate option (1) from the security check above in this case? So what next?

'''0x4''' Track back to the issue lead us inside the bbfw file (ICE3_04.11.08_BOOT_02.13.Release) which contains four .fls files inside, and the most important one is psi_flash.fls who is in charge of security checks before handover the routines to stack.fls which is responsible for updating the baseband. This file does like NOR bootloader but fortunately it's outside the device so it is accessible but not such easy format to be understand by programmers. They are raw ROM based images for XMM6180 chip, ARM based and programmed in Thread-X, but the compiler is unknown; I will write about some disassembly notes using ida pro 6.1; by the way I leave my iPhone with no BB trying to find out and break the trust chains in the above files in order to bypass the bootloader security checks which may let us to downgrade to 04.10.01 which is currently unlocked by Gevey.
Keep in mind that if this solution works..., it will need the SHSH for downgrading the iOS firmware to do reset the BB.
I heard that iPhoneDevTeam are going to release the new version of Redsn0w which there will be no need to restore by iTunes but I do not know if the baseband approaches supposed to be addressed or it will work like iFaith that is basically bypass (preserve) BB, any way if I found this article useful I will note about disassembly and possibility approach as well as BB reset to share with any followers.
'''--[[User:Kambiz|Kambiz]] 07:49, 13 May 2012 (MDT)K.N'''

== Bluetooth Chip on [[iPhone 5]] ==
Is there any confirmation of the Bluetooth chip used in the iPhone 5? If there is, can we edit this page and add it? --[[User:5urd|5urd]] 10:04, 8 October 2012 (MDT)
:Chipworks [http://www.chipworks.com/blog/recentteardowns/2012/10/02/apple-iphone-5-the-rf/ analyzed the iPhone 5's Murata Wi-Fi module] and determined it uses the [[BCM4334]]. I'll add it to the Main Page now. --[[User:Dialexio|Dialexio]] 20:35, 8 October 2012 (MDT)

== Adding vulnerability to main page ==
The page [[CVE-2013-0964]] is currently orphaned. I think it would fit under the "Vulnerabilities and Exploits" subheading. Can someone with adequate permission make the change? [[User:0x56|0x56]] ([[User talk:0x56|talk]]) 03:52, 12 September 2013 (UTC)
:Added. --[[User:Http|http]] ([[User talk:Http|talk]]) 00:53, 13 September 2013 (UTC)

==Update for new devices==
Somebody should update the main page (table) for the 5s and 5c --[[User:Phyrrus9|Phyrrus9]] ([[User talk:Phyrrus9|talk]]) 21:14, 2 October 2013 (UTC)
:No need. It says "iPhone 4S and newer". --[[User:IAdam1n|iAdam1n]] ([[User talk:IAdam1n|talk]]) 22:01, 2 October 2013 (UTC)

==Permission==
Permission to add pangu8? Or should we wait until a Cydia version comes out? --[[User:Awesomebing1|Awesomebing1]] ([[User talk:Awesomebing1|talk]]) 15:52, 22 October 2014 (UTC)
:It has already been added and is fine IMO. I would state that it's SSH only though. --[[User:IAdam1n|iAdam1n]] ([[User talk:IAdam1n|talk]]) 16:22, 22 October 2014 (UTC)

== All of the Watch product images? ==

So I was looking for Apple product images and found this interesting [https://www.apple.com/shop/sitemaps/sitemap-buy-images.xml document] that has links to all of the (current) product images. Since the Apple Watch has so many models, editions, colors, etc., would it be worthwhile to upload all the images listed from the document? So far I've found [http://store.storeimages.cdn-apple.com/4711/as-images.apple.com/is/image/AppleInc/aos/published/images/w/42/w42ss/sbbk/w42ss-sbbk-detail this one]. (Apple Watch 42mm, Stainless Steel buckle) --[[User:Citrusui|Citrusui]] ([[User talk:Citrusui|talk]]) 18:01, 5 September 2015 (UTC)

:It's not a great idea to upload images from Apple's website in general, since they're copyrighted by Apple, unless you can make a decent argument that using a copyrighted image in a particular article is [https://en.wikipedia.org/wiki/Fair_use#Fair_use_under_United_States_law is fair use]. [[User:Britta|Britta]] ([[User talk:Britta|talk]]) 09:01, 6 September 2015 (UTC)

== Removal of Apple TV 3G from "Latest Firmware" Section? ==

Apparently, the Apple TV 3G has not received any updates from Apple for a long time and looks like it will not get any in the future. So, should we remove it from the "Latest Firmware" section on the Main Page? Any other thoughts? --[[User:Tp1194045441|Tp1194045441]] ([[User talk:Tp1194045441|talk]]) 03:51, 28 November 2015 (UTC)
:It's still been sold so it should stay as it's still "active" for this reason. --[[User:IAdam1n|iAdam1n]] ([[User talk:IAdam1n|talk]]) 22:34, 23 February 2016 (UTC)

== Cleanup ==

This page has a lot of links... It almost looks intimidating. That's not exactly an impression you want to leave on a first-time visitor. I'd like to clean it up, but I'm not entirely sure on what to cut out. I currently have everything in "Hardware" underneath the basebands in mind, and some of the definitions (be honest, how popular of a topic do you think iBEC is?). Any thoughts on what can or should not be cut? --[[User:Dialexio|Dialexio]] ([[User talk:Dialexio|talk]]) 21:09, 23 February 2016 (UTC)
:I think we should remove links to pages that have not been created yet. We can always add them back if/when made. --[[User:IAdam1n|iAdam1n]] ([[User talk:IAdam1n|talk]]) 22:33, 23 February 2016 (UTC)

== KPP ==

Is there a reason why a KPP page has not been created? It would be useful to many...
--[[User:Detiac|Detiac}}

Talk:Main Page

2017-10-09T15:19:53Z

Detiac:

Disk Image Formats

2017-10-06T23:23:19Z

Detiac: Fix link (hdiutil)

[[IPSW File Format|IPSW]] files contain three [[Apple Disk Image|disk image]] (.dmg) files in addition to the [[IMG3 File Format|IMG3]] images for the [[NOR]] and on older models, unencrypted files for the [[Restore Process|restore process]]. The three disk images are the [[Update Ramdisk|update ramdisk]], the [[Restore Ramdisk|restore ramdisk]], and the main [[:/|filesystem]].

The main filesystem .dmg disk image (the largest .dmg file) is decrypted (with [[VFDecrypt]]) to an UDZO .dmg disk image containing additional checksums.

== UDZO Image Format ==
The UDZO Image is an UDIF zlib-compressed read-only image which can be mounted on Mac OS X. UDZO Images can be converted to read/write UDRW Images with [https://developer.apple.com/legacy/library/documentation/Darwin/Reference/ManPages/man1/hdiutil.1.html hdiutil] on Mac OSX:

hdiutil convert -format UDRW udzo.dmg -o udrw.dmg

To add checksums of the data in the provided UDZO Image and store them in the image [http://developer.apple.com/documentation/Darwin/Reference/ManPages/man8/asr.8.html asr] on Mac OSX can be used:

asr -imagescan udzo.dmg

== UDRW Image Format ==
The UDRW Image is an UDIF read/write image which can be mounted on Mac OS X. UDRW Images can be converted to zlib-compressed read-only UDZO Images with [http://developer.apple.com/documentation/Darwin/Reference/Manpages/man1/hdiutil.1.html hdiutil] on Mac OS X:

hdiutil convert -format UDZO udrw.dmg -o udzo.dmg

[[Category:File Formats]]

PPJailbreak

2017-09-27T00:00:44Z

Detiac:

{{about|the untethered jailbreak for iOS 8.0-8.4 on Mac|the untethered jailbreak for iOS 8.0-8.4 on Windows|TaiG}}
{{Infobox software
| name = PPJailbreak
| title = PPJailbreak
| author = 25PP
| developer = 25PP
| released = {{Start date|2015|01|18|df=yes}}
| discontinued =
| latest release version = 2.5.1
| latest release date = {{Start date and age|2017|02|16|df=yes}}
| latest preview version =
| latest preview date =
| programming language = ?
| operating system = [[wikipedia:Microsoft Windows|Windows]] / [[wikipedia:macOS|macOS]]
| size =
| platform = [[wikipedia:Microsoft Windows|Windows]] / [[wikipedia:macOS|macOS]]
| language = [[wikipedia:Chinese language|Chinese]]
| status = Active
| genre = Jailbreaking
| license = [[wikipedia:Freeware|Freeware]]
| website = [http://pro.25pp.com/ppghost_mac 25PP] (Chinese)
}}

'''PPJailbreak''' is an [[untethered jailbreak]] for all devices on iOS 8.0-8.4, except the [[List of Apple TVs|Apple TV]] and [[Apple Watch]]. It was initially released on 18 January, 2015 initially supporting 8.0-8.1.2. An updated version supporting 8.0-8.2 beta 2 was released on 23 Feburary 2015. As of 25 February 2015, it seems support was removed for the 8.2 betas. On 13 July, 2015, the tool was updated to version 2.0.0 to support 8.1.3-8.4.

On February 16, 2017, a new version was released as a repackage of [[yalu#yalu102|yalu]] to jailbreak iOS 10.0.1-10.2 [[semi-untethered jailbreak|semi-untethered]].

== Supported Devices ==
All devices capable of running [[iOS]] 8.0-8.4 except the [[List of Apple TVs|Apple TV]] and [[Apple Watch]] family, are supported.

For iOS 10.0.1-10.2, all 64-bit devices are supported except iPhone 7.

==Controversy==
[https://twitter.com/taig_jailbreak/status/616030331573944321 TaiG proved] that 25PP stole their entire exploit chain and merely "rewrote" their whole jailbreak for iOS 8.0 to 8.4.
They repeated their actions with qwertyoruiop's [[yalu102]] jailbreak, as they rebranded the code and made a Windows tool to install it.

== Download ==
{| class="wikitable"
! Version
! Download
! Changes
|-
| 1.0
| [http://ghost.25pp.com/soft/ppjailbreak.dmg 25PP]
| First version of PPJailbreak. Supports all devices with iOS 8.0 - 8.1.2 except [[Apple TV (3rd generation)]].
|-
| 2.0.0
| [http://ghost.25pp.com/soft/ppjailbreak2.dmg 25PP]
| Supports 8.1.3 - 8.4.
|-
| 2.5.1
| [http://ghost.25pp.com/soft/pppc_setup/pphelper_5.1.5.2142_ios10_course_pc5_1487824936_Setup.exe 25PP]
| Windows-only; supports iOS 10.0.1-10.2.
|}

== Installed Packages ==
This list is from the ''first'' 1.0 release.
* APR (/usr/lib) (1.3.3-2; <code>apr-lib</code>)
* APT 0.7 (apt-key) (0.7.25.3-3; <code>apt7-key</code>)
* APT 0.7 Strict (lib) (0.7.25.3-13; <code>apt7-lib</code>)
* Base Structure (1-4; <code>base</code>)
* Big Boss Icon Set (1.0; <code>org.thebigboss.repo.icons</code>)
* Bourne-Again SHell (4.0.44-15; <code>bash</code>)
* bzip2 (1.0.5-7; <code>bzip2</code>)
* Core Utilities (/bin) (8.12-7p; <code>coreutils-bin</code>)
* Cydia Installer (1.1.16; <code>cydia</code>)
* Cydia Translations (1.1.12; <code>cydia-lproj</code>)
* Darwin Tools (1-4; <code>darwintools</code>)
* Debian Packager (1.14.25-9; <code>dpkg</code>)
* Debian Utilities (3.3.3ubuntu1-1p; <code>debianutils</code>)
* Diff Utilities (2.8.1-6; <code>diffutils</code>)
* Find Utilities (4.2.33-6; <code>findutils</code>)
* GNU Privacy Guard (1.4.8-4; <code>gnupg</code>)
* grep (2.5.4-3; <code>grep</code>)
* gzip (1.6-7; <code>gzip</code>)
* LZMA Utils (4.32.7-4; <code>lzma</code>)
* New Curses (5.7-13; <code>ncurses</code>)
* PAM (Apple) (32.1-3; <code>pam</code>)
* PAM Modules (36.1-4; <code>pam-modules</code>)
* pcre (8.30-5p; <code>pcre</code>)
* PP 8.0-8.1.X Untether (2.0; <code>com.pphelper.untether8</code>)
* Profile Directory (0-2; <code>profile.d</code>)
* readline (6.0-7; <code>readline</code>)
* sed (4.1.5-7; <code>sed</code>)
* shell-cmds (118-6; <code>shell-cmds</code>)
* system-cmds (433.4-12; <code>system-cmds</code>)
* Tape Archive (1.19-8; <code>tar</code>)
* UIKit Tools (1.1.9; <code>uikittools</code>)

[[Category:Jailbreaks]]
[[Category:Jailbreaking]]

J105aAP

2017-09-23T00:19:50Z

Detiac:

[[File:Apple TV 4K.png|thumb|131px|Apple TV 4K]]
The Apple TV 4K starts at $179 for 32GB of storage, and $199 for 64GB. It’s firmware identifier is AppleTV6,2. It is capable of playing 4K content.

The Apple TV 4K was announced on 12th September 2017 and released on 22nd September 2017.

== Application processor ==
The Apple TV 4K makes use of the [[T8011|Apple A10X]] processor.

{{stub|hardware}}
[[Category:Devices]]

EtasonJB

2017-09-20T00:09:39Z

Detiac: Formatting is weird...

{{Infobox software
| name = EtasonJB
| title = EtasonJB
| developer = [http://www.twitter.com/tihmstar @tihmstar]
| released = {{Start date|2017|09|19|df=yes}}
| latest release version = RC2
| latest release date = {{Start date and age|2017|09|19|df=yes}}
| programming language =
| operating system = iOS
| language = English
| genre = Jailbreaking
| website = http://tihmstar.net/etasonjb/
}}
'''EtasonJB''' (also spelt '''etasonJB''' and '''#EtasonJB''') is an [[untethered jailbreak]] for all 32-bit devices (except [[Apple TV]]), running iOS 8.4.1. It was developed by [https://twitter.com/tihmstar tihmstar] and exploits the same vulnerabilities as [[Home Depot]]. The first public version, RC2, was released on September 19, 2017 and is installed by sideloading an IPA with [[Cydia Impactor]]. It is, for reasons not yet known, incompatible with the [[iPhone 5]].<ref>[https://twitter.com/tihmstar/status/910119986718560256 @tihmstar on Twitter]: “Seems like #etasonJB doesn't work on iPhone5. Please email me paniclogs and the output of ideviceconsole while jailbreaking”</ref>

== History ==

The development started after [[Phœnix]] was released, and on 6 September, 2017 tihmstar announced that he had ported the Trident exploits to iOS 8.4.1. Regular updates on the development were published, and the name and imminent release were announced eleven days later, on the 17th. The first public release coincided with the release of iOS 11, on the 19th.

The name is a pun on ''eta son'', a phrase commonly used to mock uncivilized “[https://www.reddit.com/r/JelBrek/ jelbrekers]” who beg for an ETA (''son'' is also short for ''soon or never'').

=== Version Change Log ===
{| class="wikitable"
|-
! Version
! Date
! Changes
|-
| RC1
| –
|
* Initial release
|-
| RC2
| September 19, 2017
|
* First public release
* Fixes patcyh stuff (thanks to @JonathanSeals)
|}

== External Links ==
* [http://tihmstar.net/etasonjb/ Homepage]

== References ==
<references />

[[Category:Jailbreaks]]
[[Category:Jailbreaking]]

Jailbreak

2017-09-20T00:06:11Z

Detiac: /* 2.x */

{{float toc|right}}
'''Jailbreak'''ing is the process by which full execute and write access is obtained on all the partitions of the Apple TV, iPad, iPad mini, iPhone or iPod touch. It is done by patching [[/private/etc/fstab]] to mount the System partition as 'read-write'. This is entirely different from an [[unlock]]. Jailbreaking is the first action that must be taken before things like unofficial [[activation]] (hacktivation), and unofficial [[unlock]]ing can be applied.

Older jailbreaks also included modifying the [[AFC]] service (used by [[iTunes]] to access the filesystem) to give full filesystem access from root. This was later updated to create a new service ([[AFC]]2) that allows access to the full filesystem.

Modern jailbreaks now include patching the kernel to get around code signing and other restrictions. These are called [[Kernel Patches]].

'''Note''': The legality of jailbreaking your device varies with each country/region. [[wikipedia:iOS jailbreaking#Legal status|Wikipedia has a summary of legality for some countries]].

== Types of Jailbreaks ==
When a device is booting, it loads Apple's own [[kernel]] initially, so a jailbroken device must be exploited and have the kernel patched each time it is booted up.

An [[untethered jailbreak|'''untethered''' jailbreak]] uses exploits that are powerful enough to allow the user to turn their device off and back on at will, with the device starting up completely, and the kernel will be patched without the help of a computer – in other words, it will be jailbroken even after each reboot.

However, some jailbreaks are [[tethered jailbreak|'''tethered''']]. A tethered jailbreak is only able to temporarily jailbreak the device during a single boot. If the user turns the device off and then boots it back up without the help of a jailbreak tool, the device will no longer be running a patched kernel, and it may get stuck in a partially started state, such as [[Recovery Mode]]. In order for the device to start completely and with a patched kernel, it must be "re-jailbroken" with a computer (using the "boot tethered" feature of a tool) each time it is turned on. All changes to the files on the device (such as installed package files or edited system files) will persist between reboots, including changes that can only function if the device is jailbroken (such as installed package files).

In more recent years, two other solutions have been created - '''semi-tethered''' and '''semi-''un''tethered'''.

A [[semi-tethered jailbreak|'''semi-tethered''']] solution is one where the device is able to start up on its own, but it will no longer have a patched kernel, and therefore will not be able to run modified code. It will, however, still be usable for normal functions, just like stock iOS. To start with a patched kernel, the user must start the device with the help of the jailbreak tool.

A [[semi-untethered jailbreak|'''semi-''un''tethered''']] jailbreak gives the ability to start the device on it's own. On first boot, the device will not be running a patched kernel. However, rather than having to run a tool from a computer to apply the kernel patches, the user is able to re-jailbreak their device with the help of an app (usually sideloaded using [[Cydia Impactor]]) running on their device. In the case of the iOS 9.2-9.3.3 jailbreak, a Safari-based exploit was available, thereby meaning a website could be used to rejailbreak.

In more detail: Each iOS device has a [[bootchain]] that tries to make sure only trusted/signed code is loaded. A device with a tethered jailbreak is able to boot up with the help of a jailbreaking tool because the tool executes exploits via USB that bypass parts of that "chain of trust", bootstrapping to a [[pwned]] (no [[Signature Check Patch|signature check]]) [[iBSS]], [[iBEC]], or [[iBoot (Bootloader)|iBoot]] to finish the boot process.

== Jailbreak Tools ==
Untethered or semi-untethered jailbreaks are shown with a green 'yes'. Tethered or semi-tethered jailbreaks will be stated in a yellow box. [[Beta Firmware]]s are not listed here.



===iPhone OS===
====1.x====
{| class="wikitable"
|-
! rowspan="2" | iPhone OS
! rowspan="2" | Jailbreak Tool
! rowspan="2" | Tool Version
! colspan="2" | Device
|-
! [[M68AP|iPhone]]
! [[N45AP|iPod touch]]
|-
| rowspan="3" | 1.0
| [[AppTapp Installer]]
| class="rborderplz" | 1.0
| rowspan="3" {{yes}}
| rowspan="3" {{n/a}}
|-
| [[iBrickr]]
| class="rborderplz" | 0.5-0.91
|-
| [[iLiberty+]]
| class="rborderplz" | 1.3.0.113
|-
| rowspan="2" | 1.0.1
| [[AppTapp Installer]]
| class="rborderplz" | 1.0
| rowspan="2" {{yes}}
| rowspan="2" {{n/a}}
|-
| [[iBrickr]]
| class="rborderplz" | 0.5-0.91
|-
| rowspan="2" | 1.0.2
| [[AppTapp Installer]]
| class="rborderplz" | 1.0
| rowspan="2" {{yes}}
| rowspan="2" {{n/a}}
|-
| [[iBrickr]]
| class="rborderplz" | 0.6-0.91
|-
| 1.1
| colspan="2" | No Tool Available
| {{n/a}}
| {{no}}
|-
| 1.1.1
| colspan="2" | The [[libTiff Exploit]]
| colspan="2" {{partial|Yes}}<ref group="1.x" name="1.1.1" />
|-
| 1.1.2
| colspan="2" | [[mknod|OktoPrep]] + [[touchFree]]
| colspan="2" {{partial|Yes}}<ref group="1.x" name="oktoprep-offline" />
|-
| class="rborderplz" rowspan="3" | 1.1.3
| [[iLiberty+|iLiberty / iLiberty+]]
| class="rborderplz" | 1.3.0.113
| colspan="2" {{yes}}
|-
| colspan="2" | [[Soft Upgrade]]
| colspan="2" {{partial|Yes}}<ref group="1.x" name="softupgrade-offline" />
|-
| [[ZiPhone]]
| 3.0
| colspan="2" {{yes}}
|-
| rowspan="3" | 1.1.4
| [[iLiberty+|iLiberty / iLiberty+]]
| class="rborderplz" | 1.3.0.113
| colspan="2" rowspan="3" {{yes}}
|-
| [[PwnageTool]]
| class="rborderplz" | 1.1
|-
| [[ZiPhone]]
| class="rborderplz" | 3.0
|-
| rowspan="2" | 1.1.5
| [[iLiberty+|iLiberty / iLiberty+]]
| class="rborderplz" | 1.3.0.113
| rowspan="2" {{n/a}}
| rowspan="2" {{yes}}
|-
| [[ZiPhone]]
| class="rborderplz" | 3.0
|}
<references group="1.x">
<ref name="1.1.1">A maliciously-crafted TIFF, using the [[libTiff Exploit]], loaded into Safari, can be used to jailbreak iPhone OS 1.1.1. There are several of these TIFFs available - two of the most notable include [https://forums.macrumors.com/threads/377126/ planetbeing's] and [[AppSnapp]]. However, both of these services are now offline, so cannot be used. Even so, a user could still create their own TIFF and payload in order to jailbreak 1.1.1.</ref>
<ref name="oktoprep-offline">It was previously possible to jailbreak 1.1.2 using [[mknod|OktoPrep]] alongside [[touchFree]]. However, the original package repository for OktoPrep through [[Installer.app]] has been taken offline. A user would need to find the original package file for OktoPrep and install it manually in order to jailbreak 1.1.2.</ref>
<ref name="softupgrade-offline">It was previously possible to jailbreak 1.1.3 using [[Soft Upgrade]], but this is no longer possible due to the package repository being taken offline. A user would need to find the original package file for Soft Upgrade and install it manually to jailbreak 1.1.3 using this method.</ref>
</references>

====2.x====
{| class="wikitable"
|-
! rowspan="2" | iPhone OS
! rowspan="2" | Jailbreak Tool
! rowspan="2" | Tool Version
! colspan="4" | Device
|-
! [[M68AP|iPhone]]
! [[N82AP|iPhone 3G]]
! [[N45AP|iPod touch]]
! [[N72AP|iPod touch (2nd generation)]]
|-
| rowspan="2" | 2.0
| [[PwnageTool]]
| class="rborderplz" | 2.0-2.0.3
| colspan="3" {{yes}}
| rowspan="2" {{n/a}}
|-
| [[QuickPwn]]
| class="rborderplz" | RC3-2.2.5
| {{yes}}
| {{no}}
| {{yes}}
|-
| rowspan="2" | 2.0.1
| [[PwnageTool]]
| class="rborderplz" | 2.0.2-2.0.3
| colspan="3" {{yes}}
| rowspan="2" {{n/a}}
|-
| [[QuickPwn]]
| class="rborderplz" | RC3-2.2.5
| {{yes}}
| {{no}}
| {{yes}}
|-
| rowspan="2" | 2.0.2
| [[PwnageTool]]
| class="rborderplz" | 2.0.3
| colspan="3" {{yes}}
| rowspan="2" {{n/a}}
|-
| [[QuickPwn]]
| class="rborderplz" | RC3-2.2.5
| {{yes}}
| {{no}}
| {{yes}}
|-
| rowspan="2" | 2.1
| [[PwnageTool]]
| class="rborderplz" | 2.1-2.2.5
| colspan="3" {{yes}}
| rowspan="2" {{n/a}}
|-
| [[QuickPwn]]
| class="rborderplz" | 2.1-2.2.5
| {{yes}}
| {{no}}
| {{yes}}
|-
| 2.1.1
| class="rborderplz" colspan="2" | [[redsn0w Lite]]
| colspan="3" {{n/a}}
| {{partial|Tethered}}<ref group="2.x">Tethered for devices running the [[Bootrom 240.4|old bootrom]] only. Will not work for devices on the [[Bootrom 240.5.1|new bootrom]] ([[Bootrom 240.5.1|new bootrom]] devices cannot run iPhoneOS 2, only 3).</ref>
|-
| rowspan="2" | 2.2
| [[PwnageTool]]
| class="rborderplz" | 2.2-2.2.5
| colspan="3" {{yes}}
| {{no}}
|-
| [[QuickPwn]]
| class="rborderplz" | 2.2-2.2.5
| {{yes}}
| {{no}}
| {{yes}}
| {{no}}
|-
| rowspan="3" | 2.2.1
| [[PwnageTool]]
| class="rborderplz" | 2.2.1-2.2.5
| colspan="3" {{yes}}
| {{no}}
|-
| [[QuickPwn]]
| class="rborderplz nobrradiusplz" | 2.2.1-2.2.5
| {{yes}}
| {{no}}
| {{yes}}
| {{no}}
|-
| [[redsn0w]]
| class="rborderplz nobrradiusplz" | 0.3
| colspan="3" {{no}}
| {{yes}}
|}
<references group="2.x" />

====3.x====
{| class="wikitable"
|-
! rowspan="2" | iPhone OS
! rowspan="2" | Jailbreak Tool
! rowspan="2" | Tool Version
! colspan="7" | Device
|-
! [[K48AP|iPad]]
! [[M68AP|iPhone]]
! [[N82AP|iPhone 3G]]
! [[N88AP|iPhone 3GS]]
! [[N45AP|iPod touch]]
! [[N72AP|iPod touch (2nd generation)]]
! [[N18AP|iPod touch (3rd generation)]]
|-
| rowspan="4" | 3.0
| colspan="2" | [[ipwndfu]]
| rowspan="4" {{n/a}}
| colspan="2" {{no}}
| {{yes}}
| colspan="2" {{no}}
| rowspan="4" {{n/a}}
|-
| [[purplera1n]]
| class="rborderplz" | 1.0
| {{yes}}
| {{no}}
| colspan="3" {{yes}}
|-
| [[PwnageTool]]
| class="rborderplz" | 3.0
| colspan="2" {{yes}}
| {{no}}
| {{yes}}
| {{no}}
|-
| [[redsn0w]]
| class="rborderplz" | 0.8-0.9.3
| colspan="5" {{yes}}
|-
| rowspan="2" | 3.0.1
| colspan="2" | [[ipwndfu]]
| rowspan="2" {{n/a}}
| colspan="2" {{no}}
| {{yes}}
| colspan="3" rowspan="2" {{n/a}}
|-
| [[redsn0w]]
| class="rborderplz" | 0.8-0.9.3
| colspan="3" {{yes}}
|-
| rowspan="4" | 3.1
| [[blackra1n]]
| class="rborderplz" | 1.0
| rowspan="4" {{n/a}}
| colspan="2" {{yes}}
| {{partial|Yes}}<ref group="3.x" name="oldboot3gs">Tethered jailbreak for any [[N88AP|iPhone 3GS]] with the [[Bootrom 359.3.2|new bootrom]]. Untethered for the [[Bootrom 359.3|old bootrom]].</ref>
| rowspan="4" colspan="3" {{n/a}}
|-
| colspan="2" | [[ipwndfu]]
| colspan="2" {{no}}
| {{yes}}
|-
| [[PwnageTool]]
| class="rborderplz" | 3.1-3.1.3
| rowspan="2" colspan="2" {{yes}}
| {{no}}
|-
| [[redsn0w]]
| class="rborderplz" | 0.9.2-0.9.3
| {{partial|Yes}}<ref group="3.x" name="oldboot3gs" />
|-
| rowspan="4" | 3.1.1
| [[blackra1n]]
| class="rborderplz" | 1.0
| rowspan="4" colspan="4" {{n/a}}
| rowspan="4" {{yes}}
| colspan="2" {{partial|Tethered}}
|-
| rowspan="2" | [[PwnageTool]]
| class="rborderplz" | 3.1
| colspan="2" {{no}}
|-
| class="rborderplz" | 3.1.3
| {{yes}}
| {{no}}
|-
| [[redsn0w]]
| class="rborderplz" | 0.9.3
| {{partial|Yes}}<ref group="3.x" name="oldboot">Tethered jailbreak for any [[N72AP|iPod touch (2nd generation)]] with the [[Bootrom 240.5.1|new bootrom]]. Untethered for the [[Bootrom 240.4|old bootrom]].</ref>
| {{partial|Tethered}}
|-
| rowspan="7" | 3.1.2
| [[blackra1n]]
| class="rborderplz" | 1.0
| rowspan="7" {{n/a}}
| colspan="2" {{yes}}
| {{partial|Yes}}<ref group="3.x" name="oldboot3gs" />
| {{yes}}
| colspan="2" {{partial|Tethered}}
|-
| colspan="2" | [[ipwndfu]]
| colspan="2" {{no}}
| {{yes}}
| colspan="3" {{no}}
|-
| [[PwnageTool]]
| class="rborderplz" | 3.1.4-3.1.5
| rowspan="2" colspan="2" {{yes}}
| colspan="3" {{yes}}
| {{no}}
|-
| [[redsn0w]]
| class="rborderplz" | 0.9.2-0.9.3
| rowspan="3" {{partial|Yes}}<ref group="3.x" name="oldboot3gs" />
| rowspan="2" {{yes}}
| {{partial|Yes}}<ref group="3.x" name="oldboot" />
| {{partial|Tethered}}
|-
| [[sn0wbreeze]]
| class="rborderplz" | Public Beta-2.9.14
| rowspan="2" {{no}}
| rowspan="2" {{yes}}
| colspan="2" {{no}}
|-
| [[Spirit]]
| class="rborderplz" | 1.0
| colspan="3" {{no}}
|-
| colspan="2" | [[Star]] ([[JailbreakMe]] 2.0)
| colspan="4" {{yes}}
| colspan="2" {{no}}
|-
| rowspan="7" | 3.1.3
| [[blackra1n]]
| class="rborderplz" | 1.0
| rowspan="7" {{n/a}}
| colspan="2" {{yes}}
| {{partial|Yes}}<ref group="3.x" name="oldboot3gs" />
| {{yes}}
| colspan="2" {{no}}
|-
| colspan="2" | [[ipwndfu]]
| colspan="2" {{no}}
| {{yes}}
| colspan="3" {{no}}
|-
| [[PwnageTool]]
| class="rborderplz" | 3.1.5
| colspan="5" {{yes}}
| rowspan="2" {{no}}
|-
| [[redsn0w]]
| class="rborderplz" | 0.9.4
| colspan="2" {{yes}}
| rowspan="3" {{partial|Yes}}<ref group="3.x" name="oldboot3gs" />
| {{yes}}
| {{partial|Yes}}<ref group="3.x" name="oldboot" />
|-
| [[sn0wbreeze]]
| class="rborderplz" | 1.5-2.9.14
| rowspan="2" {{no}}
| rowspan="2" {{yes}}
| colspan="3" {{yes}}
|-
| [[Spirit]]
| class="rborderplz" | 1.0
| {{no}}
| colspan="2" {{yes}}
|-
| colspan="2" | [[Star]] ([[JailbreakMe]] 2.0)
| colspan="6" {{yes}}
|-
| rowspan="3" | 3.2
| [[sn0wbreeze]]
| class="rborderplz nobrradiusplz" | ???-2.9.14
| rowspan="3" {{yes}}
| rowspan="3" colspan="6" {{n/a}}
|-
| [[Spirit]]
| class="rborderplz" | 1.0
|-
| class="rborderplz" colspan="2" | [[Star]] ([[JailbreakMe]] 2.0)
|-
| rowspan="2" | 3.2.1
| [[sn0wbreeze]]
| class="rborderplz nobrradiusplz" | ???-2.9.14
| rowspan="2" {{yes}}
| rowspan="2" colspan="6" {{n/a}}
|-
| colspan="2" | [[Star]] ([[JailbreakMe]] 2.0)
|-
| rowspan="6" | 3.2.2
| [[greenpois0n (jailbreak)|greenpois0n]]
| class="rborderplz" | RC4
| rowspan="5" {{yes}}
| rowspan="6" colspan="6" {{n/a}}
|-
| [[limera1n]]
| class="rborderplz" | 1.0
|-
| [[PwnageTool]]
| class="rborderplz" | 4.1-4.1.3
|-
| [[redsn0w]]
| class="rborderplz" | 0.9.6b2-0.9.11b4
|-
| [[sn0wbreeze]]
| class="rborderplz nobrradiusplz" | 2.1-2.9.14
|-
| colspan="2" | [[Star]] ([[JailbreakMe]] 2.0)
| {{partial|Yes<ref group="3.x" name="modifiedstar">Star can be modified to support 3.2.2, because Apple did not correctly patch the exploits used.</ref>}}
|}
<references group="3.x"/>

===iOS===
====4.x====
{| class="wikitable"
|-
! rowspan="2" | iOS
! rowspan="2" | Jailbreak Tool
! rowspan="2" | Tool Version
! colspan="9" | Device
|-
! [[K48AP|iPad]]
! [[iPad 2]]
! [[N82AP|iPhone 3G]]
! [[N88AP|iPhone 3GS]]
! [[N90AP|iPhone 4 (iPhone3,1)]]
! [[N92AP|iPhone 4 (iPhone3,3)]]
! [[N72AP|iPod touch (2nd generation)]]
! [[N18AP|iPod touch (3rd generation)]]
! [[N81AP|iPod touch (4th generation)]]
|-
| rowspan="6" | 4.0
| colspan="2" | [[ipwndfu]]
| colspan="2" rowspan="6" {{n/a}}
| rowspan="2" {{no}}
| {{yes}}
| {{no}}
| rowspan="6" {{n/a}}
| colspan="2" {{no}}
| rowspan="6" {{n/a}}
|-
| [[limera1n]]
| class="rborderplz" | 1.0
| colspan="2" {{yes}}
| {{no}}
| {{yes}}
|-
| [[PwnageTool]]
| class="rborderplz" | 4.0-4.01
| rowspan="2" {{yes}}
| {{partial|Yes}}<ref group="4.x_i" name="oldboot3gs" />
| {{no}}
| rowspan="2" {{partial|Yes}}<ref group="4.x_i" name="oldboot" />
| rowspan="2" {{no}}
|-
| [[redsn0w]]
| class="rborderplz" | 0.9.5b3-0.9.6b3
| colspan="2" {{no}}
|-
| [[sn0wbreeze]]
| class="rborderplz" | 1.6-2.9.14
| rowspan="2" colspan="3" {{yes}}
| rowspan="2" colspan="2" {{yes}}
|-
| colspan="2" | [[Star]] ([[JailbreakMe]] 2.0)
|-
| rowspan="6" | 4.0.1
| colspan="2" | [[ipwndfu]]
| colspan="2" rowspan="6" {{n/a}}
| rowspan="3" {{no}}
| {{yes}}
| {{no}}
| colspan="4" rowspan="6" {{n/a}}
|-
| [[limera1n]]
| class="rborderplz" | 1.0
| colspan="2" {{yes}}
|-
| [[PwnageTool]]
| class="rborderplz" | 4.0
| {{partial|Yes}}<ref group="4.x_i" name="oldboot3gs" /><ref group="4.x_i" name="bundle" />
| {{no}}
|-
| [[redsn0w]]
| class="rborderplz" | 0.9.5b3-0.9.6b3
| {{yes}}
| colspan="2" {{no}}
|-
| [[sn0wbreeze]]
| class="rborderplz" | 1.6-2.9.14
| rowspan="2" colspan="3" {{yes}}
|-
| colspan="2" | [[Star]] ([[JailbreakMe]] 2.0)
|-
| rowspan="6" | 4.0.2
| colspan="2" | [[ipwndfu]]
| colspan="2" rowspan="6" {{n/a}}
| rowspan="3" {{no}}
| {{yes}}
| {{no}}
| rowspan="6" {{n/a}}
| colspan="2" {{no}}
| rowspan="6" {{n/a}}
|-
| [[limera1n]]
| class="rborderplz" | 1.0
| colspan="2" {{yes}}
| {{no}}
| {{yes}}
|-
| [[PwnageTool]]
| class="rborderplz" | 4.0
| {{partial|Yes}}<ref group="4.x_i" name="oldboot3gs" /><ref group="4.x_i" name="bundle" />
| {{no}}
| colspan="2" {{no}}
|-
| [[redsn0w]]
| class="rborderplz" | 0.9.5b3/0.9.6b3
| {{yes}}
| colspan="2" {{no}}
| {{partial|Yes}}<ref group="4.x_i" name="oldboot" />
| {{no}}
|-
| [[sn0wbreeze]]
| class="rborderplz" | 2.0.2-2.9.14
| colspan="3" {{yes}}
| colspan="2" {{yes}}
|-
| colspan="2" | [[Star]] ([[JailbreakMe]] 2.0)
| colspan="3" {{partial|Yes<ref group="4.x_i" name="modifiedstar" />}}
| colspan="2" {{partial|Yes<ref group="4.x_i" name="modifiedstar" />}}
|-
| rowspan="7" | 4.1
| [[greenpois0n (jailbreak)|greenpois0n]]
| class="rborderplz" | RC5-RC6.1
| {{yes}}
| rowspan="7" {{n/a}}
| rowspan="3" {{no}}
| colspan="2" {{yes}}
| rowspan="7" {{n/a}}
| colspan="3" {{yes}}
|-
| colspan="2" | [[ipwndfu]]
| {{no}}
| {{yes}}
| {{no}}
| colspan="3" {{no}}
|-
| [[limera1n]]
| class="rborderplz" | 1.0
| rowspan="4" {{yes}}
| colspan="2" {{yes}}
| rowspan="4" colspan="3" {{yes}}
|-
| [[PwnageTool]]
| class="rborderplz" | 4.1-4.1.3
| colspan="2" {{yes}}
| {{no}}
|-
| [[redsn0w]]
| class="rborderplz" | 0.9.6b1-0.9.10b8b
| rowspan="2" colspan="3" {{yes}}
|-
| [[sn0wbreeze]]
| class="rborderplz" | 2.1-2.9.5
|-
| colspan="2" | [[Star]] ([[JailbreakMe]] 2.0)
| {{partial|Yes<ref group="4.x_i" name="modifiedstar" />}}
| colspan="3" {{partial|Yes<ref group="4.x_i" name="modifiedstar" />}}
| colspan="3" {{partial|Yes<ref group="4.x_i" name="modifiedstar" />}}
|-
| rowspan="6" | 4.2.1
| [[greenpois0n (jailbreak)|greenpois0n]]
| class="rborderplz" | RC5-RC6.1
| rowspan="5" {{yes}}
| rowspan="6" {{n/a}}
| rowspan="2" {{no}}
| colspan="2" {{yes}}
| rowspan="6" {{n/a}}
| colspan="3" {{yes}}
|-
| colspan="2" | [[ipwndfu]]
| {{yes}}
| {{no}}
| colspan="3" {{no}}
|-
| [[PwnageTool]]
| class="rborderplz" | 4.2
| rowspan="3" colspan="3" {{yes}}
| {{no}}
| colspan="2" {{yes}}
|-
| [[redsn0w]]
| class="rborderplz" | 0.9.6b1-0.9.11b4
| rowspan="2" colspan="3" {{yes}}
|-
| [[sn0wbreeze]]
| class="rborderplz" | 2.2-2.9.14
|-
| colspan="2" | [[Star]] ([[JailbreakMe]] 2.0)
| {{partial|Yes<ref group="4.x_i" name="modifiedstar" />}}
| colspan="3" {{partial|Yes<ref group="4.x_i" name="modifiedstar" />}}
| colspan="3" {{partial|Yes<ref group="4.x_i" name="modifiedstar" />}}
|-
| 4.2.5
| colspan="2" | [[Star]] ([[JailbreakMe]] 2.0)
| colspan="5" {{n/a}}
| {{partial|Yes<ref group="4.x_i" name="modifiedstar" />}}
| colspan="3" {{n/a}}
|-
| rowspan="7" | 4.2.6
| [[greenpois0n (jailbreak)|greenpois0n]]
| class="rborderplz" | RC5 b4-RC6.1
| rowspan="7" colspan="5" {{n/a}}
| rowspan="5" {{yes}}
| rowspan="7" colspan="3" {{n/a}}
|-
| [[PwnageTool]]
| class="rborderplz" | 4.2
|-
| [[redsn0w]]
| class="rborderplz" | 0.9.6rc9-0.9.10b8b
|-
| colspan="2" | [[Saffron]] ([[JailbreakMe]] 3.0)
|-
| [[sn0wbreeze]]
| class="rborderplz" | 2.2-2.9.14
|-
| colspan="2" | [[Star]] ([[JailbreakMe]] 2.0)
| {{partial|Yes<ref group="4.x_i" name="modifiedstar" />}}
|-
| colspan="2" | [[unthredeh4il]]
| {{yes}}
|-
| rowspan="5" | 4.2.7
| [[redsn0w]]
| class="rborderplz" | 0.9.8b2-0.9.10b8b
| rowspan="5" colspan="5" {{n/a}}
| rowspan="3" {{yes}}
| rowspan="5" colspan="3" {{n/a}}
|-
| colspan="2" | [[Saffron]] ([[JailbreakMe]] 3.0)
|-
| [[sn0wbreeze]]
| class="rborderplz" | 2.6-2.9.14
|-
| colspan="2" | [[Star]] ([[JailbreakMe]] 2.0)
| {{partial|Yes<ref group="4.x_i" name="modifiedstar" />}}
|-
| colspan="2" | [[unthredeh4il]]
| {{yes}}
|-
| rowspan="6" | 4.2.8
| [[PwnageTool]]
| class="rborderplz" | 4.2
| rowspan="6" colspan="5" {{n/a}}
| rowspan="4" {{yes}}
| rowspan="6" colspan="3" {{n/a}}
|-
| [[redsn0w]]
| class="rborderplz" | 0.9.6rc18-0.9.10b8b
|-
| colspan="2" | [[Saffron]] ([[JailbreakMe]] 3.0)
|-
| [[sn0wbreeze]]
| class="rborderplz" | 2.7-2.9.14
|-
| colspan="2" | [[Star]] ([[JailbreakMe]] 2.0)
| {{partial|Yes<ref group="4.x_i" name="modifiedstar" />}}
|-
| colspan="2" | [[unthredeh4il]]
| {{yes}}
|-
| rowspan="3" | 4.2.9
| [[redsn0w]]
| class="rborderplz" | 0.9.8b3-0.9.10b8b
| rowspan="3" colspan="5" {{n/a}}
| {{partial|Tethered}}
| rowspan="3" colspan="3" {{n/a}}
|-
| colspan="2" | [[Star]] ([[JailbreakMe]] 2.0)
| {{partial|Yes<ref group="4.x_i" name="modifiedstar" />}}
|-
| colspan="2" | [[unthredeh4il]]
| {{yes}}
|-
| rowspan="3" | 4.2.10
| [[redsn0w]]
| class="rborderplz" | 0.9.8b7-0.9.10b8b
| rowspan="3" colspan="5" {{n/a}}
| {{partial|Tethered}}
| rowspan="3" colspan="3" {{n/a}}
|-
| colspan="2" | [[Star]] ([[JailbreakMe]] 2.0)
| {{partial|Yes<ref group="4.x_i" name="modifiedstar" />}}
|-
| colspan="2" | [[unthredeh4il]]
| {{yes}}
|-
| rowspan="7" | 4.3
| colspan="2" | [[ipwndfu]]
| colspan="2" rowspan="2" {{no}}
| rowspan="7" {{n/a}}
| {{yes}}
| {{no}}
| colspan="2" rowspan="7" {{n/a}}
| colspan="2" rowspan="2" {{no}}
|-
| [[PwnageTool]]
| class="rborderplz" | 4.2
| {{partial|Yes<ref group="4.x_i" name="bundle" /><ref group="4.x_i" name="newboot" />}}
| {{partial|Tethered<ref group="4.x_i" name="bundle" />}}
|-
| [[redsn0w]]
| class="rborderplz" | 0.9.6rc9-0.9.11b4
| {{partial|Tethered}}
| rowspan="5" {{no}}
| rowspan="3" colspan="2" {{yes}}
| colspan="2" {{partial|Tethered}}
|-
| colspan="2" | [[Saffron]] ([[JailbreakMe]] 3.0)
| rowspan="2" {{yes}}
| rowspan="2" colspan="2" {{yes}}
|-
| [[sn0wbreeze]]
| class="rborderplz" | 2.3b4-2.9.14
|-
| colspan="2" | [[Star]] ([[JailbreakMe]] 2.0)
| {{partial|Yes<ref group="4.x_i" name="modifiedstar" />}}
| colspan="2" {{partial|Yes<ref group="4.x_i" name="modifiedstar" />}}
| colspan="2" {{partial|Yes<ref group="4.x_i" name="modifiedstar" />}}
|-
| colspan="2" | [[unthredeh4il]]
| {{yes}}
| colspan="2" {{yes}}
| colspan="2" {{yes}}
|-
| rowspan="6" | 4.3.1
| colspan="2" | [[ipwndfu]]
| colspan="2" {{no}}
| rowspan="6" {{n/a}}
| {{yes}}
| {{no}}
| rowspan="6" colspan="2" {{n/a}}
| colspan="2" {{no}}
|-
| [[PwnageTool]]
| class="rborderplz" | 4.3
| rowspan="5" {{yes}}
| rowspan="5" {{no}}
| rowspan="5" colspan="2" {{yes}}
| rowspan="2" colspan="2" {{yes}}
|-
| [[redsn0w]]
| class="rborderplz" | 0.9.6rc9-0.9.11b4
|-
| colspan="2" | [[Saffron]] ([[JailbreakMe]] 3.0)
| {{no}}
| {{yes}}
|-
| [[sn0wbreeze]]
| class="rborderplz" | 2.5-2.9.14
| rowspan="2" colspan="2" {{yes}}
|-
| colspan="2" | [[unthredeh4il]]
|-
| rowspan="6" | 4.3.2
| colspan="2" | [[ipwndfu]]
| colspan="2" {{no}}
| rowspan="6" {{n/a}}
| {{yes}}
| {{no}}
| rowspan="6" colspan="2" {{n/a}}
| colspan="2" {{no}}
|-
| [[PwnageTool]]
| class="rborderplz" | 4.3.2
| rowspan="5" {{yes}}
| rowspan="5" {{no}}
| rowspan="5" colspan="2" {{yes}}
| rowspan="5" colspan="2" {{yes}}
|-
| [[redsn0w]]
| class="rborderplz" | 0.9.6rc13-0.9.11b4
|-
| colspan="2" | [[Saffron]] ([[JailbreakMe]] 3.0)
|-
| [[sn0wbreeze]]
| class="rborderplz" | 2.6-2.9.14
|-
| colspan="2" | [[unthredeh4il]]
|-
| rowspan="6" | 4.3.3
| colspan="2" | [[ipwndfu]]
| colspan="2" {{no}}
| rowspan="6" {{n/a}}
| {{yes}}
| {{no}}
| rowspan="6" colspan="2" {{n/a}}
| colspan="2" {{no}}
|-
| [[PwnageTool]]
| class="rborderplz" | 4.3.3-4.3.3.1
| rowspan="2" {{yes}}
| rowspan="2" {{no}}
| rowspan="5" colspan="2" {{yes}}
| rowspan="5" colspan="2" {{yes}}
|-
| [[redsn0w]]
| class="rborderplz" | 0.9.6rc16-0.9.11b4
|-
| colspan="2" | [[Saffron]] ([[JailbreakMe]] 3.0)
| colspan="2" {{yes}}
|-
| [[sn0wbreeze]]
| class="rborderplz" | 2.7-2.9.14
| rowspan="2" {{yes}}
| rowspan="2" {{no}}
|-
| colspan="2" | [[unthredeh4il]]
|-
| rowspan="4" | 4.3.4
| colspan="2" | [[ipwndfu]]
| {{no}}
| rowspan="4" {{no}}
| rowspan="4" {{n/a}}
| {{yes}}
| {{no}}
| rowspan="4" colspan="2" {{n/a}}
| colspan="2" {{no}}
|-
| [[redsn0w]]
| class="rborderplz" | 0.9.8b3-0.9.11b4
| {{partial|Tethered}}
| colspan="2" {{partial|Tethered}}
| colspan="2" {{partial|Tethered}}
|-
| colspan="2" | [[unthredeh4il]]
| rowspan="2" {{yes}}
| colspan="2" rowspan="2" {{yes}}
| colspan="2" rowspan="2" {{yes}}
|-
| colspan="2" | [[unthredera1n]]
|-
| rowspan="4" | 4.3.5
| colspan="2" | [[ipwndfu]]
| {{no}}
| rowspan="4" {{no}}
| rowspan="4" {{n/a}}
| {{yes}}
| {{no}}
| rowspan="4" colspan="2" {{n/a}}
| colspan="2" {{no}}
|-
| [[redsn0w]]
| class="rborderplz" | 0.9.8b7-0.9.11b4
| {{partial|Tethered}}
| colspan="2" {{partial|Tethered}}
| colspan="2" {{partial|Tethered}}
|-
| colspan="2" | [[unthredeh4il]]
| rowspan="2" {{yes}}
| colspan="2" rowspan="2" {{yes}}
| colspan="2" rowspan="2" {{yes|class=nobrradiusplz}}
|-
| colspan="2" | [[unthredera1n]]
|}
<references group="4.x_i">
<ref name="oldboot3gs">Will only work for [[N88AP|iPhone 3GS]] running the [[Bootrom 359.3|old bootrom]].</ref>
<ref name="oldboot">Will only work for [[N72AP|iPod touch (2nd generation)]] running the [[Bootrom 240.4|old bootrom]].</ref>
<ref name="modifiedstar">Star can be modified to support 4.0.2-4.3, because Apple did not correctly patch the exploits used.</ref>
<ref name="bundle">An unofficial firmware bundle for this version must be manually added.</ref>
<ref name="newboot">Tethered jailbreak for any [[N88AP|iPhone 3GS]] with the [[Bootrom 359.3.2|new bootrom]]. Untethered for the [[Bootrom 359.3|old bootrom]].</ref>
</references>

=====Apple TV=====
'''Note''': "Marketing Version" is the version that the Apple TV reports in its "About" screen.
{| class="wikitable"
|-
! rowspan="2" | Marketing Version
! rowspan="2" | iOS Version
! rowspan="2" | Jailbreak Tool
! rowspan="2" | Tool Version
! Device
|-
! [[K66AP|Apple TV (2nd generation)]]
|-
| rowspan="6" | 4.0
| rowspan="6" | 4.1
| [[greenpois0n (jailbreak)|greenpois0n]]
| RC6
| rowspan="3" {{partial|Yes<ref group="4.x_atv" name="nogui" />}}
|-
| [[limera1n]]
| class="rborderplz" | 1.0
|-
| [[PwnageTool]]
| class="rborderplz" | 4.1
|-
| [[Seas0nPass]]
| class="rborderplz" | ?
| {{yes}}
|-
| [[sn0wbreeze]]
| class="rborderplz" | 2.1
| rowspan="2" {{partial|Yes<ref group="4.x_atv" name="nogui" />}}
|-
| colspan="2" | [[unthredeh4il]]
|-
| rowspan="3" | 4.1
| rowspan="3" | 4.2
| [[PwnageTool]]
| ?
| {{partial|Yes<ref group="4.x_atv" name="bundle" />}}
|-
| [[Seas0nPass]]
| class="rborderplz" | ?
| rowspan="2" {{yes}}
|-
| colspan="2" | [[unthredeh4il]]
|-
| rowspan="5" | 4.1.1
| rowspan="5" | 4.2.1
| [[greenpois0n (jailbreak)|greenpois0n]]
| RC6-RC6.1
| rowspan="5" {{yes}}
|-
| [[PwnageTool]]
| class="rborderplz" | 4.2
|-
| rowspan="2" | [[Seas0nPass]]
| class="rborderplz" | 0.6.7 (Mac)
|-
| class="rborderplz" | ? (Windows)
|-
| colspan="2" | [[unthredeh4il]]
|-
| rowspan="3" | 4.2
| rowspan="3" | 4.3
| rowspan="2" | [[Seas0nPass]]
| 0.7.2 (Mac)
| rowspan="3" {{yes}}
|-
| class="rborderplz" | ? (Windows)
|-
| colspan="2" | [[unthredeh4il]]
|-
| rowspan="6" | 4.2.1
| rowspan="6" | 4.3
| [[PwnageTool]]
| 4.3-4.3.3.1
| rowspan="6" {{yes}}
|-
| [[redsn0w]]
| class="rborderplz" | 0.9.6rc16
|-
| rowspan="2" | [[Seas0nPass]]
| class="rborderplz" | 0.7.3 (Mac)
|-
| class="rborderplz" | 0.3.7.13.2017 (Windows)
|-
| [[sn0wbreeze]]
| class="rborderplz" | 2.5-2.7.1
|-
| colspan="2" | [[unthredeh4il]]
|-
| rowspan="4" | 4.2.2
| rowspan="4" | 4.3
| [[PwnageTool]]
| 4.3-4.3.3.1
| {{partial|Yes<ref group="4.x_atv" name="bundle" />}}
|-
| rowspan="2" | [[Seas0nPass]]
| class="rborderplz" | 0.7.6.??? (Mac)
| rowspan="3" {{yes}}
|-
| class="rborderplz" | 0.3.13.2017 (Windows)
|-
| colspan="2" | [[unthredeh4il]]
|-
| colspan="2" rowspan="3" | 4.3
| rowspan="2" | [[Seas0nPass]]
| 0.7.8.??? (Mac)
| rowspan="3" {{yes}}
|-
| class="rborderplz" | 0.3.29.???? (Windows)
|-
| colspan="2" | [[unthredeh4il]]
|}
<references group="4.x_atv">
<ref name="nogui">No package management GUI.</ref>
<ref name="bundle">A firmware bundle for this version must be manually added.</ref>
</references>

====5.x====
{| class="wikitable"
|-
! rowspan="2" | iOS
! rowspan="2" | Jailbreak Tool
! rowspan="2" | Tool Version
! colspan="8" | Device
|-
! [[K48AP|iPad]]
! [[iPad 2]]
! [[iPad (3rd generation)]]
! [[N88AP|iPhone 3GS]]
! [[iPhone 4]]
! [[N94AP|iPhone 4S]]
! [[N18AP|iPod touch (3rd generation)]]
! [[N81AP|iPod touch (4th generation)]]
|-
| rowspan="8" | 5.0
| [[Absinthe]]
| class="rborderplz" | 0.1-0.4
| colspan="2" {{no}}
| rowspan="8" {{n/a}}
| colspan="2" {{no}}
| {{yes}}
| colspan="2" {{no}}
|-
| [[Ac1dSn0w]]
| Beta 1-Beta 2
| {{partial|Tethered}}
| {{no}}
| colspan="2" {{partial|Tethered}}
| colspan="2" {{no}}
| {{partial|Tethered}}
|-
| colspan="2" | [[ipwndfu]]
| colspan="2" {{no}}
| {{yes}}
| colspan="4" {{no}}
|-
| [[PwnageTool]]
| class="rborderplz" | 4.3.3<ref group="5.x_i" name="bundle" />
| rowspan="3" {{partial|Tethered}}
| rowspan="5" {{no}}
| {{no}}
| {{partial|Tethered}}
| colspan="3" {{no}}
|-
| [[redsn0w]]
| class="rborderplz" | 0.9.9b3-0.9.11b4
| colspan="2" rowspan="2" {{partial|Tethered}}
| rowspan="4" {{no}}
| colspan="2" rowspan="2" {{partial|Tethered}}
|-
| [[sn0wbreeze]]
| class="rborderplz" | 2.8b8
|-
| colspan="2" | [[unthredeh4il]]
| rowspan="2" {{yes}}
| colspan="2" rowspan="2" {{yes}}
| colspan="2" rowspan="2" {{yes}}
|-
| colspan="2" | [[unthredera1n]]
|-
| rowspan="8" | 5.0.1
| [[Absinthe]]
| class="rborderplz" | 0.1-0.4
| {{no}}
| {{yes}}
| rowspan="8" {{n/a}}
| colspan="2" {{no}}
| {{yes}}
| colspan="2" {{no}}
|-
| [[Ac1dSn0w]]
| Beta 1-Beta 2
| {{partial|Tethered}}
| {{no}}
| colspan="2" {{partial|Tethered}}
| colspan="2" {{no}}
| {{partial|Tethered}}
|-
| colspan="2" | [[ipwndfu]]
| colspan="2" {{no}}
| {{yes}}
| colspan="4" {{no}}
|-
| [[PwnageTool]]
| class="rborderplz" | 5.0.1
| {{yes}}
| {{no}}
| colspan="2" {{yes}}
| {{no}}
| colspan="2" {{yes}}
|-
| [[redsn0w]]
| class="rborderplz" | 0.9.10b4-0.9.11b4
| colspan="2" {{yes}}
| colspan="5" {{yes}}
|-
| [[sn0wbreeze]]
| class="rborderplz" | 2.8b11-2.9.14
| rowspan="3" {{yes}}
| rowspan="3" {{no}}
| colspan="2" rowspan="3" {{yes}}
| rowspan="3" {{no}}
| colspan="2" rowspan="3" {{yes}}
|-
| colspan="2" | [[unthredeh4il]]
|-
| colspan="2" | [[unthredera1n]]
|-
| rowspan="5" | 5.1
| colspan="2" | [[ipwndfu]]
| colspan="3" {{no}}
| {{yes}}
| colspan="4" {{no}}
|-
| [[redsn0w]]
| class="rborderplz" | 0.9.10b6-0.9.11b4
| rowspan="4" {{yes}}
| rowspan="4" colspan="2" {{no}}
| colspan="2" rowspan="2" {{partial|Tethered}}
| rowspan="4" {{no}}
| colspan="2" rowspan="2" {{partial|Tethered}}
|-
| [[sn0wbreeze]]
| class="rborderplz" | 2.9.2-2.9.3
|-
| colspan="2" | [[unthredeh4il]]
| colspan="2" rowspan="2" {{yes}}
| colspan="2" rowspan="2" {{yes}}
|-
| colspan="2" | [[unthredera1n]]
|-
| rowspan="8" | 5.1.1
| [[Absinthe]]
| class="rborderplz" | 2.0-2.0.4
| colspan="8" rowspan="2" {{yes}}
|-
| [[cinject]]
| class="rborderplz" | 0.5.3-0.5.4
|-
| colspan="2" | [[ipwndfu]]
| colspan="3" {{no}}
| {{yes}}
| colspan="4" {{no}}
|-
| [[PwnageTool]]
| class="rborderplz" | 5.1.1
| {{yes}}
| colspan="2" {{no}}
| colspan="2" {{yes}}
| colspan="3" {{no}}
|-
| [[redsn0w]]
| class="rborderplz" | 0.9.12b1-0.9.14b2
| colspan="8" {{yes}}
|-
| [[sn0wbreeze]]
| class="rborderplz" | 2.9.6-2.9.14
| rowspan="3" {{yes}}
| rowspan="3" colspan="2" {{no}}
| colspan="2" rowspan="3" {{yes}}
| rowspan="3" {{no}}
| colspan="2" rowspan="3" {{yes}}
|-
| colspan="2" | [[unthredeh4il]]
|-
| colspan="2" | [[unthredera1n]]
|}
<references group="5.x_i">
<ref name="bundle">A firmware bundle for this version must be manually added.</ref>
</references>

=====Apple TV=====
'''Note''': "Marketing Version" is the version that the Apple TV reports in its "About" screen.
{| class="wikitable"
|-
! rowspan="2" | Marketing Version
! rowspan="2" | iOS Version
! rowspan="2" | Jailbreak Tool
! rowspan="2" | Tool Version
! Device
|-
! [[K66AP|Apple TV (2nd generation)]]
|-
| rowspan="3" | 4.4
| rowspan="3" | 5.0
| rowspan="2" | [[Seas0nPass]]
| class="rborderplz" | 0.7.9.??? (Mac)
| rowspan="2" {{partial|Tethered}}
|-
| class="rborderplz" | 0.3.37.???? (Windows)
|-
| colspan="2" | [[unthredeh4il]]
| {{yes}}
|-
| rowspan="3" | 4.4.1
| rowspan="3" | 5.0
| rowspan="2" | [[Seas0nPass]]
| class="rborderplz" | 0.7.9.210 (Mac)
| rowspan="2" {{partial|Tethered}}
|-
| class="rborderplz" | 0.3.37.???? (Windows)
|-
| colspan="2" | [[unthredeh4il]]
| {{yes}}
|-
| rowspan="3" | 4.4.2
| rowspan="3" | 5.0
| rowspan="2" | [[Seas0nPass]]
| class="rborderplz" | 0.7.9.230 (Mac)
| rowspan="2" {{partial|Tethered}}
|-
| class="rborderplz" | 0.3.42.3335 (Windows)
|-
| colspan="2" | [[unthredeh4il]]
| {{yes}}
|-
| rowspan="3" | 4.4.3
| rowspan="3" | 5.0.1
| rowspan="2" | [[Seas0nPass]]
| class="rborderplz" | 0.7.9.270 (Mac)
| rowspan="3" {{yes}}
|-
| class="rborderplz" | 0.3.44.???? (Windows)
|-
| colspan="2" | [[unthredeh4il]]
|-
| rowspan="3" | 4.4.4
| rowspan="3" | 5.0.1
| rowspan="2" | [[Seas0nPass]]
| class="rborderplz" | 0.7.9.290 (Mac)
| rowspan="3" {{yes}}
|-
| class="rborderplz" | 0.3.45.4035 (Windows)
|-
| colspan="2" | [[unthredeh4il]]
|-
| rowspan="3" | 5.0
| rowspan="3" | 5.1
| rowspan="2" | [[Seas0nPass]]
| class="rborderplz" | 0.8.3.470 (Mac)
| rowspan="2" {{partial|Tethered}}
|-
| class="rborderplz" | 0.8.3.5592 (Windows)
|-
| colspan="2" | [[unthredeh4il]]
| {{yes}}
|-
| rowspan="4" | 5.0.1
| rowspan="4" | 5.1.1
| [[PwnageTool]]
| class="rborderplz" | 5.1.1<ref group="5.x_atv" name="nogui" />
| {{partial|Tethered}}
|-
| rowspan="2" | [[Seas0nPass]]
| class="rborderplz" | 0.8.4.518 (Mac)
| rowspan="3" {{yes}}
|-
| class="rborderplz" | 0.8.4.6306 (Windows)
|-
| colspan="2" | [[unthredeh4il]]
|-
| rowspan="3" | 5.0.2
| rowspan="3" | 5.1.1
| rowspan="2" | [[Seas0nPass]]
| class="rborderplz" | 0.8.6.565 (Mac)
| rowspan="3" {{yes}}
|-
| class="rborderplz" | 0.8.6.7558 (Windows)
|-
| colspan="2" | [[unthredeh4il]]
|}
<references group="5.x_atv">
<ref name="nogui">No package management GUI.</ref>
</references>

====6.x====
{| class="wikitable"
|-
! rowspan="2" | iOS
! rowspan="2" | Jailbreak Tool
! rowspan="2" | Tool Version
! colspan="10" | Device
|-
! [[iPad 2]]
! [[iPad (3rd generation)]]
! [[iPad (4th generation)]]
! [[iPad mini]]
! [[N88AP|iPhone 3GS]]
! [[iPhone 4]]
! [[N94AP|iPhone 4S]]
! [[iPhone 5]]
! [[iPod touch (4th generation)]]
! [[iPod touch (5th generation)]]
|-
| rowspan="4" | 6.0
| [[evasi0n]]
| class="rborderplz" | 1.0-1.5.3
| colspan="10" {{yes}}
|-
| colspan="2" | [[ipwndfu]]
| colspan="4" rowspan="3" {{no}}
| {{yes}}
| colspan="5" {{no}}
|-
| [[redsn0w]]
| class="rborderplz" | 0.9.15b1<ref group="6.x_i" name="upgradeable-evasi0n" />-0.9.15b3<ref group="6.x_i" name="upgradeable-evasi0n" />
| {{partial|Yes<ref group="6.x_i" name="upgradeable-evasi0n" />}}
| {{partial|Tethered}}
| colspan="2" rowspan="2" {{no}}
| {{partial|Tethered}}
| rowspan="2" {{no}}
|-
| [[sn0wbreeze]]
| class="rborderplz" | 2.9.8-2.9.14
| colspan="2" {{yes}}
| {{yes}}
|-
| rowspan="4" | 6.0.1
| [[evasi0n]]
| class="rborderplz" | 1.0-1.5.3
| colspan="10" {{yes}}
|-
| colspan="2" | [[ipwndfu]]
| colspan="4" rowspan="3" {{no}}
| {{yes}}
| colspan="5" {{no}}
|-
| [[redsn0w]]
| class="rborderplz" | 0.9.15b1<ref group="6.x_i" name="ipsw-upgradeable-evasi0n" />-0.9.15b3<ref group="6.x_i" name="ipsw-upgradeable-evasi0n" />
| {{partial|Yes<ref group="6.x_i" name="ipsw-upgradeable-evasi0n" />}}
| {{partial|Tethered<ref group="6.x_i" name="ipsw-upgradeable-evasi0n" />}}
| colspan="2" rowspan="2" {{no}}
| {{partial|Tethered<ref group="6.x_i" name="ipsw-upgradeable-evasi0n" />}}
| rowspan="2" {{no}}
|-
| [[sn0wbreeze]]
| class="rborderplz" | 2.9.8-2.9.14
| colspan="2" {{yes}}
| {{yes}}
|-
| 6.0.2
| [[evasi0n]]
| class="rborderplz" | 1.0-1.5.3
| colspan="3" {{n/a}}
| {{yes}}
| colspan="3" {{n/a}}
| {{yes}}
| colspan="2" {{n/a}}
|-
| rowspan="4" | 6.1
| [[evasi0n]]
| class="rborderplz" | 1.0-1.5.3
| colspan="10" {{yes}}
|-
| colspan="2" | [[ipwndfu]]
| colspan="4" rowspan="3" {{no}}
| {{yes}}
| colspan="5" {{no}}
|-
| [[redsn0w]]
| class="rborderplz" | 0.9.15b1<ref group="6.x_i" name="ipsw-upgradeable-evasi0n" />-0.9.15b3<ref group="6.x_i" name="ipsw-upgradeable-evasi0n" />
| {{partial|Yes<ref group="6.x_i" name="ipsw-upgradeable-evasi0n" />}}
| {{partial|Tethered<ref group="6.x_i" name="ipsw-upgradeable-evasi0n" />}}
| colspan="2" rowspan="2" {{no}}
| {{partial|Tethered<ref group="6.x_i" name="ipsw-upgradeable-evasi0n" />}}
| rowspan="2" {{no}}
|-
| [[sn0wbreeze]]
| class="rborderplz" | 2.9.8-2.9.14
| colspan="2" {{yes}}
| {{yes}}
|-
| 6.1.1
| [[evasi0n]]
| class="rborderplz" | 1.3-1.5.3
| colspan="6" {{n/a}}
| {{yes}}
| colspan="3" {{n/a}}
|-
| rowspan="4" | 6.1.2
| [[evasi0n]]
| class="rborderplz" | 1.4-1.5.3
| colspan="10" {{yes}}
|-
| colspan="2" | [[ipwndfu]]
| colspan="4" rowspan="3" {{no}}
| {{yes}}
| colspan="5" {{no}}
|-
| [[redsn0w]]
| class="rborderplz" | 0.9.15b1<ref group="6.x_i" name="ipsw-upgradeable-evasi0n" />-0.9.15b3<ref group="6.x_i" name="ipsw-upgradeable-evasi0n" />
| {{partial|Yes<ref group="6.x_i" name="ipsw-upgradeable-evasi0n" />}}
| {{partial|Tethered<ref group="6.x_i" name="ipsw-upgradeable-evasi0n" />}}
| colspan="2" rowspan="2" {{no}}
| {{partial|Tethered<ref group="6.x_i" name="ipsw-upgradeable-evasi0n" />}}
| rowspan="2" {{no}}
|-
| [[sn0wbreeze]]
| class="rborderplz" | 2.9.10-2.9.14
| colspan="2" {{yes}}
| {{yes}}
|-
| rowspan="4" | 6.1.3
| colspan="2" | [[ipwndfu]]
| colspan="4" {{no}}
| {{yes}}
| colspan="5" {{no}}
|-
| [[p0sixspwn]]
| class="rborderplz" | 1.0-1.0.8
| colspan="10" {{yes}}
|-
| [[redsn0w]]
| class="rborderplz" | 0.9.15b1<ref group="6.x_i" name="ipsw-upgradeable-p0sixspwn" />-0.9.15b3<ref group="6.x_i" name="ipsw-upgradeable-p0sixspwn" />
| colspan="4" rowspan="2" {{no}}
| {{partial|Yes<ref group="6.x_i" name="ipsw-upgradeable-p0sixspwn" />}}
| {{partial|Tethered<ref group="6.x_i" name="ipsw-upgradeable-p0sixspwn" />}}
| colspan="2" rowspan="2" {{no}}
| {{partial|Tethered<ref group="6.x_i" name="ipsw-upgradeable-p0sixspwn" />}}
| rowspan="2" {{no}}
|-
| [[sn0wbreeze]]
| class="rborderplz" | 2.9.14<ref group="6.x_i" name="upgradeable-p0sixspwn" />
| colspan="2" {{partial|Tethered<ref group="6.x_i" name="upgradeable-p0sixspwn" />}}
| {{partial|Tethered<ref group="6.x_i" name="upgradeable-p0sixspwn" />}}
|-
| 6.1.4
| [[p0sixspwn]]
| class="rborderplz" | 1.0-1.0.8
| colspan="7" {{n/a}}
| {{yes}}
| colspan="2" {{n/a}}
|-
| rowspan="2" | 6.1.5
| [[p0sixspwn]]
| class="rborderplz" | 1.0-1.0.8
| colspan="8" rowspan="2" {{n/a}}
| {{yes}}
| rowspan="2" {{n/a}}
|-
| [[redsn0w]]
| class="rborderplz" | 0.9.15b1<ref group="6.x_i" name="ipsw-upgradeable-p0sixspwn" />-0.9.15b3<ref group="6.x_i" name="ipsw-upgradeable-p0sixspwn" />
| {{partial|Tethered<ref group="6.x_i" name="ipsw-upgradeable-p0sixspwn" />|class=rborderplz}}
|-
| rowspan="3" | 6.1.6
| colspan="2" | [[ipwndfu]]
| rowspan="3" colspan="4" {{n/a}}
| rowspan="2" {{yes}}
| rowspan="3" colspan="3" {{n/a}}
| {{no}}
| rowspan="3" {{n/a}}
|-
| [[p0sixspwn]]
| class="rborderplz" | 1.0.8
| {{yes}}
|-
| [[redsn0w]]
| class="rborderplz" | 0.9.15b1<ref group="6.x_i" name="ipsw-upgradeable-p0sixspwn" />-0.9.15b3<ref group="6.x_i" name="ipsw-upgradeable-p0sixspwn" />
| {{partial|Tethered<ref group="6.x_i" name="ipsw-upgradeable-p0sixspwn" />}}
| {{partial|Tethered|class=rborderplz nobrradiusplz}}<ref group="6.x_i" name="ipsw-upgradeable-p0sixspwn" />
|}
<references group="6.x_i">
<ref name="upgradeable-evasi0n">[[Tethered jailbreak]] on devices not vulnerable to [[0x24000 Segment Overflow]]. Upgradable to [[untethered jailbreak]] via evasi0n Cydia package.</ref>
<ref name="ipsw-upgradeable-evasi0n">[[Tethered jailbreak]] on devices not vulnerable to [[0x24000 Segment Overflow]]. Requires pointing to 6.0 IPSW. Upgradable to [[untethered jailbreak]] via evasi0n Cydia package.</ref>
<ref name="upgradeable-p0sixspwn">[[Tethered jailbreak]] on devices not vulnerable to [[0x24000 Segment Overflow]]. Upgradable to [[untethered jailbreak]] via p0sixspwn Cydia package.</ref>
<ref name="ipsw-upgradeable-p0sixspwn">[[Tethered jailbreak]] on devices not vulnerable to [[0x24000 Segment Overflow]]. Requires pointing to 6.0 IPSW. Upgradable to [[untethered jailbreak]] via p0sixspwn Cydia package.</ref>
</references>

=====Apple TV=====
'''Note''': "Marketing Version" is the version that the Apple TV reports in its "About" screen.
{| class="wikitable"
|-
! rowspan="2" | Marketing Version
! rowspan="2" | iOS Version
! rowspan="2" | Jailbreak Tool
! rowspan="2" | Tool Version
! colspan="3" | Device
|-
! [[K66AP|Apple TV (2nd generation)]]
! [[J33AP|Apple TV (3rd generation) (AppleTV3,1)]]
! [[J33IAP|Apple TV (3rd generation) (AppleTV3,2)]]
|-
| rowspan="3" | 5.1
| rowspan="3" | 6.0
| [[evasi0n]]
| 1.0-1.5.3
| {{yes}}
| rowspan="3" {{no}}
| rowspan="3" {{n/a}}
|-
| [[redsn0w]]
| 0.9.15b1
| {{partial|Tethered}}
|-
| [[Seas0nPass]]
| class="rborderplz" | 0.8.?
| {{yes}}
|-
| rowspan="3" | 5.1.1
| rowspan="3" | 6.0.1
| [[evasi0n]]
| 1.0-1.5.3
| {{yes}}
| rowspan="3" {{no}}
| rowspan="3" {{n/a}}
|-
| [[redsn0w]]
| 0.9.15b3<ref group="6.x_atv" name="ipsw" />
| {{partial|Tethered}}
|-
| [[Seas0nPass]]
| class="rborderplz" | 0.8.?
| {{yes}}
|-
| rowspan="4" | 5.2
| rowspan="4" | 6.1
| [[evasi0n]]
| 1.0-1.5.3
| {{yes}}
| rowspan="4" colspan="2" {{no}}
|-
| [[redsn0w]]
| 0.9.15b3<ref group="6.x_atv" name="ipsw" />
| {{partial|Tethered}}
|-
| rowspan="2" | [[Seas0nPass]]
| class="rborderplz" | 0.8.9.655 (Mac)
| rowspan="2" {{yes}}
|-
| class="rborderplz" | 0.8.9.11241 (Windows)
|-
| rowspan="3" | 5.2.1
| rowspan="3" | 6.1.3
| [[redsn0w]]
| 0.9.15b3<ref group="6.x_atv" name="ipsw" />
| {{partial|Tethered}}
| rowspan="3" colspan="2" {{no}}
|-
| [[p0sixspwn]]
| 1.0-1.0.8
| {{yes}}
|-
| [[Seas0nPass]]
| class="rborderplz" | 0.9.?
| {{partial|Tethered}}
|-
| rowspan="3" | 5.3
| rowspan="3" | 6.1.4
| [[redsn0w]]
| 0.9.15b3<ref group="6.x_atv" name="ipsw" />
| {{partial|Tethered}}
| rowspan="3" colspan="2" {{no}}
|-
| [[p0sixspwn]]
| 1.0-1.0.8
| rowspan="2" {{yes}}
|-
| [[Seas0nPass]]
| class="rborderplz" | 0.9.5
|}
<references group="6.x_atv">
<ref name="ipsw">Point at 6.0 IPSW.</ref>
</references>

====7.x====
{| class="wikitable"
|-
! rowspan="2" | iOS
! rowspan="2" | Jailbreak Tool
! rowspan="2" | Tool Version
! colspan="12" | Device
|-
! [[iPad 2]]
! [[iPad (3rd generation)]]
! [[iPad (4th generation)]]
! [[iPad Air]]
! [[iPad mini]]
! [[iPad mini 2]]
! [[iPhone 4]]
! [[N94AP|iPhone 4S]]
! [[iPhone 5]]
! [[iPhone 5c]]
! [[iPhone 5s]]
! [[iPod touch (5th generation)]]
|-
| 7.0
| [[evasi0n7]]<ref group="7.x_i" name="offline" />
| class="rborderplz" | 1.0-1.0.7
| colspan="9" {{yes}}
| colspan="2" {{partial|Yes<ref group="7.x_i" name="hexedit" />}}
| {{yes}}
|-
| 7.0.1
| [[evasi0n7]]<ref group="7.x_i" name="offline" />
| class="rborderplz" | 1.0-1.0.7
| colspan="9" {{n/a}}
| colspan="2" {{yes}}
| {{n/a}}
|-
| 7.0.2
| [[evasi0n7]]<ref group="7.x_i" name="offline" />
| class="rborderplz" | 1.0-1.0.7
| colspan="12" {{yes}}
|-
| 7.0.3
| [[evasi0n7]]<ref group="7.x_i" name="offline" />
| class="rborderplz" | 1.0-1.0.7
| colspan="12" {{yes}}
|-
| 7.0.4
| [[evasi0n7]]<ref group="7.x_i" name="offline" />
| class="rborderplz" | 1.0-1.0.7
| colspan="12" {{yes}}
|-
| 7.0.5
| [[evasi0n7]]<ref group="7.x_i" name="offline" />
| class="rborderplz" | 1.0.5-1.0.7
| colspan="9" {{n/a}}
| colspan="2" {{yes}}
| {{n/a}}
|-
| 7.0.6
| [[evasi0n7]]<ref group="7.x_i" name="offline" />
| class="rborderplz" | 1.0.6-1.0.7
| colspan="12" {{yes}}
|-
| rowspan="3" | 7.1
| rowspan="2" | [[Geeksn0w]]
| class="rborderplz" | 2.5-2.8.3<ref group="7.x_i" name="upgradeable-semi" />
| rowspan="2" colspan="6" {{no}}
| {{partial|Tethered}}
| rowspan="2" colspan="5" {{no}}
|-
| class="rborderplz" | 2.9-2.9.1
| {{partial|Semi-Tethered}}
|-
| [[Pangu]]
| class="rborderplz" | 1.0.0-1.2.1
| colspan="12" {{yes}}
|-
| rowspan="2" | 7.1.1
| [[Geeksn0w]]
| class="rborderplz" | 2.9-2.9.1
| colspan="6" {{no}}
| {{partial|Semi-Tethered}}
| colspan="5" {{no}}
|-
| [[Pangu]]
| class="rborderplz" | 1.0.0-1.2.1
| colspan="12" {{yes}}
|-
| rowspan="2" | 7.1.2
| [[Geeksn0w]]
| class="rborderplz" | 2.9-2.9.1
| colspan="6" {{no}}
| {{partial|Semi-Tethered}}
| colspan="5" {{no}}
|-
| [[Pangu]]
| class="rborderplz" | 1.0.0-1.2.1
| colspan="12" {{yes}}
|}
<references group="7.x_i">
<ref name="offline">Due to the jailbreak payload being removed from the evasi0n website, a modified version of evasi0n7 is now required for a successful jailbreak.</ref>
<ref name="hexedit">Build 11A466. Requires a hex edit of [[evasi0n7]] binary. See [https://i.imgur.com/GVQnpig.png this image].</ref>
<ref name="upgradeable-semi">[[Tethered jailbreak]]. "Upgradable" to semi-tethered with "GeekSn0w Semi Untether Payload" (<code>com.blackgeek.geeksn0wsemiuntetherpayload</code>) from [http://geekrepo.beiphone.it geekrepo.beiphone.it].</ref>
</references>

=====Apple TV=====
'''Note''': "Marketing Version" is the version that the Apple TV reports in its "About" screen.
{| class="wikitable"
|-
! rowspan="2" | Marketing Version
! rowspan="2" | iOS Version
! rowspan="2" | Jailbreak Tool
! rowspan="2" | Tool Version
! colspan="3" | Device
|-
! [[K66AP|Apple TV (2nd generation)]]
! [[J33AP|Apple TV (3rd generation) (AppleTV3,1)]]
! [[J33IAP|Apple TV (3rd generation) (AppleTV3,2)]]
|-
| rowspan="2" | 6.0
| 7.0.1
| colspan="2" | No Tool Available
| colspan="3" {{no}}
|-
| 7.0.2
| colspan="2" | No Tool Available
| colspan="3" {{no}}
|-
| 6.0.1
| 7.0.3
| colspan="2" | No Tool Available
| colspan="3" {{no}}
|-
| rowspan="2" | 6.0.2
| 7.0.4
| colspan="2" | No Tool Available
| colspan="3" {{no}}
|-
| 7.0.6
| colspan="2" | No Tool Available
| colspan="3" {{no}}
|-
| 6.1
| 7.1
| colspan="2" | No Tool Available
| colspan="3" {{no}}
|-
| 6.1.1
| 7.1.1
| colspan="2" | No Tool Available
| colspan="3" {{no}}
|-
| 6.2
| rowspan="2" | 7.1.2
| colspan="2" | No Tool Available
| colspan="3" {{no}}
|-
| 6.2.1
| Seas0nPass
| 0.9.7 beta
| {{partial|Tethered}}
| colspan="2" {{no}}
|}

====8.x====
{| class="wikitable"
|-
! rowspan="2" | iOS
! rowspan="2" | Jailbreak Tool
! rowspan="2" | Tool Version
! colspan="16" | Device
|-
! [[iPad 2]]
! [[iPad (3rd generation)]]
! [[iPad (4th generation)]]
! [[iPad Air]]
! [[iPad Air 2]]
! [[iPad mini]]
! [[iPad mini 2]]
! [[iPad mini 3]]
! [[N94AP|iPhone 4S]]
! [[iPhone 5]]
! [[iPhone 5c]]
! [[iPhone 5s]]
! [[N61AP|iPhone 6]]
! [[N56AP|iPhone 6 Plus]]
! [[iPod touch (5th generation)]]
! [[N102AP|iPod touch (6th generation)]]
|-
| rowspan="4" | 8.0
| rowspan="2" | [[Pangu8]]
| class="rborderplz" | 1.0.0-1.2.1<ref group="8.x_i" name="ssh" /> (Windows)
| rowspan="4" colspan="4" {{yes}}
| rowspan="4" {{n/a}}
| rowspan="4" colspan="2" {{yes}}
| rowspan="4" {{partial}}<ref group="8.x_i" name="ipad-wifi" />
| rowspan="4" colspan="7" {{yes}}
| rowspan="4" {{n/a}}
|-
| class="rborderplz" | 1.0.0 (Mac)
|-
| [[PPJailbreak]]
| class="rborderplz" | 1.0 (Mac)
|-
| [[TaiG]]
| class="rborderplz" | 1.0.0-1.2.1 (Windows)
|-
| rowspan="4" | 8.0.1
| rowspan="2" | [[Pangu8]]
| class="rborderplz" | 1.0.0-1.2.1<ref group="8.x_i" name="ssh" /> (Windows)
| rowspan="4" colspan="4" {{yes}}
| rowspan="4" {{n/a}}
| rowspan="4" colspan="2" {{yes}}
| rowspan="4" {{partial}}<ref group="8.x_i" name="ipad-wifi" />
| rowspan="4" colspan="7" {{yes}}
| rowspan="4" {{n/a}}
|-
| class="rborderplz" | 1.0.0 (Mac)
|-
| [[PPJailbreak]]
| class="rborderplz" | 1.0 (Mac)
|-
| [[TaiG]]
| class="rborderplz" | 1.0.0-1.2.1 (Windows)
|-
| rowspan="4" | 8.0.2
| rowspan="2" | [[Pangu8]]
| class="rborderplz" | 1.0.0-1.2.1<ref group="8.x_i" name="ssh" /> (Windows)
| rowspan="4" colspan="4" {{yes}}
| rowspan="4" {{n/a}}
| rowspan="4" colspan="2" {{yes}}
| rowspan="4" {{partial}}<ref group="8.x_i" name="ipad-wifi" />
| rowspan="4" colspan="7" {{yes}}
| rowspan="4" {{n/a}}
|-
| class="rborderplz" | 1.0.0 (Mac)
|-
| [[PPJailbreak]]
| class="rborderplz" | 1.0 (Mac)
|-
| [[TaiG]]
| class="rborderplz" | 1.0.0-1.2.1 (Windows)
|-
| rowspan="4" | 8.1
| rowspan="2" | [[Pangu8]]
| class="rborderplz" | 1.0.0-1.2.1<ref group="8.x_i" name="ssh" /> (Windows)
| rowspan="4" colspan="15" {{yes}}
| rowspan="4" {{n/a}}
|-
| class="rborderplz" | 1.0.0 (Mac)
|-
| [[PPJailbreak]]
| class="rborderplz" | 1.0 (Mac)
|-
| [[TaiG]]
| class="rborderplz" | 1.0.0-1.2.1 (Windows)
|-
| rowspan="2" | 8.1.1
| [[PPJailbreak]]
| class="rborderplz" | 1.0 (Mac)
| rowspan="2" colspan="15" {{yes}}
| rowspan="2" {{n/a}}
|-
| [[TaiG]]
| class="rborderplz" | 1.0.0-1.2.1 (Windows)
|-
| rowspan="2" | 8.1.2
| [[PPJailbreak]]
| class="rborderplz" | 1.0 (Mac)
| rowspan="2" colspan="15" {{yes}}
| rowspan="2" {{n/a}}
|-
| [[TaiG]]
| class="rborderplz" | 1.2.0-1.2.1 (Windows)
|-
| rowspan="3" | 8.1.3
| [[PPJailbreak]]
| 2.0.0 (Mac)
| rowspan="3" colspan="15" {{yes}}
| rowspan="3" {{n/a}}
|-
| rowspan="2" | [[TaiG]]
| class="rborderplz" | 2.2.0-2.4.5 (Windows)
|-
| class="rborderplz" | 1.0.0-1.1.0 (Mac)
|-
| rowspan="3" | 8.2
| [[PPJailbreak]]
| 2.0.0 (Mac)
| rowspan="3" colspan="15" {{yes}}
| rowspan="3" {{n/a}}
|-
| rowspan="2" | [[TaiG]]
| class="rborderplz" | 2.2.0-2.4.5 (Windows)
|-
| class="rborderplz" | 1.0.0-1.1.0 (Mac)
|-
| rowspan="3" | 8.3
| [[PPJailbreak]]
| 2.0.0 (Mac)
| rowspan="3" colspan="15" {{yes}}
| rowspan="3" {{n/a}}
|-
| rowspan="2" | [[TaiG]]
| class="rborderplz" | 2.2.0-2.4.5 (Windows)
|-
| class="rborderplz" | 1.0.0-1.1.0 (Mac)
|-
| rowspan="3" | 8.4
| [[PPJailbreak]]
| 2.0.0 (Mac)
| rowspan="3" colspan="16" {{yes}}
|-
| rowspan="2" | [[TaiG]]
| class="rborderplz" | 2.2.0-2.4.5 (Windows)
|-
| class="rborderplz" | 1.0.0-1.1.0 (Mac)
|-
| 8.4.1
| [[EtasonJB]]
| RC2
| colspan="3" {{yes}}
| colspan="2" {{no}}
| {{yes}}
| colspan="2" {{no}}
| {{yes}}
| {{no}}
| {{yes}}
| colspan="3" {{no}}
| {{yes}}
| {{no}}
|}
<references group="8.x_i">
<ref name="ssh">1.0.0 and 1.0.1 give SSH access only ([[Cydia]] is not installed).</ref>
<ref name="ipad-wifi">[[J85mAP|iPad4,7 (Wi-Fi)]] only.</ref>
</references>

=====Apple TV=====
'''Note''': "Marketing Version" is the version that the Apple TV reports in its "About" screen.
{| class="wikitable"
|-
! rowspan="2" | Marketing Version
! rowspan="2" | iOS Version
! rowspan="2" | Jailbreak Tool
! rowspan="2" | Tool Version
! colspan="2" | Device
|-
! [[J33AP|Apple TV (3rd generation) (AppleTV3,1)]]
! [[J33IAP|Apple TV (3rd generation) (AppleTV3,2)]]
|-
| 7.0
| 8.0
| colspan="2" | No Tool Available
| colspan="2" {{no}}
|-
| 7.0.1
| 8.1
| colspan="2" | No Tool Available
| colspan="2" {{no}}
|-
| 7.0.2
| 8.1.1
| colspan="2" | No Tool Available
| colspan="2" {{no}}
|-
| 7.0.3
| 8.1.3
| colspan="2" | No Tool Available
| colspan="2" {{no}}
|-
| 7.1
| 8.2
| colspan="2" | No Tool Available
| colspan="2" {{no}}
|-
| 7.2
| 8.3
| colspan="2" | No Tool Available
| colspan="2" {{no}}
|-
| 7.2.1
| 8.4.1
| colspan="2" | No Tool Available
| colspan="2" {{no}}
|-
| 7.2.2
| 8.4.2
| colspan="2" | No Tool Available
| colspan="2" {{no}}
|}

====9.x====
{| class="wikitable"
|-
! rowspan="2" | iOS
! rowspan="2" | Jailbreak Tool
! rowspan="2" | Tool Version
! colspan="22" | Device
|-
! [[iPad 2]]
! [[iPad (3rd generation)]]
! [[iPad (4th generation)]]
! [[iPad Air]]
! [[iPad Air 2]]
! [[iPad Pro (12.9-inch)]]
! [[iPad Pro (9.7-inch)]]
! [[iPad mini]]
! [[iPad mini 2]]
! [[iPad mini 3]]
! [[iPad mini 4]]
! [[N94AP|iPhone 4S]]
! [[iPhone 5]]
! [[iPhone 5c]]
! [[iPhone 5s]]
! [[N61AP|iPhone 6]]
! [[N56AP|iPhone 6 Plus]]
! [[iPhone 6s]]
! [[iPhone 6s Plus]]
! [[iPhone SE]]
! [[iPod touch (5th generation)]]
! [[N102AP|iPod touch (6th generation)]]
|-
| rowspan="2" | 9.0
| rowspan="2" | [[Pangu9]] for 9.0-9.1
| 1.0.0-1.3.2 (Windows)
| colspan="6" rowspan="2" {{yes}}
| rowspan="2" {{n/a}}
| colspan="12" rowspan="2" {{yes}}
| rowspan="2" {{n/a}}
| colspan="2" rowspan="2" {{yes}}
|-
| 1.0.0-1.1.1 (Mac)
|-
| rowspan="2" | 9.0.1
| rowspan="2" | [[Pangu9]] for 9.0-9.1
| 1.0.0-1.3.2 (Windows)
| colspan="6" rowspan="2" {{yes}}
| rowspan="2" {{n/a}}
| colspan="12" rowspan="2" {{yes}}
| rowspan="2" {{n/a}}
| colspan="2" rowspan="2" {{yes}}
|-
| 1.0.0-1.1.1 (Mac)
|-
| rowspan="2" | 9.0.2
| rowspan="2" | [[Pangu9]] for 9.0-9.1
| 1.0.0-1.3.2 (Windows)
| colspan="6" rowspan="2" {{yes}}
| rowspan="2" {{n/a}}
| colspan="12" rowspan="2" {{yes}}
| rowspan="2" {{n/a}}
| colspan="2" rowspan="2" {{yes}}
|-
| 1.0.0-1.1.1 (Mac)
|-
| rowspan="4" | 9.1
| rowspan="2" | [[Home Depot]]
| Rev 1 - Rev 7
| {{yes}}
| colspan="5" {{no}}
| rowspan="4" {{n/a}}
| colspan="5" {{no}}
| {{partial|Partial<ref group="9.x" name="iphone52" />}}
| colspan="6" {{no}}
| rowspan="4" {{n/a}}
| {{yes}}
| {{no}}
|-
| RC1-RC3
| colspan="3" {{yes}}
| colspan="3" {{no}}
| {{yes}}
| colspan="3" {{no}}
| colspan="3" {{yes}}
| colspan="5" {{no}}
| {{yes}}
| {{no}}
|-
| rowspan="2" | [[Pangu9]] for 9.0-9.1
| 1.3.0-1.3.2 (Windows)
| colspan="3" rowspan="2" {{no}}
| colspan="3" rowspan="2" {{yes}}
| rowspan="2" {{no}}
| colspan="3" rowspan="2" {{yes}}
| colspan="3" rowspan="2" {{no}}
| colspan="5" rowspan="2" {{yes}}
| rowspan="2" {{no}}
| rowspan="2" {{yes}}
|-
| 1.1.0-1.1.1 (Mac)
|-
| rowspan="3" | 9.2
| rowspan="2" | [[Home Depot]]
| Rev 1 - Rev 7
| {{yes}}
| colspan="5" {{no}}
| rowspan="3" {{n/a}}
| colspan="4" {{no}}
| {{yes}}
| {{partial|Partial<ref group="9.x" name="iphone52" />}}
| colspan="6" {{no}}
| rowspan="3" {{n/a}}
| colspan="2" {{no}}
|-
| RC1-RC3
| colspan="3" {{yes}}
| colspan="3" {{no}}
| {{yes}}
| colspan="3" {{no}}
| colspan="3" {{yes}}
| colspan="5" {{no}}
| {{yes}}
| {{no}}
|-
| [[Pangu9]] for 9.2-9.3.3
| 1.0.0-1.1.0
| colspan="3" {{no}}
| colspan="3" {{yes}}
| {{no}}
| colspan="3" {{yes}}
| colspan="3" {{no}}
| colspan="5" {{yes}}
| {{no}}
| {{yes}}
|-
| rowspan="3" | 9.2.1
| rowspan="2" | [[Home Depot]]
| Rev 1 - Rev 7
| {{yes}}
| {{no}}
| {{yes}}
| colspan="3" {{no}}
| rowspan="3" {{n/a}}
| {{partial|Partial<ref group="9.x" name="ipad25" />}}
| colspan="3" {{no}}
| {{yes}}
| {{partial|Partial<ref group="9.x" name="iphone52" />}}
| {{partial|Partial<ref group="9.x" name="iphone53" />}}
| colspan="5" {{no}}
| rowspan="3" {{n/a}}
| colspan="2" {{no}}
|-
| RC1-RC3
| colspan="3" {{yes}}
| colspan="3" {{no}}
| {{yes}}
| colspan="3" {{no}}
| colspan="3" {{yes}}
| colspan="5" {{no}}
| {{yes}}
| {{no}}
|-
| [[Pangu9]] for 9.2-9.3.3
| 1.0.0-1.1.0
| colspan="3" {{no}}
| colspan="3" {{yes}}
| {{no}}
| colspan="3" {{yes}}
| colspan="3" {{no}}
| colspan="5" {{yes}}
| {{no}}
| {{yes}}
|-
| rowspan="3" | 9.3
| rowspan="2" | [[Home Depot]]
| Rev 1 - Rev 7
| {{yes}}
| colspan="10" {{no}}
| {{yes}}
| colspan="10" {{no}}
|-
| RC1-RC3
| colspan="3" {{yes}}
| colspan="4" {{no}}
| {{yes}}
| colspan="3" {{no}}
| colspan="3" {{yes}}
| colspan="6" {{no}}
| {{yes}}
| {{no}}
|-
| [[Pangu9]] for 9.2-9.3.3
| 1.0.0-1.1.0
| colspan="3" {{no}}
| colspan="4" {{yes}}
| {{no}}
| colspan="3" {{yes}}
| colspan="3" {{no}}
| colspan="6" {{yes}}
| {{no}}
| {{yes}}
|-
| rowspan="3" | 9.3.1
| rowspan="2" | [[Home Depot]]
| Rev 1 - Rev 7
| {{yes}}
| {{partial|Partial<ref group="9.x" name="ipad32" />}}
| colspan="9" {{no}}
| {{yes}}
| colspan="10" {{no}}
|-
| RC1-RC3
| colspan="3" {{yes}}
| colspan="4" {{no}}
| {{yes}}
| colspan="3" {{no}}
| colspan="3" {{yes}}
| colspan="6" {{no}}
| {{yes}}
| {{no}}
|-
| [[Pangu9]] for 9.2-9.3.3
| 1.0.0-1.1.0
| colspan="3" {{no}}
| colspan="4" {{yes}}
| {{no}}
| colspan="3" {{yes}}
| colspan="3" {{no}}
| colspan="6" {{yes}}
| {{no}}
| {{yes}}
|-
| rowspan="3" | 9.3.2
| rowspan="2" | [[Home Depot]]
| Rev 1 - Rev 7
| {{yes}}
| {{partial|Partial<ref group="9.x" name="ipad33" />}}
| colspan="5" {{no}}
| {{partial|Partial<ref group="9.x" name="ipad25" />}}
| colspan="3" {{no}}
| {{yes}}
| {{partial|Partial<ref group="9.x" name="iphone52" />}}
| {{yes}}
| colspan="6" {{no}}
| {{yes}}
| {{no}}
|-
| RC1-RC3
| colspan="3" {{yes}}
| colspan="4" {{no}}
| {{yes}}
| colspan="3" {{no}}
| colspan="3" {{yes}}
| colspan="6" {{no}}
| {{yes}}
| {{no}}
|-
| [[Pangu9]] for 9.2-9.3.3
| 1.0.0-1.1.0
| colspan="3" {{no}}
| colspan="4" {{yes}}
| {{no}}
| colspan="3" {{yes}}
| colspan="3" {{no}}
| colspan="6" {{yes}}
| {{no}}
| {{yes}}
|-
| rowspan="3" | 9.3.3
| rowspan="2" | [[Home Depot]]
| Rev 1 - Rev 7
| {{yes}}
| {{partial|Partial<ref group="9.x" name="ipad33" />}}
| colspan="5" {{no}}
| {{partial|Partial<ref group="9.x" name="ipad25" />}}
| colspan="3" {{no}}
| colspan="3" {{yes}}
| colspan="6" {{no}}
| {{yes}}
| {{no}}
|-
| RC1-RC3
| colspan="3" {{yes}}
| colspan="4" {{no}}
| {{yes}}
| colspan="3" {{no}}
| colspan="3" {{yes}}
| colspan="6" {{no}}
| {{yes}}
| {{no}}
|-
| [[Pangu9]] for 9.2-9.3.3
| 1.0.0-1.1.0
| colspan="3" {{no}}
| colspan="4" {{yes}}
| {{no}}
| colspan="3" {{yes}}
| colspan="3" {{no}}
| colspan="6" {{yes}}
| {{no}}
| {{yes}}
|-
| rowspan="2" | 9.3.4
| rowspan="2" | [[Home Depot]]
| Rev 1 - Rev 7
| {{yes}}
| {{partial|Partial<ref group="9.x" name="ipad31" />}}
| colspan="9" {{no}}
| colspan="2" {{yes}}
| {{partial|Partial<ref group="9.x" name="iphone53" />}}
| colspan="6" {{no}}
| {{yes}}
| {{no}}
|-
| RC1-RC3
| colspan="3" {{yes}}
| colspan="4" {{no}}
| {{yes}}
| colspan="3" {{no}}
| colspan="3" {{yes}}
| colspan="6" {{no}}
| {{yes}}
| {{no}}
|-
| 9.3.5
| [[Phœnix]]
| v1-v3
| colspan="3" {{yes}}
| colspan="4" {{no}}
| {{yes}}
| colspan="3" {{no}}
| colspan="3" {{yes}}
| colspan="6" {{no}}
| {{yes}}
| {{no}}
|}
<references group="9.x">
<ref name="ipad25">[[P105AP|iPad mini (Wi-Fi) (iPad2,5)]] only.</ref>
<ref name="ipad31">[[J1AP|iPad (3rd generation) (Wi-Fi) (iPad3,1)]] only.</ref>
<ref name="ipad32">[[J2AP|iPad (3rd generation) (GSM) (iPad3,2)]] only.</ref>
<ref name="ipad33">[[J2AAP|iPad (3rd generation) (CDMA) (iPad3,3)]] only.</ref>
<ref name="iphone52">[[N42AP|iPhone 5 (Global) (iPhone5,2)]] only.</ref>
<ref name="iphone53">[[N48AP|iPhone 5c (GSM) (iPhone5,3)]] only.</ref>
</references>

====10.x====
{| class="wikitable"
|-
! rowspan="2" | iOS
! rowspan="2" | Jailbreak Tool
! rowspan="2" | Tool Version
! colspan="22" | Device
|-
! [[iPad (4th generation)]]
! [[iPad Air]]
! [[iPad Air 2]]
! [[iPad Pro (12.9-inch)]]
! [[iPad Pro (9.7-inch)]]
! [[iPad (5th generation)]]
! [[iPad Pro (12.9-inch, 2nd generation)]]
! [[iPad Pro (10.5-inch)]]
! [[iPad mini 2]]
! [[iPad mini 3]]
! [[iPad mini 4]]
! [[iPhone 5]]
! [[iPhone 5c]]
! [[iPhone 5s]]
! [[N61AP|iPhone 6]]
! [[N56AP|iPhone 6 Plus]]
! [[iPhone 6s]]
! [[iPhone 6s Plus]]
! [[iPhone SE]]
! [[iPhone 7]]
! [[iPhone 7 Plus]]
! [[N102AP|iPod touch (6th generation)]]
|-
| 10.0
| colspan="2" | No Tool Available
| colspan="19" {{n/a}}
| colspan="2" {{no}}
| {{n/a}}
|-
| rowspan="5" | 10.0.1
| [[Yalu#extra_recipe_.2810.0.1-10.1.1_for_iPhone_7.29|extra_recipe+yaluX]]
| beta 4
| colspan="5" {{no}}
| rowspan="5" colspan="3" {{n/a}}
| colspan="11" {{no}}
| colspan="2" {{yes}}
| {{no}}
|-
| [[PPJailbreak]]
| 2.5.1 (Windows)
| {{no}}
| colspan="4" {{yes}}
| colspan="3" {{yes}}
| colspan="2" {{no}}
| colspan="6" {{yes}}
| colspan="2" {{no}}
| {{yes}}
|-
| rowspan="3" | [[yalu102]]
| beta 1
| colspan="3" {{no}}
| colspan="2" {{yes}}
| colspan="8" {{no}}
| colspan="3" {{yes}}
| colspan="3" {{no}}
|-
| beta 2-beta 6
| rowspan="2" {{no}}
| colspan="1" {{yes}}
| {{no}}
| colspan="2" {{yes}}
| colspan="2" {{yes}}
| colspan="3" {{no}}
| rowspan="2" colspan="6" {{yes}}
| rowspan="2" colspan="2" {{no}}
| rowspan="2" {{yes}}
|-
| beta 7
| colspan="4" {{yes}}
| colspan="3" {{yes}}
| colspan="2" {{no}}
|-
| rowspan="5" | 10.0.2
| [[Yalu#extra_recipe_.2810.0.1-10.1.1_for_iPhone_7.29|extra_recipe+yaluX]]
| beta 4
| colspan="5" {{no}}
| rowspan="5" colspan="3" {{n/a}}
| colspan="11" {{no}}
| colspan="2" {{yes}}
| {{no}}
|-
| [[PPJailbreak]]
| 2.5.1 (Windows)
| {{no}}
| colspan="4" {{yes}}
| colspan="3" {{yes}}
| colspan="2" {{no}}
| colspan="6" {{yes}}
| colspan="2" {{no}}
| {{yes}}
|-
| rowspan="3" | [[yalu102]]
| beta 1
| colspan="3" {{no}}
| colspan="2" {{yes}}
| colspan="8" {{no}}
| colspan="3" {{yes}}
| colspan="3" {{no}}
|-
| beta 2-beta 6
| rowspan="2" {{no}}
| colspan="1" {{yes}}
| {{no}}
| colspan="2" {{yes}}
| colspan="2" {{yes}}
| colspan="3" {{no}}
| rowspan="2" colspan="6" {{yes}}
| rowspan="2" colspan="2" {{no}}
| rowspan="2" {{yes}}
|-
| beta 7
| colspan="4" {{yes}}
| colspan="3" {{yes}}
| colspan="2" {{no}}
|-
| 10.0.3
| [[Yalu#extra_recipe_.2810.0.1-10.1.1_for_iPhone_7.29|extra_recipe+yaluX]]
| beta 4
| colspan="19" {{n/a}}
| colspan="2" {{yes}}
| {{n/a}}
|-
| rowspan="6" | 10.1
| [[Yalu#extra_recipe_.2810.0.1-10.1.1_for_iPhone_7.29|extra_recipe+yaluX]]
| beta 1-beta 4
| colspan="5" {{no}}
| rowspan="6" colspan="3" {{n/a}}
| colspan="11" {{no}}
| colspan="2" {{yes}}
| {{no}}
|-
| [[PPJailbreak]]
| 2.5.1 (Windows)
| {{no}}
| colspan="4" {{yes}}
| colspan="3" {{yes}}
| colspan="2" {{no}}
| colspan="6" {{yes}}
| colspan="2" {{no}}
| {{yes}}
|-
| [[Yalu#yalu_.2B_mach_portal_.2810.1-10.1.1.29|yalu + mach_portal]]
| beta 1-beta 3
| colspan="3" {{no}}
| colspan="2" {{yes}}
| colspan="8" {{no}}
| colspan="5" {{yes}}
| {{no}}
|-
| rowspan="3" | [[yalu102]]
| beta 1
| colspan="3" {{no}}
| colspan="2" {{yes}}
| colspan="8" {{no}}
| colspan="3" {{yes}}
| colspan="3" {{no}}
|-
| beta 2-beta 6
| rowspan="2" {{no}}
| colspan="1" {{yes}}
| {{no}}
| colspan="2" {{yes}}
| colspan="2" {{yes}}
| colspan="3" {{no}}
| rowspan="2" colspan="6" {{yes}}
| rowspan="2" colspan="2" {{no}}
| rowspan="2" {{yes}}
|-
| beta 7
| colspan="4" {{yes}}
| colspan="3" {{yes}}
| colspan="2" {{no}}
|-
| rowspan="6" | 10.1.1
| [[Yalu#extra_recipe_.2810.0.1-10.1.1_for_iPhone_7.29|extra_recipe+yaluX]]
| beta 1-beta 4
| colspan="5" {{no}}
| rowspan="6" colspan="3" {{n/a}}
| colspan="11" {{no}}
| colspan="2" {{yes}}
| {{no}}
|-
| [[PPJailbreak]]
| 2.5.1 (Windows)
| {{no}}
| colspan="4" {{yes}}
| colspan="3" {{yes}}
| colspan="2" {{no}}
| colspan="6" {{yes}}
| colspan="2" {{no}}
| {{yes}}
|-
| [[Yalu#yalu_.2B_mach_portal_.2810.1-10.1.1.29|yalu + mach_portal]]
| beta 1-beta 3
| colspan="3" {{no}}
| colspan="2" {{yes}}
| colspan="8" {{no}}
| colspan="5" {{yes}}
| {{no}}
|-
| rowspan="3" | [[yalu102]]
| beta 1
| colspan="3" {{no}}
| colspan="2" {{yes}}
| colspan="8" {{no}}
| colspan="3" {{yes}}
| colspan="3" {{no}}
|-
| beta 2-beta 6
| rowspan="2" {{no}}
| colspan="1" {{yes}}
| {{no}}
| colspan="2" {{yes}}
| colspan="2" {{yes}}
| colspan="3" {{no}}
| rowspan="2" colspan="6" {{yes}}
| rowspan="2" colspan="2" {{no}}
| rowspan="2" {{yes}}
|-
| beta 7
| colspan="4" {{yes}}
| colspan="3" {{yes}}
| colspan="2" {{no}}
|-
| rowspan="4" | 10.2
| [[PPJailbreak]]
| 2.5.1 (Windows)
| {{no}}
| colspan="4" {{yes}}
| rowspan="4" colspan="3" {{n/a}}
| colspan="3" {{yes}}
| colspan="2" {{no}}
| colspan="6" {{yes}}
| colspan="2" {{no}}
| {{yes}}
|-
| rowspan="3" | [[yalu102]]
| beta 1
| colspan="3" {{no}}
| colspan="2" {{yes}}
| colspan="8" {{no}}
| colspan="3" {{yes}}
| colspan="3" {{no}}
|-
| beta 2-beta 6
| rowspan="2" {{no}}
| colspan="1" {{yes}}
| {{no}}
| colspan="2" {{yes}}
| colspan="2" {{yes}}
| colspan="3" {{no}}
| rowspan="2" colspan="6" {{yes}}
| rowspan="2" colspan="2" {{no}}
| rowspan="2" {{yes}}
|-
| beta 7
| colspan="4" {{yes}}
| colspan="3" {{yes}}
| colspan="2" {{no}}
|-
| 10.2.1
| colspan="2" | No Tool Available
| colspan="5" {{no}}
| colspan="3" {{n/a}}
| colspan="14" {{no}}
|-
| 10.3
| colspan="2" | No Tool Available
| colspan="6" {{no}}
| colspan="2" {{n/a}}
| colspan="14" {{no}}
|-
| 10.3.1
| colspan="2" | No Tool Available
| colspan="6" {{no}}
| colspan="2" {{n/a}}
| colspan="14" {{no}}
|-
| 10.3.2
| colspan="2" | No Tool Available
| colspan="22" {{no}}
|-
| 10.3.3
| colspan="2" | No Tool Available
| colspan="22" {{no}}
|}

====11.x====
{| class="wikitable"
|-
! rowspan="2" | iOS
! rowspan="2" | Jailbreak Tool
! rowspan="2" | Tool Version
! colspan="21" | Device
|-
! [[iPad Air]]
! [[iPad Air 2]]
! [[iPad Pro (12.9-inch)]]
! [[iPad Pro (9.7-inch)]]
! [[iPad (5th generation)]]
! [[iPad Pro (12.9-inch, 2nd generation)]]
! [[iPad Pro (10.5-inch)]]
! [[iPad mini 2]]
! [[iPad mini 3]]
! [[iPad mini 4]]
! [[iPhone 5s]]
! [[N61AP|iPhone 6]]
! [[N56AP|iPhone 6 Plus]]
! [[iPhone 6s]]
! [[iPhone 6s Plus]]
! [[iPhone SE]]
! [[iPhone 7]]
! [[iPhone 7 Plus]]
! [[iPhone 8]]
! [[iPhone 8 Plus]]
! [[N102AP|iPod touch (6th generation)]]
|-
| 11.0
| colspan="2" | No Tool Available
| colspan="21" {{no}}
|}

=== tvOS ===
==== 9.x ====
{| class="wikitable"
|-
! rowspan="2" | tvOS
! rowspan="2" | Jailbreak Tool
! rowspan="2" | Tool Version
! Device
|-
! [[J42dAP|Apple TV (4th generation)]]
|-
| 9.0
| [[Pangu9]]
| 1.0.0
| {{yes}}
|-
| 9.0.1
| [[Pangu9]]
| 1.0.0
| {{yes}}
|-
| 9.1
| colspan="2" | No Tool Available
| {{no}}
|-
| 9.1.1
| colspan="2" | No Tool Available
| {{no}}
|-
| 9.2
| colspan="2" | No Tool Available
| {{no}}
|-
| 9.2.1
| colspan="2" | No Tool Available
| {{no}}
|-
| 9.2.2
| colspan="2" | No Tool Available
| {{no}}
|}

==== 10.x ====
{| class="wikitable"
|-
! rowspan="2" | tvOS
! rowspan="2" | Jailbreak Tool
! rowspan="2" | Tool Version
! Device
|-
! [[J42dAP|Apple TV (4th generation)]]
|-
| 10.0
| [[LiberTV]]
| v1-v2
| {{yes}}
|-
| 10.0.1
| [[LiberTV]]
| v1-v2
| {{yes}}
|-
| 10.1
| [[LiberTV]]
| v1-v2
| {{yes}}
|-
| 10.1.1
| colspan="2" | No Tool Available
| {{no}}
|-
| 10.2
| colspan="2" | No Tool Available
| {{no}}
|-
| 10.2.1
| colspan="2" | No Tool Available
| {{no}}
|-
| 10.2.2
| colspan="2" | No Tool Available
| {{no}}
|}

==== 11.x ====
{| class="wikitable"
|-
! rowspan="2" | tvOS
! rowspan="2" | Jailbreak Tool
! rowspan="2" | Tool Version
! colspan="2" | Device
|-
! [[J42dAP|Apple TV (4th generation)]]
! [[J105aAP|Apple TV 4K]]
|-
| 11.0
| colspan="2" | No Tool Available
| colspan="2" {{no}}
|}

==See Also==
* [[Failbreak]]
* [[Jailbreak Exploits]]
* [[Kernel Patches]]

[[Category:Jailbreaking]]

User:Detiac

2017-09-09T18:38:28Z

Detiac:

==About Me==

I like to code stuff... C is my favourite language (Alongside it's childs).

==Devices I Own==

{| class="wikitable"
|-
! Device
! iOS
! Condition
|-
| [[N72AP|iPod 2G, New BootROM]]
| 3.1.3, 7E18
| Working
|-
| [[N72AP|iPod 2G, Old BootROM]]
| 4.1, 8B117
| Working
|-
| [[N81AP|iPod 4G]]
| 5.1.1, 9B206
| Working
|-
| [[N78aAP|iPod 5]]
| 8.3, 12F69
| Smashed With A Rock
|-
| [[N92AP|iPhone 4S]]
| 9.3.5, 13G36
| Working
|-
| [[N48AP|iPhone 5C (Yellow)]]
| 10.2.1, 14D27
| Working
|-
| [[N102AP|iPod 6]]
| 10.3.2, 14F89
| Working
|}

T7000

2017-08-28T16:43:59Z

Detiac: /* Bootrom Exploits */

[[File:A8.jpg|150px|thumb|A8 chip.]]
The '''T7000''' is the Apple A8 processor currently used in the [[J42dAP|Apple TV (4th generation)]], [[B238aAP|HomePod]], [[iPad mini 4]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]] and [[N102AP|iPod touch (6th generation)]]. Designed by Apple, it contains two 64-bit Typhoon ARMv8-A CPU cores running at 1.38 GHz (1.1 GHz for [[N102AP|iPod touch (6th generation)]]).

== Hardware ==
The A8 part number is <code>APL1011</code>. It is manufactured using the TSMC 20 nm HKMG process and has a die size of 89 mm2. It contains a 4-core IMG PowerVR GX6450 GPU.

==Bootrom Exploits==
There are no publicly known exploits.

== References ==
* [[wikipedia:Apple A8|Wikipedia]]

{{stub|hardware}}
[[Category:Application Processors]]

Jailbreak

2017-08-28T12:49:45Z

Detiac: Fix depressing issue

{{float toc|right}}
'''Jailbreak'''ing is the process by which full execute and write access is obtained on all the partitions of the Apple TV, iPad, iPad mini, iPhone or iPod touch. It is done by patching [[/private/etc/fstab]] to mount the System partition as 'read-write'. This is entirely different from an [[unlock]]. Jailbreaking is the first action that must be taken before things like unofficial [[activation]] (hacktivation), and unofficial [[unlock]]ing can be applied.

Older jailbreaks also included modifying the [[AFC]] service (used by [[iTunes]] to access the filesystem) to give full filesystem access from root. This was later updated to create a new service ([[AFC]]2) that allows access to the full filesystem.

Modern jailbreaks now include patching the kernel to get around code signing and other restrictions. These are called [[Kernel Patches]].

'''Note''': The legality of jailbreaking your device varies with each country/region. [[wikipedia:iOS jailbreaking#Legal status|Wikipedia has a summary of legality for some countries]].

== Types of Jailbreaks ==
When a device is booting, it loads Apple's own [[kernel]] initially, so a jailbroken device must be exploited and have the kernel patched each time it is booted up.

An [[untethered jailbreak|'''untethered''' jailbreak]] uses exploits that are powerful enough to allow the user to turn their device off and back on at will, with the device starting up completely, and the kernel will be patched without the help of a computer – in other words, it will be jailbroken even after each reboot.

However, some jailbreaks are [[tethered jailbreak|'''tethered''']]. A tethered jailbreak is only able to temporarily jailbreak the device during a single boot. If the user turns the device off and then boots it back up without the help of a jailbreak tool, the device will no longer be running a patched kernel, and it may get stuck in a partially started state, such as [[Recovery Mode]]. In order for the device to start completely and with a patched kernel, it must be "re-jailbroken" with a computer (using the "boot tethered" feature of a tool) each time it is turned on. All changes to the files on the device (such as installed package files or edited system files) will persist between reboots, including changes that can only function if the device is jailbroken (such as installed package files).

In more recent years, two other solutions have been created - '''semi-tethered''' and '''semi-''un''tethered'''.

A [[semi-tethered jailbreak|'''semi-tethered''']] solution is one where the device is able to start up on its own, but it will no longer have a patched kernel, and therefore will not be able to run modified code. It will, however, still be usable for normal functions, just like stock iOS. To start with a patched kernel, the user must start the device with the help of the jailbreak tool.

A [[semi-untethered jailbreak|'''semi-''un''tethered''']] jailbreak gives the ability to start the device on it's own. On first boot, the device will not be running a patched kernel. However, rather than having to run a tool from a computer to apply the kernel patches, the user is able to re-jailbreak their device with the help of an app (usually sideloaded using [[Cydia Impactor]]) running on their device. In the case of the iOS 9.2-9.3.3 jailbreak, a Safari-based exploit was available, thereby meaning a website could be used to rejailbreak.

In more detail: Each iOS device has a [[bootchain]] that tries to make sure only trusted/signed code is loaded. A device with a tethered jailbreak is able to boot up with the help of a jailbreaking tool because the tool executes exploits via USB that bypass parts of that "chain of trust", bootstrapping to a [[pwned]] (no [[Signature Check Patch|signature check]]) [[iBSS]], [[iBEC]], or [[iBoot (Bootloader)|iBoot]] to finish the boot process.

== Jailbreak Tools ==
Untethered or semi-untethered jailbreaks are shown with a green 'yes'. Tethered or semi-tethered jailbreaks will be stated in a yellow box. [[Beta Firmware]]s are not listed here.



===iPhone OS===
====1.x====
{| class="wikitable"
|-
! rowspan="2" | iPhone OS
! rowspan="2" | Jailbreak Tool
! rowspan="2" | Tool Version
! colspan="2" | Device
|-
! [[M68AP|iPhone]]
! [[N45AP|iPod touch]]
|-
| rowspan="3" | 1.0
| [[AppTapp Installer]]
| class="rborderplz" | 1.0
| rowspan="3" {{yes}}
| rowspan="3" {{n/a}}
|-
| [[iBrickr]]
| class="rborderplz" | 0.5-0.91
|-
| [[iLiberty+]]
| class="rborderplz" | 1.3.0.113
|-
| rowspan="2" | 1.0.1
| [[AppTapp Installer]]
| class="rborderplz" | 1.0
| rowspan="2" {{yes}}
| rowspan="2" {{n/a}}
|-
| [[iBrickr]]
| class="rborderplz" | 0.5-0.91
|-
| rowspan="2" | 1.0.2
| [[AppTapp Installer]]
| class="rborderplz" | 1.0
| rowspan="2" {{yes}}
| rowspan="2" {{n/a}}
|-
| [[iBrickr]]
| class="rborderplz" | 0.6-0.91
|-
| 1.1
| colspan="2" | No Tool Available
| {{n/a}}
| {{no}}
|-
| 1.1.1
| colspan="2" | The [[libTiff Exploit]]
| colspan="2" {{partial|Yes}}<ref group="1.x" name="1.1.1" />
|-
| 1.1.2
| colspan="2" | [[mknod|OktoPrep]] + [[touchFree]]
| colspan="2" {{partial|Yes}}<ref group="1.x" name="oktoprep-offline" />
|-
| class="rborderplz" rowspan="3" | 1.1.3
| [[iLiberty+|iLiberty / iLiberty+]]
| class="rborderplz" | 1.3.0.113
| colspan="2" {{yes}}
|-
| colspan="2" | [[Soft Upgrade]]
| colspan="2" {{partial|Yes}}<ref group="1.x" name="softupgrade-offline" />
|-
| [[ZiPhone]]
| 3.0
| colspan="2" {{yes}}
|-
| rowspan="3" | 1.1.4
| [[iLiberty+|iLiberty / iLiberty+]]
| class="rborderplz" | 1.3.0.113
| colspan="2" rowspan="3" {{yes}}
|-
| [[PwnageTool]]
| class="rborderplz" | 1.1
|-
| [[ZiPhone]]
| class="rborderplz" | 3.0
|-
| rowspan="2" | 1.1.5
| [[iLiberty+|iLiberty / iLiberty+]]
| class="rborderplz" | 1.3.0.113
| rowspan="2" {{n/a}}
| rowspan="2" {{yes}}
|-
| [[ZiPhone]]
| class="rborderplz" | 3.0
|}
<references group="1.x">
<ref name="1.1.1">A maliciously-crafted TIFF, using the [[libTiff Exploit]], loaded into Safari, can be used to jailbreak iPhone OS 1.1.1. There are several of these TIFFs available - two of the most notable include [https://forums.macrumors.com/threads/377126/ planetbeing's] and [[AppSnapp]]. However, both of these services are now offline, so cannot be used. Even so, a user could still create their own TIFF and payload in order to jailbreak 1.1.1.</ref>
<ref name="oktoprep-offline">It was previously possible to jailbreak 1.1.2 using [[mknod|OktoPrep]] alongside [[touchFree]]. However, the original package repository for OktoPrep through [[Installer.app]] has been taken offline. A user would need to find the original package file for OktoPrep and install it manually in order to jailbreak 1.1.2.</ref>
<ref name="softupgrade-offline">It was previously possible to jailbreak 1.1.3 using [[Soft Upgrade]], but this is no longer possible due to the package repository being taken offline. A user would need to find the original package file for Soft Upgrade and install it manually to jailbreak 1.1.3 using this method.</ref>
</references>

====2.x====
{| class="wikitable"
|-
! rowspan="2" | iPhone OS
! rowspan="2" | Jailbreak Tool
! rowspan="2" | Tool Version
! colspan="4" | Device
|-
! [[M68AP|iPhone]]
! [[N82AP|iPhone 3G]]
! [[N45AP|iPod touch]]
! [[N72AP|iPod touch (2nd generation)]]
|-
| rowspan="2" | 2.0
| [[PwnageTool]]
| class="rborderplz" | 2.0-2.0.3
| colspan="3" {{yes}}
| rowspan="2" {{n/a}}
|-
| [[QuickPwn]]
| class="rborderplz" | RC3-2.2.5
| {{yes}}
| {{no}}
| {{yes}}
|-
| rowspan="2" | 2.0.1
| [[PwnageTool]]
| class="rborderplz" | 2.0.2-2.0.3
| colspan="3" {{yes}}
| rowspan="2" {{n/a}}
|-
| [[QuickPwn]]
| class="rborderplz" | RC3-2.2.5
| {{yes}}
| {{no}}
| {{yes}}
|-
| rowspan="2" | 2.0.2
| [[PwnageTool]]
| class="rborderplz" | 2.0.3
| colspan="3" {{yes}}
| rowspan="2" {{n/a}}
|-
| [[QuickPwn]]
| class="rborderplz" | RC3-2.2.5
| {{yes}}
| {{no}}
| {{yes}}
|-
| rowspan="2" | 2.1
| [[PwnageTool]]
| class="rborderplz" | 2.1-2.2.5
| colspan="3" {{yes}}
| rowspan="2" {{n/a}}
|-
| [[QuickPwn]]
| class="rborderplz" | 2.1-2.2.5
| {{yes}}
| {{no}}
| {{yes}}
|-
| 2.1.1
| class="rborderplz" colspan="2" | [[redsn0w Lite]]
| colspan="3" {{n/a}}
| {{partial|Tethered}}<ref group="2.x">Tethered for devices running the [[Bootrom 240.4|old bootrom]] only. Will not work for devices on the [[Bootrom 240.5.1|new bootrom]].</ref>
|-
| rowspan="2" | 2.2
| [[PwnageTool]]
| class="rborderplz" | 2.2-2.2.5
| colspan="3" {{yes}}
| {{no}}
|-
| [[QuickPwn]]
| class="rborderplz" | 2.2-2.2.5
| {{yes}}
| {{no}}
| {{yes}}
| {{no}}
|-
| rowspan="3" | 2.2.1
| [[PwnageTool]]
| class="rborderplz" | 2.2.1-2.2.5
| colspan="3" {{yes}}
| {{no}}
|-
| [[QuickPwn]]
| class="rborderplz nobrradiusplz" | 2.2.1-2.2.5
| {{yes}}
| {{no}}
| {{yes}}
| {{no}}
|-
| [[redsn0w]]
| class="rborderplz nobrradiusplz" | 0.3
| colspan="3" {{no}}
| {{yes}}
|}
<references group="2.x" />

====3.x====
{| class="wikitable"
|-
! rowspan="2" | iPhone OS
! rowspan="2" | Jailbreak Tool
! rowspan="2" | Tool Version
! colspan="7" | Device
|-
! [[K48AP|iPad]]
! [[M68AP|iPhone]]
! [[N82AP|iPhone 3G]]
! [[N88AP|iPhone 3GS]]
! [[N45AP|iPod touch]]
! [[N72AP|iPod touch (2nd generation)]]
! [[N18AP|iPod touch (3rd generation)]]
|-
| rowspan="4" | 3.0
| colspan="2" | [[ipwndfu]]
| rowspan="4" {{n/a}}
| colspan="2" {{no}}
| {{yes}}
| colspan="2" {{no}}
| rowspan="4" {{n/a}}
|-
| [[purplera1n]]
| class="rborderplz" | 1.0
| {{yes}}
| {{no}}
| colspan="3" {{yes}}
|-
| [[PwnageTool]]
| class="rborderplz" | 3.0
| colspan="2" {{yes}}
| {{no}}
| {{yes}}
| {{no}}
|-
| [[redsn0w]]
| class="rborderplz" | 0.8-0.9.3
| colspan="5" {{yes}}
|-
| rowspan="2" | 3.0.1
| colspan="2" | [[ipwndfu]]
| rowspan="2" {{n/a}}
| colspan="2" {{no}}
| {{yes}}
| colspan="3" rowspan="2" {{n/a}}
|-
| [[redsn0w]]
| class="rborderplz" | 0.8-0.9.3
| colspan="3" {{yes}}
|-
| rowspan="4" | 3.1
| [[blackra1n]]
| class="rborderplz" | 1.0
| rowspan="4" {{n/a}}
| colspan="2" {{yes}}
| {{partial|Yes}}<ref group="3.x" name="oldboot3gs">Tethered jailbreak for any [[N88AP|iPhone 3GS]] with the [[Bootrom 359.3.2|new bootrom]]. Untethered for the [[Bootrom 359.3|old bootrom]].</ref>
| rowspan="4" colspan="3" {{n/a}}
|-
| colspan="2" | [[ipwndfu]]
| colspan="2" {{no}}
| {{yes}}
|-
| [[PwnageTool]]
| class="rborderplz" | 3.1-3.1.3
| rowspan="2" colspan="2" {{yes}}
| {{no}}
|-
| [[redsn0w]]
| class="rborderplz" | 0.9.2-0.9.3
| {{partial|Yes}}<ref group="3.x" name="oldboot3gs" />
|-
| rowspan="4" | 3.1.1
| [[blackra1n]]
| class="rborderplz" | 1.0
| rowspan="4" colspan="4" {{n/a}}
| rowspan="4" {{yes}}
| colspan="2" {{partial|Tethered}}
|-
| rowspan="2" | [[PwnageTool]]
| class="rborderplz" | 3.1
| colspan="2" {{no}}
|-
| class="rborderplz" | 3.1.3
| {{yes}}
| {{no}}
|-
| [[redsn0w]]
| class="rborderplz" | 0.9.3
| {{partial|Yes}}<ref group="3.x" name="oldboot">Tethered jailbreak for any [[N72AP|iPod touch (2nd generation)]] with the [[Bootrom 240.5.1|new bootrom]]. Untethered for the [[Bootrom 240.4|old bootrom]].</ref>
| {{partial|Tethered}}
|-
| rowspan="7" | 3.1.2
| [[blackra1n]]
| class="rborderplz" | 1.0
| rowspan="7" {{n/a}}
| colspan="2" {{yes}}
| {{partial|Yes}}<ref group="3.x" name="oldboot3gs" />
| {{yes}}
| colspan="2" {{partial|Tethered}}
|-
| colspan="2" | [[ipwndfu]]
| colspan="2" {{no}}
| {{yes}}
| colspan="3" {{no}}
|-
| [[PwnageTool]]
| class="rborderplz" | 3.1.4-3.1.5
| rowspan="2" colspan="2" {{yes}}
| colspan="3" {{yes}}
| {{no}}
|-
| [[redsn0w]]
| class="rborderplz" | 0.9.2-0.9.3
| rowspan="3" {{partial|Yes}}<ref group="3.x" name="oldboot3gs" />
| rowspan="2" {{yes}}
| {{partial|Yes}}<ref group="3.x" name="oldboot" />
| {{partial|Tethered}}
|-
| [[sn0wbreeze]]
| class="rborderplz" | Public Beta-2.9.14
| rowspan="2" {{no}}
| rowspan="2" {{yes}}
| colspan="2" {{no}}
|-
| [[Spirit]]
| class="rborderplz" | 1.0
| colspan="3" {{no}}
|-
| colspan="2" | [[Star]] ([[JailbreakMe]] 2.0)
| colspan="4" {{yes}}
| colspan="2" {{no}}
|-
| rowspan="7" | 3.1.3
| [[blackra1n]]
| class="rborderplz" | 1.0
| rowspan="7" {{n/a}}
| colspan="2" {{yes}}
| {{partial|Yes}}<ref group="3.x" name="oldboot3gs" />
| {{yes}}
| colspan="2" {{no}}
|-
| colspan="2" | [[ipwndfu]]
| colspan="2" {{no}}
| {{yes}}
| colspan="3" {{no}}
|-
| [[PwnageTool]]
| class="rborderplz" | 3.1.5
| colspan="5" {{yes}}
| rowspan="2" {{no}}
|-
| [[redsn0w]]
| class="rborderplz" | 0.9.4
| colspan="2" {{yes}}
| rowspan="3" {{partial|Yes}}<ref group="3.x" name="oldboot3gs" />
| {{yes}}
| {{partial|Yes}}<ref group="3.x" name="oldboot" />
|-
| [[sn0wbreeze]]
| class="rborderplz" | 1.5-2.9.14
| rowspan="2" {{no}}
| rowspan="2" {{yes}}
| colspan="3" {{yes}}
|-
| [[Spirit]]
| class="rborderplz" | 1.0
| {{no}}
| colspan="2" {{yes}}
|-
| colspan="2" | [[Star]] ([[JailbreakMe]] 2.0)
| colspan="6" {{yes}}
|-
| rowspan="3" | 3.2
| [[sn0wbreeze]]
| class="rborderplz nobrradiusplz" | ???-2.9.14
| rowspan="3" {{yes}}
| rowspan="3" colspan="6" {{n/a}}
|-
| [[Spirit]]
| class="rborderplz" | 1.0
|-
| class="rborderplz" colspan="2" | [[Star]] ([[JailbreakMe]] 2.0)
|-
| rowspan="2" | 3.2.1
| [[sn0wbreeze]]
| class="rborderplz nobrradiusplz" | ???-2.9.14
| rowspan="2" {{yes}}
| rowspan="2" colspan="6" {{n/a}}
|-
| colspan="2" | [[Star]] ([[JailbreakMe]] 2.0)
|-
| rowspan="6" | 3.2.2
| [[greenpois0n (jailbreak)|greenpois0n]]
| class="rborderplz" | RC4
| rowspan="5" {{yes}}
| rowspan="6" colspan="6" {{n/a}}
|-
| [[limera1n]]
| class="rborderplz" | 1.0
|-
| [[PwnageTool]]
| class="rborderplz" | 4.1-4.1.3
|-
| [[redsn0w]]
| class="rborderplz" | 0.9.6b2-0.9.11b4
|-
| [[sn0wbreeze]]
| class="rborderplz nobrradiusplz" | 2.1-2.9.14
|-
| colspan="2" | [[Star]] ([[JailbreakMe]] 2.0)
| {{partial|Yes<ref group="3.x" name="modifiedstar">Star can be modified to support 3.2.2, because Apple did not correctly patch the exploits used.</ref>}}
|}
<references group="3.x"/>

===iOS===
====4.x====
{| class="wikitable"
|-
! rowspan="2" | iOS
! rowspan="2" | Jailbreak Tool
! rowspan="2" | Tool Version
! colspan="9" | Device
|-
! [[K48AP|iPad]]
! [[iPad 2]]
! [[N82AP|iPhone 3G]]
! [[N88AP|iPhone 3GS]]
! [[N90AP|iPhone 4 (iPhone3,1)]]
! [[N92AP|iPhone 4 (iPhone3,3)]]
! [[N72AP|iPod touch (2nd generation)]]
! [[N18AP|iPod touch (3rd generation)]]
! [[N81AP|iPod touch (4th generation)]]
|-
| rowspan="6" | 4.0
| colspan="2" | [[ipwndfu]]
| colspan="2" rowspan="6" {{n/a}}
| rowspan="2" {{no}}
| {{yes}}
| {{no}}
| rowspan="6" {{n/a}}
| colspan="2" {{no}}
| rowspan="6" {{n/a}}
|-
| [[limera1n]]
| class="rborderplz" | 1.0
| colspan="2" {{yes}}
| {{no}}
| {{yes}}
|-
| [[PwnageTool]]
| class="rborderplz" | 4.0-4.01
| rowspan="2" {{yes}}
| {{partial|Yes}}<ref group="4.x_i" name="oldboot3gs" />
| {{no}}
| rowspan="2" {{partial|Yes}}<ref group="4.x_i" name="oldboot" />
| rowspan="2" {{no}}
|-
| [[redsn0w]]
| class="rborderplz" | 0.9.5b3-0.9.6b3
| colspan="2" {{no}}
|-
| [[sn0wbreeze]]
| class="rborderplz" | 1.6-2.9.14
| rowspan="2" colspan="3" {{yes}}
| rowspan="2" colspan="2" {{yes}}
|-
| colspan="2" | [[Star]] ([[JailbreakMe]] 2.0)
|-
| rowspan="6" | 4.0.1
| colspan="2" | [[ipwndfu]]
| colspan="2" rowspan="6" {{n/a}}
| rowspan="3" {{no}}
| {{yes}}
| {{no}}
| colspan="4" rowspan="6" {{n/a}}
|-
| [[limera1n]]
| class="rborderplz" | 1.0
| colspan="2" {{yes}}
|-
| [[PwnageTool]]
| class="rborderplz" | 4.0
| {{partial|Yes}}<ref group="4.x_i" name="oldboot3gs" /><ref group="4.x_i" name="bundle" />
| {{no}}
|-
| [[redsn0w]]
| class="rborderplz" | 0.9.5b3-0.9.6b3
| {{yes}}
| colspan="2" {{no}}
|-
| [[sn0wbreeze]]
| class="rborderplz" | 1.6-2.9.14
| rowspan="2" colspan="3" {{yes}}
|-
| colspan="2" | [[Star]] ([[JailbreakMe]] 2.0)
|-
| rowspan="6" | 4.0.2
| colspan="2" | [[ipwndfu]]
| colspan="2" rowspan="6" {{n/a}}
| rowspan="3" {{no}}
| {{yes}}
| {{no}}
| rowspan="6" {{n/a}}
| colspan="2" {{no}}
| rowspan="6" {{n/a}}
|-
| [[limera1n]]
| class="rborderplz" | 1.0
| colspan="2" {{yes}}
| {{no}}
| {{yes}}
|-
| [[PwnageTool]]
| class="rborderplz" | 4.0
| {{partial|Yes}}<ref group="4.x_i" name="oldboot3gs" /><ref group="4.x_i" name="bundle" />
| {{no}}
| colspan="2" {{no}}
|-
| [[redsn0w]]
| class="rborderplz" | 0.9.5b3/0.9.6b3
| {{yes}}
| colspan="2" {{no}}
| {{partial|Yes}}<ref group="4.x_i" name="oldboot" />
| {{no}}
|-
| [[sn0wbreeze]]
| class="rborderplz" | 2.0.2-2.9.14
| colspan="3" {{yes}}
| colspan="2" {{yes}}
|-
| colspan="2" | [[Star]] ([[JailbreakMe]] 2.0)
| colspan="3" {{partial|Yes<ref group="4.x_i" name="modifiedstar" />}}
| colspan="2" {{partial|Yes<ref group="4.x_i" name="modifiedstar" />}}
|-
| rowspan="7" | 4.1
| [[greenpois0n (jailbreak)|greenpois0n]]
| class="rborderplz" | RC5-RC6.1
| {{yes}}
| rowspan="7" {{n/a}}
| rowspan="3" {{no}}
| colspan="2" {{yes}}
| rowspan="7" {{n/a}}
| colspan="3" {{yes}}
|-
| colspan="2" | [[ipwndfu]]
| {{no}}
| {{yes}}
| {{no}}
| colspan="3" {{no}}
|-
| [[limera1n]]
| class="rborderplz" | 1.0
| rowspan="4" {{yes}}
| colspan="2" {{yes}}
| rowspan="4" colspan="3" {{yes}}
|-
| [[PwnageTool]]
| class="rborderplz" | 4.1-4.1.3
| colspan="2" {{yes}}
| {{no}}
|-
| [[redsn0w]]
| class="rborderplz" | 0.9.6b1-0.9.10b8b
| rowspan="2" colspan="3" {{yes}}
|-
| [[sn0wbreeze]]
| class="rborderplz" | 2.1-2.9.5
|-
| colspan="2" | [[Star]] ([[JailbreakMe]] 2.0)
| {{partial|Yes<ref group="4.x_i" name="modifiedstar" />}}
| colspan="3" {{partial|Yes<ref group="4.x_i" name="modifiedstar" />}}
| colspan="3" {{partial|Yes<ref group="4.x_i" name="modifiedstar" />}}
|-
| rowspan="6" | 4.2.1
| [[greenpois0n (jailbreak)|greenpois0n]]
| class="rborderplz" | RC5-RC6.1
| rowspan="5" {{yes}}
| rowspan="6" {{n/a}}
| rowspan="2" {{no}}
| colspan="2" {{yes}}
| rowspan="6" {{n/a}}
| colspan="3" {{yes}}
|-
| colspan="2" | [[ipwndfu]]
| {{yes}}
| {{no}}
| colspan="3" {{no}}
|-
| [[PwnageTool]]
| class="rborderplz" | 4.2
| rowspan="3" colspan="3" {{yes}}
| {{no}}
| colspan="2" {{yes}}
|-
| [[redsn0w]]
| class="rborderplz" | 0.9.6b1-0.9.11b4
| rowspan="2" colspan="3" {{yes}}
|-
| [[sn0wbreeze]]
| class="rborderplz" | 2.2-2.9.14
|-
| colspan="2" | [[Star]] ([[JailbreakMe]] 2.0)
| {{partial|Yes<ref group="4.x_i" name="modifiedstar" />}}
| colspan="3" {{partial|Yes<ref group="4.x_i" name="modifiedstar" />}}
| colspan="3" {{partial|Yes<ref group="4.x_i" name="modifiedstar" />}}
|-
| 4.2.5
| colspan="2" | [[Star]] ([[JailbreakMe]] 2.0)
| colspan="5" {{n/a}}
| {{partial|Yes<ref group="4.x_i" name="modifiedstar" />}}
| colspan="3" {{n/a}}
|-
| rowspan="7" | 4.2.6
| [[greenpois0n (jailbreak)|greenpois0n]]
| class="rborderplz" | RC5 b4-RC6.1
| rowspan="7" colspan="5" {{n/a}}
| rowspan="5" {{yes}}
| rowspan="7" colspan="3" {{n/a}}
|-
| [[PwnageTool]]
| class="rborderplz" | 4.2
|-
| [[redsn0w]]
| class="rborderplz" | 0.9.6rc9-0.9.10b8b
|-
| colspan="2" | [[Saffron]] ([[JailbreakMe]] 3.0)
|-
| [[sn0wbreeze]]
| class="rborderplz" | 2.2-2.9.14
|-
| colspan="2" | [[Star]] ([[JailbreakMe]] 2.0)
| {{partial|Yes<ref group="4.x_i" name="modifiedstar" />}}
|-
| colspan="2" | [[unthredeh4il]]
| {{yes}}
|-
| rowspan="5" | 4.2.7
| [[redsn0w]]
| class="rborderplz" | 0.9.8b2-0.9.10b8b
| rowspan="5" colspan="5" {{n/a}}
| rowspan="3" {{yes}}
| rowspan="5" colspan="3" {{n/a}}
|-
| colspan="2" | [[Saffron]] ([[JailbreakMe]] 3.0)
|-
| [[sn0wbreeze]]
| class="rborderplz" | 2.6-2.9.14
|-
| colspan="2" | [[Star]] ([[JailbreakMe]] 2.0)
| {{partial|Yes<ref group="4.x_i" name="modifiedstar" />}}
|-
| colspan="2" | [[unthredeh4il]]
| {{yes}}
|-
| rowspan="6" | 4.2.8
| [[PwnageTool]]
| class="rborderplz" | 4.2
| rowspan="6" colspan="5" {{n/a}}
| rowspan="4" {{yes}}
| rowspan="6" colspan="3" {{n/a}}
|-
| [[redsn0w]]
| class="rborderplz" | 0.9.6rc18-0.9.10b8b
|-
| colspan="2" | [[Saffron]] ([[JailbreakMe]] 3.0)
|-
| [[sn0wbreeze]]
| class="rborderplz" | 2.7-2.9.14
|-
| colspan="2" | [[Star]] ([[JailbreakMe]] 2.0)
| {{partial|Yes<ref group="4.x_i" name="modifiedstar" />}}
|-
| colspan="2" | [[unthredeh4il]]
| {{yes}}
|-
| rowspan="3" | 4.2.9
| [[redsn0w]]
| class="rborderplz" | 0.9.8b3-0.9.10b8b
| rowspan="3" colspan="5" {{n/a}}
| {{partial|Tethered}}
| rowspan="3" colspan="3" {{n/a}}
|-
| colspan="2" | [[Star]] ([[JailbreakMe]] 2.0)
| {{partial|Yes<ref group="4.x_i" name="modifiedstar" />}}
|-
| colspan="2" | [[unthredeh4il]]
| {{yes}}
|-
| rowspan="3" | 4.2.10
| [[redsn0w]]
| class="rborderplz" | 0.9.8b7-0.9.10b8b
| rowspan="3" colspan="5" {{n/a}}
| {{partial|Tethered}}
| rowspan="3" colspan="3" {{n/a}}
|-
| colspan="2" | [[Star]] ([[JailbreakMe]] 2.0)
| {{partial|Yes<ref group="4.x_i" name="modifiedstar" />}}
|-
| colspan="2" | [[unthredeh4il]]
| {{yes}}
|-
| rowspan="7" | 4.3
| colspan="2" | [[ipwndfu]]
| colspan="2" rowspan="2" {{no}}
| rowspan="7" {{n/a}}
| {{yes}}
| {{no}}
| colspan="2" rowspan="7" {{n/a}}
| colspan="2" rowspan="2" {{no}}
|-
| [[PwnageTool]]
| class="rborderplz" | 4.2
| {{partial|Yes<ref group="4.x_i" name="bundle" /><ref group="4.x_i" name="newboot" />}}
| {{partial|Tethered<ref group="4.x_i" name="bundle" />}}
|-
| [[redsn0w]]
| class="rborderplz" | 0.9.6rc9-0.9.11b4
| {{partial|Tethered}}
| rowspan="5" {{no}}
| rowspan="3" colspan="2" {{yes}}
| colspan="2" {{partial|Tethered}}
|-
| colspan="2" | [[Saffron]] ([[JailbreakMe]] 3.0)
| rowspan="2" {{yes}}
| rowspan="2" colspan="2" {{yes}}
|-
| [[sn0wbreeze]]
| class="rborderplz" | 2.3b4-2.9.14
|-
| colspan="2" | [[Star]] ([[JailbreakMe]] 2.0)
| {{partial|Yes<ref group="4.x_i" name="modifiedstar" />}}
| colspan="2" {{partial|Yes<ref group="4.x_i" name="modifiedstar" />}}
| colspan="2" {{partial|Yes<ref group="4.x_i" name="modifiedstar" />}}
|-
| colspan="2" | [[unthredeh4il]]
| {{yes}}
| colspan="2" {{yes}}
| colspan="2" {{yes}}
|-
| rowspan="6" | 4.3.1
| colspan="2" | [[ipwndfu]]
| colspan="2" {{no}}
| rowspan="6" {{n/a}}
| {{yes}}
| {{no}}
| rowspan="6" colspan="2" {{n/a}}
| colspan="2" {{no}}
|-
| [[PwnageTool]]
| class="rborderplz" | 4.3
| rowspan="5" {{yes}}
| rowspan="5" {{no}}
| rowspan="5" colspan="2" {{yes}}
| rowspan="2" colspan="2" {{yes}}
|-
| [[redsn0w]]
| class="rborderplz" | 0.9.6rc9-0.9.11b4
|-
| colspan="2" | [[Saffron]] ([[JailbreakMe]] 3.0)
| {{no}}
| {{yes}}
|-
| [[sn0wbreeze]]
| class="rborderplz" | 2.5-2.9.14
| rowspan="2" colspan="2" {{yes}}
|-
| colspan="2" | [[unthredeh4il]]
|-
| rowspan="6" | 4.3.2
| colspan="2" | [[ipwndfu]]
| colspan="2" {{no}}
| rowspan="6" {{n/a}}
| {{yes}}
| {{no}}
| rowspan="6" colspan="2" {{n/a}}
| colspan="2" {{no}}
|-
| [[PwnageTool]]
| class="rborderplz" | 4.3.2
| rowspan="5" {{yes}}
| rowspan="5" {{no}}
| rowspan="5" colspan="2" {{yes}}
| rowspan="5" colspan="2" {{yes}}
|-
| [[redsn0w]]
| class="rborderplz" | 0.9.6rc13-0.9.11b4
|-
| colspan="2" | [[Saffron]] ([[JailbreakMe]] 3.0)
|-
| [[sn0wbreeze]]
| class="rborderplz" | 2.6-2.9.14
|-
| colspan="2" | [[unthredeh4il]]
|-
| rowspan="6" | 4.3.3
| colspan="2" | [[ipwndfu]]
| colspan="2" {{no}}
| rowspan="6" {{n/a}}
| {{yes}}
| {{no}}
| rowspan="6" colspan="2" {{n/a}}
| colspan="2" {{no}}
|-
| [[PwnageTool]]
| class="rborderplz" | 4.3.3-4.3.3.1
| rowspan="2" {{yes}}
| rowspan="2" {{no}}
| rowspan="5" colspan="2" {{yes}}
| rowspan="5" colspan="2" {{yes}}
|-
| [[redsn0w]]
| class="rborderplz" | 0.9.6rc16-0.9.11b4
|-
| colspan="2" | [[Saffron]] ([[JailbreakMe]] 3.0)
| colspan="2" {{yes}}
|-
| [[sn0wbreeze]]
| class="rborderplz" | 2.7-2.9.14
| rowspan="2" {{yes}}
| rowspan="2" {{no}}
|-
| colspan="2" | [[unthredeh4il]]
|-
| rowspan="4" | 4.3.4
| colspan="2" | [[ipwndfu]]
| {{no}}
| rowspan="4" {{no}}
| rowspan="4" {{n/a}}
| {{yes}}
| {{no}}
| rowspan="4" colspan="2" {{n/a}}
| colspan="2" {{no}}
|-
| [[redsn0w]]
| class="rborderplz" | 0.9.8b3-0.9.11b4
| {{partial|Tethered}}
| colspan="2" {{partial|Tethered}}
| colspan="2" {{partial|Tethered}}
|-
| colspan="2" | [[unthredeh4il]]
| rowspan="2" {{yes}}
| colspan="2" rowspan="2" {{yes}}
| colspan="2" rowspan="2" {{yes}}
|-
| colspan="2" | [[unthredera1n]]
|-
| rowspan="4" | 4.3.5
| colspan="2" | [[ipwndfu]]
| {{no}}
| rowspan="4" {{no}}
| rowspan="4" {{n/a}}
| {{yes}}
| {{no}}
| rowspan="4" colspan="2" {{n/a}}
| colspan="2" {{no}}
|-
| [[redsn0w]]
| class="rborderplz" | 0.9.8b7-0.9.11b4
| {{partial|Tethered}}
| colspan="2" {{partial|Tethered}}
| colspan="2" {{partial|Tethered}}
|-
| colspan="2" | [[unthredeh4il]]
| rowspan="2" {{yes}}
| colspan="2" rowspan="2" {{yes}}
| colspan="2" rowspan="2" {{yes|class=nobrradiusplz}}
|-
| colspan="2" | [[unthredera1n]]
|}
<references group="4.x_i">
<ref name="oldboot3gs">Will only work for [[N88AP|iPhone 3GS]] running the [[Bootrom 359.3|old bootrom]].</ref>
<ref name="oldboot">Will only work for [[N72AP|iPod touch (2nd generation)]] running the [[Bootrom 240.4|old bootrom]].</ref>
<ref name="modifiedstar">Star can be modified to support 4.0.2-4.3, because Apple did not correctly patch the exploits used.</ref>
<ref name="bundle">An unofficial firmware bundle for this version must be manually added.</ref>
<ref name="newboot">Tethered jailbreak for any [[N88AP|iPhone 3GS]] with the [[Bootrom 359.3.2|new bootrom]]. Untethered for the [[Bootrom 359.3|old bootrom]].</ref>
</references>

=====Apple TV=====
'''Note''': "Marketing Version" is the version that the Apple TV reports in its "About" screen.
{| class="wikitable"
|-
! rowspan="2" | Marketing Version
! rowspan="2" | iOS Version
! rowspan="2" | Jailbreak Tool
! rowspan="2" | Tool Version
! Device
|-
! [[K66AP|Apple TV (2nd generation)]]
|-
| rowspan="6" | 4.0
| rowspan="6" | 4.1
| [[greenpois0n (jailbreak)|greenpois0n]]
| RC6
| rowspan="3" {{partial|Yes<ref group="4.x_atv" name="nogui" />}}
|-
| [[limera1n]]
| class="rborderplz" | 1.0
|-
| [[PwnageTool]]
| class="rborderplz" | 4.1
|-
| [[Seas0nPass]]
| class="rborderplz" | ?
| {{yes}}
|-
| [[sn0wbreeze]]
| class="rborderplz" | 2.1
| rowspan="2" {{partial|Yes<ref group="4.x_atv" name="nogui" />}}
|-
| colspan="2" | [[unthredeh4il]]
|-
| rowspan="3" | 4.1
| rowspan="3" | 4.2
| [[PwnageTool]]
| ?
| {{partial|Yes<ref group="4.x_atv" name="bundle" />}}
|-
| [[Seas0nPass]]
| class="rborderplz" | ?
| rowspan="2" {{yes}}
|-
| colspan="2" | [[unthredeh4il]]
|-
| rowspan="5" | 4.1.1
| rowspan="5" | 4.2.1
| [[greenpois0n (jailbreak)|greenpois0n]]
| RC6-RC6.1
| rowspan="5" {{yes}}
|-
| [[PwnageTool]]
| class="rborderplz" | 4.2
|-
| rowspan="2" | [[Seas0nPass]]
| class="rborderplz" | 0.6.7 (Mac)
|-
| class="rborderplz" | ? (Windows)
|-
| colspan="2" | [[unthredeh4il]]
|-
| rowspan="3" | 4.2
| rowspan="3" | 4.3
| rowspan="2" | [[Seas0nPass]]
| 0.7.2 (Mac)
| rowspan="3" {{yes}}
|-
| class="rborderplz" | ? (Windows)
|-
| colspan="2" | [[unthredeh4il]]
|-
| rowspan="6" | 4.2.1
| rowspan="6" | 4.3
| [[PwnageTool]]
| 4.3-4.3.3.1
| rowspan="6" {{yes}}
|-
| [[redsn0w]]
| class="rborderplz" | 0.9.6rc16
|-
| rowspan="2" | [[Seas0nPass]]
| class="rborderplz" | 0.7.3 (Mac)
|-
| class="rborderplz" | 0.3.7.13.2017 (Windows)
|-
| [[sn0wbreeze]]
| class="rborderplz" | 2.5-2.7.1
|-
| colspan="2" | [[unthredeh4il]]
|-
| rowspan="4" | 4.2.2
| rowspan="4" | 4.3
| [[PwnageTool]]
| 4.3-4.3.3.1
| {{partial|Yes<ref group="4.x_atv" name="bundle" />}}
|-
| rowspan="2" | [[Seas0nPass]]
| class="rborderplz" | 0.7.6.??? (Mac)
| rowspan="3" {{yes}}
|-
| class="rborderplz" | 0.3.13.2017 (Windows)
|-
| colspan="2" | [[unthredeh4il]]
|-
| colspan="2" rowspan="3" | 4.3
| rowspan="2" | [[Seas0nPass]]
| 0.7.8.??? (Mac)
| rowspan="3" {{yes}}
|-
| class="rborderplz" | 0.3.29.???? (Windows)
|-
| colspan="2" | [[unthredeh4il]]
|}
<references group="4.x_atv">
<ref name="nogui">No package management GUI.</ref>
<ref name="bundle">A firmware bundle for this version must be manually added.</ref>
</references>

====5.x====
{| class="wikitable"
|-
! rowspan="2" | iOS
! rowspan="2" | Jailbreak Tool
! rowspan="2" | Tool Version
! colspan="8" | Device
|-
! [[K48AP|iPad]]
! [[iPad 2]]
! [[iPad (3rd generation)]]
! [[N88AP|iPhone 3GS]]
! [[iPhone 4]]
! [[N94AP|iPhone 4S]]
! [[N18AP|iPod touch (3rd generation)]]
! [[N81AP|iPod touch (4th generation)]]
|-
| rowspan="8" | 5.0
| [[Absinthe]]
| class="rborderplz" | 0.1-0.4
| colspan="2" {{no}}
| rowspan="8" {{n/a}}
| colspan="2" {{no}}
| {{yes}}
| colspan="2" {{no}}
|-
| [[Ac1dSn0w]]
| Beta 1-Beta 2
| {{partial|Tethered}}
| {{no}}
| colspan="2" {{partial|Tethered}}
| colspan="2" {{no}}
| {{partial|Tethered}}
|-
| colspan="2" | [[ipwndfu]]
| colspan="2" {{no}}
| {{yes}}
| colspan="4" {{no}}
|-
| [[PwnageTool]]
| class="rborderplz" | 4.3.3<ref group="5.x_i" name="bundle" />
| rowspan="3" {{partial|Tethered}}
| rowspan="5" {{no}}
| {{no}}
| {{partial|Tethered}}
| colspan="3" {{no}}
|-
| [[redsn0w]]
| class="rborderplz" | 0.9.9b3-0.9.11b4
| colspan="2" rowspan="2" {{partial|Tethered}}
| rowspan="4" {{no}}
| colspan="2" rowspan="2" {{partial|Tethered}}
|-
| [[sn0wbreeze]]
| class="rborderplz" | 2.8b8
|-
| colspan="2" | [[unthredeh4il]]
| rowspan="2" {{yes}}
| colspan="2" rowspan="2" {{yes}}
| colspan="2" rowspan="2" {{yes}}
|-
| colspan="2" | [[unthredera1n]]
|-
| rowspan="8" | 5.0.1
| [[Absinthe]]
| class="rborderplz" | 0.1-0.4
| {{no}}
| {{yes}}
| rowspan="8" {{n/a}}
| colspan="2" {{no}}
| {{yes}}
| colspan="2" {{no}}
|-
| [[Ac1dSn0w]]
| Beta 1-Beta 2
| {{partial|Tethered}}
| {{no}}
| colspan="2" {{partial|Tethered}}
| colspan="2" {{no}}
| {{partial|Tethered}}
|-
| colspan="2" | [[ipwndfu]]
| colspan="2" {{no}}
| {{yes}}
| colspan="4" {{no}}
|-
| [[PwnageTool]]
| class="rborderplz" | 5.0.1
| {{yes}}
| {{no}}
| colspan="2" {{yes}}
| {{no}}
| colspan="2" {{yes}}
|-
| [[redsn0w]]
| class="rborderplz" | 0.9.10b4-0.9.11b4
| colspan="2" {{yes}}
| colspan="5" {{yes}}
|-
| [[sn0wbreeze]]
| class="rborderplz" | 2.8b11-2.9.14
| rowspan="3" {{yes}}
| rowspan="3" {{no}}
| colspan="2" rowspan="3" {{yes}}
| rowspan="3" {{no}}
| colspan="2" rowspan="3" {{yes}}
|-
| colspan="2" | [[unthredeh4il]]
|-
| colspan="2" | [[unthredera1n]]
|-
| rowspan="5" | 5.1
| colspan="2" | [[ipwndfu]]
| colspan="3" {{no}}
| {{yes}}
| colspan="4" {{no}}
|-
| [[redsn0w]]
| class="rborderplz" | 0.9.10b6-0.9.11b4
| rowspan="4" {{yes}}
| rowspan="4" colspan="2" {{no}}
| colspan="2" rowspan="2" {{partial|Tethered}}
| rowspan="4" {{no}}
| colspan="2" rowspan="2" {{partial|Tethered}}
|-
| [[sn0wbreeze]]
| class="rborderplz" | 2.9.2-2.9.3
|-
| colspan="2" | [[unthredeh4il]]
| colspan="2" rowspan="2" {{yes}}
| colspan="2" rowspan="2" {{yes}}
|-
| colspan="2" | [[unthredera1n]]
|-
| rowspan="8" | 5.1.1
| [[Absinthe]]
| class="rborderplz" | 2.0-2.0.4
| colspan="8" rowspan="2" {{yes}}
|-
| [[cinject]]
| class="rborderplz" | 0.5.3-0.5.4
|-
| colspan="2" | [[ipwndfu]]
| colspan="3" {{no}}
| {{yes}}
| colspan="4" {{no}}
|-
| [[PwnageTool]]
| class="rborderplz" | 5.1.1
| {{yes}}
| colspan="2" {{no}}
| colspan="2" {{yes}}
| colspan="3" {{no}}
|-
| [[redsn0w]]
| class="rborderplz" | 0.9.12b1-0.9.14b2
| colspan="8" {{yes}}
|-
| [[sn0wbreeze]]
| class="rborderplz" | 2.9.6-2.9.14
| rowspan="3" {{yes}}
| rowspan="3" colspan="2" {{no}}
| colspan="2" rowspan="3" {{yes}}
| rowspan="3" {{no}}
| colspan="2" rowspan="3" {{yes}}
|-
| colspan="2" | [[unthredeh4il]]
|-
| colspan="2" | [[unthredera1n]]
|}
<references group="5.x_i">
<ref name="bundle">A firmware bundle for this version must be manually added.</ref>
</references>

=====Apple TV=====
'''Note''': "Marketing Version" is the version that the Apple TV reports in its "About" screen.
{| class="wikitable"
|-
! rowspan="2" | Marketing Version
! rowspan="2" | iOS Version
! rowspan="2" | Jailbreak Tool
! rowspan="2" | Tool Version
! Device
|-
! [[K66AP|Apple TV (2nd generation)]]
|-
| rowspan="3" | 4.4
| rowspan="3" | 5.0
| rowspan="2" | [[Seas0nPass]]
| class="rborderplz" | 0.7.9.??? (Mac)
| rowspan="2" {{partial|Tethered}}
|-
| class="rborderplz" | 0.3.37.???? (Windows)
|-
| colspan="2" | [[unthredeh4il]]
| {{yes}}
|-
| rowspan="3" | 4.4.1
| rowspan="3" | 5.0
| rowspan="2" | [[Seas0nPass]]
| class="rborderplz" | 0.7.9.210 (Mac)
| rowspan="2" {{partial|Tethered}}
|-
| class="rborderplz" | 0.3.37.???? (Windows)
|-
| colspan="2" | [[unthredeh4il]]
| {{yes}}
|-
| rowspan="3" | 4.4.2
| rowspan="3" | 5.0
| rowspan="2" | [[Seas0nPass]]
| class="rborderplz" | 0.7.9.230 (Mac)
| rowspan="2" {{partial|Tethered}}
|-
| class="rborderplz" | 0.3.42.3335 (Windows)
|-
| colspan="2" | [[unthredeh4il]]
| {{yes}}
|-
| rowspan="3" | 4.4.3
| rowspan="3" | 5.0.1
| rowspan="2" | [[Seas0nPass]]
| class="rborderplz" | 0.7.9.270 (Mac)
| rowspan="3" {{yes}}
|-
| class="rborderplz" | 0.3.44.???? (Windows)
|-
| colspan="2" | [[unthredeh4il]]
|-
| rowspan="3" | 4.4.4
| rowspan="3" | 5.0.1
| rowspan="2" | [[Seas0nPass]]
| class="rborderplz" | 0.7.9.290 (Mac)
| rowspan="3" {{yes}}
|-
| class="rborderplz" | 0.3.45.4035 (Windows)
|-
| colspan="2" | [[unthredeh4il]]
|-
| rowspan="3" | 5.0
| rowspan="3" | 5.1
| rowspan="2" | [[Seas0nPass]]
| class="rborderplz" | 0.8.3.470 (Mac)
| rowspan="2" {{partial|Tethered}}
|-
| class="rborderplz" | 0.8.3.5592 (Windows)
|-
| colspan="2" | [[unthredeh4il]]
| {{yes}}
|-
| rowspan="4" | 5.0.1
| rowspan="4" | 5.1.1
| [[PwnageTool]]
| class="rborderplz" | 5.1.1<ref group="5.x_atv" name="nogui" />
| {{partial|Tethered}}
|-
| rowspan="2" | [[Seas0nPass]]
| class="rborderplz" | 0.8.4.518 (Mac)
| rowspan="3" {{yes}}
|-
| class="rborderplz" | 0.8.4.6306 (Windows)
|-
| colspan="2" | [[unthredeh4il]]
|-
| rowspan="3" | 5.0.2
| rowspan="3" | 5.1.1
| rowspan="2" | [[Seas0nPass]]
| class="rborderplz" | 0.8.6.565 (Mac)
| rowspan="3" {{yes}}
|-
| class="rborderplz" | 0.8.6.7558 (Windows)
|-
| colspan="2" | [[unthredeh4il]]
|}
<references group="5.x_atv">
<ref name="nogui">No package management GUI.</ref>
</references>

====6.x====
{| class="wikitable"
|-
! rowspan="2" | iOS
! rowspan="2" | Jailbreak Tool
! rowspan="2" | Tool Version
! colspan="10" | Device
|-
! [[iPad 2]]
! [[iPad (3rd generation)]]
! [[iPad (4th generation)]]
! [[iPad mini]]
! [[N88AP|iPhone 3GS]]
! [[iPhone 4]]
! [[N94AP|iPhone 4S]]
! [[iPhone 5]]
! [[iPod touch (4th generation)]]
! [[iPod touch (5th generation)]]
|-
| rowspan="4" | 6.0
| [[evasi0n]]
| class="rborderplz" | 1.0-1.5.3
| colspan="10" {{yes}}
|-
| colspan="2" | [[ipwndfu]]
| colspan="4" rowspan="3" {{no}}
| {{yes}}
| colspan="5" {{no}}
|-
| [[redsn0w]]
| class="rborderplz" | 0.9.15b1<ref group="6.x_i" name="upgradeable-evasi0n" />-0.9.15b3<ref group="6.x_i" name="upgradeable-evasi0n" />
| {{partial|Yes<ref group="6.x_i" name="upgradeable-evasi0n" />}}
| {{partial|Tethered}}
| colspan="2" rowspan="2" {{no}}
| {{partial|Tethered}}
| rowspan="2" {{no}}
|-
| [[sn0wbreeze]]
| class="rborderplz" | 2.9.8-2.9.14
| colspan="2" {{yes}}
| {{yes}}
|-
| rowspan="4" | 6.0.1
| [[evasi0n]]
| class="rborderplz" | 1.0-1.5.3
| colspan="10" {{yes}}
|-
| colspan="2" | [[ipwndfu]]
| colspan="4" rowspan="3" {{no}}
| {{yes}}
| colspan="5" {{no}}
|-
| [[redsn0w]]
| class="rborderplz" | 0.9.15b1<ref group="6.x_i" name="ipsw-upgradeable-evasi0n" />-0.9.15b3<ref group="6.x_i" name="ipsw-upgradeable-evasi0n" />
| {{partial|Yes<ref group="6.x_i" name="ipsw-upgradeable-evasi0n" />}}
| {{partial|Tethered<ref group="6.x_i" name="ipsw-upgradeable-evasi0n" />}}
| colspan="2" rowspan="2" {{no}}
| {{partial|Tethered<ref group="6.x_i" name="ipsw-upgradeable-evasi0n" />}}
| rowspan="2" {{no}}
|-
| [[sn0wbreeze]]
| class="rborderplz" | 2.9.8-2.9.14
| colspan="2" {{yes}}
| {{yes}}
|-
| 6.0.2
| [[evasi0n]]
| class="rborderplz" | 1.0-1.5.3
| colspan="3" {{n/a}}
| {{yes}}
| colspan="3" {{n/a}}
| {{yes}}
| colspan="2" {{n/a}}
|-
| rowspan="4" | 6.1
| [[evasi0n]]
| class="rborderplz" | 1.0-1.5.3
| colspan="10" {{yes}}
|-
| colspan="2" | [[ipwndfu]]
| colspan="4" rowspan="3" {{no}}
| {{yes}}
| colspan="5" {{no}}
|-
| [[redsn0w]]
| class="rborderplz" | 0.9.15b1<ref group="6.x_i" name="ipsw-upgradeable-evasi0n" />-0.9.15b3<ref group="6.x_i" name="ipsw-upgradeable-evasi0n" />
| {{partial|Yes<ref group="6.x_i" name="ipsw-upgradeable-evasi0n" />}}
| {{partial|Tethered<ref group="6.x_i" name="ipsw-upgradeable-evasi0n" />}}
| colspan="2" rowspan="2" {{no}}
| {{partial|Tethered<ref group="6.x_i" name="ipsw-upgradeable-evasi0n" />}}
| rowspan="2" {{no}}
|-
| [[sn0wbreeze]]
| class="rborderplz" | 2.9.8-2.9.14
| colspan="2" {{yes}}
| {{yes}}
|-
| 6.1.1
| [[evasi0n]]
| class="rborderplz" | 1.3-1.5.3
| colspan="6" {{n/a}}
| {{yes}}
| colspan="3" {{n/a}}
|-
| rowspan="4" | 6.1.2
| [[evasi0n]]
| class="rborderplz" | 1.4-1.5.3
| colspan="10" {{yes}}
|-
| colspan="2" | [[ipwndfu]]
| colspan="4" rowspan="3" {{no}}
| {{yes}}
| colspan="5" {{no}}
|-
| [[redsn0w]]
| class="rborderplz" | 0.9.15b1<ref group="6.x_i" name="ipsw-upgradeable-evasi0n" />-0.9.15b3<ref group="6.x_i" name="ipsw-upgradeable-evasi0n" />
| {{partial|Yes<ref group="6.x_i" name="ipsw-upgradeable-evasi0n" />}}
| {{partial|Tethered<ref group="6.x_i" name="ipsw-upgradeable-evasi0n" />}}
| colspan="2" rowspan="2" {{no}}
| {{partial|Tethered<ref group="6.x_i" name="ipsw-upgradeable-evasi0n" />}}
| rowspan="2" {{no}}
|-
| [[sn0wbreeze]]
| class="rborderplz" | 2.9.10-2.9.14
| colspan="2" {{yes}}
| {{yes}}
|-
| rowspan="4" | 6.1.3
| colspan="2" | [[ipwndfu]]
| colspan="4" {{no}}
| {{yes}}
| colspan="5" {{no}}
|-
| [[p0sixspwn]]
| class="rborderplz" | 1.0-1.0.8
| colspan="10" {{yes}}
|-
| [[redsn0w]]
| class="rborderplz" | 0.9.15b1<ref group="6.x_i" name="ipsw-upgradeable-p0sixspwn" />-0.9.15b3<ref group="6.x_i" name="ipsw-upgradeable-p0sixspwn" />
| colspan="4" rowspan="2" {{no}}
| {{partial|Yes<ref group="6.x_i" name="ipsw-upgradeable-p0sixspwn" />}}
| {{partial|Tethered<ref group="6.x_i" name="ipsw-upgradeable-p0sixspwn" />}}
| colspan="2" rowspan="2" {{no}}
| {{partial|Tethered<ref group="6.x_i" name="ipsw-upgradeable-p0sixspwn" />}}
| rowspan="2" {{no}}
|-
| [[sn0wbreeze]]
| class="rborderplz" | 2.9.14<ref group="6.x_i" name="upgradeable-p0sixspwn" />
| colspan="2" {{partial|Tethered<ref group="6.x_i" name="upgradeable-p0sixspwn" />}}
| {{partial|Tethered<ref group="6.x_i" name="upgradeable-p0sixspwn" />}}
|-
| 6.1.4
| [[p0sixspwn]]
| class="rborderplz" | 1.0-1.0.8
| colspan="7" {{n/a}}
| {{yes}}
| colspan="2" {{n/a}}
|-
| rowspan="2" | 6.1.5
| [[p0sixspwn]]
| class="rborderplz" | 1.0-1.0.8
| colspan="8" rowspan="2" {{n/a}}
| {{yes}}
| rowspan="2" {{n/a}}
|-
| [[redsn0w]]
| class="rborderplz" | 0.9.15b1<ref group="6.x_i" name="ipsw-upgradeable-p0sixspwn" />-0.9.15b3<ref group="6.x_i" name="ipsw-upgradeable-p0sixspwn" />
| {{partial|Tethered<ref group="6.x_i" name="ipsw-upgradeable-p0sixspwn" />|class=rborderplz}}
|-
| rowspan="3" | 6.1.6
| colspan="2" | [[ipwndfu]]
| rowspan="3" colspan="4" {{n/a}}
| rowspan="2" {{yes}}
| rowspan="3" colspan="3" {{n/a}}
| {{no}}
| rowspan="3" {{n/a}}
|-
| [[p0sixspwn]]
| class="rborderplz" | 1.0.8
| {{yes}}
|-
| [[redsn0w]]
| class="rborderplz" | 0.9.15b1<ref group="6.x_i" name="ipsw-upgradeable-p0sixspwn" />-0.9.15b3<ref group="6.x_i" name="ipsw-upgradeable-p0sixspwn" />
| {{partial|Tethered<ref group="6.x_i" name="ipsw-upgradeable-p0sixspwn" />}}
| {{partial|Tethered|class=rborderplz nobrradiusplz}}<ref group="6.x_i" name="ipsw-upgradeable-p0sixspwn" />
|}
<references group="6.x_i">
<ref name="upgradeable-evasi0n">[[Tethered jailbreak]] on devices not vulnerable to [[0x24000 Segment Overflow]]. Upgradable to [[untethered jailbreak]] via evasi0n Cydia package.</ref>
<ref name="ipsw-upgradeable-evasi0n">[[Tethered jailbreak]] on devices not vulnerable to [[0x24000 Segment Overflow]]. Requires pointing to 6.0 IPSW. Upgradable to [[untethered jailbreak]] via evasi0n Cydia package.</ref>
<ref name="upgradeable-p0sixspwn">[[Tethered jailbreak]] on devices not vulnerable to [[0x24000 Segment Overflow]]. Upgradable to [[untethered jailbreak]] via p0sixspwn Cydia package.</ref>
<ref name="ipsw-upgradeable-p0sixspwn">[[Tethered jailbreak]] on devices not vulnerable to [[0x24000 Segment Overflow]]. Requires pointing to 6.0 IPSW. Upgradable to [[untethered jailbreak]] via p0sixspwn Cydia package.</ref>
</references>

=====Apple TV=====
'''Note''': "Marketing Version" is the version that the Apple TV reports in its "About" screen.
{| class="wikitable"
|-
! rowspan="2" | Marketing Version
! rowspan="2" | iOS Version
! rowspan="2" | Jailbreak Tool
! rowspan="2" | Tool Version
! colspan="3" | Device
|-
! [[K66AP|Apple TV (2nd generation)]]
! [[J33AP|Apple TV (3rd generation) (AppleTV3,1)]]
! [[J33IAP|Apple TV (3rd generation) (AppleTV3,2)]]
|-
| rowspan="3" | 5.1
| rowspan="3" | 6.0
| [[evasi0n]]
| 1.0-1.5.3
| {{yes}}
| rowspan="3" {{no}}
| rowspan="3" {{n/a}}
|-
| [[redsn0w]]
| 0.9.15b1
| {{partial|Tethered}}
|-
| [[Seas0nPass]]
| class="rborderplz" | 0.8.?
| {{yes}}
|-
| rowspan="3" | 5.1.1
| rowspan="3" | 6.0.1
| [[evasi0n]]
| 1.0-1.5.3
| {{yes}}
| rowspan="3" {{no}}
| rowspan="3" {{n/a}}
|-
| [[redsn0w]]
| 0.9.15b3<ref group="6.x_atv" name="ipsw" />
| {{partial|Tethered}}
|-
| [[Seas0nPass]]
| class="rborderplz" | 0.8.?
| {{yes}}
|-
| rowspan="4" | 5.2
| rowspan="4" | 6.1
| [[evasi0n]]
| 1.0-1.5.3
| {{yes}}
| rowspan="4" colspan="2" {{no}}
|-
| [[redsn0w]]
| 0.9.15b3<ref group="6.x_atv" name="ipsw" />
| {{partial|Tethered}}
|-
| rowspan="2" | [[Seas0nPass]]
| class="rborderplz" | 0.8.9.655 (Mac)
| rowspan="2" {{yes}}
|-
| class="rborderplz" | 0.8.9.11241 (Windows)
|-
| rowspan="3" | 5.2.1
| rowspan="3" | 6.1.3
| [[redsn0w]]
| 0.9.15b3<ref group="6.x_atv" name="ipsw" />
| {{partial|Tethered}}
| rowspan="3" colspan="2" {{no}}
|-
| [[p0sixspwn]]
| 1.0-1.0.8
| {{yes}}
|-
| [[Seas0nPass]]
| class="rborderplz" | 0.9.?
| {{partial|Tethered}}
|-
| rowspan="3" | 5.3
| rowspan="3" | 6.1.4
| [[redsn0w]]
| 0.9.15b3<ref group="6.x_atv" name="ipsw" />
| {{partial|Tethered}}
| rowspan="3" colspan="2" {{no}}
|-
| [[p0sixspwn]]
| 1.0-1.0.8
| rowspan="2" {{yes}}
|-
| [[Seas0nPass]]
| class="rborderplz" | 0.9.5
|}
<references group="6.x_atv">
<ref name="ipsw">Point at 6.0 IPSW.</ref>
</references>

====7.x====
{| class="wikitable"
|-
! rowspan="2" | iOS
! rowspan="2" | Jailbreak Tool
! rowspan="2" | Tool Version
! colspan="12" | Device
|-
! [[iPad 2]]
! [[iPad (3rd generation)]]
! [[iPad (4th generation)]]
! [[iPad Air]]
! [[iPad mini]]
! [[iPad mini 2]]
! [[iPhone 4]]
! [[N94AP|iPhone 4S]]
! [[iPhone 5]]
! [[iPhone 5c]]
! [[iPhone 5s]]
! [[iPod touch (5th generation)]]
|-
| 7.0
| [[evasi0n7]]<ref group="7.x_i" name="offline" />
| class="rborderplz" | 1.0-1.0.7
| colspan="9" {{yes}}
| colspan="2" {{partial|Yes<ref group="7.x_i" name="hexedit" />}}
| {{yes}}
|-
| 7.0.1
| [[evasi0n7]]<ref group="7.x_i" name="offline" />
| class="rborderplz" | 1.0-1.0.7
| colspan="9" {{n/a}}
| colspan="2" {{yes}}
| {{n/a}}
|-
| 7.0.2
| [[evasi0n7]]<ref group="7.x_i" name="offline" />
| class="rborderplz" | 1.0-1.0.7
| colspan="12" {{yes}}
|-
| 7.0.3
| [[evasi0n7]]<ref group="7.x_i" name="offline" />
| class="rborderplz" | 1.0-1.0.7
| colspan="12" {{yes}}
|-
| 7.0.4
| [[evasi0n7]]<ref group="7.x_i" name="offline" />
| class="rborderplz" | 1.0-1.0.7
| colspan="12" {{yes}}
|-
| 7.0.5
| [[evasi0n7]]<ref group="7.x_i" name="offline" />
| class="rborderplz" | 1.0.5-1.0.7
| colspan="9" {{n/a}}
| colspan="2" {{yes}}
| {{n/a}}
|-
| 7.0.6
| [[evasi0n7]]<ref group="7.x_i" name="offline" />
| class="rborderplz" | 1.0.6-1.0.7
| colspan="12" {{yes}}
|-
| rowspan="3" | 7.1
| rowspan="2" | [[Geeksn0w]]
| class="rborderplz" | 2.5-2.8.3<ref group="7.x_i" name="upgradeable-semi" />
| rowspan="2" colspan="6" {{no}}
| {{partial|Tethered}}
| rowspan="2" colspan="5" {{no}}
|-
| class="rborderplz" | 2.9-2.9.1
| {{partial|Semi-Tethered}}
|-
| [[Pangu]]
| class="rborderplz" | 1.0.0-1.2.1
| colspan="12" {{yes}}
|-
| rowspan="2" | 7.1.1
| [[Geeksn0w]]
| class="rborderplz" | 2.9-2.9.1
| colspan="6" {{no}}
| {{partial|Semi-Tethered}}
| colspan="5" {{no}}
|-
| [[Pangu]]
| class="rborderplz" | 1.0.0-1.2.1
| colspan="12" {{yes}}
|-
| rowspan="2" | 7.1.2
| [[Geeksn0w]]
| class="rborderplz" | 2.9-2.9.1
| colspan="6" {{no}}
| {{partial|Semi-Tethered}}
| colspan="5" {{no}}
|-
| [[Pangu]]
| class="rborderplz" | 1.0.0-1.2.1
| colspan="12" {{yes}}
|}
<references group="7.x_i">
<ref name="offline">Due to the jailbreak payload being removed from the evasi0n website, a modified version of evasi0n7 is now required for a successful jailbreak.</ref>
<ref name="hexedit">Build 11A466. Requires a hex edit of [[evasi0n7]] binary. See [https://i.imgur.com/GVQnpig.png this image].</ref>
<ref name="upgradeable-semi">[[Tethered jailbreak]]. "Upgradable" to semi-tethered with "GeekSn0w Semi Untether Payload" (<code>com.blackgeek.geeksn0wsemiuntetherpayload</code>) from [http://geekrepo.beiphone.it geekrepo.beiphone.it].</ref>
</references>

=====Apple TV=====
'''Note''': "Marketing Version" is the version that the Apple TV reports in its "About" screen.
{| class="wikitable"
|-
! rowspan="2" | Marketing Version
! rowspan="2" | iOS Version
! rowspan="2" | Jailbreak Tool
! rowspan="2" | Tool Version
! colspan="3" | Device
|-
! [[K66AP|Apple TV (2nd generation)]]
! [[J33AP|Apple TV (3rd generation) (AppleTV3,1)]]
! [[J33IAP|Apple TV (3rd generation) (AppleTV3,2)]]
|-
| rowspan="2" | 6.0
| 7.0.1
| colspan="2" | No Tool Available
| colspan="3" {{no}}
|-
| 7.0.2
| colspan="2" | No Tool Available
| colspan="3" {{no}}
|-
| 6.0.1
| 7.0.3
| colspan="2" | No Tool Available
| colspan="3" {{no}}
|-
| rowspan="2" | 6.0.2
| 7.0.4
| colspan="2" | No Tool Available
| colspan="3" {{no}}
|-
| 7.0.6
| colspan="2" | No Tool Available
| colspan="3" {{no}}
|-
| 6.1
| 7.1
| colspan="2" | No Tool Available
| colspan="3" {{no}}
|-
| 6.1.1
| 7.1.1
| colspan="2" | No Tool Available
| colspan="3" {{no}}
|-
| 6.2
| rowspan="2" | 7.1.2
| colspan="2" | No Tool Available
| colspan="3" {{no}}
|-
| 6.2.1
| Seas0nPass
| 0.9.7 beta
| {{partial|Tethered}}
| colspan="2" {{no}}
|}

====8.x====
{| class="wikitable"
|-
! rowspan="2" | iOS
! rowspan="2" | Jailbreak Tool
! rowspan="2" | Tool Version
! colspan="16" | Device
|-
! [[iPad 2]]
! [[iPad (3rd generation)]]
! [[iPad (4th generation)]]
! [[iPad Air]]
! [[iPad Air 2]]
! [[iPad mini]]
! [[iPad mini 2]]
! [[iPad mini 3]]
! [[N94AP|iPhone 4S]]
! [[iPhone 5]]
! [[iPhone 5c]]
! [[iPhone 5s]]
! [[N61AP|iPhone 6]]
! [[N56AP|iPhone 6 Plus]]
! [[iPod touch (5th generation)]]
! [[N102AP|iPod touch (6th generation)]]
|-
| rowspan="4" | 8.0
| rowspan="2" | [[Pangu8]]
| class="rborderplz" | 1.0.0-1.2.1<ref group="8.x_i" name="ssh" /> (Windows)
| rowspan="4" colspan="4" {{yes}}
| rowspan="4" {{n/a}}
| rowspan="4" colspan="2" {{yes}}
| rowspan="4" {{partial}}<ref group="8.x_i" name="ipad-wifi" />
| rowspan="4" colspan="7" {{yes}}
| rowspan="4" {{n/a}}
|-
| class="rborderplz" | 1.0.0 (Mac)
|-
| [[PPJailbreak]]
| class="rborderplz" | 1.0 (Mac)
|-
| [[TaiG]]
| class="rborderplz" | 1.0.0-1.2.1 (Windows)
|-
| rowspan="4" | 8.0.1
| rowspan="2" | [[Pangu8]]
| class="rborderplz" | 1.0.0-1.2.1<ref group="8.x_i" name="ssh" /> (Windows)
| rowspan="4" colspan="4" {{yes}}
| rowspan="4" {{n/a}}
| rowspan="4" colspan="2" {{yes}}
| rowspan="4" {{partial}}<ref group="8.x_i" name="ipad-wifi" />
| rowspan="4" colspan="7" {{yes}}
| rowspan="4" {{n/a}}
|-
| class="rborderplz" | 1.0.0 (Mac)
|-
| [[PPJailbreak]]
| class="rborderplz" | 1.0 (Mac)
|-
| [[TaiG]]
| class="rborderplz" | 1.0.0-1.2.1 (Windows)
|-
| rowspan="4" | 8.0.2
| rowspan="2" | [[Pangu8]]
| class="rborderplz" | 1.0.0-1.2.1<ref group="8.x_i" name="ssh" /> (Windows)
| rowspan="4" colspan="4" {{yes}}
| rowspan="4" {{n/a}}
| rowspan="4" colspan="2" {{yes}}
| rowspan="4" {{partial}}<ref group="8.x_i" name="ipad-wifi" />
| rowspan="4" colspan="7" {{yes}}
| rowspan="4" {{n/a}}
|-
| class="rborderplz" | 1.0.0 (Mac)
|-
| [[PPJailbreak]]
| class="rborderplz" | 1.0 (Mac)
|-
| [[TaiG]]
| class="rborderplz" | 1.0.0-1.2.1 (Windows)
|-
| rowspan="4" | 8.1
| rowspan="2" | [[Pangu8]]
| class="rborderplz" | 1.0.0-1.2.1<ref group="8.x_i" name="ssh" /> (Windows)
| rowspan="4" colspan="15" {{yes}}
| rowspan="4" {{n/a}}
|-
| class="rborderplz" | 1.0.0 (Mac)
|-
| [[PPJailbreak]]
| class="rborderplz" | 1.0 (Mac)
|-
| [[TaiG]]
| class="rborderplz" | 1.0.0-1.2.1 (Windows)
|-
| rowspan="2" | 8.1.1
| [[PPJailbreak]]
| class="rborderplz" | 1.0 (Mac)
| rowspan="2" colspan="15" {{yes}}
| rowspan="2" {{n/a}}
|-
| [[TaiG]]
| class="rborderplz" | 1.0.0-1.2.1 (Windows)
|-
| rowspan="2" | 8.1.2
| [[PPJailbreak]]
| class="rborderplz" | 1.0 (Mac)
| rowspan="2" colspan="15" {{yes}}
| rowspan="2" {{n/a}}
|-
| [[TaiG]]
| class="rborderplz" | 1.2.0-1.2.1 (Windows)
|-
| rowspan="3" | 8.1.3
| [[PPJailbreak]]
| 2.0.0 (Mac)
| rowspan="3" colspan="15" {{yes}}
| rowspan="3" {{n/a}}
|-
| rowspan="2" | [[TaiG]]
| class="rborderplz" | 2.2.0-2.4.5 (Windows)
|-
| class="rborderplz" | 1.0.0-1.1.0 (Mac)
|-
| rowspan="3" | 8.2
| [[PPJailbreak]]
| 2.0.0 (Mac)
| rowspan="3" colspan="15" {{yes}}
| rowspan="3" {{n/a}}
|-
| rowspan="2" | [[TaiG]]
| class="rborderplz" | 2.2.0-2.4.5 (Windows)
|-
| class="rborderplz" | 1.0.0-1.1.0 (Mac)
|-
| rowspan="3" | 8.3
| [[PPJailbreak]]
| 2.0.0 (Mac)
| rowspan="3" colspan="15" {{yes}}
| rowspan="3" {{n/a}}
|-
| rowspan="2" | [[TaiG]]
| class="rborderplz" | 2.2.0-2.4.5 (Windows)
|-
| class="rborderplz" | 1.0.0-1.1.0 (Mac)
|-
| rowspan="3" | 8.4
| [[PPJailbreak]]
| 2.0.0 (Mac)
| rowspan="3" colspan="16" {{yes}}
|-
| rowspan="2" | [[TaiG]]
| class="rborderplz" | 2.2.0-2.4.5 (Windows)
|-
| class="rborderplz" | 1.0.0-1.1.0 (Mac)
|-
| 8.4.1
| colspan="2" | No Tool Available
| colspan="16" {{no}}
|}
<references group="8.x_i">
<ref name="ssh">1.0.0 and 1.0.1 give SSH access only ([[Cydia]] is not installed).</ref>
<ref name="ipad-wifi">[[J85mAP|iPad4,7 (Wi-Fi)]] only.</ref>
</references>

=====Apple TV=====
'''Note''': "Marketing Version" is the version that the Apple TV reports in its "About" screen.
{| class="wikitable"
|-
! rowspan="2" | Marketing Version
! rowspan="2" | iOS Version
! rowspan="2" | Jailbreak Tool
! rowspan="2" | Tool Version
! colspan="2" | Device
|-
! [[J33AP|Apple TV (3rd generation) (AppleTV3,1)]]
! [[J33IAP|Apple TV (3rd generation) (AppleTV3,2)]]
|-
| 7.0
| 8.0
| colspan="2" | No Tool Available
| colspan="2" {{no}}
|-
| 7.0.1
| 8.1
| colspan="2" | No Tool Available
| colspan="2" {{no}}
|-
| 7.0.2
| 8.1.1
| colspan="2" | No Tool Available
| colspan="2" {{no}}
|-
| 7.0.3
| 8.1.3
| colspan="2" | No Tool Available
| colspan="2" {{no}}
|-
| 7.1
| 8.2
| colspan="2" | No Tool Available
| colspan="2" {{no}}
|-
| 7.2
| 8.3
| colspan="2" | No Tool Available
| colspan="2" {{no}}
|-
| 7.2.1
| 8.4.1
| colspan="2" | No Tool Available
| colspan="2" {{no}}
|-
| 7.2.2
| 8.4.2
| colspan="2" | No Tool Available
| colspan="2" {{no}}
|}

====9.x====
{| class="wikitable"
|-
! rowspan="2" | iOS
! rowspan="2" | Jailbreak Tool
! rowspan="2" | Tool Version
! colspan="22" | Device
|-
! [[iPad 2]]
! [[iPad (3rd generation)]]
! [[iPad (4th generation)]]
! [[iPad Air]]
! [[iPad Air 2]]
! [[iPad Pro (12.9-inch)]]
! [[iPad Pro (9.7-inch)]]
! [[iPad mini]]
! [[iPad mini 2]]
! [[iPad mini 3]]
! [[iPad mini 4]]
! [[N94AP|iPhone 4S]]
! [[iPhone 5]]
! [[iPhone 5c]]
! [[iPhone 5s]]
! [[N61AP|iPhone 6]]
! [[N56AP|iPhone 6 Plus]]
! [[iPhone 6s]]
! [[iPhone 6s Plus]]
! [[iPhone SE]]
! [[iPod touch (5th generation)]]
! [[N102AP|iPod touch (6th generation)]]
|-
| rowspan="2" | 9.0
| rowspan="2" | [[Pangu9]] for 9.0-9.1
| 1.0.0-1.3.2 (Windows)
| colspan="6" rowspan="2" {{yes}}
| rowspan="2" {{n/a}}
| colspan="12" rowspan="2" {{yes}}
| rowspan="2" {{n/a}}
| colspan="2" rowspan="2" {{yes}}
|-
| 1.0.0-1.1.1 (Mac)
|-
| rowspan="2" | 9.0.1
| rowspan="2" | [[Pangu9]] for 9.0-9.1
| 1.0.0-1.3.2 (Windows)
| colspan="6" rowspan="2" {{yes}}
| rowspan="2" {{n/a}}
| colspan="12" rowspan="2" {{yes}}
| rowspan="2" {{n/a}}
| colspan="2" rowspan="2" {{yes}}
|-
| 1.0.0-1.1.1 (Mac)
|-
| rowspan="2" | 9.0.2
| rowspan="2" | [[Pangu9]] for 9.0-9.1
| 1.0.0-1.3.2 (Windows)
| colspan="6" rowspan="2" {{yes}}
| rowspan="2" {{n/a}}
| colspan="12" rowspan="2" {{yes}}
| rowspan="2" {{n/a}}
| colspan="2" rowspan="2" {{yes}}
|-
| 1.0.0-1.1.1 (Mac)
|-
| rowspan="4" | 9.1
| rowspan="2" | [[Home Depot]]
| Rev 1 - Rev 7
| {{yes}}
| colspan="5" {{no}}
| rowspan="4" {{n/a}}
| colspan="5" {{no}}
| {{partial|Partial<ref group="9.x" name="iphone52" />}}
| colspan="6" {{no}}
| rowspan="4" {{n/a}}
| {{yes}}
| {{no}}
|-
| RC1-RC3
| colspan="3" {{yes}}
| colspan="3" {{no}}
| {{yes}}
| colspan="3" {{no}}
| colspan="3" {{yes}}
| colspan="5" {{no}}
| {{yes}}
| {{no}}
|-
| rowspan="2" | [[Pangu9]] for 9.0-9.1
| 1.3.0-1.3.2 (Windows)
| colspan="3" rowspan="2" {{no}}
| colspan="3" rowspan="2" {{yes}}
| rowspan="2" {{no}}
| colspan="3" rowspan="2" {{yes}}
| colspan="3" rowspan="2" {{no}}
| colspan="5" rowspan="2" {{yes}}
| rowspan="2" {{no}}
| rowspan="2" {{yes}}
|-
| 1.1.0-1.1.1 (Mac)
|-
| rowspan="3" | 9.2
| rowspan="2" | [[Home Depot]]
| Rev 1 - Rev 7
| {{yes}}
| colspan="5" {{no}}
| rowspan="3" {{n/a}}
| colspan="4" {{no}}
| {{yes}}
| {{partial|Partial<ref group="9.x" name="iphone52" />}}
| colspan="6" {{no}}
| rowspan="3" {{n/a}}
| colspan="2" {{no}}
|-
| RC1-RC3
| colspan="3" {{yes}}
| colspan="3" {{no}}
| {{yes}}
| colspan="3" {{no}}
| colspan="3" {{yes}}
| colspan="5" {{no}}
| {{yes}}
| {{no}}
|-
| [[Pangu9]] for 9.2-9.3.3
| 1.0.0-1.1.0
| colspan="3" {{no}}
| colspan="3" {{yes}}
| {{no}}
| colspan="3" {{yes}}
| colspan="3" {{no}}
| colspan="5" {{yes}}
| {{no}}
| {{yes}}
|-
| rowspan="3" | 9.2.1
| rowspan="2" | [[Home Depot]]
| Rev 1 - Rev 7
| {{yes}}
| {{no}}
| {{yes}}
| colspan="3" {{no}}
| rowspan="3" {{n/a}}
| {{partial|Partial<ref group="9.x" name="ipad25" />}}
| colspan="3" {{no}}
| {{yes}}
| {{partial|Partial<ref group="9.x" name="iphone52" />}}
| {{partial|Partial<ref group="9.x" name="iphone53" />}}
| colspan="5" {{no}}
| rowspan="3" {{n/a}}
| colspan="2" {{no}}
|-
| RC1-RC3
| colspan="3" {{yes}}
| colspan="3" {{no}}
| {{yes}}
| colspan="3" {{no}}
| colspan="3" {{yes}}
| colspan="5" {{no}}
| {{yes}}
| {{no}}
|-
| [[Pangu9]] for 9.2-9.3.3
| 1.0.0-1.1.0
| colspan="3" {{no}}
| colspan="3" {{yes}}
| {{no}}
| colspan="3" {{yes}}
| colspan="3" {{no}}
| colspan="5" {{yes}}
| {{no}}
| {{yes}}
|-
| rowspan="3" | 9.3
| rowspan="2" | [[Home Depot]]
| Rev 1 - Rev 7
| {{yes}}
| colspan="10" {{no}}
| {{yes}}
| colspan="10" {{no}}
|-
| RC1-RC3
| colspan="3" {{yes}}
| colspan="4" {{no}}
| {{yes}}
| colspan="3" {{no}}
| colspan="3" {{yes}}
| colspan="6" {{no}}
| {{yes}}
| {{no}}
|-
| [[Pangu9]] for 9.2-9.3.3
| 1.0.0-1.1.0
| colspan="3" {{no}}
| colspan="4" {{yes}}
| {{no}}
| colspan="3" {{yes}}
| colspan="3" {{no}}
| colspan="6" {{yes}}
| {{no}}
| {{yes}}
|-
| rowspan="3" | 9.3.1
| rowspan="2" | [[Home Depot]]
| Rev 1 - Rev 7
| {{yes}}
| {{partial|Partial<ref group="9.x" name="ipad32" />}}
| colspan="9" {{no}}
| {{yes}}
| colspan="10" {{no}}
|-
| RC1-RC3
| colspan="3" {{yes}}
| colspan="4" {{no}}
| {{yes}}
| colspan="3" {{no}}
| colspan="3" {{yes}}
| colspan="6" {{no}}
| {{yes}}
| {{no}}
|-
| [[Pangu9]] for 9.2-9.3.3
| 1.0.0-1.1.0
| colspan="3" {{no}}
| colspan="4" {{yes}}
| {{no}}
| colspan="3" {{yes}}
| colspan="3" {{no}}
| colspan="6" {{yes}}
| {{no}}
| {{yes}}
|-
| rowspan="3" | 9.3.2
| rowspan="2" | [[Home Depot]]
| Rev 1 - Rev 7
| {{yes}}
| {{partial|Partial<ref group="9.x" name="ipad33" />}}
| colspan="5" {{no}}
| {{partial|Partial<ref group="9.x" name="ipad25" />}}
| colspan="3" {{no}}
| {{yes}}
| {{partial|Partial<ref group="9.x" name="iphone52" />}}
| {{yes}}
| colspan="6" {{no}}
| {{yes}}
| {{no}}
|-
| RC1-RC3
| colspan="3" {{yes}}
| colspan="4" {{no}}
| {{yes}}
| colspan="3" {{no}}
| colspan="3" {{yes}}
| colspan="6" {{no}}
| {{yes}}
| {{no}}
|-
| [[Pangu9]] for 9.2-9.3.3
| 1.0.0-1.1.0
| colspan="3" {{no}}
| colspan="4" {{yes}}
| {{no}}
| colspan="3" {{yes}}
| colspan="3" {{no}}
| colspan="6" {{yes}}
| {{no}}
| {{yes}}
|-
| rowspan="3" | 9.3.3
| rowspan="2" | [[Home Depot]]
| Rev 1 - Rev 7
| {{yes}}
| {{partial|Partial<ref group="9.x" name="ipad33" />}}
| colspan="5" {{no}}
| {{partial|Partial<ref group="9.x" name="ipad25" />}}
| colspan="3" {{no}}
| colspan="3" {{yes}}
| colspan="6" {{no}}
| {{yes}}
| {{no}}
|-
| RC1-RC3
| colspan="3" {{yes}}
| colspan="4" {{no}}
| {{yes}}
| colspan="3" {{no}}
| colspan="3" {{yes}}
| colspan="6" {{no}}
| {{yes}}
| {{no}}
|-
| [[Pangu9]] for 9.2-9.3.3
| 1.0.0-1.1.0
| colspan="3" {{no}}
| colspan="4" {{yes}}
| {{no}}
| colspan="3" {{yes}}
| colspan="3" {{no}}
| colspan="6" {{yes}}
| {{no}}
| {{yes}}
|-
| rowspan="2" | 9.3.4
| rowspan="2" | [[Home Depot]]
| Rev 1 - Rev 7
| {{yes}}
| {{partial|Partial<ref group="9.x" name="ipad31" />}}
| colspan="9" {{no}}
| colspan="2" {{yes}}
| {{partial|Partial<ref group="9.x" name="iphone53" />}}
| colspan="6" {{no}}
| {{yes}}
| {{no}}
|-
| RC1-RC3
| colspan="3" {{yes}}
| colspan="4" {{no}}
| {{yes}}
| colspan="3" {{no}}
| colspan="3" {{yes}}
| colspan="6" {{no}}
| {{yes}}
| {{no}}
|-
| 9.3.5
| [[Phœnix]]
| v1-v3
| colspan="3" {{yes}}
| colspan="4" {{no}}
| {{yes}}
| colspan="3" {{no}}
| colspan="3" {{yes}}
| colspan="6" {{no}}
| {{yes}}
| {{no}}
|}
<references group="9.x">
<ref name="ipad25">[[P105AP|iPad mini (Wi-Fi) (iPad2,5)]] only.</ref>
<ref name="ipad31">[[J1AP|iPad (3rd generation) (Wi-Fi) (iPad3,1)]] only.</ref>
<ref name="ipad32">[[J2AP|iPad (3rd generation) (GSM) (iPad3,2)]] only.</ref>
<ref name="ipad33">[[J2AAP|iPad (3rd generation) (CDMA) (iPad3,3)]] only.</ref>
<ref name="iphone52">[[N42AP|iPhone 5 (Global) (iPhone5,2)]] only.</ref>
<ref name="iphone53">[[N48AP|iPhone 5c (GSM) (iPhone5,3)]] only.</ref>
</references>

====10.x====
{| class="wikitable"
|-
! rowspan="2" | iOS
! rowspan="2" | Jailbreak Tool
! rowspan="2" | Tool Version
! colspan="22" | Device
|-
! [[iPad (4th generation)]]
! [[iPad Air]]
! [[iPad Air 2]]
! [[iPad Pro (12.9-inch)]]
! [[iPad Pro (9.7-inch)]]
! [[iPad (5th generation)]]
! [[iPad Pro (12.9-inch, 2nd generation)]]
! [[iPad Pro (10.5-inch)]]
! [[iPad mini 2]]
! [[iPad mini 3]]
! [[iPad mini 4]]
! [[iPhone 5]]
! [[iPhone 5c]]
! [[iPhone 5s]]
! [[N61AP|iPhone 6]]
! [[N56AP|iPhone 6 Plus]]
! [[iPhone 6s]]
! [[iPhone 6s Plus]]
! [[iPhone SE]]
! [[iPhone 7]]
! [[iPhone 7 Plus]]
! [[N102AP|iPod touch (6th generation)]]
|-
| 10.0
| colspan="2" | No Tool Available
| colspan="19" {{n/a}}
| colspan="2" {{no}}
| {{n/a}}
|-
| rowspan="5" | 10.0.1
| [[Yalu#extra_recipe_.2810.0.1-10.1.1_for_iPhone_7.29|extra_recipe+yaluX]]
| beta 4
| colspan="5" {{no}}
| rowspan="5" colspan="3" {{n/a}}
| colspan="11" {{no}}
| colspan="2" {{yes}}
| {{no}}
|-
| [[PPJailbreak]]
| 2.5.1 (Windows)
| {{no}}
| colspan="4" {{yes}}
| colspan="3" {{yes}}
| colspan="2" {{no}}
| colspan="6" {{yes}}
| colspan="2" {{no}}
| {{yes}}
|-
| rowspan="3" | [[yalu102]]
| beta 1
| colspan="3" {{no}}
| colspan="2" {{yes}}
| colspan="8" {{no}}
| colspan="3" {{yes}}
| colspan="3" {{no}}
|-
| beta 2-beta 6
| rowspan="2" {{no}}
| colspan="1" {{yes}}
| {{no}}
| colspan="2" {{yes}}
| colspan="2" {{yes}}
| colspan="3" {{no}}
| rowspan="2" colspan="6" {{yes}}
| rowspan="2" colspan="2" {{no}}
| rowspan="2" {{yes}}
|-
| beta 7
| colspan="4" {{yes}}
| colspan="3" {{yes}}
| colspan="2" {{no}}
|-
| rowspan="5" | 10.0.2
| [[Yalu#extra_recipe_.2810.0.1-10.1.1_for_iPhone_7.29|extra_recipe+yaluX]]
| beta 4
| colspan="5" {{no}}
| rowspan="5" colspan="3" {{n/a}}
| colspan="11" {{no}}
| colspan="2" {{yes}}
| {{no}}
|-
| [[PPJailbreak]]
| 2.5.1 (Windows)
| {{no}}
| colspan="4" {{yes}}
| colspan="3" {{yes}}
| colspan="2" {{no}}
| colspan="6" {{yes}}
| colspan="2" {{no}}
| {{yes}}
|-
| rowspan="3" | [[yalu102]]
| beta 1
| colspan="3" {{no}}
| colspan="2" {{yes}}
| colspan="8" {{no}}
| colspan="3" {{yes}}
| colspan="3" {{no}}
|-
| beta 2-beta 6
| rowspan="2" {{no}}
| colspan="1" {{yes}}
| {{no}}
| colspan="2" {{yes}}
| colspan="2" {{yes}}
| colspan="3" {{no}}
| rowspan="2" colspan="6" {{yes}}
| rowspan="2" colspan="2" {{no}}
| rowspan="2" {{yes}}
|-
| beta 7
| colspan="4" {{yes}}
| colspan="3" {{yes}}
| colspan="2" {{no}}
|-
| 10.0.3
| [[Yalu#extra_recipe_.2810.0.1-10.1.1_for_iPhone_7.29|extra_recipe+yaluX]]
| beta 4
| colspan="19" {{n/a}}
| colspan="2" {{yes}}
| {{n/a}}
|-
| rowspan="6" | 10.1
| [[Yalu#extra_recipe_.2810.0.1-10.1.1_for_iPhone_7.29|extra_recipe+yaluX]]
| beta 1-beta 4
| colspan="5" {{no}}
| rowspan="6" colspan="3" {{n/a}}
| colspan="11" {{no}}
| colspan="2" {{yes}}
| {{no}}
|-
| [[PPJailbreak]]
| 2.5.1 (Windows)
| {{no}}
| colspan="4" {{yes}}
| colspan="3" {{yes}}
| colspan="2" {{no}}
| colspan="6" {{yes}}
| colspan="2" {{no}}
| {{yes}}
|-
| [[Yalu#yalu_.2B_mach_portal_.2810.1-10.1.1.29|yalu + mach_portal]]
| beta 1-beta 3
| colspan="3" {{no}}
| colspan="2" {{yes}}
| colspan="8" {{no}}
| colspan="5" {{yes}}
| {{no}}
|-
| rowspan="3" | [[yalu102]]
| beta 1
| colspan="3" {{no}}
| colspan="2" {{yes}}
| colspan="8" {{no}}
| colspan="3" {{yes}}
| colspan="3" {{no}}
|-
| beta 2-beta 6
| rowspan="2" {{no}}
| colspan="1" {{yes}}
| {{no}}
| colspan="2" {{yes}}
| colspan="2" {{yes}}
| colspan="3" {{no}}
| rowspan="2" colspan="6" {{yes}}
| rowspan="2" colspan="2" {{no}}
| rowspan="2" {{yes}}
|-
| beta 7
| colspan="4" {{yes}}
| colspan="3" {{yes}}
| colspan="2" {{no}}
|-
| rowspan="6" | 10.1.1
| [[Yalu#extra_recipe_.2810.0.1-10.1.1_for_iPhone_7.29|extra_recipe+yaluX]]
| beta 1-beta 4
| colspan="5" {{no}}
| rowspan="6" colspan="3" {{n/a}}
| colspan="11" {{no}}
| colspan="2" {{yes}}
| {{no}}
|-
| [[PPJailbreak]]
| 2.5.1 (Windows)
| {{no}}
| colspan="4" {{yes}}
| colspan="3" {{yes}}
| colspan="2" {{no}}
| colspan="6" {{yes}}
| colspan="2" {{no}}
| {{yes}}
|-
| [[Yalu#yalu_.2B_mach_portal_.2810.1-10.1.1.29|yalu + mach_portal]]
| beta 1-beta 3
| colspan="3" {{no}}
| colspan="2" {{yes}}
| colspan="8" {{no}}
| colspan="5" {{yes}}
| {{no}}
|-
| rowspan="3" | [[yalu102]]
| beta 1
| colspan="3" {{no}}
| colspan="2" {{yes}}
| colspan="8" {{no}}
| colspan="3" {{yes}}
| colspan="3" {{no}}
|-
| beta 2-beta 6
| rowspan="2" {{no}}
| colspan="1" {{yes}}
| {{no}}
| colspan="2" {{yes}}
| colspan="2" {{yes}}
| colspan="3" {{no}}
| rowspan="2" colspan="6" {{yes}}
| rowspan="2" colspan="2" {{no}}
| rowspan="2" {{yes}}
|-
| beta 7
| colspan="4" {{yes}}
| colspan="3" {{yes}}
| colspan="2" {{no}}
|-
| rowspan="4" | 10.2
| [[PPJailbreak]]
| 2.5.1 (Windows)
| {{no}}
| colspan="4" {{yes}}
| rowspan="4" colspan="3" {{n/a}}
| colspan="3" {{yes}}
| colspan="2" {{no}}
| colspan="6" {{yes}}
| colspan="2" {{no}}
| {{yes}}
|-
| rowspan="3" | [[yalu102]]
| beta 1
| colspan="3" {{no}}
| colspan="2" {{yes}}
| colspan="8" {{no}}
| colspan="3" {{yes}}
| colspan="3" {{no}}
|-
| beta 2-beta 6
| rowspan="2" {{no}}
| colspan="1" {{yes}}
| {{no}}
| colspan="2" {{yes}}
| colspan="2" {{yes}}
| colspan="3" {{no}}
| rowspan="2" colspan="6" {{yes}}
| rowspan="2" colspan="2" {{no}}
| rowspan="2" {{yes}}
|-
| beta 7
| colspan="4" {{yes}}
| colspan="3" {{yes}}
| colspan="2" {{no}}
|-
| 10.2.1
| colspan="2" | No Tool Available
| colspan="5" {{no}}
| colspan="3" {{n/a}}
| colspan="14" {{no}}
|-
| 10.3
| colspan="2" | No Tool Available
| colspan="6" {{no}}
| colspan="2" {{n/a}}
| colspan="14" {{no}}
|-
| 10.3.1
| colspan="2" | No Tool Available
| colspan="6" {{no}}
| colspan="2" {{n/a}}
| colspan="14" {{no}}
|-
| 10.3.2
| colspan="2" | No Tool Available
| colspan="22" {{no}}
|-
| 10.3.3
| colspan="2" | No Tool Available
| colspan="22" {{no}}
|}

=== tvOS ===
==== 9.x ====
{| class="wikitable"
|-
! rowspan="2" | tvOS
! rowspan="2" | Jailbreak Tool
! rowspan="2" | Tool Version
! Device
|-
! [[J42dAP|Apple TV (4th generation)]]
|-
| 9.0
| [[Pangu9]]
| 1.0.0
| {{yes}}
|-
| 9.0.1
| [[Pangu9]]
| 1.0.0
| {{yes}}
|-
| 9.1
| colspan="2" | No Tool Available
| {{no}}
|-
| 9.1.1
| colspan="2" | No Tool Available
| {{no}}
|-
| 9.2
| colspan="2" | No Tool Available
| {{no}}
|-
| 9.2.1
| colspan="2" | No Tool Available
| {{no}}
|-
| 9.2.2
| colspan="2" | No Tool Available
| {{no}}
|}

==== 10.x ====
{| class="wikitable"
|-
! rowspan="2" | tvOS
! rowspan="2" | Jailbreak Tool
! rowspan="2" | Tool Version
! Device
|-
! [[J42dAP|Apple TV (4th generation)]]
|-
| 10.0
| [[LiberTV]]
| v1-v2
| {{yes}}
|-
| 10.0.1
| [[LiberTV]]
| v1-v2
| {{yes}}
|-
| 10.1
| [[LiberTV]]
| v1-v2
| {{yes}}
|-
| 10.1.1
| colspan="2" | No Tool Available
| {{no}}
|-
| 10.2
| colspan="2" | No Tool Available
| {{no}}
|-
| 10.2.1
| colspan="2" | No Tool Available
| {{no}}
|-
| 10.2.2
| colspan="2" | No Tool Available
| {{no}}
|}

==See Also==
* [[Failbreak]]
* [[Jailbreak Exploits]]
* [[Kernel Patches]]

[[Category:Jailbreaking]]

User talk:Detiac

2017-08-23T17:06:07Z

Detiac: Created blank page

User:Detiac

2017-08-21T00:37:06Z

Detiac:

==About Me==

I like to code stuff... C is my favourite language (Alongside it's childs).

==Devices I Own==

[[N72AP|iPod 2G, New BootROM:]] On iOS 3.1.2 (Via [[Sn0wbreeze]]).

[[N18AP|iPod 3G:]] On iOS 4.1 (Jailbroken via [[limera1n]]).

[[N81AP|iPod 4G:]] On iOS 5.1.1 (Jailbroken via [[Absinthe]])

[[N102AP|iPod 6:]] On iOS 10.3.2 (Jailed).

[[N92AP|iPhone 4S:]] On iOS 6.1.3 (Jailbroken via [[P0sixspwn]]).

[[N48AP|iPhone 5C:]] Yellow. On iOS 10.2.1 (Jailed).

User:Detiac

2017-08-21T00:36:58Z

Detiac:

User:Detiac

2017-08-21T00:24:18Z

Detiac: Created page with "==About Me== I like to code stuff... C is my favourite language (Alongside it's childs). ==Devices I Own== iPod 2G, New BootROM: On iOS 3.1.2 (Via Sn0wbreeze..."

Home Depot

2017-08-19T19:53:53Z

Detiac:

'''Home Depot''' is a [[semi-untethered jailbreak]] for 32-bit devices on iOS 9.1 - 9.3.4. It was written by [https://twitter.com/REALKJCMEMBER jk9357]. It works by sideloading an IPA using [[Cydia Impactor]]. The latest releases, RC1 and above, support all 32-bit devices on iOS 9.1-9.3.4.

== Version Change Log ==
{| class="wikitable"
|-
! Version
! Changes
|-
| "JailBreak" (first beta release)
| Initial beta release
|-
| "JailBreakMoreDevices" (second beta)
| More devices supported
|-
| "iPhone53932" (third beta)
| Fix for iPhone5,3 on iOS 9.3.2
|-
| "iPhone52932" (forth beta)
| Fix for iPhone5,2 on iOS 9.3.2
|-
| "Make Mexico Pay For It" (fifth beta)
| Experimental support for more devices
|-
| Revision 1
| Initial release
|-
| Revision 2
| Fix for Cydia not appearing
|-
| Revision 3
| Real fix for Cydia not appearing
|-
| Revision 4
| Fix for app crashing
|-
| Revision 5
| Fix for tfp0
|-
| Revision 6
| [[iPad 2]] fix for some iOS versions
|-
| Revision 7
| Fix for broken LwVM patch
|-
| Release Candidate 1
|
*Added 3 bonus tracks to Mixtape Player: Lay Low, Purple Demo (KJC Edit), KJC Anthem Pt. 4 (Feat. Jailbreakbusters, Qwerty, Tihmstar & rg0rd)
*Mixtape Player now displays song lyrics
*Seek backwards in Mixtape Player to hear your favorite part of the track again
*Rearrange tracks in Up Next in Mixtape Player
*Fixes an issue where the volume slider in Mixtape Player would not appear on some devices
*Fixes an issue where the Home Depot label would not be aligned properly while in the launch screen
*Saves a jailbreak log, which is available in iTunes File Sharing
*No longer extracts iosbinpack
*No longer installs Droplets wallpaper
*Treats "Enable Jailbreak" as "Prepare For Jailbreak" including re-extracting Cydia when file /.installed_home_depot is not present
*Support for every 32-bit device on iOS 9.1-9.3.4 (Beta, requires internet connection)
*Improved reliability on [[iPod touch (5th generation)]]
|-
| Release Candidate 2
| Fix for Cydia not installing
|-
| Release Candidate 3
|
*Improved reliability of re-extracting Cydia
*No longer installs Dropbear
*Fixes an issue with LwVM patch which would result in failure on iOS 9.3.1
|}
==BetterHomeDepot==
On August 18, [https://twitter.com/tihmstar tihmstar] released a untethered jailbreak (Based off of [[Home Depot]]) was released on [http://repo.tihmstar.net tihmstar's APT repository] entitled BetterHomeDepot.

[https://twitter.com/qwertyoruiopz/status/898676150020390912 Luca Todesco] told people to not use this, as there is a risk of bootlooping your device (which will force you to restore to the latest firmware).
== External Links ==
* [http://www.wall.supplies/ Home page]
* [http://pastebin.com/a91ywvEW Extra Offsets] (will add more when found)
* [https://www.reddit.com/r/jailbreak/comments/5vpuyf/discussion_list_of_all_iphone_all_ipad_will_be/ A redditor who claims to have found all the offsets]

[[Category:Jailbreaks]]
[[Category:Jailbreaking]]

Home Depot

2017-08-19T01:23:53Z

Detiac: BetterHomeDepot

'''Home Depot''' is a [[semi-untethered jailbreak]] for 32-bit devices on iOS 9.1 - 9.3.4. It was written by [https://twitter.com/REALKJCMEMBER jk9357]. It works by sideloading an IPA using [[Cydia Impactor]]. The latest releases, RC1 and above, support all 32-bit devices on iOS 9.1-9.3.4.

== Version Change Log ==
{| class="wikitable"
|-
! Version
! Changes
|-
| "JailBreak" (first beta release)
| Initial beta release
|-
| "JailBreakMoreDevices" (second beta)
| More devices supported
|-
| "iPhone53932" (third beta)
| Fix for iPhone5,3 on iOS 9.3.2
|-
| "iPhone52932" (forth beta)
| Fix for iPhone5,2 on iOS 9.3.2
|-
| "Make Mexico Pay For It" (fifth beta)
| Experimental support for more devices
|-
| Revision 1
| Initial release
|-
| Revision 2
| Fix for Cydia not appearing
|-
| Revision 3
| Real fix for Cydia not appearing
|-
| Revision 4
| Fix for app crashing
|-
| Revision 5
| Fix for tfp0
|-
| Revision 6
| [[iPad 2]] fix for some iOS versions
|-
| Revision 7
| Fix for broken LwVM patch
|-
| Release Candidate 1
|
*Added 3 bonus tracks to Mixtape Player: Lay Low, Purple Demo (KJC Edit), KJC Anthem Pt. 4 (Feat. Jailbreakbusters, Qwerty, Tihmstar & rg0rd)
*Mixtape Player now displays song lyrics
*Seek backwards in Mixtape Player to hear your favorite part of the track again
*Rearrange tracks in Up Next in Mixtape Player
*Fixes an issue where the volume slider in Mixtape Player would not appear on some devices
*Fixes an issue where the Home Depot label would not be aligned properly while in the launch screen
*Saves a jailbreak log, which is available in iTunes File Sharing
*No longer extracts iosbinpack
*No longer installs Droplets wallpaper
*Treats "Enable Jailbreak" as "Prepare For Jailbreak" including re-extracting Cydia when file /.installed_home_depot is not present
*Support for every 32-bit device on iOS 9.1-9.3.4 (Beta, requires internet connection)
*Improved reliability on [[iPod touch (5th generation)]]
|-
| Release Candidate 2
| Fix for Cydia not installing
|-
| Release Candidate 3
|
*Improved reliability of re-extracting Cydia
*No longer installs Dropbear
*Fixes an issue with LwVM patch which would result in failure on iOS 9.3.1
|}
==BetterHomeDepot==
On August 18, [https://twitter.com/tihmstar tihmstar] released a untethered jailbreak (Based off of [[Home Depot]]) was released on [http://repo.tihmstar.net tihmstar's APT repository] entitled BetterHomeDepot.

[https://twitter.com/qwertyoruiopz/status/898676150020390912 Luca Todesco] told people to not use this, as there is a risk of bootlooping your device (which will force you to restore to the latest firmware.
== External Links ==
* [http://www.wall.supplies/ Home page]
* [http://pastebin.com/a91ywvEW Extra Offsets] (will add more when found)
* [https://www.reddit.com/r/jailbreak/comments/5vpuyf/discussion_list_of_all_iphone_all_ipad_will_be/ A redditor who claims to have found all the offsets]

[[Category:Jailbreaks]]
[[Category:Jailbreaking]]

Extra Recipe

2017-08-18T00:16:59Z

Detiac: Redirected page to Yalu#extra recipe .2810.0.1-10.1.1 for iPhone 7.29

#REDIRECT [[Yalu#extra_recipe_.2810.0.1-10.1.1_for_iPhone_7.29]]

Jailbreak Exploits

2017-08-18T00:16:28Z

Detiac: /* extra_recipe (10-10.2) */

This page lists the '''exploits''' used in [[jailbreak]]s.

== Common exploits ==
These exploits are not dependent on any firmware; as such, they are used in numerous jailbreaking programs.

* [[Pwnage]] + [[Pwnage 2.0]] (together to jailbreak the [[M68AP|iPhone]], [[N45AP|iPod touch]], and [[N82AP|iPhone 3G]])
* [[ARM7 Go]] (from iOS 2.1.1) (for [[tethered jailbreak]] on [[N72AP|iPod touch (2nd generation)]])
* [[0x24000 Segment Overflow]] (for [[untethered jailbreak]] on [[N88AP|iPhone 3GS]] with [[Bootrom 359.3|old bootrom]] and [[N72AP|iPod touch (2nd generation)]] with [[Bootrom 240.4|old bootrom]]; another exploit as the [[limera1n Exploit]] is required)
* [[limera1n Exploit]] (for [[tethered jailbreak]] on [[N88AP|iPhone 3GS]], [[N18AP|iPod touch (3rd generation)]], [[K48AP|iPad]], [[iPhone 4]], [[N81AP|iPod touch (4th generation)]] and [[K66AP|Apple TV (2nd generation)]])
* [[usb_control_msg(0xA1, 1) Exploit]] (also known as "steaks4uce") (for [[tethered jailbreak]] on [[N72AP|iPod touch (2nd generation)]])

== Jailbreak Programs ==
=== [[PwnageTool]] (2.0 - 5.1.1) ===
* uses different common exploits
* uses the exploits listed below to untether up to iOS 5.1.1

=== [[redsn0w]] (3.0 - 6.0) ===
* uses different common exploits
* uses the same exploits as [[Absinthe|Absinthe]] and [[Absinthe|Absinthe 2.0]] to jailbreak iOS 5.0/5.0.1 and 5.1.1
* uses the exploits listed below to untether up to iOS 5.1.1

=== [[sn0wbreeze]] (3.1.3 - 6.1.3) ===
* uses different common exploits
* uses the exploits listed below to untether up to iOS 6.1.2

== Programs used to jailbreak 1.x ==
=== [[AppTapp Installer]] (1.0 / 1.0.1 / 1.0.2) ===
* iBoot <code>cp</code>-command exploit

=== [[iBrickr]] (1.0 / 1.0.1 / 1.0.2) ===
* iBoot <code>cp</code>-command exploit

=== [[AppSnapp]]/[[JailbreakMe|JailbreakMe 1.0]] (1.0 / 1.0.1 / 1.0.2 / 1.1.1) ===
* [[LibTiff|libtiff exploit]] (Adapted from the PSP scene, used by [[JailbreakMe]]) ({{cve|2006-3459}})

=== [[mknod|OktoPrep]] (1.1.2) ===
"Upgrade" to 1.1.2 from a jailborken 1.1.1
* [[mknod]]

=== [[Soft Upgrade]] (1.1.3) ===
"Upgrade" to 1.1.3 from a running jailbroken 1.1.2

=== [[ZiPhone]] (1.1.3 / 1.1.4 /1.1.5) ===
* [[Ramdisk Hack]]

=== [[iLiberty+|iLiberty / iLiberty+]] (1.1.3 / 1.1.4 /1.1.5) ===

== Programs used to jailbreak 2.x ==
=== [[QuickPwn]] (2.0 - 2.2.1) ===
* uses [[Pwnage]] and [[Pwnage 2.0]]

=== [[Redsn0w Lite]] (2.1.1) ===
* [[ARM7 Go]] (for [[N72AP|iPod touch (2nd generation)]] only)

== Programs used to jailbreak 3.x ==
=== [[purplera1n]] (3.0) ===
* [[iBoot Environment Variable Overflow]] ({{cve|2009-2795}})
* uses [[0x24000 Segment Overflow]]

=== [[blackra1n]] (3.1.2) ===
* [[usb_control_msg(0x21, 2) Exploit]] ({{cve|2010-0038}})
* uses [[0x24000 Segment Overflow]]

=== [[Spirit]] (3.1.2 / 3.1.3 / 3.2) ===
* [[MobileBackup Copy Exploit]]
* [[Incomplete Codesign Exploit]]
* [[BPF_STX Kernel Write Exploit]]

=== [[Star|JailbreakMe 2.0 / Star]] (3.1.2 / 3.1.3 / 3.2 / 3.2.1) ===
* [[Malformed CFF Vulnerability]] ({{cve|2010-1797}})
* [[Incomplete Codesign Exploit]]
* [[IOSurface Kernel Exploit]] ({{cve|2010-2973}})

=== [[limera1n]] / [[greenpois0n (jailbreak)|greenpois0n]] (3.2.2) ===
* uses different common exploits
* [[Packet Filter Kernel Exploit]]

== Programs used to jailbreak 4.x ==
=== [[Star|JailbreakMe 2.0 / Star]] (4.0 / 4.0.1) ===
* [[Malformed CFF Vulnerability]] ({{cve|2010-1797}})
* [[Incomplete Codesign Exploit]]
* [[IOSurface Kernel Exploit]] ({{cve|2010-2973}})

=== [[limera1n]] / (4.0 / 4.0.1 / 4.0.2 / 4.1) ===
* uses different common exploits
* [[Packet Filter Kernel Exploit]]

=== [[greenpois0n (jailbreak)|greenpois0n]] (4.1) ===
* uses different common exploits
* [[Packet Filter Kernel Exploit]]

=== [[greenpois0n (jailbreak)|greenpois0n]] (4.2.1) ===
* uses different common exploits
* [[HFS Legacy Volume Name Stack Buffer Overflow]]

=== [[Saffron|JailbreakMe 3.0 / Saffron]] (4.2.6 / 4.2.7 / 4.2.8) ===
* [[T1 Font Integer Overflow]] ({{cve|2011-0226}})
* [[HFS Legacy Volume Name Stack Buffer Overflow]]

=== [[Saffron|JailbreakMe 3.0 / Saffron]] (4.3 / 4.3.1 / 4.3.2 / 4.3.3) ===
Except for the [[N18AP|iPod touch (3rd generation)]] on iOS 4.3.1.
* [[T1 Font Integer Overflow]] ({{cve|2011-0226}})
* [[IOMobileFrameBuffer Privilege Escalation Exploit]] ({{cve|2011-0227}})

=== i0nic's Untether (4.3.1 / 4.3.2 / 4.3.3) ===
used in [[redsn0w]] to untether iOS 4.3.1 / 4.3.2 / 4.3.3
* [[ndrv_setspec() Integer Overflow]]

== Programs used to jailbreak 5.x ==
=== [[unthredera1n]] (5.0 / 5.0.1 / 5.1 / 5.1.1) ===
Except for the [[iPad (3rd generation)]]
* MobileBackup2 Copy Exploit
* a new Packet Filter Kernel Exploit ({{cve|2012-3728}})
* [[AMFID code signing evasion]] ({{cve|2013-0977}})
* [[launchd.conf untether]]
* [[Timezone Vulnerability]]

=== [[Absinthe]] (5.0 on [[N94AP|iPhone 4S]] only / 5.0.1 on [[iPad 2]] and [[iPhone 4S]]) ===
* [[Racoon String Format Overflow Exploit]] ({{cve|2012-0646}}) (used both for payload injection and untether)
* [[HFS Heap Overflow]] ({{cve|2012-0642}})
* unknown exploit ({{cve|2012-0643}})

=== [[Corona|Corona Untether]] (5.0.1) ===
* [[Racoon String Format Overflow Exploit]] ({{cve|2012-0646}})
* [[HFS Heap Overflow]] ({{cve|2012-0642}})
* unknown exploit ({{cve|2012-0643}})

=== [[Absinthe|Absinthe 2.0]] and [[Rocky Racoon|Rocky Racoon Untether]] (5.1.1) ===
* a new Packet Filter Kernel Exploit ({{cve|2012-3728}})
* Racoon DNS4/WINS4 table buffer overflow ({{cve|2012-3727}})
* MobileBackup2 Copy Exploit

== Programs used to jailbreak 6.x ==
=== [[evasi0n]] (6.0 / 6.0.1 / 6.0.2 / 6.1 / 6.1.1 / 6.1.2) ===
* [[Symbolic Link Vulnerability]] ({{cve|2013-0979}})
* [[Timezone Vulnerability]]
* [[Shebang Trick]] ({{cve|2013-5154}})
* [[AMFID code signing evasion]]
* [[launchd.conf untether]]
* [[IOUSBDeviceFamily Vulnerability]] ({{cve|2013-0981}})
* [[ARM Exception Vector Info Leak]] ({{cve|2013-0978}})
* [[dynamic memmove() locating]]
* [[vm_map_copy_t corruption for arbitrary memory disclosure]]
* [[kernel memory write via ROP gadget]]
* [[Overlapping Segment Attack]] ({{cve|2013-0977}})

=== [[p0sixspwn]] (6.1.3 / 6.1.4 / 6.1.5 / 6.1.6) ===
* [[posix_spawn kernel information leak]] ({{cve|2013-3954}}) (by [[i0n1c]])
* [[posix_spawn kernel exploit]] ({{cve|2013-3954}}) (by [[i0n1c]])
* [[mach_msg_ool_descriptor_ts for heap shaping]] ({{cve|2013-3953}})
* [[AMFID_code_signing_evasi0n7]] ({{cve|2014-1273}})
* [[DeveloperDiskImage race condition]] (by [[comex]])
* [[launchd.conf untether]]

== Programs used to jailbreak 7.x ==
=== [[evasi0n7]] (7.0 / 7.0.1 / 7.0.2 / 7.0.3 / 7.0.4 / 7.0.5 / 7.0.6) ===
{{Section Stub}}
* [[Symbolic Link Vulnerability]] ({{cve|2013-5133}})
* [[AMFID_code_signing_evasi0n7]] ({{cve|2014-1273}})
* CrashHouseKeeping chmod vulnarability ({{cve|2014-1272}})
* ptmx_get_ioctl ioctl crafted call ({{cve|2014-1278}})

=== [[Geeksn0w]] (7.1 / 7.1.1 / 7.1.2) ===
* [[limera1n]]'s bootrom exploit ([[Tethered jailbreak]]) on [[iPhone 4]]

=== [[Pangu]] (7.1 / 7.1.1 / 7.1.2) ===
* Mach-O OSBundleHeaders info leak ({{cve|2014-4491}}) (Pangu v1.0.0)
* AppleKeyStore::initUserClient info leak ({{cve|2014-4407}}) (Pangu >v1.0.0)
* break_early_random (by [[i0n1c]] and Tarjei Mandt of Azimuth) ({{cve|2014-4422}})
* mach_port_kobject exploit {{cve|2014-4496}} - used to recover the permutation value and addresses of kernel objects
* IOSharedDataQueue notification port overwrite ({{cve|2014-4461}})
* "syslogd chown" vulnerability
* enterprise certificate (no real exploit, used for initial "unsigned" code execution)
* "foo_extracted" symlink vulnerability (used to write to /var) ({{cve|2014-4386}})
* /tmp/bigfile (a big file for improvement of the reliability of a race condition)
* VoIP backgrounding trick (used to auto restart the app)
* hidden segment attack

== Programs used to jailbreak 8.x ==
=== [[Pangu8]] (8.0 / 8.0.1 / 8.0.2 / 8.1) ===
* an exploit for a bug in /usr/libexec/neagent (source @iH8sn0w)
* enterprise certificate (inside the IPA)
* a kind of dylib injection into a system process (see IPA)
* a dmg mount command (looks like the Developer DMG) (syslog while jailbreaking)
* a sandboxing problem in debugserver ({{cve|2014-4457}})
* mach_port_kobject exploit {{cve|2014-4496}} - used to recover the permutation value and addresses of kernel objects
* the same kernel exploit as used in [[Pangu|the first Pangu]] ({{cve|2014-4461}}) (source @iH8sn0w) - now used to also leak kernel memory (source @Morpheus______)
* enable-dylibs-to-override-cache
* a new ovelapping segment attack ({{cve|2014-4455}})

=== [[TaiG]] and [[PPJailbreak]] (8.0 / 8.0.1 / 8.0.2 / 8.1 / 8.1.1 / 8.1.2) ===
(See also details at [http://newosxbook.com/articles/TaiG.html newosxbook.com])
* A new AFC symlink attack ({{cve|2014-4480}}) - to get onto the device filesystem
* [[DeveloperDiskImage race condition]] (by [[comex]], also used in p0sixspwn) - to mount a fake DDI and instantly overwrite (via union) libmis/xpcd_cache
* A new overlapping segment attack [in a modified version], dyld, ({{cve|2014-4455}}) - negative LC_SEGMENT - to allow libmis and xpcdcache to load
* libmis redirection of MISValidateSignature (as per evasion) to kCFEqual, with overlapping segment variant on TaiG (Segment at end of file, negative)
* enable-dylibs-to-override-cache - force loading of dynamic libraries from filesystem (where available) instead of the shared cache (overriding libmis/xpcd_cache)
* MobileStorageMounter exploit ({{cve|2015-1062}})
* Backup exploit used to access restricted parts of the filesystem ({{cve|2015-1087}})

Kernel:

* Mach-O OSBundleHeaders info leak ({{cve|2014-4491}}) - leaks slid addresses
* mach_port_kobject exploit {{cve|2014-4496}} - used to recover the permutation value and addresses of kernel objects
* IOHIDFamily Kernel exploit ({{cve|2014-4487}}) - to overwrite memory

=== [[TaiG]] (8.1.3 / 8.2 / 8.3 / 8.4) and [[PPJailbreak]] ===
(See also details at http://newosxbook.com/articles/28DaysLater.html and http://newosxbook.com/articles/HIDeAndSeek.html)
* [[DeveloperDiskImage race condition]] (also used in TaiG for 8.0-8.1.2 but modified) - to mount a fake DDI
* enable-dylibs-to-override-cache - force loading of dynamic libraries from filesystem (where available) instead of the shared cache (overriding libmis)
* Symbolic linking to AFC ({{cve|2015-5746}})
* Backup exploit to write to protected regions of the disk ({{cve|2015-5752}})
* Code signing exploit ({{cve|2015-3802}})
* Code signing exploit ({{cve|2015-3803}})
* Code signing exploit ({{cve|2015-3805}})
* Code signing exploit ({{cve|2015-3806}})
* IOHIDFamily exploit ({{cve|2015-5774}})
* Air Traffic exploit to allow attackers to access arbitrary filesystem locations via vectors related to asset handling ({{cve|2015-5766}})

== Programs used to jailbreak 9.x ==
=== [[Pangu9]] (9.0 / 9.0.1 / 9.0.2) ===
* Photos exploit to gain arbitrary unsandboxed file system access as mobile to load outdated DDI. ({{cve|2015-7037}})
* MobileStorageMounter allowed older DeveloperDiskImages to be mounted, resulting in unsandboxed unsigned code execution due to known weaknesses in entitled executables. ({{cve|2015-7051}})
* IOHIDFamily Use-After-Free for kernel information leak / code execution as mobile. ({{cve|2015-6974}})
* dyld exploit in dyld shared cache handling to override MISValidateSignature in libmis.dylib for persistency ({{cve|2015-7079}})
* Racing KPP for some of the patches.
* AMFI MAC Hooks were in non-__const __DATA section, so wouldn't be integrity checked by KPP, allowing to replace MAC hooks required for code-signing. ({{cve|2015-7055}})

=== [[Pangu9]] (9.1) ===
* unknown

=== [[Pangu9]] (9.2 / 9.2.1 / 9.3 / 9.3.1 / 9.3.2 / 9.3.3) ===
* IOMobileFrameBuffer exploit to execute arbitrary code with kernel privileges. ({{cve|2016-4654}})

== Programs used to jailbreak 10.x ==

=== [[yalu + mach_portal]] (10-10.1.1) ===

* set_dp_control_port exploit to execute arbitrary code with kernel privileges. ({{cve|2016-7644}})

=== [[yalu102]] (10-10.2) ===

* mach_voucher_extract_attr_recipe_trap memory corruption. ({{cve|2017-2370}})

=== [[Extra_Recipe]] (10-10.2) ===

* mach_voucher_extract_attr_recipe_trap memory corruption. ({{cve|2017-2370}})

Jailbreak Exploits

2017-08-18T00:14:14Z

Detiac: /* Programs used to jailbreak 10.x */

This page lists the '''exploits''' used in [[jailbreak]]s.

== Common exploits ==
These exploits are not dependent on any firmware; as such, they are used in numerous jailbreaking programs.

* [[Pwnage]] + [[Pwnage 2.0]] (together to jailbreak the [[M68AP|iPhone]], [[N45AP|iPod touch]], and [[N82AP|iPhone 3G]])
* [[ARM7 Go]] (from iOS 2.1.1) (for [[tethered jailbreak]] on [[N72AP|iPod touch (2nd generation)]])
* [[0x24000 Segment Overflow]] (for [[untethered jailbreak]] on [[N88AP|iPhone 3GS]] with [[Bootrom 359.3|old bootrom]] and [[N72AP|iPod touch (2nd generation)]] with [[Bootrom 240.4|old bootrom]]; another exploit as the [[limera1n Exploit]] is required)
* [[limera1n Exploit]] (for [[tethered jailbreak]] on [[N88AP|iPhone 3GS]], [[N18AP|iPod touch (3rd generation)]], [[K48AP|iPad]], [[iPhone 4]], [[N81AP|iPod touch (4th generation)]] and [[K66AP|Apple TV (2nd generation)]])
* [[usb_control_msg(0xA1, 1) Exploit]] (also known as "steaks4uce") (for [[tethered jailbreak]] on [[N72AP|iPod touch (2nd generation)]])

== Jailbreak Programs ==
=== [[PwnageTool]] (2.0 - 5.1.1) ===
* uses different common exploits
* uses the exploits listed below to untether up to iOS 5.1.1

=== [[redsn0w]] (3.0 - 6.0) ===
* uses different common exploits
* uses the same exploits as [[Absinthe|Absinthe]] and [[Absinthe|Absinthe 2.0]] to jailbreak iOS 5.0/5.0.1 and 5.1.1
* uses the exploits listed below to untether up to iOS 5.1.1

=== [[sn0wbreeze]] (3.1.3 - 6.1.3) ===
* uses different common exploits
* uses the exploits listed below to untether up to iOS 6.1.2

== Programs used to jailbreak 1.x ==
=== [[AppTapp Installer]] (1.0 / 1.0.1 / 1.0.2) ===
* iBoot <code>cp</code>-command exploit

=== [[iBrickr]] (1.0 / 1.0.1 / 1.0.2) ===
* iBoot <code>cp</code>-command exploit

=== [[AppSnapp]]/[[JailbreakMe|JailbreakMe 1.0]] (1.0 / 1.0.1 / 1.0.2 / 1.1.1) ===
* [[LibTiff|libtiff exploit]] (Adapted from the PSP scene, used by [[JailbreakMe]]) ({{cve|2006-3459}})

=== [[mknod|OktoPrep]] (1.1.2) ===
"Upgrade" to 1.1.2 from a jailborken 1.1.1
* [[mknod]]

=== [[Soft Upgrade]] (1.1.3) ===
"Upgrade" to 1.1.3 from a running jailbroken 1.1.2

=== [[ZiPhone]] (1.1.3 / 1.1.4 /1.1.5) ===
* [[Ramdisk Hack]]

=== [[iLiberty+|iLiberty / iLiberty+]] (1.1.3 / 1.1.4 /1.1.5) ===

== Programs used to jailbreak 2.x ==
=== [[QuickPwn]] (2.0 - 2.2.1) ===
* uses [[Pwnage]] and [[Pwnage 2.0]]

=== [[Redsn0w Lite]] (2.1.1) ===
* [[ARM7 Go]] (for [[N72AP|iPod touch (2nd generation)]] only)

== Programs used to jailbreak 3.x ==
=== [[purplera1n]] (3.0) ===
* [[iBoot Environment Variable Overflow]] ({{cve|2009-2795}})
* uses [[0x24000 Segment Overflow]]

=== [[blackra1n]] (3.1.2) ===
* [[usb_control_msg(0x21, 2) Exploit]] ({{cve|2010-0038}})
* uses [[0x24000 Segment Overflow]]

=== [[Spirit]] (3.1.2 / 3.1.3 / 3.2) ===
* [[MobileBackup Copy Exploit]]
* [[Incomplete Codesign Exploit]]
* [[BPF_STX Kernel Write Exploit]]

=== [[Star|JailbreakMe 2.0 / Star]] (3.1.2 / 3.1.3 / 3.2 / 3.2.1) ===
* [[Malformed CFF Vulnerability]] ({{cve|2010-1797}})
* [[Incomplete Codesign Exploit]]
* [[IOSurface Kernel Exploit]] ({{cve|2010-2973}})

=== [[limera1n]] / [[greenpois0n (jailbreak)|greenpois0n]] (3.2.2) ===
* uses different common exploits
* [[Packet Filter Kernel Exploit]]

== Programs used to jailbreak 4.x ==
=== [[Star|JailbreakMe 2.0 / Star]] (4.0 / 4.0.1) ===
* [[Malformed CFF Vulnerability]] ({{cve|2010-1797}})
* [[Incomplete Codesign Exploit]]
* [[IOSurface Kernel Exploit]] ({{cve|2010-2973}})

=== [[limera1n]] / (4.0 / 4.0.1 / 4.0.2 / 4.1) ===
* uses different common exploits
* [[Packet Filter Kernel Exploit]]

=== [[greenpois0n (jailbreak)|greenpois0n]] (4.1) ===
* uses different common exploits
* [[Packet Filter Kernel Exploit]]

=== [[greenpois0n (jailbreak)|greenpois0n]] (4.2.1) ===
* uses different common exploits
* [[HFS Legacy Volume Name Stack Buffer Overflow]]

=== [[Saffron|JailbreakMe 3.0 / Saffron]] (4.2.6 / 4.2.7 / 4.2.8) ===
* [[T1 Font Integer Overflow]] ({{cve|2011-0226}})
* [[HFS Legacy Volume Name Stack Buffer Overflow]]

=== [[Saffron|JailbreakMe 3.0 / Saffron]] (4.3 / 4.3.1 / 4.3.2 / 4.3.3) ===
Except for the [[N18AP|iPod touch (3rd generation)]] on iOS 4.3.1.
* [[T1 Font Integer Overflow]] ({{cve|2011-0226}})
* [[IOMobileFrameBuffer Privilege Escalation Exploit]] ({{cve|2011-0227}})

=== i0nic's Untether (4.3.1 / 4.3.2 / 4.3.3) ===
used in [[redsn0w]] to untether iOS 4.3.1 / 4.3.2 / 4.3.3
* [[ndrv_setspec() Integer Overflow]]

== Programs used to jailbreak 5.x ==
=== [[unthredera1n]] (5.0 / 5.0.1 / 5.1 / 5.1.1) ===
Except for the [[iPad (3rd generation)]]
* MobileBackup2 Copy Exploit
* a new Packet Filter Kernel Exploit ({{cve|2012-3728}})
* [[AMFID code signing evasion]] ({{cve|2013-0977}})
* [[launchd.conf untether]]
* [[Timezone Vulnerability]]

=== [[Absinthe]] (5.0 on [[N94AP|iPhone 4S]] only / 5.0.1 on [[iPad 2]] and [[iPhone 4S]]) ===
* [[Racoon String Format Overflow Exploit]] ({{cve|2012-0646}}) (used both for payload injection and untether)
* [[HFS Heap Overflow]] ({{cve|2012-0642}})
* unknown exploit ({{cve|2012-0643}})

=== [[Corona|Corona Untether]] (5.0.1) ===
* [[Racoon String Format Overflow Exploit]] ({{cve|2012-0646}})
* [[HFS Heap Overflow]] ({{cve|2012-0642}})
* unknown exploit ({{cve|2012-0643}})

=== [[Absinthe|Absinthe 2.0]] and [[Rocky Racoon|Rocky Racoon Untether]] (5.1.1) ===
* a new Packet Filter Kernel Exploit ({{cve|2012-3728}})
* Racoon DNS4/WINS4 table buffer overflow ({{cve|2012-3727}})
* MobileBackup2 Copy Exploit

== Programs used to jailbreak 6.x ==
=== [[evasi0n]] (6.0 / 6.0.1 / 6.0.2 / 6.1 / 6.1.1 / 6.1.2) ===
* [[Symbolic Link Vulnerability]] ({{cve|2013-0979}})
* [[Timezone Vulnerability]]
* [[Shebang Trick]] ({{cve|2013-5154}})
* [[AMFID code signing evasion]]
* [[launchd.conf untether]]
* [[IOUSBDeviceFamily Vulnerability]] ({{cve|2013-0981}})
* [[ARM Exception Vector Info Leak]] ({{cve|2013-0978}})
* [[dynamic memmove() locating]]
* [[vm_map_copy_t corruption for arbitrary memory disclosure]]
* [[kernel memory write via ROP gadget]]
* [[Overlapping Segment Attack]] ({{cve|2013-0977}})

=== [[p0sixspwn]] (6.1.3 / 6.1.4 / 6.1.5 / 6.1.6) ===
* [[posix_spawn kernel information leak]] ({{cve|2013-3954}}) (by [[i0n1c]])
* [[posix_spawn kernel exploit]] ({{cve|2013-3954}}) (by [[i0n1c]])
* [[mach_msg_ool_descriptor_ts for heap shaping]] ({{cve|2013-3953}})
* [[AMFID_code_signing_evasi0n7]] ({{cve|2014-1273}})
* [[DeveloperDiskImage race condition]] (by [[comex]])
* [[launchd.conf untether]]

== Programs used to jailbreak 7.x ==
=== [[evasi0n7]] (7.0 / 7.0.1 / 7.0.2 / 7.0.3 / 7.0.4 / 7.0.5 / 7.0.6) ===
{{Section Stub}}
* [[Symbolic Link Vulnerability]] ({{cve|2013-5133}})
* [[AMFID_code_signing_evasi0n7]] ({{cve|2014-1273}})
* CrashHouseKeeping chmod vulnarability ({{cve|2014-1272}})
* ptmx_get_ioctl ioctl crafted call ({{cve|2014-1278}})

=== [[Geeksn0w]] (7.1 / 7.1.1 / 7.1.2) ===
* [[limera1n]]'s bootrom exploit ([[Tethered jailbreak]]) on [[iPhone 4]]

=== [[Pangu]] (7.1 / 7.1.1 / 7.1.2) ===
* Mach-O OSBundleHeaders info leak ({{cve|2014-4491}}) (Pangu v1.0.0)
* AppleKeyStore::initUserClient info leak ({{cve|2014-4407}}) (Pangu >v1.0.0)
* break_early_random (by [[i0n1c]] and Tarjei Mandt of Azimuth) ({{cve|2014-4422}})
* mach_port_kobject exploit {{cve|2014-4496}} - used to recover the permutation value and addresses of kernel objects
* IOSharedDataQueue notification port overwrite ({{cve|2014-4461}})
* "syslogd chown" vulnerability
* enterprise certificate (no real exploit, used for initial "unsigned" code execution)
* "foo_extracted" symlink vulnerability (used to write to /var) ({{cve|2014-4386}})
* /tmp/bigfile (a big file for improvement of the reliability of a race condition)
* VoIP backgrounding trick (used to auto restart the app)
* hidden segment attack

== Programs used to jailbreak 8.x ==
=== [[Pangu8]] (8.0 / 8.0.1 / 8.0.2 / 8.1) ===
* an exploit for a bug in /usr/libexec/neagent (source @iH8sn0w)
* enterprise certificate (inside the IPA)
* a kind of dylib injection into a system process (see IPA)
* a dmg mount command (looks like the Developer DMG) (syslog while jailbreaking)
* a sandboxing problem in debugserver ({{cve|2014-4457}})
* mach_port_kobject exploit {{cve|2014-4496}} - used to recover the permutation value and addresses of kernel objects
* the same kernel exploit as used in [[Pangu|the first Pangu]] ({{cve|2014-4461}}) (source @iH8sn0w) - now used to also leak kernel memory (source @Morpheus______)
* enable-dylibs-to-override-cache
* a new ovelapping segment attack ({{cve|2014-4455}})

=== [[TaiG]] and [[PPJailbreak]] (8.0 / 8.0.1 / 8.0.2 / 8.1 / 8.1.1 / 8.1.2) ===
(See also details at [http://newosxbook.com/articles/TaiG.html newosxbook.com])
* A new AFC symlink attack ({{cve|2014-4480}}) - to get onto the device filesystem
* [[DeveloperDiskImage race condition]] (by [[comex]], also used in p0sixspwn) - to mount a fake DDI and instantly overwrite (via union) libmis/xpcd_cache
* A new overlapping segment attack [in a modified version], dyld, ({{cve|2014-4455}}) - negative LC_SEGMENT - to allow libmis and xpcdcache to load
* libmis redirection of MISValidateSignature (as per evasion) to kCFEqual, with overlapping segment variant on TaiG (Segment at end of file, negative)
* enable-dylibs-to-override-cache - force loading of dynamic libraries from filesystem (where available) instead of the shared cache (overriding libmis/xpcd_cache)
* MobileStorageMounter exploit ({{cve|2015-1062}})
* Backup exploit used to access restricted parts of the filesystem ({{cve|2015-1087}})

Kernel:

* Mach-O OSBundleHeaders info leak ({{cve|2014-4491}}) - leaks slid addresses
* mach_port_kobject exploit {{cve|2014-4496}} - used to recover the permutation value and addresses of kernel objects
* IOHIDFamily Kernel exploit ({{cve|2014-4487}}) - to overwrite memory

=== [[TaiG]] (8.1.3 / 8.2 / 8.3 / 8.4) and [[PPJailbreak]] ===
(See also details at http://newosxbook.com/articles/28DaysLater.html and http://newosxbook.com/articles/HIDeAndSeek.html)
* [[DeveloperDiskImage race condition]] (also used in TaiG for 8.0-8.1.2 but modified) - to mount a fake DDI
* enable-dylibs-to-override-cache - force loading of dynamic libraries from filesystem (where available) instead of the shared cache (overriding libmis)
* Symbolic linking to AFC ({{cve|2015-5746}})
* Backup exploit to write to protected regions of the disk ({{cve|2015-5752}})
* Code signing exploit ({{cve|2015-3802}})
* Code signing exploit ({{cve|2015-3803}})
* Code signing exploit ({{cve|2015-3805}})
* Code signing exploit ({{cve|2015-3806}})
* IOHIDFamily exploit ({{cve|2015-5774}})
* Air Traffic exploit to allow attackers to access arbitrary filesystem locations via vectors related to asset handling ({{cve|2015-5766}})

== Programs used to jailbreak 9.x ==
=== [[Pangu9]] (9.0 / 9.0.1 / 9.0.2) ===
* Photos exploit to gain arbitrary unsandboxed file system access as mobile to load outdated DDI. ({{cve|2015-7037}})
* MobileStorageMounter allowed older DeveloperDiskImages to be mounted, resulting in unsandboxed unsigned code execution due to known weaknesses in entitled executables. ({{cve|2015-7051}})
* IOHIDFamily Use-After-Free for kernel information leak / code execution as mobile. ({{cve|2015-6974}})
* dyld exploit in dyld shared cache handling to override MISValidateSignature in libmis.dylib for persistency ({{cve|2015-7079}})
* Racing KPP for some of the patches.
* AMFI MAC Hooks were in non-__const __DATA section, so wouldn't be integrity checked by KPP, allowing to replace MAC hooks required for code-signing. ({{cve|2015-7055}})

=== [[Pangu9]] (9.1) ===
* unknown

=== [[Pangu9]] (9.2 / 9.2.1 / 9.3 / 9.3.1 / 9.3.2 / 9.3.3) ===
* IOMobileFrameBuffer exploit to execute arbitrary code with kernel privileges. ({{cve|2016-4654}})

== Programs used to jailbreak 10.x ==

=== [[yalu + mach_portal]] (10-10.1.1) ===

* set_dp_control_port exploit to execute arbitrary code with kernel privileges. ({{cve|2016-7644}})

=== [[yalu102]] (10-10.2) ===

* mach_voucher_extract_attr_recipe_trap memory corruption. ({{cve|2017-2370}})

=== [[extra_recipe]] (10-10.2) ===

* mach_voucher_extract_attr_recipe_trap memory corruption. ({{cve|2017-2370}})

Jailbreak Exploits

2017-08-18T00:14:00Z

Detiac:

This page lists the '''exploits''' used in [[jailbreak]]s.

== Common exploits ==
These exploits are not dependent on any firmware; as such, they are used in numerous jailbreaking programs.

* [[Pwnage]] + [[Pwnage 2.0]] (together to jailbreak the [[M68AP|iPhone]], [[N45AP|iPod touch]], and [[N82AP|iPhone 3G]])
* [[ARM7 Go]] (from iOS 2.1.1) (for [[tethered jailbreak]] on [[N72AP|iPod touch (2nd generation)]])
* [[0x24000 Segment Overflow]] (for [[untethered jailbreak]] on [[N88AP|iPhone 3GS]] with [[Bootrom 359.3|old bootrom]] and [[N72AP|iPod touch (2nd generation)]] with [[Bootrom 240.4|old bootrom]]; another exploit as the [[limera1n Exploit]] is required)
* [[limera1n Exploit]] (for [[tethered jailbreak]] on [[N88AP|iPhone 3GS]], [[N18AP|iPod touch (3rd generation)]], [[K48AP|iPad]], [[iPhone 4]], [[N81AP|iPod touch (4th generation)]] and [[K66AP|Apple TV (2nd generation)]])
* [[usb_control_msg(0xA1, 1) Exploit]] (also known as "steaks4uce") (for [[tethered jailbreak]] on [[N72AP|iPod touch (2nd generation)]])

== Jailbreak Programs ==
=== [[PwnageTool]] (2.0 - 5.1.1) ===
* uses different common exploits
* uses the exploits listed below to untether up to iOS 5.1.1

=== [[redsn0w]] (3.0 - 6.0) ===
* uses different common exploits
* uses the same exploits as [[Absinthe|Absinthe]] and [[Absinthe|Absinthe 2.0]] to jailbreak iOS 5.0/5.0.1 and 5.1.1
* uses the exploits listed below to untether up to iOS 5.1.1

=== [[sn0wbreeze]] (3.1.3 - 6.1.3) ===
* uses different common exploits
* uses the exploits listed below to untether up to iOS 6.1.2

== Programs used to jailbreak 1.x ==
=== [[AppTapp Installer]] (1.0 / 1.0.1 / 1.0.2) ===
* iBoot <code>cp</code>-command exploit

=== [[iBrickr]] (1.0 / 1.0.1 / 1.0.2) ===
* iBoot <code>cp</code>-command exploit

=== [[AppSnapp]]/[[JailbreakMe|JailbreakMe 1.0]] (1.0 / 1.0.1 / 1.0.2 / 1.1.1) ===
* [[LibTiff|libtiff exploit]] (Adapted from the PSP scene, used by [[JailbreakMe]]) ({{cve|2006-3459}})

=== [[mknod|OktoPrep]] (1.1.2) ===
"Upgrade" to 1.1.2 from a jailborken 1.1.1
* [[mknod]]

=== [[Soft Upgrade]] (1.1.3) ===
"Upgrade" to 1.1.3 from a running jailbroken 1.1.2

=== [[ZiPhone]] (1.1.3 / 1.1.4 /1.1.5) ===
* [[Ramdisk Hack]]

=== [[iLiberty+|iLiberty / iLiberty+]] (1.1.3 / 1.1.4 /1.1.5) ===

== Programs used to jailbreak 2.x ==
=== [[QuickPwn]] (2.0 - 2.2.1) ===
* uses [[Pwnage]] and [[Pwnage 2.0]]

=== [[Redsn0w Lite]] (2.1.1) ===
* [[ARM7 Go]] (for [[N72AP|iPod touch (2nd generation)]] only)

== Programs used to jailbreak 3.x ==
=== [[purplera1n]] (3.0) ===
* [[iBoot Environment Variable Overflow]] ({{cve|2009-2795}})
* uses [[0x24000 Segment Overflow]]

=== [[blackra1n]] (3.1.2) ===
* [[usb_control_msg(0x21, 2) Exploit]] ({{cve|2010-0038}})
* uses [[0x24000 Segment Overflow]]

=== [[Spirit]] (3.1.2 / 3.1.3 / 3.2) ===
* [[MobileBackup Copy Exploit]]
* [[Incomplete Codesign Exploit]]
* [[BPF_STX Kernel Write Exploit]]

=== [[Star|JailbreakMe 2.0 / Star]] (3.1.2 / 3.1.3 / 3.2 / 3.2.1) ===
* [[Malformed CFF Vulnerability]] ({{cve|2010-1797}})
* [[Incomplete Codesign Exploit]]
* [[IOSurface Kernel Exploit]] ({{cve|2010-2973}})

=== [[limera1n]] / [[greenpois0n (jailbreak)|greenpois0n]] (3.2.2) ===
* uses different common exploits
* [[Packet Filter Kernel Exploit]]

== Programs used to jailbreak 4.x ==
=== [[Star|JailbreakMe 2.0 / Star]] (4.0 / 4.0.1) ===
* [[Malformed CFF Vulnerability]] ({{cve|2010-1797}})
* [[Incomplete Codesign Exploit]]
* [[IOSurface Kernel Exploit]] ({{cve|2010-2973}})

=== [[limera1n]] / (4.0 / 4.0.1 / 4.0.2 / 4.1) ===
* uses different common exploits
* [[Packet Filter Kernel Exploit]]

=== [[greenpois0n (jailbreak)|greenpois0n]] (4.1) ===
* uses different common exploits
* [[Packet Filter Kernel Exploit]]

=== [[greenpois0n (jailbreak)|greenpois0n]] (4.2.1) ===
* uses different common exploits
* [[HFS Legacy Volume Name Stack Buffer Overflow]]

=== [[Saffron|JailbreakMe 3.0 / Saffron]] (4.2.6 / 4.2.7 / 4.2.8) ===
* [[T1 Font Integer Overflow]] ({{cve|2011-0226}})
* [[HFS Legacy Volume Name Stack Buffer Overflow]]

=== [[Saffron|JailbreakMe 3.0 / Saffron]] (4.3 / 4.3.1 / 4.3.2 / 4.3.3) ===
Except for the [[N18AP|iPod touch (3rd generation)]] on iOS 4.3.1.
* [[T1 Font Integer Overflow]] ({{cve|2011-0226}})
* [[IOMobileFrameBuffer Privilege Escalation Exploit]] ({{cve|2011-0227}})

=== i0nic's Untether (4.3.1 / 4.3.2 / 4.3.3) ===
used in [[redsn0w]] to untether iOS 4.3.1 / 4.3.2 / 4.3.3
* [[ndrv_setspec() Integer Overflow]]

== Programs used to jailbreak 5.x ==
=== [[unthredera1n]] (5.0 / 5.0.1 / 5.1 / 5.1.1) ===
Except for the [[iPad (3rd generation)]]
* MobileBackup2 Copy Exploit
* a new Packet Filter Kernel Exploit ({{cve|2012-3728}})
* [[AMFID code signing evasion]] ({{cve|2013-0977}})
* [[launchd.conf untether]]
* [[Timezone Vulnerability]]

=== [[Absinthe]] (5.0 on [[N94AP|iPhone 4S]] only / 5.0.1 on [[iPad 2]] and [[iPhone 4S]]) ===
* [[Racoon String Format Overflow Exploit]] ({{cve|2012-0646}}) (used both for payload injection and untether)
* [[HFS Heap Overflow]] ({{cve|2012-0642}})
* unknown exploit ({{cve|2012-0643}})

=== [[Corona|Corona Untether]] (5.0.1) ===
* [[Racoon String Format Overflow Exploit]] ({{cve|2012-0646}})
* [[HFS Heap Overflow]] ({{cve|2012-0642}})
* unknown exploit ({{cve|2012-0643}})

=== [[Absinthe|Absinthe 2.0]] and [[Rocky Racoon|Rocky Racoon Untether]] (5.1.1) ===
* a new Packet Filter Kernel Exploit ({{cve|2012-3728}})
* Racoon DNS4/WINS4 table buffer overflow ({{cve|2012-3727}})
* MobileBackup2 Copy Exploit

== Programs used to jailbreak 6.x ==
=== [[evasi0n]] (6.0 / 6.0.1 / 6.0.2 / 6.1 / 6.1.1 / 6.1.2) ===
* [[Symbolic Link Vulnerability]] ({{cve|2013-0979}})
* [[Timezone Vulnerability]]
* [[Shebang Trick]] ({{cve|2013-5154}})
* [[AMFID code signing evasion]]
* [[launchd.conf untether]]
* [[IOUSBDeviceFamily Vulnerability]] ({{cve|2013-0981}})
* [[ARM Exception Vector Info Leak]] ({{cve|2013-0978}})
* [[dynamic memmove() locating]]
* [[vm_map_copy_t corruption for arbitrary memory disclosure]]
* [[kernel memory write via ROP gadget]]
* [[Overlapping Segment Attack]] ({{cve|2013-0977}})

=== [[p0sixspwn]] (6.1.3 / 6.1.4 / 6.1.5 / 6.1.6) ===
* [[posix_spawn kernel information leak]] ({{cve|2013-3954}}) (by [[i0n1c]])
* [[posix_spawn kernel exploit]] ({{cve|2013-3954}}) (by [[i0n1c]])
* [[mach_msg_ool_descriptor_ts for heap shaping]] ({{cve|2013-3953}})
* [[AMFID_code_signing_evasi0n7]] ({{cve|2014-1273}})
* [[DeveloperDiskImage race condition]] (by [[comex]])
* [[launchd.conf untether]]

== Programs used to jailbreak 7.x ==
=== [[evasi0n7]] (7.0 / 7.0.1 / 7.0.2 / 7.0.3 / 7.0.4 / 7.0.5 / 7.0.6) ===
{{Section Stub}}
* [[Symbolic Link Vulnerability]] ({{cve|2013-5133}})
* [[AMFID_code_signing_evasi0n7]] ({{cve|2014-1273}})
* CrashHouseKeeping chmod vulnarability ({{cve|2014-1272}})
* ptmx_get_ioctl ioctl crafted call ({{cve|2014-1278}})

=== [[Geeksn0w]] (7.1 / 7.1.1 / 7.1.2) ===
* [[limera1n]]'s bootrom exploit ([[Tethered jailbreak]]) on [[iPhone 4]]

=== [[Pangu]] (7.1 / 7.1.1 / 7.1.2) ===
* Mach-O OSBundleHeaders info leak ({{cve|2014-4491}}) (Pangu v1.0.0)
* AppleKeyStore::initUserClient info leak ({{cve|2014-4407}}) (Pangu >v1.0.0)
* break_early_random (by [[i0n1c]] and Tarjei Mandt of Azimuth) ({{cve|2014-4422}})
* mach_port_kobject exploit {{cve|2014-4496}} - used to recover the permutation value and addresses of kernel objects
* IOSharedDataQueue notification port overwrite ({{cve|2014-4461}})
* "syslogd chown" vulnerability
* enterprise certificate (no real exploit, used for initial "unsigned" code execution)
* "foo_extracted" symlink vulnerability (used to write to /var) ({{cve|2014-4386}})
* /tmp/bigfile (a big file for improvement of the reliability of a race condition)
* VoIP backgrounding trick (used to auto restart the app)
* hidden segment attack

== Programs used to jailbreak 8.x ==
=== [[Pangu8]] (8.0 / 8.0.1 / 8.0.2 / 8.1) ===
* an exploit for a bug in /usr/libexec/neagent (source @iH8sn0w)
* enterprise certificate (inside the IPA)
* a kind of dylib injection into a system process (see IPA)
* a dmg mount command (looks like the Developer DMG) (syslog while jailbreaking)
* a sandboxing problem in debugserver ({{cve|2014-4457}})
* mach_port_kobject exploit {{cve|2014-4496}} - used to recover the permutation value and addresses of kernel objects
* the same kernel exploit as used in [[Pangu|the first Pangu]] ({{cve|2014-4461}}) (source @iH8sn0w) - now used to also leak kernel memory (source @Morpheus______)
* enable-dylibs-to-override-cache
* a new ovelapping segment attack ({{cve|2014-4455}})

=== [[TaiG]] and [[PPJailbreak]] (8.0 / 8.0.1 / 8.0.2 / 8.1 / 8.1.1 / 8.1.2) ===
(See also details at [http://newosxbook.com/articles/TaiG.html newosxbook.com])
* A new AFC symlink attack ({{cve|2014-4480}}) - to get onto the device filesystem
* [[DeveloperDiskImage race condition]] (by [[comex]], also used in p0sixspwn) - to mount a fake DDI and instantly overwrite (via union) libmis/xpcd_cache
* A new overlapping segment attack [in a modified version], dyld, ({{cve|2014-4455}}) - negative LC_SEGMENT - to allow libmis and xpcdcache to load
* libmis redirection of MISValidateSignature (as per evasion) to kCFEqual, with overlapping segment variant on TaiG (Segment at end of file, negative)
* enable-dylibs-to-override-cache - force loading of dynamic libraries from filesystem (where available) instead of the shared cache (overriding libmis/xpcd_cache)
* MobileStorageMounter exploit ({{cve|2015-1062}})
* Backup exploit used to access restricted parts of the filesystem ({{cve|2015-1087}})

Kernel:

* Mach-O OSBundleHeaders info leak ({{cve|2014-4491}}) - leaks slid addresses
* mach_port_kobject exploit {{cve|2014-4496}} - used to recover the permutation value and addresses of kernel objects
* IOHIDFamily Kernel exploit ({{cve|2014-4487}}) - to overwrite memory

=== [[TaiG]] (8.1.3 / 8.2 / 8.3 / 8.4) and [[PPJailbreak]] ===
(See also details at http://newosxbook.com/articles/28DaysLater.html and http://newosxbook.com/articles/HIDeAndSeek.html)
* [[DeveloperDiskImage race condition]] (also used in TaiG for 8.0-8.1.2 but modified) - to mount a fake DDI
* enable-dylibs-to-override-cache - force loading of dynamic libraries from filesystem (where available) instead of the shared cache (overriding libmis)
* Symbolic linking to AFC ({{cve|2015-5746}})
* Backup exploit to write to protected regions of the disk ({{cve|2015-5752}})
* Code signing exploit ({{cve|2015-3802}})
* Code signing exploit ({{cve|2015-3803}})
* Code signing exploit ({{cve|2015-3805}})
* Code signing exploit ({{cve|2015-3806}})
* IOHIDFamily exploit ({{cve|2015-5774}})
* Air Traffic exploit to allow attackers to access arbitrary filesystem locations via vectors related to asset handling ({{cve|2015-5766}})

== Programs used to jailbreak 9.x ==
=== [[Pangu9]] (9.0 / 9.0.1 / 9.0.2) ===
* Photos exploit to gain arbitrary unsandboxed file system access as mobile to load outdated DDI. ({{cve|2015-7037}})
* MobileStorageMounter allowed older DeveloperDiskImages to be mounted, resulting in unsandboxed unsigned code execution due to known weaknesses in entitled executables. ({{cve|2015-7051}})
* IOHIDFamily Use-After-Free for kernel information leak / code execution as mobile. ({{cve|2015-6974}})
* dyld exploit in dyld shared cache handling to override MISValidateSignature in libmis.dylib for persistency ({{cve|2015-7079}})
* Racing KPP for some of the patches.
* AMFI MAC Hooks were in non-__const __DATA section, so wouldn't be integrity checked by KPP, allowing to replace MAC hooks required for code-signing. ({{cve|2015-7055}})

=== [[Pangu9]] (9.1) ===
* unknown

=== [[Pangu9]] (9.2 / 9.2.1 / 9.3 / 9.3.1 / 9.3.2 / 9.3.3) ===
* IOMobileFrameBuffer exploit to execute arbitrary code with kernel privileges. ({{cve|2016-4654}})

== Programs used to jailbreak 10.x ==

=== [[yalu + mach_portal]] (10-10.1.1) ===

* set_dp_control_port exploit to execute arbitrary code with kernel privileges. ({{cve|2016-7644}})

=== [[yalu102] (10-10.2) ===

* mach_voucher_extract_attr_recipe_trap memory corruption. ({{cve|2017-2370}})

=== [[extra_recipe] (10-10.2) ===

* mach_voucher_extract_attr_recipe_trap memory corruption. ({{cve|2017-2370}})

S5L8930

2017-08-14T18:53:49Z

Detiac: /* Bootrom Exploits */

[[Image:A4.jpg|right]]
A [[wikipedia:system on a chip|system on a chip]] ("SoC") developed by Apple's in-house chip design department. Publicly, Apple refers to this chip as the '''A4'''. Internally, this processor is also based on the [[S5L8920]]X family, which can also be seen through the reuse of several MMIO devices and MMIO device registers (i.e: chipid). This is the last SoC revision on mobile devices manufactured for Apple that has a publicly known exploitable [[bootrom]] vulnerability.

== Used in ==
* [[K66AP|Apple TV (2nd generation)]]
* [[K48AP|iPad]]
* [[iPhone 4]]
* [[N81AP|iPod touch (4th generation)]]

== [[Bootrom]] Exploits ==
* [[Limera1n Exploit|limera1n]]
* [[SHA-1 Image Segment Overflow|SHAtter (Unreleased)]]

== Boot Chain ==
[[Bootrom 574.4|Bootrom]]->[[LLB]]->[[iBoot]]->[[Kernel]]->[[Firmware|System Software]]

== Specifications ==
* '''CPU''': ARM Cortex-A8
* '''GPU''': PowerVR SGX 535
* '''A/V Playback''': PowerVR VXD
* '''RAM''': 256 MB ([[K66AP|Apple TV (2nd generation)]], [[K48AP|iPad]], and [[N81AP|iPod touch (4th generation)]]) or 512 MB ([[iPhone 4]])

[[Category:Application Processors]]
Aside from the [[iPhone 4]]'s additional RAM and an overall higher clock speed, these are the same specifications as the [[S5L8920]] and [[S5L8922]].

== See also ==
* [[Bootrom 574.4]]

== Links ==
* http://www.apple.com/ipad/specs/
* http://www.brightsideofnews.com/news/2010/1/27/apple-a4-soc-unveiled---its-an-arm-cpu-and-the-gpu!.aspx

Geeksn0w

2017-08-08T15:35:17Z

Detiac:

{{about|the semi-tethered jailbreak for iOS 7.1.x|the untethered jailbreak for iOS 7.1.x|Pangu}}
{{Infobox software
| title = Geeksn0w
| logo = [[File:Geeksn0w.png|75px]]
| screenshot = [[File:Geeksn0w_2.8.2.png|250px]]
| caption = Geeksn0w 2.8.2 on Windows 7
| author = [http://twitter.com/blackgeektuto BlackGeek]
| developer = [http://twitter.com/blackgeektuto BlackGeek]
| released =
| discontinued =
| latest release version = 2.9.1
| latest release date = {{Start date and age|2014|6|13|df=yes}}
| latest preview version = 1.0 beta (CLI)
| latest preview date = {{Start date and age|2014|5|1|df=yes}}
| programming language = .NET Visual Basic
| operating system = [[wikipedia:Microsoft Windows|Windows]] / [[wikipedia:OS X|OS X]]
| size =
| platform =
| language = [[wikipedia:English|English]]
| status = Active
| genre = Jailbreaking
| license = [[wikipedia:Freeware|Freeware]]
| website = [http://geeksn0w.it geeksn0w.it]
}}

'''Geeksn0w''' is a [[semi-tethered jailbreak]] for the [[iPhone 4]] on iOS 7.1.x.

== Supported Devices and Requirements==
The only supported devices are those of the [[iPhone 4]]. This is because Geeksn0w uses the [[A4]]-dependent [[limera1n exploit]] and the [[iPhone 4]] is the only A4 device running [[iOS]] 7. Geeksn0w currently only supports Windows (unless you use BootCamp or another VM on your Mac to install Windows). Geeksn0w requires [http://www.oracle.com/technetwork/java/javase/downloads/jdk7-downloads-1880260.html Java Development Kit for 32-bit PCs] and [http://www.microsoft.com/net .NET Framework] installed on your computer to be able to run. Unlike other jailbreak tools (such as [[evasi0n7]]), Geeksn0w does not need [[iTunes]] to be installed.

==Versions and Updates==
Geeksn0w originally performed a [[tethered jailbreak]] on [[iOS]] 7.0 on the [[iPhone 4]] until [[evasi0n7]] was released. BlackGeek then updated Geeksn0w to use the same exploits as [[evasi0n7]] for all devices. Versions 2.5 and above perform a tethered jailbreak on iOS 7.1 for the iPhone 4. Version 2.9 performs a [[semi-tethered jailbreak]] on iOS 7.1, 7.1.1 and 7.1.2.
On May 1, 2014, BlackGeek released the Mac beta cli for OS X.

===Download===
{| class="wikitable" style="text-align:center;"
! Version
! OS
! Download
! Changelog
|-
! 2.5
| class="noborderplz" rowspan="8" | [[wikipedia:Microsoft Windows|Windows]]
| [https://www.mega.co.nz/#!cA0nRQZA!khTx3YZ-Q5nZq2nYaB0dJtLrp16OLaTmi-TUEaBjk0s MEGA]
| First release that jailbreaks iOS 7.1
|-
! 2.6
| [https://www.mega.co.nz#!YBcCmKTL!ViKwyAzB8k30nly_LBTVnzlH_KK7LUyvTgQMcBOENXs MEGA]
| Bug fixes
|-
! 2.7
| [https://www.mediafire.com/download/1j4q76u9bm24wc0/geeksn0w_win_2.7_ea343bc6ca7b07ad662e2c4b3e0cefa.zip MediaFire]
|
* Added official Cydia 1.1.9 build
* Fixed Mail, Safari, Calculator and Weather crash after doing a tethered boot (SandBox fix)
* Added auto-Hacktivation for locked iPhones
* Fixed a bug in the Progress Bar
* Added iDevice arch finder: now GeekSn0w can auto-detect your iPhone model
* Improved speed of root_fs mount
* Fixed mount.sh error
* Reduced the .exe size
* Speeded up the Jailbreak process
* Added AFC2 protocol (iFunBox, iExplorer)
|-
! 2.8
| [http://www.geeksn0w.it/GeekSn0w/Releases/Windows/geeksn0w_win_2.8_7c148dc55660b4466dade25aa19bb.zip geeksn0w.it]
|
* Fixed a huge bug of GeekSn0w's dfuarch extension
|-
! 2.8.1
| [http://www.geeksn0w.it/GeekSn0w/Releases/Windows/geeksn0w_win_2.8.1_0b65917a7fd23e279ac97763338ecf.zip geeksn0w.it]
|
* Removed "dfuarch", now GeekSn0w uses iRecovery to identify the iPhone model
* Fixed "New Curses" installation error
|-
! 2.8.2
| [http://www.geeksn0w.it/GeekSn0w/Releases/Windows/geeksn0w_2.8.2_win_c7e3b8f62934143a93e69042c9de96f.zip geeksn0w.it]
|
* Fixed an issue with iPhone 3,2 and 3,3 Jailbreak's process
|-
! 2.8.3
| [http://www.geeksn0w.it/GeekSn0w/Releases/Windows/geeksn0w_win_2.8.3_3f17cffb2b38bc34a5d3dae91da8c2b.zip geeksn0w.it]
|
* Fixed an issue with New Curses installation
|-
! 2.9
| [http://www.geeksn0w.it/GeekSn0w/Releases/Windows/geeksn0w_win_2.9_6322a7e8d3b4bfefe9f585beb7d6d4a5.zip geeksn0w.it]
|
* Updated Jailbreak payload: GeekSn0w now executes a [[Tethered jailbreak|Semi-Tethered Jailbreak]]
* Updated .NET Framework version of some resources
* Removed Respring after any reboot: now all the hack stuff is executed during Apple Logo stage
* Supports iOS 7.1.1
|-
! 1.0 beta (cli)
| [[wikipedia:OS X|OS X]]
| [http://www.geeksn0w.it/GeekSn0w/Releases/Mac_cli/geeksn0w_cli_mac_1.0_d4bdaea1f30d353297d3d4293491f741.zip geeksn0w.it]
|
* First version for OS X.
|-
! 2.9.1
| Windows
| [http://www.geeksn0w.it/GeekSn0w/Releases/Windows/geeksn0w_win_2.9.1_c2d308ebe982521ba066a7299598372e.zip geeksn0w.it]
|
* Bundled with Cydia 1.1.12.
* Minor bug fixes
|}

==How it works==
Geeksn0w uses msftguy and DevBug's [[SSH Ramdisk]] tool which uses [[geohot]]'s [[limera1n exploit]] to obtain root access. It then installs Cydia and mounts the root filesystem. It then uses [[opensn0w]] to boot the [[iPhone 4]] tethered. Geeksn0w is technically a GUI of [[opensn0w]] and [[SSH Ramdisk|ssh_rd]].

===The Semi-Tether===
When the device is booted, it uses a LaunchDaemon to start a script in /gfix that reinstalls MobileSubstrate and PreferenceLoader from a local package and then kills the springboard and remounts the system partition as r/w. At installation time it sets the 'nvram' variable boot-args to true, which prevents [[Recovery Mode]]. However, it reinstalls MobileSubstrate and PreferenceLoader from a local package, which prevents [[saurik]] from updating it. It also kills the [[SpringBoard]] which adds additional boot time, and it remounts the fs after the first [[SpringBoard]] launch, which may cause other LaunchDaemons that needs r/w at boot time to fail. This is why many people have made their own SemiTether packages that use the 'dirhelper' which is being executed during the boot, to remount the fs and looping through /etc/rc.d and execute every binary there, just like [[evasi0n7]] does, which directly injects MobileSubstrate. They then use 'auto-boot' to prevent [[Recovery Mode]]. This resulting package boots faster and is far more efficient than the way it is currently used by. The reason that Geeksn0w is not an [[untethered jailbreak]], is that there is no kernel exploit

==The Semi-Tether==
On April 21, 2014, BlackGeek announced on Twitter that he had achieved a [[semi-tethered jailbreak]] on the iPhone 4 on 7.1<ref>https://twitter.com/blackgeektuto/status/458283310100541441</ref>. On April 25, BlackGeek updated Geeksn0w to version 2.9 which achieved a semi-tethered jailbreak for 7.1 or 7.1.1. He also added the semi-tether package to his repo (http://geekrepo.beiphone.it) for people who had already jailbroken tethered on 7.1 and wanted to upgrade to semi-tethered.

==Exploits==
*[[geohot]]'s [[limera1n exploit]] - Tethered

==See Also==
*[[Semi-tethered jailbreak]]
*[[limera1n exploit]]
*[[opensn0w]]
*[http://twitter.com/blackgeektuto BlackGeek] on Twitter

==References==
<references/>

[[Category:Jailbreaks]]
[[Category:Jailbreaking]]

DFU Mode

2017-08-03T03:12:21Z

Detiac: /* Entering DFU Mode on iPhone, iPad or iPod touch */

'''DFU''' or '''Device Firmware Upgrade''' mode allows all devices to be restored from any state. It is essentially a mode where the BootROM can accept iBSS. DFU is burned into the hardware, so it cannot be removed. On A7+ devices, it generates an ApNonce and recognizes APTickets as well, so even in DFU, it can accept an APTicket.

==DFU Mode==
===Entering DFU Mode on iPhone, iPad or iPod touch===
# Plug your device into your computer with a USB cable.
# Turn off the device.
# Hold the Power button for 3 seconds.
# Hold the Home and Power buttons for 10 seconds.
# Release the Power button but keep holding the Home button.
# After about 15 seconds you will be alerted by iTunes saying that it has detected a device in Recovery Mode.

'''Make sure the device screen is blank and no logos are present'''

Alternative way:

# Plug in your device to your computer via a USB cable.
# Hold both the Power and Home button.
# Wait 1 second after the screen flickers off.
# Let go of Power but keep holding Home.
# iTunes will prompt you that your device has entered Recovery and needs to be restored.

'''If you see a connect to iTunes logo on your device; You failed. Try again'''

===Exiting DFU Mode on iPhone, iPad or iPod touch===
# Hold the Home and Power buttons until the Apple Logo appears.

===Entering DFU Mode on Apple TV===
# Plug the device into your computer using a microUSB cable.
# Force the device to reboot by holding down the "Menu" and "Down" buttons simultaneously for 6-7 seconds.
# Press "Menu" and "Play" simultaneously right after reboot, until a message pops up in [[iTunes]], saying that it has detected an Apple TV in Recovery Mode.

===Exiting DFU Mode on Apple TV===
# Hold down the "Menu" and "Down" buttons. The Apple TV will reboot.

==Enter True Hardware DFU Mode Automatically==
The EnterDFU function in the [[MobileDevice Library]] does not enter the true DFU Mode in the hardware. It's possible to enter the true DFU Mode without doing it manually, but it cannot be exited unless a restore is performed, as it creates a [[DFU Loop]]. This doesn't work with [[S5L8900]] devices.

===Steps===
# Make a copy of a fresh IPSW file.
# Open the IPSW as a zip folder and browse to /firmware/all_flash/all_flash.xxxxx.production/
# Extract LLB.*****.RELEASE.img3/im4p and open it in a hex editor.
# Change some random bit or bits, it doesn't matter which or what you write.
# Add the edited file back to the zip, rename zip to ipsw and restore it to your device using iTunes.
# The restore will error out and your device will be in DFU Mode.

===Alternative Method===
If the previous method does not work for you, try this one.
# Do steps 1 and 2 from above.
# Delete LLB.*****.RELEASE.img3.
# Copy applelogo.********.img3 to temporary directory.
# Rename the copy of applelogo.********.img3/im4p to LLB.*****.RELEASE.img3/im4p. (If you forget the name of the LLB file, you can find it again in the file named manifest.)
# Copy the renamed applelogo file back to the all_flash.xxxxx.production directory.
# Rename the zip.
# Restore the file using iTunes. (If every thing goes well, you should receive an error 31 from iTunes.)

==DFU Mode Output to the computer==
<pre>iProduct: "Apple Mobile Device (DFU Mode)"</pre> <pre>iSerialNumber: "CPID:XXXX CPRV:15 CPFM:03 SCEP:03 BDID:00 ECID:XXXXXXXXXXXXXXXX SRTG:[iBoot-XXX.X.X]"</pre>

==Revisions==
===[[S5L8900]] (0x1222)===
This is the device ID in the [[N45AP|iPod touch]], the [[M68AP|iPhone]], and the [[N82AP|iPhone 3G]]. For more information about the protocol, see [[DFU 0x1222]].

===[[S5L8720 Bootrom|S5L8720]], [[S5L8920]], and [[WTF|WTF mode post-2.0]] (0x1227)===
This is the device ID in the [[N72AP|iPod touch (2nd generation)]], the [[N88AP|iPhone 3GS]], the [[N90AP|iPhone 4]], subsequent 32 bit devices, all 64 bit devices, and [[WTF|WTF mode]]. For more information on the protocol, see [[DFU 0x1227]].

[[Category:Bootrom]]

Home Depot

2017-08-03T03:01:02Z

Detiac: let people know it works on 8.4.1

'''Home Depot''' is a [[semi-untethered jailbreak]] for 32-bit devices on iOS 9.1 - 9.3.4. It was written by [https://twitter.com/REALKJCMEMBER jk9357]. It works by sideloading an IPA using [[Cydia Impactor]]. The latest releases, RC1 and above, support all 32-bit devices on iOS 9.1-9.3.4. Works on 8.4.1 with custom offsets.

== Version Change Log ==
{| class="wikitable"
|-
! Version
! Changes
|-
| "JailBreak" (first beta release)
| Initial beta release
|-
| "JailBreakMoreDevices" (second beta)
| More devices supported
|-
| "iPhone53932" (third beta)
| Fix for iPhone5,3 on iOS 9.3.2
|-
| "iPhone52932" (forth beta)
| Fix for iPhone5,2 on iOS 9.3.2
|-
| "Make Mexico Pay For It" (fifth beta)
| Experimental support for more devices
|-
| Revision 1
| Initial release
|-
| Revision 2
| Fix for Cydia not appearing
|-
| Revision 3
| Real fix for Cydia not appearing
|-
| Revision 4
| Fix for app crashing
|-
| Revision 5
| Fix for tfp0
|-
| Revision 6
| [[iPad 2]] fix for some iOS versions
|-
| Revision 7
| Fix for broken LwVM patch
|-
| Release Candidate 1
|
*Added 3 bonus tracks to Mixtape Player: Lay Low, Purple Demo (KJC Edit), KJC Anthem Pt. 4 (Feat. Jailbreakbusters, Qwerty, Tihmstar & rg0rd)
*Mixtape Player now displays song lyrics
*Seek backwards in Mixtape Player to hear your favorite part of the track again
*Rearrange tracks in Up Next in Mixtape Player
*Fixes an issue where the volume slider in Mixtape Player would not appear on some devices
*Fixes an issue where the Home Depot label would not be aligned properly while in the launch screen
*Saves a jailbreak log, which is available in iTunes File Sharing
*No longer extracts iosbinpack
*No longer installs Droplets wallpaper
*Treats "Enable Jailbreak" as "Prepare For Jailbreak" including re-extracting Cydia when file /.installed_home_depot is not present
*Support for every 32-bit device on iOS 9.1-9.3.4 (Beta, requires internet connection)
*Improved reliability on [[iPod touch (5th generation)]]
|-
| Release Candidate 2
| Fix for Cydia not installing
|-
| Release Candidate 3
|
*Improved reliability of re-extracting Cydia
*No longer installs Dropbear
*Fixes an issue with LwVM patch which would result in failure on iOS 9.3.1
|}

== External Links ==
* [http://www.wall.supplies/ Home page]
* [http://pastebin.com/a91ywvEW Extra Offsets] (will add more when found)
* [https://www.reddit.com/r/jailbreak/comments/5vpuyf/discussion_list_of_all_iphone_all_ipad_will_be/ A redditor who claims to have found all the offsets]

[[Category:Jailbreaks]]
[[Category:Jailbreaking]]

IRecovery

2017-08-03T02:58:28Z

Detiac: fixed spacing

{{DISPLAYTITLE:iRecovery}}
iRecovery is a libusb-based CLI utility for Mac OS X, Linux, and Windows. It is able to talk to [[iBoot (Bootloader)|iBoot]] and [[iBSS]] and [[iBEC]] via USB. It's completely open source; the source code is released under the terms of the GNU GPL v3. The full license text can be found in the LICENSE file on github.
Please note that there is no official compiled version available.

It currently connects to:
* [[DFU 0x1227|0x1227]] ([[DFU Mode]]/[[WTF]] Mode 2.0)
* [[Recovery Mode (Protocols)#Recovery_Mode_2.x_.28DevID.3D0x1281.29|Recovery Mode 0x1281]] (Recovery Mode/iBSS/iBEC)

==Credits==
westbaer

==Thanks==
[[User:Pod2g|pod2g]], [[tom3q]], [[User:Planetbeing|planetbeing]], [[User:Geohot|geohot]] and [[User:posixninja|posixninja]].

==Features==

===DFU 2.0 (0x1227)===
It can upload a file, such as an [[iBSS]], so that you can unplug and spawn a shell with 0x1281.

===Recovery 2.0 (0x1281)===
====File Uploading====
You can upload a file to 0x9000000 with the following syntax:
./iRecovery -f file
In newer builds that use libusb-1.0 this is now
./iRecovery -u file

====Two-Way Shell====
You can spawn a shell to do all sorts of neat things with the syntax:
./iRecovery -s
Once it has spawned, you can type 'help' and iBoot will respond with its built-in command list.

====Single Command====
./iRecovery -c "command"
Sends a single command to the device *without* spawning a shell.

====usb_control_msg(0x21, 2) Exploit Command====
./iRecovery -k
Sends Chronic Dev's + Geohot's latest usb exploit. Implemented into blackra1n.
This was updated near October 17, 2009. [http://github.com/posixninja/irecovery posixninja's fork]
In newer builds this is now -e

====Auto Boot====
You can now enable auto-boot by running:
./iRecovery -a
or by sending /auto-boot in a shell.

In newer builds it is now:
./iRecovery -n

====USB Reset====
Reset USB
./iRecovery -r

====Batch Scripting====
iRecovery now supports batch scripting, this allows you to send commands to iBoot from a pre written list of commands, this also supports scripting such as /auto-boot and /upload <file>
./iRecovery -b <file>
or in a shell:
/batch <file>

====Raw Commands====
You can now send raw commands via the -x21 -x40 or -xA1 flags

==Example Output==

iRecovery -s
======================================
::
:: iBSS for n82ap, Copyright 2009, Apple Inc.
::
:: BUILD_TAG: iBoot-596.24
::
:: BUILD_STYLE: RELEASE
::
:: USB_SERIAL_NUMBER: CPID:8900 CPRV:30 CPFM:03 SCEP:05 BDID:04 ECID:000003293C113D76 IBFL:00
::
=======================================

Entering recovery mode, starting command prompt
] printenv
build-style = "RELEASE"
build-version = "iBoot-596.24"
config_board = "n82ap"
loadaddr = "0x9000000"
boot-command = "fsboot"
bootdelay = "0"
auto-boot = "true"
idle-off = "true"
boot-device = "nand0"
boot-partition = "0"
boot-path = "/System/Library/Caches/com.apple.kernelcaches/kernelcache.s5l8900x"
display-color-space = "RGB888"
display-timing = "optC"
framebuffer = "0xfd00000"
secure-boot = "0x1"

== Supported Raw Commands ==

Currently Supported by All Firmware: 
Reboot - Reboots Iphone

More IBoot Commands Information: 
http://code.google.com/p/chronicdev/wiki/iBootCommands

NOTE: 'bgcolor' appears to be no longer supported -- requires confirmation.

==Forks==
[http://github.com/iH8sn0w/irecovery iH8sn0w/irecovery]

[http://github.com/GreySyntax/irecovery GreySyntax/irecovery]

==Updates==
* A C++ port is also in the works dubbed iRecovery++ (by [[User:GreySyntax|GreySyntax]]) can be found at [http://github.com/NSPwn/iRecoveryplusplus GitHub/NSPwn/iRecoveryplusplus]
* [https://www.openjailbreak.org/projects/libirecovery-2-0/repository libiRecovery 2.0 in development by OpenJailBreak.org]
* A VB.NET GUI port for Windows has been made under the name [[GiRecovery|Zeratul]].

==Download==
*[https://github.com/Chronic-Dev/libirecovery Chronic-Dev - libiRecovery (Mac OS X | Linux | Windows)]
*[https://github.com/GreySyntax/iRecoveryplusplus GreySyntax - iRecovery++ (Mac OS X| Linux | Windows (Possibly))]

Note: Source only.

[[Category:Hacking Software]]

IRecovery

2017-08-01T00:09:17Z

Detiac:

{{DISPLAYTITLE:iRecovery}}
iRecovery is a libusb-based CLI utility for Mac OS X, Linux, and Windows. It is able to talk to [[iBoot (Bootloader)|iBoot]] and [[iBSS]] and [[iBEC]] via USB. It's completely open source; the source code is released under the terms of the GNU GPL v3. The full license text can be found in the LICENSE file on github.
Please note that there is no official compiled version available
It currently connects to:
* [[DFU 0x1227|0x1227]] ([[DFU Mode]]/[[WTF]] Mode 2.0)
* [[Recovery Mode (Protocols)#Recovery_Mode_2.x_.28DevID.3D0x1281.29|Recovery Mode 0x1281]] (Recovery Mode/iBSS/iBEC)

==Credits==
westbaer

==Thanks==
[[User:Pod2g|pod2g]], [[tom3q]], [[User:Planetbeing|planetbeing]], [[User:Geohot|geohot]] and [[User:posixninja|posixninja]].

==Features==

===DFU 2.0 (0x1227)===
It can upload a file, such as an [[iBSS]], so that you can unplug and spawn a shell with 0x1281.

===Recovery 2.0 (0x1281)===
====File Uploading====
You can upload a file to 0x9000000 with the following syntax:
./iRecovery -f file
In newer builds that use libusb-1.0 this is now
./iRecovery -u file

====Two-Way Shell====
You can spawn a shell to do all sorts of neat things with the syntax:
./iRecovery -s
Once it has spawned, you can type 'help' and iBoot will respond with its built-in command list.

====Single Command====
./iRecovery -c "command"
Sends a single command to the device *without* spawning a shell.

====usb_control_msg(0x21, 2) Exploit Command====
./iRecovery -k
Sends Chronic Dev's + Geohot's latest usb exploit. Implemented into blackra1n.
This was updated near October 17, 2009. [http://github.com/posixninja/irecovery posixninja's fork]
In newer builds this is now -e

====Auto Boot====
You can now enable auto-boot by running:
./iRecovery -a
or by sending /auto-boot in a shell.

In newer builds it is now:
./iRecovery -n

====USB Reset====
Reset USB
./iRecovery -r

====Batch Scripting====
iRecovery now supports batch scripting, this allows you to send commands to iBoot from a pre written list of commands, this also supports scripting such as /auto-boot and /upload <file>
./iRecovery -b <file>
or in a shell:
/batch <file>

====Raw Commands====
You can now send raw commands via the -x21 -x40 or -xA1 flags

==Example Output==

iRecovery -s
======================================
::
:: iBSS for n82ap, Copyright 2009, Apple Inc.
::
:: BUILD_TAG: iBoot-596.24
::
:: BUILD_STYLE: RELEASE
::
:: USB_SERIAL_NUMBER: CPID:8900 CPRV:30 CPFM:03 SCEP:05 BDID:04 ECID:000003293C113D76 IBFL:00
::
=======================================

Entering recovery mode, starting command prompt
] printenv
build-style = "RELEASE"
build-version = "iBoot-596.24"
config_board = "n82ap"
loadaddr = "0x9000000"
boot-command = "fsboot"
bootdelay = "0"
auto-boot = "true"
idle-off = "true"
boot-device = "nand0"
boot-partition = "0"
boot-path = "/System/Library/Caches/com.apple.kernelcaches/kernelcache.s5l8900x"
display-color-space = "RGB888"
display-timing = "optC"
framebuffer = "0xfd00000"
secure-boot = "0x1"

== Supported Raw Commands ==

Currently Supported by All Firmware: 
Reboot - Reboots Iphone

More IBoot Commands Information: 
http://code.google.com/p/chronicdev/wiki/iBootCommands

NOTE: 'bgcolor' appears to be no longer supported -- requires confirmation.

==Forks==
[http://github.com/iH8sn0w/irecovery iH8sn0w/irecovery]

[http://github.com/GreySyntax/irecovery GreySyntax/irecovery]

==Updates==
* A C++ port is also in the works dubbed iRecovery++ (by [[User:GreySyntax|GreySyntax]]) can be found at [http://github.com/NSPwn/iRecoveryplusplus GitHub/NSPwn/iRecoveryplusplus]
* [https://www.openjailbreak.org/projects/libirecovery-2-0/repository libiRecovery 2.0 in development by OpenJailBreak.org]
* A VB.NET GUI port for Windows has been made under the name [[GiRecovery|Zeratul]].

==Download==
*[https://github.com/Chronic-Dev/libirecovery Chronic-Dev - libiRecovery (Mac OS X | Linux | Windows)]
*[https://github.com/GreySyntax/iRecoveryplusplus GreySyntax - iRecovery++ (Mac OS X| Linux | Windows (Possibly))]

Note: Source only.

[[Category:Hacking Software]]

IRecovery

2017-08-01T00:07:17Z

Detiac: /* Auto Boot */

{{DISPLAYTITLE:iRecovery}}
iRecovery is a libusb-based CLI utility for Mac OS X, Linux, and Windows. It is able to talk to [[iBoot (Bootloader)|iBoot]] and [[iBSS]] and [[iBEC]] via USB. It's completely open source; the source code is released under the terms of the GNU GPL v3. The full license text can be found in the LICENSE file on github.

It currently connects to:
* [[DFU 0x1227|0x1227]] ([[DFU Mode]]/[[WTF]] Mode 2.0)
* [[Recovery Mode (Protocols)#Recovery_Mode_2.x_.28DevID.3D0x1281.29|Recovery Mode 0x1281]] (Recovery Mode/iBSS/iBEC)

==Credits==
westbaer

==Thanks==
[[User:Pod2g|pod2g]], [[tom3q]], [[User:Planetbeing|planetbeing]], [[User:Geohot|geohot]] and [[User:posixninja|posixninja]].

==Features==

===DFU 2.0 (0x1227)===
It can upload a file, such as an [[iBSS]], so that you can unplug and spawn a shell with 0x1281.

===Recovery 2.0 (0x1281)===
====File Uploading====
You can upload a file to 0x9000000 with the following syntax:
./iRecovery -f file
In newer builds that use libusb-1.0 this is now
./iRecovery -u file

====Two-Way Shell====
You can spawn a shell to do all sorts of neat things with the syntax:
./iRecovery -s
Once it has spawned, you can type 'help' and iBoot will respond with its built-in command list.

====Single Command====
./iRecovery -c "command"
Sends a single command to the device *without* spawning a shell.

====usb_control_msg(0x21, 2) Exploit Command====
./iRecovery -k
Sends Chronic Dev's + Geohot's latest usb exploit. Implemented into blackra1n.
This was updated near October 17, 2009. [http://github.com/posixninja/irecovery posixninja's fork]
In newer builds this is now -e

====Auto Boot====
You can now enable auto-boot by running:
./iRecovery -a
or by sending /auto-boot in a shell.

In newer builds it is now:
./iRecovery -n

====USB Reset====
Reset USB
./iRecovery -r

====Batch Scripting====
iRecovery now supports batch scripting, this allows you to send commands to iBoot from a pre written list of commands, this also supports scripting such as /auto-boot and /upload <file>
./iRecovery -b <file>
or in a shell:
/batch <file>

====Raw Commands====
You can now send raw commands via the -x21 -x40 or -xA1 flags

==Example Output==

iRecovery -s
======================================
::
:: iBSS for n82ap, Copyright 2009, Apple Inc.
::
:: BUILD_TAG: iBoot-596.24
::
:: BUILD_STYLE: RELEASE
::
:: USB_SERIAL_NUMBER: CPID:8900 CPRV:30 CPFM:03 SCEP:05 BDID:04 ECID:000003293C113D76 IBFL:00
::
=======================================

Entering recovery mode, starting command prompt
] printenv
build-style = "RELEASE"
build-version = "iBoot-596.24"
config_board = "n82ap"
loadaddr = "0x9000000"
boot-command = "fsboot"
bootdelay = "0"
auto-boot = "true"
idle-off = "true"
boot-device = "nand0"
boot-partition = "0"
boot-path = "/System/Library/Caches/com.apple.kernelcaches/kernelcache.s5l8900x"
display-color-space = "RGB888"
display-timing = "optC"
framebuffer = "0xfd00000"
secure-boot = "0x1"

== Supported Raw Commands ==

Currently Supported by All Firmware: 
Reboot - Reboots Iphone

More IBoot Commands Information: 
http://code.google.com/p/chronicdev/wiki/iBootCommands

NOTE: 'bgcolor' appears to be no longer supported -- requires confirmation.

==Forks==
[http://github.com/iH8sn0w/irecovery iH8sn0w/irecovery]

[http://github.com/GreySyntax/irecovery GreySyntax/irecovery]

==Updates==
* A C++ port is also in the works dubbed iRecovery++ (by [[User:GreySyntax|GreySyntax]]) can be found at [http://github.com/NSPwn/iRecoveryplusplus GitHub/NSPwn/iRecoveryplusplus]
* [https://www.openjailbreak.org/projects/libirecovery-2-0/repository libiRecovery 2.0 in development by OpenJailBreak.org]
* A VB.NET GUI port for Windows has been made under the name [[GiRecovery|Zeratul]].

==Download==
*[https://github.com/Chronic-Dev/libirecovery Chronic-Dev - libiRecovery (Mac OS X | Linux | Windows)]
*[https://github.com/GreySyntax/iRecoveryplusplus GreySyntax - iRecovery++ (Mac OS X| Linux | Windows (Possibly))]

Note: Source only.

[[Category:Hacking Software]]