The iPhone Wiki - User contributions [en]

Jailbreak

2014-03-12T11:57:00Z

Flexpert: /* Apple TV 2G */ setting tethered Jailbreaks to partial, thus following the new style of the page; also redsn0w cannot be used to jailbreak 6.0/7.0.1

{{float toc|right}}
This is the process by which full execute and write access is obtained on all the partitions of the iPhone. It is done by patching [[/private/etc/fstab]] to mount the System partition as read-write. This is entirely different from an [[unlock]]. Jailbreaking is the first action that must be taken before things like unofficial [[activation]] (hacktivation), and unofficial unlocking can be applied.

The original jailbreak also included modifying the [[AFC]] service (used by [[iTunes]] to access the filesystem) to give full filesystem access from root. This was later updated to create a new service ([[AFC]]2) that allows access to the full filesystem.

Modern jailbreaks also include patching the kernel to get around code signing and other restrictions. See [[Kernel Patches]].

NOTE: The legality of jailbreaking your device varies with each country/region. [http://en.wikipedia.org/wiki/IOS_jailbreaking#Legal_status Wikipedia has a summary of legality for some countries.]

Version numbers are the first to jailbreak and last is the last supported version. Last will only be listed if a newer version is out that does not support the device and iOS.

==See Also==
* [[failbreak]]

== Exploits which were used in order to jailbreak 1.x ==
=== 1.0.2 ===
* [[Restore Mode]] ([[iBoot (Bootloader)|iBoot]] had a command named cp, which had access to the whole filesystem)
=== 1.1.1 ===
* [[Symlinks]] (an upgrade jailbreak)
* [[LibTiff|libtiff exploit]] (Adapted from the PSP scene, used by [[JailbreakMe]])
=== 1.1.2 ===
* [[Mknod]] (an upgrade jailbreak)
=== 1.1.3 / 1.1.4 / 1.1.5 ===
* [[Soft Upgrade]] (an upgrade jailbreak)
* [[Ramdisk Hack]]
* [[Dual Boot Exploit]] - Works up to [[iOS]] 2.0 beta 3
* [[diags]] - Works up to [[iOS]] 2.0 beta 5

== Exploits which are used in order to jailbreak 2.x ==
=== 2.0 / 2.0.1 / 2.0.2 / 2.1 ===
* [[Pwnage]] + [[Pwnage 2.0]]
=== 2.1.1 ===
* [[ARM7 Go]] ([[tethered jailbreak]])
=== 2.2 ===
* [[Pwnage]] + [[Pwnage 2.0]] ([[m68ap|iPhone]], [[n45ap|iPod touch]], and [[n82ap|iPhone 3G]])
=== 2.2.1 ===
* [[Pwnage]] + [[Pwnage 2.0]] ([[m68ap|iPhone]], [[n45ap|iPod touch]], and [[n82ap|iPhone 3G]])
* [[0x24000 Segment Overflow]] + [[ARM7 Go]] (from iOS 2.1.1) ([[n72ap|iPod touch 2G]])

== Exploits which are used in order to jailbreak 3.x ==
=== 3.0 / 3.0.1 ===
* [[Pwnage]] + [[Pwnage 2.0]] ([[m68ap|iPhone]], [[n45ap|iPod touch]], and [[n82ap|iPhone 3G]])
* [[ARM7 Go]] (from iOS 2.1.1) + [[0x24000 Segment Overflow]] ( [[n72ap|iPod touch 2G]])
* [[Pwnage]] + [[iBoot Environment Variable Overflow]] ([[m68ap|iPhone]], [[n45ap|iPod touch]], and [[n82ap|iPhone 3G]])
* [[0x24000 Segment Overflow]] + [[iBoot Environment Variable Overflow]] ([[n72ap|iPod touch 2G]] and [[n88ap|iPhone 3GS]])
=== 3.1 / 3.1.1 ===
* [[Pwnage]] + [[Pwnage 2.0]] (together for [[untethered jailbreak]] on [[m68ap|iPhone]], [[n45ap|iPod touch]], and [[n82ap|iPhone 3G]])
* [[usb_control_msg(0x21, 2) Exploit]] ([[tethered jailbreak]] on [[n72ap|iPod touch 2G]] [[Bootrom 240.5.1|new bootrom]], [[n88ap|iPhone 3GS]] [[Bootrom 359.3.2|new bootrom]], and [[n18ap|iPod touch 3G]])
* [[0x24000 Segment Overflow]] + [[usb_control_msg(0x21, 2) Exploit]] ([[n72ap|iPod touch 2G]] [[Bootrom 240.4|old bootrom]] and [[n88ap|iPhone 3GS]] [[Bootrom 359.3|old bootrom]])
=== 3.1.2 ===
* [[Pwnage]] + [[Pwnage 2.0]] (together for [[untethered jailbreak]] on [[m68ap|iPhone]], [[n45ap|iPod touch]], and [[n82ap|iPhone 3G]])
* [[usb_control_msg(0x21, 2) Exploit]] ([[tethered jailbreak]] on [[n72ap|iPod touch 2G]] [[Bootrom 240.5.1|new bootrom]], [[n88ap|iPhone 3GS]] [[Bootrom 359.3.2|new bootrom]], and [[n18ap|iPod touch 3G]])
* [[0x24000 Segment Overflow]] + [[usb_control_msg(0x21, 2) Exploit]] ([[n72ap|iPod touch 2G]] [[Bootrom 240.4|old bootrom]] and [[n88ap|iPhone 3GS]] [[Bootrom 359.3|old bootrom]])
* [[MobileBackup Copy Exploit]] + [[Incomplete Codesign Exploit]] + [[BPF_STX Kernel Write Exploit]] (all devices, used in [[Spirit]])
* [[Malformed CFF Vulnerability]] + [[Incomplete Codesign Exploit]] + [[IOSurface Kernel Exploit]] (all devices, used in [[Star]])
=== 3.1.3 ===
* [[Pwnage]] + [[Pwnage 2.0]] (together for [[untethered jailbreak]] on [[m68ap|iPhone]], [[n45ap|iPod touch]], and [[n82ap|iPhone 3G]])
* [[0x24000 Segment Overflow]] (for [[n72ap|iPod touch 2G]] and [[n88ap|iPhone 3GS]] devices with older bootroms)
** + [[Limera1n Exploit]] ([[n88ap|iPhone 3GS]] [[Bootrom 359.3|old bootrom]], used in [[sn0wbreeze]])
** + [[usb_control_msg(0xA1, 1) Exploit]] ([[n72ap|iPod touch 2G]] [[Bootrom 240.4|old bootrom]], used in [[sn0wbreeze]])
* [[usb_control_msg(0xA1, 1) Exploit]]+ [[Incomplete Codesign Exploit]] + [[BPF_STX Kernel Write Exploit]] ([[n72ap|iPod touch 2G]] [[Bootrom 240.5.1|new bootrom]], used in [[sn0wbreeze]])
* [[Limera1n Exploit]] + [[Incomplete Codesign Exploit]] + [[BPF_STX Kernel Write Exploit]] ([[N18ap|iPod touch 3G]] and [[n88ap|iPhone 3GS]] [[Bootrom 359.3.2|new bootrom]], used in [[sn0wbreeze]])
* [[MobileBackup Copy Exploit]] + [[Incomplete Codesign Exploit]] + [[BPF_STX Kernel Write Exploit]] (all devices, used in [[Spirit]])
* [[Malformed CFF Vulnerability]] + [[Incomplete Codesign Exploit]] + [[IOSurface Kernel Exploit]] (all devices, used in [[Star]])

=== 3.2 ===
* [[MobileBackup Copy Exploit]] + [[Incomplete Codesign Exploit]] + [[BPF_STX Kernel Write Exploit]] (all devices, used in [[Spirit]])
* [[Malformed CFF Vulnerability]] + [[Incomplete Codesign Exploit]] + [[IOSurface Kernel Exploit]] ([[k48ap|iPad]], used in [[Star]])
* [[Limera1n Exploit]] + [[Incomplete Codesign Exploit]] + [[BPF_STX Kernel Write Exploit]] ([[K48ap|iPad]] used in [[sn0wbreeze]] 2.9.x)
=== 3.2.1 ===
* [[Malformed CFF Vulnerability]] + [[Incomplete Codesign Exploit]] + [[IOSurface Kernel Exploit]] ([[k48ap|iPad]], used in [[Star]])
* [[Limera1n Exploit]] + [[Incomplete Codesign Exploit]] + [[IOSurface Kernel Exploit]] ([[k48ap|iPad]], used in [[sn0wbreeze]] 2.9.x)
=== 3.2.2 ===
* [[Limera1n Exploit]] + [[Packet Filter Kernel Exploit]] ([[k48ap|iPad]])

== Exploits which are used in order to jailbreak 4.x ==
=== 4.0 / 4.0.1 ===
* [[Pwnage]] + [[Pwnage 2.0]] ([[n82ap|iPhone 3G]])
* [[0x24000 Segment Overflow]] ([[n72ap|iPod touch 2G]] and [[n88ap|iPhone 3GS]] devices with older bootroms)
* [[Malformed CFF Vulnerability]] + [[Incomplete Codesign Exploit]] + [[IOSurface Kernel Exploit]] (all devices, used in [[Star]])
* [[Limera1n Exploit]] + [[Packet Filter Kernel Exploit]] ([[n88ap|iPhone 3GS]] New bootrom, [[N18ap|iPod touch 3G]], [[n90ap|iPhone 4 (iPhone3,1)]])

=== 4.0.2 ===
* [[Pwnage]] + [[Pwnage 2.0]] ([[n82ap|iPhone 3G]])
* [[ARM7 Go]] (from iOS 2.1.1) + [[0x24000 Segment Overflow]] ([[n72ap|iPod touch 2G]])
* [[0x24000 Segment Overflow]] ([[n88ap|iPhone 3GS]])
* [[limera1n]]'s bootrom exploit + [[Packet Filter Kernel Exploit]] ([[n88ap|iPhone 3GS]] [[Bootrom 359.3.2|new bootrom]], [[n18ap|iPod touch 3G]], [[n90ap|iPhone 4 (iPhone3,1)]], and [[n81ap|iPod touch 4G]])

=== 4.1 ===
* [[Pwnage]] + [[Pwnage 2.0]] (together to jailbreak the [[n82ap|iPhone 3G]])
* [[ARM7 Go]] (from iOS 2.1.1) + [[0x24000 Segment Overflow]] (together for [[untethered jailbreak]] on [[n72ap|iPod touch 2G]] [[Bootrom 240.4|old bootrom]])
* [[limera1n]]'s bootrom exploit + [[0x24000 Segment Overflow]] (together for [[untethered jailbreak]] on [[n88ap|iPhone 3GS]] [[Bootrom 359.3|old bootrom]])
* [[limera1n]]'s bootrom exploit + [[Packet Filter Kernel Exploit]] (together for [[untethered jailbreak]] on [[n88ap|iPhone 3GS]] [[Bootrom 359.3.2|new bootrom]], [[n18ap|iPod touch 3G]], [[n90ap|iPhone 4 (iPhone3,1)]], [[n81ap|iPod touch 4G]], and [[k66ap|Apple TV 2G]]))
* [[usb_control_msg(0xA1, 1) Exploit]] + [[Packet Filter Kernel Exploit]] (together for [[untethered jailbreak]] on [[n72ap|iPod touch 2G]])

=== 4.2.1 ===
* [[Pwnage]] + [[Pwnage 2.0]] (together to jailbreak the [[n82ap|iPhone 3G]])
* [[ARM7 Go]] (from iOS 2.1.1) + [[0x24000 Segment Overflow]] (together for [[untethered jailbreak]] on [[n72ap|iPod touch 2G]] [[Bootrom 240.4|old bootrom]])
* [[limera1n]]'s bootrom exploit + [[0x24000 Segment Overflow]] (together for [[untethered jailbreak]] on [[n88ap|iPhone 3GS]] [[Bootrom 359.3|old bootrom]])
* [[limera1n]]'s bootrom exploit + [[HFS Legacy Volume Name Stack Buffer Overflow]] (together for [[untethered jailbreak]] on [[n88ap|iPhone 3GS]] [[Bootrom 359.3.2|new bootrom]], [[n18ap|iPod touch 3G]], [[k48ap|iPad]], [[n90ap|iPhone 4 (iPhone3,1)]], [[n81ap|iPod touch 4G]], and [[k66ap|Apple TV 2G]])
* [[usb_control_msg(0xA1, 1) Exploit]] + [[HFS Legacy Volume Name Stack Buffer Overflow]] (together for [[untethered jailbreak]] on [[n72ap|iPod touch 2G]])

=== 4.2.6 / 4.2.7 / 4.2.8 ===
* [[limera1n]]'s bootrom exploit + [[HFS Legacy Volume Name Stack Buffer Overflow]] (together for [[untethered jailbreak]] on [[n92ap|iPhone 4 (iPhone3,3)]])
* [[T1 Font Integer Overflow]] (used for [[Saffron]])

=== 4.2.9 / 4.2.10 ===
* [[limera1n]]'s bootrom exploit (Tethered jailbreak on [[n92ap|iPhone 4 (iPhone3,3)]])

=== 4.3 ===
* [[limera1n]]'s bootrom exploit + [[0x24000 Segment Overflow]] (together for [[untethered jailbreak]] on [[n88ap|iPhone 3GS]] [[Bootrom 359.3|old bootrom]])
* [[limera1n]]'s bootrom exploit ([[tethered jailbreak]] on [[n88ap|iPhone 3GS]] [[Bootrom 359.3.2|new bootrom]], [[n18ap|iPod touch 3G]], [[k48ap|iPad]], [[n90ap|iPhone 4 (iPhone3,1)]], [[n81ap|iPod touch 4G]], and [[k66ap|Apple TV 2G]])
* [[T1 Font Integer Overflow]] (used for [[Saffron]])

=== 4.3.1 / 4.3.2 / 4.3.3 ===
* [[limera1n]]'s bootrom exploit + [[0x24000 Segment Overflow]] (together for [[untethered jailbreak]] on [[n88ap|iPhone 3GS]] [[Bootrom 359.3|old bootrom]])
* [[limera1n]]'s bootrom exploit + [[ndrv_setspec() Integer Overflow]] (together for [[untethered jailbreak]] on [[n88ap|iPhone 3GS]] [[Bootrom 359.3.2|new bootrom]], [[n18ap|iPod touch 3G]], [[k48ap|iPad]], [[n90ap|iPhone 4 (iPhone3,1)]], and [[n81ap|iPod touch 4G]])
* [[T1 Font Integer Overflow]] (used for [[Saffron]])

=== 4.3.4 / 4.3.5 ===
* [[limera1n]]'s bootrom exploit + [[0x24000 Segment Overflow]] (together for [[untethered jailbreak]] on [[n88ap|iPhone 3GS]] with [[Bootrom 359.3|old bootrom]])
* [[limera1n]]'s bootrom exploit (Tethered jailbreak) on [[n88ap|iPhone 3GS]] with [[Bootrom 359.3.2|new bootrom]], [[n18ap|iPod touch 3G]], [[k48ap|iPad]], [[n90ap|iPhone 4 (iPhone3,1)]], and [[n81ap|iPod touch 4G]])

== Exploits which are used in order to jailbreak 5.x ==
=== 5.0 ===
* [[limera1n]]'s bootrom exploit + [[0x24000 Segment Overflow]] (together for [[untethered jailbreak]] on [[n88ap|iPhone 3GS]] with [[Bootrom 359.3|old bootrom]])
* [[limera1n]]'s bootrom exploit (Tethered jailbreak) on [[n88ap|iPhone 3GS]] with [[Bootrom 359.3.2|new bootrom]], [[n18ap|iPod touch 3G]], [[k48ap|iPad]], [[iPhone 4]], and [[n81ap|iPod touch 4G]])
* [[Racoon String Format Overflow Exploit]] (used both for payload injection and untether)+[[HFS Heap Overflow]]- [[n94ap|iPhone 4S]] only

===5.0.1===
* [[limera1n]]'s bootrom exploit + [[0x24000 Segment Overflow]] (together for [[untethered jailbreak]] on [[n88ap|iPhone 3GS]] with [[Bootrom 359.3|old bootrom]])
* [[limera1n]]'s bootrom exploit + [[Racoon String Format Overflow Exploit]]+[[HFS Heap Overflow]] on [[n88ap|iPhone 3GS]] with [[Bootrom 359.3.2|new bootrom]], [[n18ap|iPod touch 3G]], [[k48ap|iPad]], [[iPhone 4]], and [[n81ap|iPod touch 4G]])
* [[Racoon String Format Overflow Exploit]] (used both for payload injection and untether)+[[HFS Heap Overflow]] - [[iPad 2]] and [[iPhone 4S]] with [[Absinthe]]

===5.1===
* [[limera1n]]'s bootrom exploit (Tethered jailbreak) on [[n88ap|iPhone 3GS]] with [[Bootrom 359.3.2|new bootrom]], [[n18ap|iPod touch 3G]], [[k48ap|iPad]], [[iPhone 4]], and [[n81ap|iPod touch 4G]])
* [[limera1n]]'s bootrom exploit + [[0x24000 Segment Overflow]] (together for [[untethered jailbreak]] on [[n88ap|iPhone 3GS]] with [[Bootrom 359.3|old bootrom]])

===5.1.1===
* [[limera1n Exploit]] + [[0x24000 Segment Overflow]] (together for [[untethered jailbreak]] on [[n88ap|iPhone 3GS]] with [[Bootrom 359.3|old bootrom]])
* [[limera1n Exploit]] + [[Rocky Racoon]] (together for [[untethered jailbreak]] on [[n88ap|iPhone 3GS]] with [[Bootrom 359.3.2|new bootrom]], [[iPhone 4]], [[n18ap|iPod touch 3G]], and [[n81ap|iPod touch 4G]])

== Exploits which are used in order to jailbreak 6.x ==
=== 6.0 / 6.0.1 / 6.0.2 / 6.1 / 6.1.1 / 6.1.2 ===
* [[limera1n]]'s bootrom exploit (Tethered jailbreak) on [[n88ap|iPhone 3GS]] with [[Bootrom 359.3.2|new bootrom]], [[iPhone 4]], and [[n81ap|iPod touch 4G]])
* [[limera1n]]'s bootrom exploit + [[0x24000 Segment Overflow]] (together for [[untethered jailbreak]] on [[n88ap|iPhone 3GS]] with [[Bootrom 359.3|old bootrom]])
* [[Symbolic Link Vulnerability]]
* [[Timezone Vulnerability]]
* [[Shebang Trick]]
* [[AMFID code signing evasion]]
* [[launchd.conf untether]]
* [[IOUSBDeviceFamily Vulnerability]]
* [[ARM Exception Vector Info Leak]]
* [[dynamic memmove() locating]]
* [[vm_map_copy_t corruption for arbitrary memory disclosure]]
* [[kernel memory write via ROP gadget]]

== Exploits which are used in order to jailbreak 7.0.x ==
=== 7.0 / 7.0.1 / 7.0.2 / 7.0.3 / 7.0.4 / 7.0.5 / 7.0.6 ===
* ?

== Jailbreak Tools ==
==== [[k66ap|Apple TV 2G]] ====
{| class="wikitable" style="font-size: smaller; text-align: center;"
|-
! rowspan="2" | [[Jailbreak]] Tool
! colspan="26" | Works with [[firmware]]...
|-
| [[Mojave 8M89 (AppleTV2,1)|4.0/4.1]]
| [[Jasper 8C150 (AppleTV2,1)|4.1/4.2]]
| [[Jasper 8C154 (AppleTV2,1)|4.1.1/4.2.1]]
| [[Durango 8F191m (AppleTV2,1)|4.2/4.3]]
| [[DurangoTide 8F202 (AppleTV2,1)|4.2.1/4.3]]
| [[DurangoTide 8F305 (AppleTV2,1)|4.2.2/4.3]]
| [[DurangoTideCuba 8F455 (AppleTV2,1)|4.3]]
| [[Telluride 9A334v (AppleTV2,1)|4.4/5.0]]
| [[Telluride 9A335a (AppleTV2,1)|4.4.1/5.0]]
| [[Telluride 9A336a (AppleTV2,1)|4.4.2/5.0]]
| [[Telluride 9A405l (AppleTV2,1)|4.4.3/5.0.1]]
| [[Telluride 9A406a (AppleTV2,1)|4.4.4/5.0.1]]
| [[Hoodoo 9B179b (AppleTV2,1)|5.0/5.1]]
| [[Hoodoo 9B206f (AppleTV2,1)|5.0.1/5.1.1]]
| [[HoodooTide 9B830 (AppleTV2,1)|5.0.2/5.1.1]]
| [[Sundance 10A406e (AppleTV2,1)|5.1/6.0]]
| [[SundanceTide 10A831 (AppleTV2,1)|5.1.1/6.0.1]]
| [[Brighton 10B144b (AppleTV2,1)|5.2/6.1]]
| [[BrightonMaps 10B329a (AppleTV2,1)|5.2.1/6.1.3]]
| [[BrightonTide 10B809 (AppleTV2,1)|5.3/6.1.4]]
| [[Innsbruck 11A470e (AppleTV2,1)|6.0/7.0.1]]
| [[Innsbruck 11A502 (AppleTV2,1)|6.0/7.0.2]]
| [[InnsbruckTaos 11B511d (AppleTV2,1)|6.0.1/7.0.3]]
| [[InnsbruckTaos 11B554a (AppleTV2,1)|6.0.2/7.0.4]]
| [[InnsbruckTaos 11B651 (AppleTV2,1)|6.0.2/7.0.6]]
| [[Sochi 11D169b (AppleTV2,1)|6.1/7.1]]
|-
| [[evasi0n]]
| colspan="15" {{no}}
| colspan="3" {{yes|1.0}}
| colspan="8" {{no}}
|-
| [[Greenpois0n (jailbreak)|greenpois0n]]
| {{partial|no package management GUI}}
| {{no}}
| {{yes|RC6-RC6.1}}
| colspan="25" {{no}}
|-
| [[limera1n]]
| {{partial|no package management GUI}}
| colspan="25" {{no}}
|-
| [[p0sixspwn]]
| colspan="18" {{no}}
| colspan="2" {{yes|1.0}}
| colspan="6" {{no}}
|-
| [[PwnageTool]]
| {{partial|no package management GUI}}
| {{partial|Restore from a custom firmware with unofficial bundle1}}
| {{yes|4.2}}
| {{no}}
| {{yes|4.3-4.3.3.1}}
| {{yes|4.3-4.3.3.12}}
| colspan="7" {{no}}
| {{partial|5.1.1 (no package management GUI)}}
| colspan="12" {{no}}
|-
| [[redsn0w]]
| colspan="4" {{no}}
| {{yes|0.9.6rc16}}
| colspan="10" {{no}}
| {{partial|0.9.15b11}}
| colspan="4" {{partial|0.9.15b33}}
| colspan="6" {{no}}
|-
| [[Seas0nPass]] (Mac)
| {{yes|??? -}}
| {{yes|??? -}}
| {{yes|0.6.7 -}}
| {{yes|0.7.2 -}}
| {{yes|0.7.3 -}}
| {{yes|0.7.6.??? -}}
| {{yes|0.7.8.??? -}}
| {{partial|0.7.9.???1 -}}
| {{partial|0.7.9.2101 -}}
| {{partial|0.7.9.2301 -}}
| {{yes|0.7.9.270 -}}
| {{yes|0.7.9.290 -}}
| {{partial|0.8.3.4701 -}}
| {{yes|0.8.4.518 -}}
| {{yes|0.8.6.565 -}}
| {{yes|0.8.? -}}
| {{yes|0.8.? -}}
| {{yes|0.8.9.655 -}}
| {{partial|0.9.?1 -}}
| {{yes|0.9.5 -}}
| colspan="7" {{no}}
|-
| [[Seas0nPass]] (Windows)
| {{yes|??? -}}
| {{yes|??? -}}
| {{yes|??? -}}
| {{yes|??? -}}
| {{yes|0.3.7.???? -}}
| {{yes|0.3.13.???? -}}
| {{yes|0.3.29.???? -}}
| colspan="2" {{partial|0.3.37.????1 -}}
| {{partial|0.3.42.33351 -}}
| {{yes|0.3.44.???? -}}
| {{yes|0.3.45.4035 -}}
| {{partial|0.8.3.55921}}
| {{yes|0.8.4.6306 -}}
| {{yes|0.8.6.7558 -}}
| {{yes|0.8.? -}}
| {{yes|0.8.? -}}
| {{yes|0.8.9.11241 -}}
| {{partial|0.9.?1 -}}
| {{yes|0.9.5 -}}
| colspan="7" {{no}}
|-
| [[sn0wbreeze]]
| {{partial|no package management GUI}}
| colspan="3" {{no}}
| {{yes|2.5-2.7.1}}
| colspan="10" {{no}}
| colspan="3" {{yes|2.9.8}}
| colspan="8" {{no}}
|-
| [[unthredera1n]]
| {{partial|no package management GUI}}
| colspan="14" {{yes}}
| colspan="11" {{no}}
|}
1 [[Tethered jailbreak]]. 
2 User needs to manually add [[PwnageTool]] firmware bundle into application. 
3 Point at 6.0 IPSW. Also [[Tethered jailbreak]].

==== [[j33ap|Apple TV 3G (AppleTV3,1)]] ====
{| class="wikitable" style="font-size: smaller; text-align: center;"
|-
! rowspan="2" | [[Jailbreak]] Tool
! colspan="14" | Works with [[firmware]]...
|-
| 5.0/5.1
| 5.0.1/5.1
| 5.0.2/5.1.1
| 5.1/6.0
| 5.1.1/6.0.1
| 5.2/6.1
| 5.2.1/6.1.3
| 5.3/6.1.4
| 6.0/7.0.1
| 6.0/7.0.2
| 6.0.1/7.0.3
| 6.0.2/7.0.4
| 6.0.2/7.0.6
| 6.1/7.1
|-
| [[Absinthe]]
| colspan="14" {{no}}
|-
| [[evasi0n]]
| colspan="14" {{no}}
|-
| [[redsn0w]]
| colspan="14" {{no}}
|-
| [[Seas0npass]]
| colspan="14" {{no}}
|-
| [[Sn0wbreeze]]
| colspan="14" {{no}}
|}

==== [[j33iap|Apple TV 3G (AppleTV3,2)]] ====
{| class="wikitable" style="font-size: smaller; text-align: center;"
|-
! rowspan="2" | [[Jailbreak]] Tool
! colspan="9" | Works with [[firmware]]...
|-
| 5.2/6.1
| 5.2.1/6.1.3
| 5.3/6.1.4
| 6.0/7.0.1
| 6.0/7.0.2
| 6.0.1/7.0.3
| 6.0.2/7.0.4
| 6.0.2/7.0.6
| 6.1/7.1
|-
| [[Absinthe]]
| colspan="9" {{no}}
|-
| [[evasi0n]]
| colspan="9" {{no}}
|-
| [[redsn0w]]
| colspan="9" {{no}}
|-
| [[Seas0npass]]
| colspan="9" {{no}}
|-
| [[Sn0wbreeze]]
| colspan="9" {{no}}
|}

{{:Jailbreak/Deprecated iPads}}

=== [[iPad 2]] ===
{| class="wikitable" style="font-size: smaller; text-align: center;"
|-
! rowspan="2" | [[Jailbreak]] Tool
! colspan="21" | Works with [[firmware]]...
|-
| 4.3
| 4.3.1
| 4.3.2
| 4.3.3
| 4.3.4
| 4.3.5
| 5.0
| 5.0.1
| 5.1
| 5.1.1
| 6.0
| 6.0.1
| 6.1
| 6.1.2
| 6.1.3
| 7.0
| 7.0.2
| 7.0.3
| 7.0.4
| 7.0.6
| 7.1
|-
| [[Absinthe]]
| colspan="7" {{no}}
| {{yes|0.2-0.4}}
| {{no}}
| {{yes|2.01-2.0.4}}
| colspan="11" {{no}}
|-
| [[evasi0n]]
| colspan="10" {{no}}
| colspan="3" {{yes|1.0}}
| {{yes|1.4}}
| colspan="7" {{no}}
|-
| [[evasi0n7]]
| colspan="15" {{no}}
| colspan="4" {{yes|1.0.0}}
| {{yes|1.0.6}}
| {{no}}
|-
| [[p0sixspwn]]
| colspan="14" {{no}}
| {{yes|1.0}}
| colspan="6" {{no}}
|-
| [[redsn0w]]
| colspan="7" {{no}}
| {{yes|0.9.10b7-0.9.11b4}}
| {{no}}
| {{yes|0.9.12b1}}
| colspan="11" {{no}}
|-
| [[Saffron]]
| colspan="3" {{no}}
| {{yes}}
| colspan="17" {{no}}
|}
1 Not compatible with [[k93aap|iPad2,4]]

=== [[iPad 3]] ===
{| class="wikitable" style="font-size: smaller; text-align: center;"
|-
! rowspan="2" | [[Jailbreak]] Tool
! colspan="13" | Works with [[firmware]]...
|-
| 5.1
| 5.1.1
| 6.0
| 6.0.1
| 6.1
| 6.1.2
| 6.1.3
| 7.0
| 7.0.2
| 7.0.3
| 7.0.4
| 7.0.6
| 7.1
|-
| [[Absinthe]]
| {{no}}
| {{yes|2.0-2.0.4}}
| colspan="11" {{no}}
|-
| [[evasi0n]]
| colspan="2" {{no}}
| colspan="3" {{yes|1.0}}
| {{yes|1.4}}
| colspan="7" {{no}}
|-
| [[evasi0n7]]
| colspan="7" {{no}}
| colspan="4" {{yes|1.0.0}}
| {{yes|1.0.6}}
| {{no}}
|-
| [[p0sixspwn]]
| colspan="6" {{no}}
| {{yes|1.0}}
| colspan="6" {{no}}
|-
| [[redsn0w]]
| {{no}}
| {{yes|0.9.12b1}}
| colspan="11" {{no}}
|}

=== [[iPad 4]] ===
{| class="wikitable" style="font-size: smaller; text-align: center;"
|-
! rowspan="2" | [[Jailbreak]] Tool
! colspan="11" | Works with [[firmware]]...
|-
| 6.0
| 6.0.1
| 6.1
| 6.1.2
| 6.1.3
| 7.0
| 7.0.2
| 7.0.3
| 7.0.4
| 7.0.6
| 7.1
|-
| [[evasi0n]]
| colspan="3" {{yes|1.0}}
| {{yes|1.4}}
| colspan="7" {{no}}
|-
| [[evasi0n7]]
| colspan="5" {{no}}
| colspan="4" {{yes|1.0.0}}
| {{yes|1.0.6}}
| {{no}}
|-
| [[p0sixspwn]]
| colspan="4" {{no}}
| {{yes|1.0}}
| colspan="6" {{no}}
|}

=== [[iPad Air]] ===
{| class="wikitable" style="font-size: smaller; text-align: center;"
|-
! rowspan="2" | [[Jailbreak]] Tool
! colspan="4" | Works with [[firmware]]...
|-
| 7.0.3
| 7.0.4
| 7.0.6
| 7.1
|-
| [[evasi0n7]]
| colspan="2" {{yes|1.0.0}}
| {{yes|1.0.6}}
| {{no}}
|}

=== [[iPad mini 1G]] ===
{| class="wikitable" style="font-size: smaller; text-align: center;"
|-
! rowspan="2" | [[Jailbreak]] Tool
! colspan="12" | Works with [[firmware]]...
|-
| 6.0
| 6.0.1
| 6.0.2
| 6.1
| 6.1.2
| 6.1.3
| 7.0
| 7.0.2
| 7.0.3
| 7.0.4
| 7.0.6
| 7.1
|-
| [[evasi0n]]
| colspan="4" {{yes|1.0}}
| {{yes|1.4}}
| colspan="7" {{no}}
|-
| [[evasi0n7]]
| colspan="6" {{no}}
| colspan="4" {{yes|1.0.0}}
| {{yes|1.0.6}}
| {{no}}
|-
| [[p0sixspwn]]
| colspan="5" {{no}}
| {{yes|1.0}}
| colspan="6" {{no}}
|}

=== [[iPad mini 2G]] ===
{| class="wikitable" style="font-size: smaller; text-align: center;"
|-
! rowspan="2" | [[Jailbreak]] Tool
! colspan="4" | Works with [[firmware]]...
|-
| 7.0.3
| 7.0.4
| 7.0.6
| 7.1
|-
| [[evasi0n7]]
| colspan="2" {{yes|1.0.0}}
| {{yes|1.0.6}}
| {{no}}
|}

{{:Jailbreak/Deprecated iPhones}}

=== [[N90ap|iPhone 4 (iPhone3,1)]] ===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
! rowspan="2" | [[Jailbreak]] Tool
! colspan="27" | Works with [[firmware]]...
|-
| [[Apex 8A293 (iPhone3,1)|4.0]]
| [[Apex 8A306 (iPhone3,1)|4.0.1]]
| [[Apex 8A400 (iPhone3,1)|4.0.2]]
| [[Baker 8B117 (iPhone3,1)|4.1]]
| [[Jasper 8C148 (iPhone3,1)|4.2.1]]
| [[Durango 8F190 (iPhone3,1)|4.3]]
| [[Durango 8G4 (iPhone3,1)|4.3.1]]
| [[Durango 8H7 (iPhone3,1)|4.3.2]]
| [[Durango 8J2 (iPhone3,1)|4.3.3]]
| [[Durango 8K2 (iPhone3,1)|4.3.4]]
| [[Durango 8L1 (iPhone3,1)|4.3.5]]
| [[Telluride 9A334 (iPhone3,1)|5.0]]
| [[Telluride 9A405 (iPhone3,1)|5.0.1]]
| [[Hoodoo 9B176 (iPhone3,1)|5.1]]
| [[Hoodoo 9B206 (iPhone3,1)|5.1.1 (9B206)]]
| [[Hoodoo 9B208 (iPhone3,1)|5.1.1 (9B208)]]
| [[Sundance 10A403 (iPhone3,1)|6.0]]
| [[Sundance 10A523 (iPhone3,1)|6.0.1]]
| [[Brighton 10B144 (iPhone3,1)|6.1]]
| [[Brighton 10B146 (iPhone3,1)|6.1.2]]
| [[BrightonMaps 10B329 (iPhone3,1)|6.1.3]]
| [[Innsbruck 11A465 (iPhone3,1)|7.0]]
| [[Innsbruck 11A501 (iPhone3,1)|7.0.2]]
| [[InnsbruckTaos 11B511 (iPhone3,1)|7.0.3]]
| [[InnsbruckTaos 11B554a (iPhone3,1)|7.0.4]]
| [[InnsbruckTaos 11B651 (iPhone3,1)|7.0.6]]
| [[Sochi 11D169 (iPhone3,1)|7.1]]
|-
| [[Absinthe]]
| colspan="14" {{no}}
| {{yes|2.0}}
| {{yes|2.0.2}}
| colspan="11" {{no}}
|-
| [[evasi0n]]
| colspan="16" {{no}}
| colspan="3" {{yes|1.0}}
| {{yes|1.4}}
| colspan="7" {{no}}
|-
| [[evasi0n7]]
| colspan="21" {{no}}
| colspan="4" {{yes|1.0.0}}
| {{yes|1.0.6}}
| {{no}}
|-
| [[Greenpois0n (jailbreak)|greenpois0n]]
| colspan="3" {{no}}
| {{yes|RC4}}
| {{yes|RC5-RC6.1}}
| colspan="22" {{no}}
|-
| [[limera1n]]
| colspan="4" {{yes}}
| colspan="23" {{no}}
|-
| [[p0sixspwn]]
| colspan="20" {{no}}
| {{yes|1.0}}
| colspan="6" {{no}}
|-
| [[PwnageTool]]
| colspan="3" {{no}}
| {{yes|4.1-4.1.3}}
| {{yes|4.2}}
| {{partial|4.21 3}}
| {{yes|4.3}}
| {{yes|4.3.2}}
| {{yes|4.3.3-4.3.3.1}}
| colspan="3" {{partial|4.3.31 3}}
| {{yes|5.0.1}}
| {{no}}
| colspan="2" {{yes|5.1.1}}
| colspan="11" {{no}}
|-
| [[redsn0w]]
| colspan="3" {{no}}
| {{yes|0.9.6b2-0.9.6rc16}}
| {{partial|0.9.6b41-0.9.6rc16 or 0.9.7b61 2}}
| {{partial|0.9.6rc91-0.9.6rc161}}
| {{partial|0.9.6rc91-0.9.6rc16}}
| {{partial|0.9.6rc131-0.9.6rc16}}
| {{yes|0.9.6rc16}}
| {{partial|0.9.8b31}}
| {{partial|0.9.8b71}}
| {{partial|0.9.9b31}}
| {{yes|0.9.10b6}}
| {{partial|0.9.10b61}}
| colspan="2" {{yes|0.9.12b1-0.9.14b2}}
| {{partial|0.9.15b11}}
| colspan="4" {{partial|0.9.15b14}}
| colspan="6" {{no}}
|-
| [[Saffron]]
| colspan="5" {{no}}
| colspan="4" {{yes}}
| colspan="18" {{no}}
|-
| [[sn0wbreeze]]
| colspan="3" {{no}}
| {{yes|2.1}}
| {{yes|2.2}}
| {{partial|2.3b41}}
| {{yes|2.5}}
| {{yes|2.6-2.6.1}}
| {{yes|2.7-2.7.1}}
| colspan="2" {{no}}
| {{partial|2.8b81}}
| {{yes|2.9.1}}
| {{no}}
| colspan="2" {{yes|2.9.6}}
| colspan="3" {{yes|2.9.8}}
| {{yes|2.9.10}}
| {{partial|2.9.141}}
| colspan="6" {{no}}
|-
| [[Star]]
| colspan="2" {{yes}}
| colspan="25" {{no}}
|-
| [[unthredera1n]]
| colspan="5" {{no}}
| colspan="11" {{yes}}
| colspan="11" {{no}}
|}
1 [[Tethered jailbreak]]. 
2 If [[SHSH]]s were saved for iOS 4.2b3 and if you have a developer access to its IPSW, [[Jailbreak Monte]] can be used. 
3 Requires an unofficial firmware bundle. 
4 Requires pointing [[redsn0w]] at 6.0 [[IPSW File Format|IPSW]]. Also [[Tethered jailbreak]].

=== [[N90bap|iPhone 4 (iPhone3,2)]] ===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
! rowspan="2" | [[Jailbreak]] Tool
! colspan="11" | Works with [[firmware]]...
|-
| [[Sundance 10A403 (iPhone3,2)|6.0]]
| [[Sundance 10A523 (iPhone3,2)|6.0.1]]
| [[Brighton 10B144 (iPhone3,2)|6.1]]
| [[Brighton 10B146 (iPhone3,2)|6.1.2]]
| [[BrightonMaps 10B329 (iPhone3,2)|6.1.3]]
| [[Innsbruck 11A465 (iPhone3,2)|7.0]]
| [[Innsbruck 11A501 (iPhone3,2)|7.0.2]]
| [[InnsbruckTaos 11B511 (iPhone3,2)|7.0.3]]
| [[InnsbruckTaos 11B554a (iPhone3,2)|7.0.4]]
| [[InnsbruckTaos 11B651 (iPhone3,2)|7.0.6]]
| [[Sochi 11D169 (iPhone3,2)|7.1]]
|-
| [[evasi0n]]
| colspan="3" {{yes|1.0}}
| {{yes|1.4}}
| colspan="7" {{no}}
|-
| [[evasi0n7]]
| colspan="5" {{no}}
| colspan="4" {{yes|1.0.0}}
| {{yes|1.0.6}}
| {{no}}
|-
| [[p0sixspwn]]
| colspan="4" {{no}}
| {{yes|1.0}}
| colspan="6" {{no}}
|-
| [[redsn0w]]
| colspan="5" {{partial|0.9.15b32}}
| colspan="6" {{no}}
|-
| [[sn0wbreeze]]
| colspan="3" {{yes|2.9.8}}
| {{yes|2.9.10}}
| {{partial|2.9.141}}
| colspan="6" {{no}}
|}

1 [[Tethered jailbreak]]. 
2 Requires pointing [[redsn0w]] at 6.0 [[IPSW File Format|IPSW]]. Also [[Tethered jailbreak]].

=== [[N92ap|iPhone 4 (iPhone3,3)]] ===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
! rowspan="2" | [[Jailbreak]] Tool
! colspan="21" | Works with [[firmware]]...
|-
| [[Phoenix 8E128 (iPhone3,3)|4.2.5]]
| [[Phoenix 8E200 (iPhone3,3)|4.2.6]]
| [[Phoenix 8E303 (iPhone3,3)|4.2.7]]
| [[Phoenix 8E401 (iPhone3,3)|4.2.8]]
| [[Phoenix 8E501 (iPhone3,3)|4.2.9]]
| [[Phoenix 8E600 (iPhone3,3)|4.2.10]]
| [[Telluride 9A334 (iPhone3,3)|5.0]]
| [[Telluride 9A405 (iPhone3,3)|5.0.1]]
| [[Hoodoo 9B176 (iPhone3,3)|5.1]]
| [[Hoodoo 9B206 (iPhone3,3)|5.1.1]]
| [[Sundance 10A403 (iPhone3,3)|6.0]]
| [[Sundance 10A523 (iPhone3,3)|6.0.1]]
| [[Brighton 10B141 (iPhone3,3)|6.1]]
| [[Brighton 10B146 (iPhone3,3)|6.1.2]]
| [[BrightonMaps 10B329 (iPhone3,3)|6.1.3]]
| [[Innsbruck 11A465 (iPhone3,3)|7.0]]
| [[Innsbruck 11A501 (iPhone3,3)|7.0.2]]
| [[InnsbruckTaos 11B511 (iPhone3,3)|7.0.3]]
| [[InnsbruckTaos 11B554a (iPhone3,3)|7.0.4]]
| [[InnsbruckTaos 11B651 (iPhone3,3)|7.0.6]]
| [[Sochi 11D167 (iPhone3,3)|7.1]]
|-
| [[Absinthe]]
| colspan="7" {{no}}
| {{yes|2.0}}
| {{no}}
| {{yes|2.0}}
| colspan="11" {{no}}
|-
| [[evasi0n]]
| colspan="10" {{no}}
| colspan="3" {{yes|1.0}}
| {{yes|1.4}}
| colspan="7" {{no}}
|-
| [[evasi0n7]]
| colspan="15" {{no}}
| colspan="4" {{yes|1.0.0}}
| {{yes|1.0.6}}
| {{no}}
|-
| [[Greenpois0n (jailbreak)|greenpois0n]]
| {{no}}
| {{yes|RC5 b4-RC6.1}}
| colspan="19" {{no}}
|-
| [[p0sixspwn]]
| colspan="14" {{no}}
| {{yes|1.0}}
| colspan="6" {{no}}
|-
| [[PwnageTool]]
| {{no}}
| {{yes|4.2}}
| {{no}}
| {{yes|4.22}}
| colspan="3" {{no}}
| {{yes|5.0.1}}
| colspan="13" {{no}}
|-
| [[redsn0w]]
| {{no}}
| {{yes|0.9.6rc9-0.9.10b8b}}
| {{yes|0.9.8b2-0.9.10b8b}}
| {{yes|0.9.6rc18-0.9.10b8b}}
| {{partial|0.9.8b31-0.9.10b8b1}}
| {{partial|0.9.8b71-0.9.10b8b1}}
| {{partial|0.9.9b31-0.9.10b8b1}}
| {{partial|0.9.9b91-0.9.10b8b}}
| {{partial|0.9.10b61-0.9.10b8b1}}
| {{yes|0.9.12b1}}
| {{partial|0.9.14b11}}
| colspan="4" {{partial|0.9.15b33}}
| colspan="6" {{no}}
|-
| [[Saffron]]
| {{no}}
| colspan="3" {{yes}}
| colspan="17" {{no}}
|-
| [[sn0wbreeze]]
| {{no}}
| {{yes|2.2-2.9.3}}
| {{yes|2.6-2.9.3}}
| {{yes|2.7-2.9.3}}
| colspan="2" {{no}}
| {{partial|2.8b91-2.9.31}}
| {{partial|2.8b111-2.9.3}}
| {{partial|2.9.21-2.9.31}}
| {{yes|2.9.7}}
| colspan="3" {{yes|2.9.8}}
| {{yes|2.9.10}}
| {{partial|2.9.141}}
| colspan="6" {{no}}
|-
| [[unthredera1n]]
| {{no}}
| colspan="9" {{yes}}
| colspan="11" {{no}}
|}
1 [[Tethered jailbreak]]. 
2 Requires unofficial bundle. 
3 Requires pointing [[redsn0w]] at 6.0 [[IPSW File Format|IPSW]]. Also [[Tethered jailbreak]].

=== [[N94ap|iPhone 4S]] ===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
! rowspan="2" | [[Jailbreak]] Tool
! colspan="17" | Works with [[firmware]]...
|-
| [[Telluride 9A334 (iPhone4,1)|5.0]]
| [[Telluride 9A405 (iPhone4,1)|5.0.1]]
| [[Telluride 9A406 (iPhone4,1)|5.0.1 (9A406)]]
| [[Hoodoo 9B179 (iPhone4,1)|5.1]]
| [[Hoodoo 9B206 (iPhone4,1)|5.1.1]]
| [[Sundance 10A403 (iPhone4,1)|6.0]]
| [[Sundance 10A523 (iPhone4,1)|6.0.1]]
| [[Brighton 10B142 (iPhone4,1)|6.1]]
| [[Brighton 10B145 (iPhone4,1)|6.1.1]]
| [[Brighton 10B146 (iPhone4,1)|6.1.2]]
| [[BrightonMaps 10B329 (iPhone4,1)|6.1.3]]
| [[Innsbruck 11A465 (iPhone4,1)|7.0]]
| [[Innsbruck 11A501 (iPhone4,1)|7.0.2]]
| [[InnsbruckTaos 11B511 (iPhone4,1)|7.0.3]]
| [[InnsbruckTaos 11B554a (iPhone4,1)|7.0.4]]
| [[InnsbruckTaos 11B651 (iPhone4,1)|7.0.6]]
| [[Sochi 11D167 (iPhone4,1)|7.1]]
|-
| [[Absinthe]]
| colspan="3" {{yes|0.1.2-1}}
| {{no}}
| {{yes|2.0}}
| colspan="12" {{no}}
|-
| [[evasi0n]]
| colspan="5" {{no}}
| colspan="3" {{yes|1.0}}
| {{yes|1.3}}
| {{yes|1.4}}
| colspan="8" {{no}}
|-
| [[evasi0n7]]
| colspan="11" {{no}}
| colspan="4" {{yes|1.0.0}}
| {{yes|1.0.6}}
| {{no}}
|-
| [[p0sixspwn]]
| colspan="10" {{no}}
| {{yes|1.0}}
| colspan="6" {{no}}
|-
| [[redsn0w]]
| {{no}}
| {{yes|0.9.10b7}}
| {{yes|0.9.11b2}}
| {{no}}
| {{yes|0.9.12b1}}
| colspan="12" {{no}}
|}

=== [[iPhone 5]] ===
{| class="wikitable" style="font-size: smaller; text-align: center;"
|-
! rowspan="2" | [[Jailbreak]] Tool
! colspan="14" | Works with [[firmware]]...
|-
| 6.0
| 6.0.1
| 6.0.2
| 6.1
| 6.1.2
| 6.1.3
| 6.1.4
| 7.0
| 7.0.2
| 7.0.3
| 7.0.4
| 7.0.6
| 7.1
|-
| [[evasi0n]]
| colspan="5" {{yes|1.0}}
| {{yes|1.4}}
| colspan="8" {{no}}
|-
| [[evasi0n7]]
| colspan="7" {{no}}
| colspan="4" {{yes|1.0.0}}
| {{yes|1.0.6}}
| {{no}}
|-
| [[p0sixspwn]]
| colspan="5" {{no}}
| colspan="2" {{yes|1.0}}
| colspan="7" {{no}}
|}

=== [[n48ap|iPhone 5c (iPhone5,3)]] ===
{| class="wikitable" style="font-size: smaller; text-align: center;"
|-
! rowspan="2" | [[Jailbreak]] Tool
! colspan="7" | Works with [[firmware]]...
|-
| 7.0
| 7.0.1
| 7.0.2
| 7.0.3
| 7.0.4
| 7.0.6
| 7.1
|-
| [[evasi0n7]]
| colspan="5" {{yes|1.0.0}}
| {{yes|1.0.6}}
| {{no}}
|}

=== [[n49ap|iPhone 5c (iPhone5,4)]] ===
{| class="wikitable" style="font-size: smaller; text-align: center;"
|-
! rowspan="2" | [[Jailbreak]] Tool
! colspan="8" | Works with [[firmware]]...
|-
| 7.0
| 7.0.1
| 7.0.2
| 7.0.3
| 7.0.4
| 7.0.5
| 7.0.6
| 7.1
|-
| [[evasi0n7]]
| colspan="5" {{yes|1.0.0}}
| {{yes|1.0.5}}
| {{yes|1.0.6}}
| {{no}}
|}

=== [[n51ap|iPhone 5s (iPhone6,1)]] ===
{| class="wikitable" style="font-size: smaller; text-align: center;"
|-
! rowspan="2" | [[Jailbreak]] Tool
! colspan="7" | Works with [[firmware]]...
|-
| 7.0
| 7.0.1
| 7.0.2
| 7.0.3
| 7.0.4
| 7.0.6
| 7.1
|-
| [[evasi0n7]]
| colspan="5" {{yes|1.0.0}}
| {{yes|1.0.6}}
| {{no}}
|}

=== [[n53ap|iPhone 5s (iPhone6,2)]] ===
{| class="wikitable" style="font-size: smaller; text-align: center;"
|-
! rowspan="2" | [[Jailbreak]] Tool
! colspan="8" | Works with [[firmware]]...
|-
| 7.0
| 7.0.1
| 7.0.2
| 7.0.3
| 7.0.4
| 7.0.5
| 7.0.6
| 7.1
|-
| [[evasi0n7]]
| colspan="5" {{yes|1.0.0}}
| {{yes|1.0.5}}
| {{yes|1.0.6}}
| {{no}}
|}

{{:Jailbreak/Deprecated iPod touches}}

=== [[iPod touch 5G]] ===
{| class="wikitable" style="font-size: smaller; text-align: center;"
|-
! rowspan="2" | [[Jailbreak]] Tool
! colspan="11" | Works with [[firmware]]...
|-
| 6.0
| 6.0.1
| 6.1
| 6.1.2
| 6.1.3
| 7.0
| 7.0.2
| 7.0.3
| 7.0.4
| 7.0.6
| 7.1
|-
| [[evasi0n]]
| colspan="3" {{yes|1.0}}
| {{yes|1.4}}
| colspan="7" {{no}}
|-
| [[evasi0n7]]
| colspan="5" {{no}}
| colspan="4" {{yes|1.0.0}}
| {{yes|1.0.6}}
| {{no}}
|-
| [[p0sixspwn]]
| colspan="4" {{no}}
| {{yes|1.0}}
| colspan="6" {{no}}
|}

Jailbreak

2014-03-12T11:35:59Z

Flexpert: /* iPhone 4 (iPhone3,2) */ corrected footnotes

{{float toc|right}}
This is the process by which full execute and write access is obtained on all the partitions of the iPhone. It is done by patching [[/private/etc/fstab]] to mount the System partition as read-write. This is entirely different from an [[unlock]]. Jailbreaking is the first action that must be taken before things like unofficial [[activation]] (hacktivation), and unofficial unlocking can be applied.

The original jailbreak also included modifying the [[AFC]] service (used by [[iTunes]] to access the filesystem) to give full filesystem access from root. This was later updated to create a new service ([[AFC]]2) that allows access to the full filesystem.

Modern jailbreaks also include patching the kernel to get around code signing and other restrictions. See [[Kernel Patches]].

NOTE: The legality of jailbreaking your device varies with each country/region. [http://en.wikipedia.org/wiki/IOS_jailbreaking#Legal_status Wikipedia has a summary of legality for some countries.]

Version numbers are the first to jailbreak and last is the last supported version. Last will only be listed if a newer version is out that does not support the device and iOS.

==See Also==
* [[failbreak]]

== Exploits which were used in order to jailbreak 1.x ==
=== 1.0.2 ===
* [[Restore Mode]] ([[iBoot (Bootloader)|iBoot]] had a command named cp, which had access to the whole filesystem)
=== 1.1.1 ===
* [[Symlinks]] (an upgrade jailbreak)
* [[LibTiff|libtiff exploit]] (Adapted from the PSP scene, used by [[JailbreakMe]])
=== 1.1.2 ===
* [[Mknod]] (an upgrade jailbreak)
=== 1.1.3 / 1.1.4 / 1.1.5 ===
* [[Soft Upgrade]] (an upgrade jailbreak)
* [[Ramdisk Hack]]
* [[Dual Boot Exploit]] - Works up to [[iOS]] 2.0 beta 3
* [[diags]] - Works up to [[iOS]] 2.0 beta 5

== Exploits which are used in order to jailbreak 2.x ==
=== 2.0 / 2.0.1 / 2.0.2 / 2.1 ===
* [[Pwnage]] + [[Pwnage 2.0]]
=== 2.1.1 ===
* [[ARM7 Go]] ([[tethered jailbreak]])
=== 2.2 ===
* [[Pwnage]] + [[Pwnage 2.0]] ([[m68ap|iPhone]], [[n45ap|iPod touch]], and [[n82ap|iPhone 3G]])
=== 2.2.1 ===
* [[Pwnage]] + [[Pwnage 2.0]] ([[m68ap|iPhone]], [[n45ap|iPod touch]], and [[n82ap|iPhone 3G]])
* [[0x24000 Segment Overflow]] + [[ARM7 Go]] (from iOS 2.1.1) ([[n72ap|iPod touch 2G]])

== Exploits which are used in order to jailbreak 3.x ==
=== 3.0 / 3.0.1 ===
* [[Pwnage]] + [[Pwnage 2.0]] ([[m68ap|iPhone]], [[n45ap|iPod touch]], and [[n82ap|iPhone 3G]])
* [[ARM7 Go]] (from iOS 2.1.1) + [[0x24000 Segment Overflow]] ( [[n72ap|iPod touch 2G]])
* [[Pwnage]] + [[iBoot Environment Variable Overflow]] ([[m68ap|iPhone]], [[n45ap|iPod touch]], and [[n82ap|iPhone 3G]])
* [[0x24000 Segment Overflow]] + [[iBoot Environment Variable Overflow]] ([[n72ap|iPod touch 2G]] and [[n88ap|iPhone 3GS]])
=== 3.1 / 3.1.1 ===
* [[Pwnage]] + [[Pwnage 2.0]] (together for [[untethered jailbreak]] on [[m68ap|iPhone]], [[n45ap|iPod touch]], and [[n82ap|iPhone 3G]])
* [[usb_control_msg(0x21, 2) Exploit]] ([[tethered jailbreak]] on [[n72ap|iPod touch 2G]] [[Bootrom 240.5.1|new bootrom]], [[n88ap|iPhone 3GS]] [[Bootrom 359.3.2|new bootrom]], and [[n18ap|iPod touch 3G]])
* [[0x24000 Segment Overflow]] + [[usb_control_msg(0x21, 2) Exploit]] ([[n72ap|iPod touch 2G]] [[Bootrom 240.4|old bootrom]] and [[n88ap|iPhone 3GS]] [[Bootrom 359.3|old bootrom]])
=== 3.1.2 ===
* [[Pwnage]] + [[Pwnage 2.0]] (together for [[untethered jailbreak]] on [[m68ap|iPhone]], [[n45ap|iPod touch]], and [[n82ap|iPhone 3G]])
* [[usb_control_msg(0x21, 2) Exploit]] ([[tethered jailbreak]] on [[n72ap|iPod touch 2G]] [[Bootrom 240.5.1|new bootrom]], [[n88ap|iPhone 3GS]] [[Bootrom 359.3.2|new bootrom]], and [[n18ap|iPod touch 3G]])
* [[0x24000 Segment Overflow]] + [[usb_control_msg(0x21, 2) Exploit]] ([[n72ap|iPod touch 2G]] [[Bootrom 240.4|old bootrom]] and [[n88ap|iPhone 3GS]] [[Bootrom 359.3|old bootrom]])
* [[MobileBackup Copy Exploit]] + [[Incomplete Codesign Exploit]] + [[BPF_STX Kernel Write Exploit]] (all devices, used in [[Spirit]])
* [[Malformed CFF Vulnerability]] + [[Incomplete Codesign Exploit]] + [[IOSurface Kernel Exploit]] (all devices, used in [[Star]])
=== 3.1.3 ===
* [[Pwnage]] + [[Pwnage 2.0]] (together for [[untethered jailbreak]] on [[m68ap|iPhone]], [[n45ap|iPod touch]], and [[n82ap|iPhone 3G]])
* [[0x24000 Segment Overflow]] (for [[n72ap|iPod touch 2G]] and [[n88ap|iPhone 3GS]] devices with older bootroms)
** + [[Limera1n Exploit]] ([[n88ap|iPhone 3GS]] [[Bootrom 359.3|old bootrom]], used in [[sn0wbreeze]])
** + [[usb_control_msg(0xA1, 1) Exploit]] ([[n72ap|iPod touch 2G]] [[Bootrom 240.4|old bootrom]], used in [[sn0wbreeze]])
* [[usb_control_msg(0xA1, 1) Exploit]]+ [[Incomplete Codesign Exploit]] + [[BPF_STX Kernel Write Exploit]] ([[n72ap|iPod touch 2G]] [[Bootrom 240.5.1|new bootrom]], used in [[sn0wbreeze]])
* [[Limera1n Exploit]] + [[Incomplete Codesign Exploit]] + [[BPF_STX Kernel Write Exploit]] ([[N18ap|iPod touch 3G]] and [[n88ap|iPhone 3GS]] [[Bootrom 359.3.2|new bootrom]], used in [[sn0wbreeze]])
* [[MobileBackup Copy Exploit]] + [[Incomplete Codesign Exploit]] + [[BPF_STX Kernel Write Exploit]] (all devices, used in [[Spirit]])
* [[Malformed CFF Vulnerability]] + [[Incomplete Codesign Exploit]] + [[IOSurface Kernel Exploit]] (all devices, used in [[Star]])

=== 3.2 ===
* [[MobileBackup Copy Exploit]] + [[Incomplete Codesign Exploit]] + [[BPF_STX Kernel Write Exploit]] (all devices, used in [[Spirit]])
* [[Malformed CFF Vulnerability]] + [[Incomplete Codesign Exploit]] + [[IOSurface Kernel Exploit]] ([[k48ap|iPad]], used in [[Star]])
* [[Limera1n Exploit]] + [[Incomplete Codesign Exploit]] + [[BPF_STX Kernel Write Exploit]] ([[K48ap|iPad]] used in [[sn0wbreeze]] 2.9.x)
=== 3.2.1 ===
* [[Malformed CFF Vulnerability]] + [[Incomplete Codesign Exploit]] + [[IOSurface Kernel Exploit]] ([[k48ap|iPad]], used in [[Star]])
* [[Limera1n Exploit]] + [[Incomplete Codesign Exploit]] + [[IOSurface Kernel Exploit]] ([[k48ap|iPad]], used in [[sn0wbreeze]] 2.9.x)
=== 3.2.2 ===
* [[Limera1n Exploit]] + [[Packet Filter Kernel Exploit]] ([[k48ap|iPad]])

== Exploits which are used in order to jailbreak 4.x ==
=== 4.0 / 4.0.1 ===
* [[Pwnage]] + [[Pwnage 2.0]] ([[n82ap|iPhone 3G]])
* [[0x24000 Segment Overflow]] ([[n72ap|iPod touch 2G]] and [[n88ap|iPhone 3GS]] devices with older bootroms)
* [[Malformed CFF Vulnerability]] + [[Incomplete Codesign Exploit]] + [[IOSurface Kernel Exploit]] (all devices, used in [[Star]])
* [[Limera1n Exploit]] + [[Packet Filter Kernel Exploit]] ([[n88ap|iPhone 3GS]] New bootrom, [[N18ap|iPod touch 3G]], [[n90ap|iPhone 4 (iPhone3,1)]])

=== 4.0.2 ===
* [[Pwnage]] + [[Pwnage 2.0]] ([[n82ap|iPhone 3G]])
* [[ARM7 Go]] (from iOS 2.1.1) + [[0x24000 Segment Overflow]] ([[n72ap|iPod touch 2G]])
* [[0x24000 Segment Overflow]] ([[n88ap|iPhone 3GS]])
* [[limera1n]]'s bootrom exploit + [[Packet Filter Kernel Exploit]] ([[n88ap|iPhone 3GS]] [[Bootrom 359.3.2|new bootrom]], [[n18ap|iPod touch 3G]], [[n90ap|iPhone 4 (iPhone3,1)]], and [[n81ap|iPod touch 4G]])

=== 4.1 ===
* [[Pwnage]] + [[Pwnage 2.0]] (together to jailbreak the [[n82ap|iPhone 3G]])
* [[ARM7 Go]] (from iOS 2.1.1) + [[0x24000 Segment Overflow]] (together for [[untethered jailbreak]] on [[n72ap|iPod touch 2G]] [[Bootrom 240.4|old bootrom]])
* [[limera1n]]'s bootrom exploit + [[0x24000 Segment Overflow]] (together for [[untethered jailbreak]] on [[n88ap|iPhone 3GS]] [[Bootrom 359.3|old bootrom]])
* [[limera1n]]'s bootrom exploit + [[Packet Filter Kernel Exploit]] (together for [[untethered jailbreak]] on [[n88ap|iPhone 3GS]] [[Bootrom 359.3.2|new bootrom]], [[n18ap|iPod touch 3G]], [[n90ap|iPhone 4 (iPhone3,1)]], [[n81ap|iPod touch 4G]], and [[k66ap|Apple TV 2G]]))
* [[usb_control_msg(0xA1, 1) Exploit]] + [[Packet Filter Kernel Exploit]] (together for [[untethered jailbreak]] on [[n72ap|iPod touch 2G]])

=== 4.2.1 ===
* [[Pwnage]] + [[Pwnage 2.0]] (together to jailbreak the [[n82ap|iPhone 3G]])
* [[ARM7 Go]] (from iOS 2.1.1) + [[0x24000 Segment Overflow]] (together for [[untethered jailbreak]] on [[n72ap|iPod touch 2G]] [[Bootrom 240.4|old bootrom]])
* [[limera1n]]'s bootrom exploit + [[0x24000 Segment Overflow]] (together for [[untethered jailbreak]] on [[n88ap|iPhone 3GS]] [[Bootrom 359.3|old bootrom]])
* [[limera1n]]'s bootrom exploit + [[HFS Legacy Volume Name Stack Buffer Overflow]] (together for [[untethered jailbreak]] on [[n88ap|iPhone 3GS]] [[Bootrom 359.3.2|new bootrom]], [[n18ap|iPod touch 3G]], [[k48ap|iPad]], [[n90ap|iPhone 4 (iPhone3,1)]], [[n81ap|iPod touch 4G]], and [[k66ap|Apple TV 2G]])
* [[usb_control_msg(0xA1, 1) Exploit]] + [[HFS Legacy Volume Name Stack Buffer Overflow]] (together for [[untethered jailbreak]] on [[n72ap|iPod touch 2G]])

=== 4.2.6 / 4.2.7 / 4.2.8 ===
* [[limera1n]]'s bootrom exploit + [[HFS Legacy Volume Name Stack Buffer Overflow]] (together for [[untethered jailbreak]] on [[n92ap|iPhone 4 (iPhone3,3)]])
* [[T1 Font Integer Overflow]] (used for [[Saffron]])

=== 4.2.9 / 4.2.10 ===
* [[limera1n]]'s bootrom exploit (Tethered jailbreak on [[n92ap|iPhone 4 (iPhone3,3)]])

=== 4.3 ===
* [[limera1n]]'s bootrom exploit + [[0x24000 Segment Overflow]] (together for [[untethered jailbreak]] on [[n88ap|iPhone 3GS]] [[Bootrom 359.3|old bootrom]])
* [[limera1n]]'s bootrom exploit ([[tethered jailbreak]] on [[n88ap|iPhone 3GS]] [[Bootrom 359.3.2|new bootrom]], [[n18ap|iPod touch 3G]], [[k48ap|iPad]], [[n90ap|iPhone 4 (iPhone3,1)]], [[n81ap|iPod touch 4G]], and [[k66ap|Apple TV 2G]])
* [[T1 Font Integer Overflow]] (used for [[Saffron]])

=== 4.3.1 / 4.3.2 / 4.3.3 ===
* [[limera1n]]'s bootrom exploit + [[0x24000 Segment Overflow]] (together for [[untethered jailbreak]] on [[n88ap|iPhone 3GS]] [[Bootrom 359.3|old bootrom]])
* [[limera1n]]'s bootrom exploit + [[ndrv_setspec() Integer Overflow]] (together for [[untethered jailbreak]] on [[n88ap|iPhone 3GS]] [[Bootrom 359.3.2|new bootrom]], [[n18ap|iPod touch 3G]], [[k48ap|iPad]], [[n90ap|iPhone 4 (iPhone3,1)]], and [[n81ap|iPod touch 4G]])
* [[T1 Font Integer Overflow]] (used for [[Saffron]])

=== 4.3.4 / 4.3.5 ===
* [[limera1n]]'s bootrom exploit + [[0x24000 Segment Overflow]] (together for [[untethered jailbreak]] on [[n88ap|iPhone 3GS]] with [[Bootrom 359.3|old bootrom]])
* [[limera1n]]'s bootrom exploit (Tethered jailbreak) on [[n88ap|iPhone 3GS]] with [[Bootrom 359.3.2|new bootrom]], [[n18ap|iPod touch 3G]], [[k48ap|iPad]], [[n90ap|iPhone 4 (iPhone3,1)]], and [[n81ap|iPod touch 4G]])

== Exploits which are used in order to jailbreak 5.x ==
=== 5.0 ===
* [[limera1n]]'s bootrom exploit + [[0x24000 Segment Overflow]] (together for [[untethered jailbreak]] on [[n88ap|iPhone 3GS]] with [[Bootrom 359.3|old bootrom]])
* [[limera1n]]'s bootrom exploit (Tethered jailbreak) on [[n88ap|iPhone 3GS]] with [[Bootrom 359.3.2|new bootrom]], [[n18ap|iPod touch 3G]], [[k48ap|iPad]], [[iPhone 4]], and [[n81ap|iPod touch 4G]])
* [[Racoon String Format Overflow Exploit]] (used both for payload injection and untether)+[[HFS Heap Overflow]]- [[n94ap|iPhone 4S]] only

===5.0.1===
* [[limera1n]]'s bootrom exploit + [[0x24000 Segment Overflow]] (together for [[untethered jailbreak]] on [[n88ap|iPhone 3GS]] with [[Bootrom 359.3|old bootrom]])
* [[limera1n]]'s bootrom exploit + [[Racoon String Format Overflow Exploit]]+[[HFS Heap Overflow]] on [[n88ap|iPhone 3GS]] with [[Bootrom 359.3.2|new bootrom]], [[n18ap|iPod touch 3G]], [[k48ap|iPad]], [[iPhone 4]], and [[n81ap|iPod touch 4G]])
* [[Racoon String Format Overflow Exploit]] (used both for payload injection and untether)+[[HFS Heap Overflow]] - [[iPad 2]] and [[iPhone 4S]] with [[Absinthe]]

===5.1===
* [[limera1n]]'s bootrom exploit (Tethered jailbreak) on [[n88ap|iPhone 3GS]] with [[Bootrom 359.3.2|new bootrom]], [[n18ap|iPod touch 3G]], [[k48ap|iPad]], [[iPhone 4]], and [[n81ap|iPod touch 4G]])
* [[limera1n]]'s bootrom exploit + [[0x24000 Segment Overflow]] (together for [[untethered jailbreak]] on [[n88ap|iPhone 3GS]] with [[Bootrom 359.3|old bootrom]])

===5.1.1===
* [[limera1n Exploit]] + [[0x24000 Segment Overflow]] (together for [[untethered jailbreak]] on [[n88ap|iPhone 3GS]] with [[Bootrom 359.3|old bootrom]])
* [[limera1n Exploit]] + [[Rocky Racoon]] (together for [[untethered jailbreak]] on [[n88ap|iPhone 3GS]] with [[Bootrom 359.3.2|new bootrom]], [[iPhone 4]], [[n18ap|iPod touch 3G]], and [[n81ap|iPod touch 4G]])

== Exploits which are used in order to jailbreak 6.x ==
=== 6.0 / 6.0.1 / 6.0.2 / 6.1 / 6.1.1 / 6.1.2 ===
* [[limera1n]]'s bootrom exploit (Tethered jailbreak) on [[n88ap|iPhone 3GS]] with [[Bootrom 359.3.2|new bootrom]], [[iPhone 4]], and [[n81ap|iPod touch 4G]])
* [[limera1n]]'s bootrom exploit + [[0x24000 Segment Overflow]] (together for [[untethered jailbreak]] on [[n88ap|iPhone 3GS]] with [[Bootrom 359.3|old bootrom]])
* [[Symbolic Link Vulnerability]]
* [[Timezone Vulnerability]]
* [[Shebang Trick]]
* [[AMFID code signing evasion]]
* [[launchd.conf untether]]
* [[IOUSBDeviceFamily Vulnerability]]
* [[ARM Exception Vector Info Leak]]
* [[dynamic memmove() locating]]
* [[vm_map_copy_t corruption for arbitrary memory disclosure]]
* [[kernel memory write via ROP gadget]]

== Exploits which are used in order to jailbreak 7.0.x ==
=== 7.0 / 7.0.1 / 7.0.2 / 7.0.3 / 7.0.4 / 7.0.5 / 7.0.6 ===
* ?

== Jailbreak Tools ==
==== [[k66ap|Apple TV 2G]] ====
{| class="wikitable" style="font-size: smaller; text-align: center;"
|-
! rowspan="2" | [[Jailbreak]] Tool
! colspan="26" | Works with [[firmware]]...
|-
| [[Mojave 8M89 (AppleTV2,1)|4.0/4.1]]
| [[Jasper 8C150 (AppleTV2,1)|4.1/4.2]]
| [[Jasper 8C154 (AppleTV2,1)|4.1.1/4.2.1]]
| [[Durango 8F191m (AppleTV2,1)|4.2/4.3]]
| [[DurangoTide 8F202 (AppleTV2,1)|4.2.1/4.3]]
| [[DurangoTide 8F305 (AppleTV2,1)|4.2.2/4.3]]
| [[DurangoTideCuba 8F455 (AppleTV2,1)|4.3]]
| [[Telluride 9A334v (AppleTV2,1)|4.4/5.0]]
| [[Telluride 9A335a (AppleTV2,1)|4.4.1/5.0]]
| [[Telluride 9A336a (AppleTV2,1)|4.4.2/5.0]]
| [[Telluride 9A405l (AppleTV2,1)|4.4.3/5.0.1]]
| [[Telluride 9A406a (AppleTV2,1)|4.4.4/5.0.1]]
| [[Hoodoo 9B179b (AppleTV2,1)|5.0/5.1]]
| [[Hoodoo 9B206f (AppleTV2,1)|5.0.1/5.1.1]]
| [[HoodooTide 9B830 (AppleTV2,1)|5.0.2/5.1.1]]
| [[Sundance 10A406e (AppleTV2,1)|5.1/6.0]]
| [[SundanceTide 10A831 (AppleTV2,1)|5.1.1/6.0.1]]
| [[Brighton 10B144b (AppleTV2,1)|5.2/6.1]]
| [[BrightonMaps 10B329a (AppleTV2,1)|5.2.1/6.1.3]]
| [[BrightonTide 10B809 (AppleTV2,1)|5.3/6.1.4]]
| [[Innsbruck 11A470e (AppleTV2,1)|6.0/7.0.1]]
| [[Innsbruck 11A502 (AppleTV2,1)|6.0/7.0.2]]
| [[InnsbruckTaos 11B511d (AppleTV2,1)|6.0.1/7.0.3]]
| [[InnsbruckTaos 11B554a (AppleTV2,1)|6.0.2/7.0.4]]
| [[InnsbruckTaos 11B651 (AppleTV2,1)|6.0.2/7.0.6]]
| [[Sochi 11D169b (AppleTV2,1)|6.1/7.1]]
|-
| [[evasi0n]]
| colspan="15" {{no}}
| colspan="3" {{yes|1.0}}
| colspan="8" {{no}}
|-
| [[Greenpois0n (jailbreak)|greenpois0n]]
| {{partial|no package management GUI}}
| {{no}}
| {{yes|RC6-RC6.1}}
| colspan="25" {{no}}
|-
| [[limera1n]]
| {{partial|no package management GUI}}
| colspan="25" {{no}}
|-
| [[p0sixspwn]]
| colspan="18" {{no}}
| colspan="2" {{yes|1.0}}
| colspan="6" {{no}}
|-
| [[PwnageTool]]
| {{partial|no package management GUI}}
| {{partial|Restore from a custom firmware with unofficial bundle1}}
| {{yes|4.2}}
| {{no}}
| {{yes|4.3-4.3.3.1}}
| {{yes|4.3-4.3.3.12}}
| colspan="7" {{no}}
| {{partial|5.1.1 (no package management GUI)}}
| colspan="12" {{no}}
|-
| [[redsn0w]]
| colspan="4" {{no}}
| {{yes|0.9.6rc16}}
| colspan="10" {{no}}
| {{yes|0.9.15b11}}
| colspan="5" {{yes|0.9.15b33}}
| colspan="5" {{no}}
|-
| [[Seas0nPass]] (Mac)
| {{yes|??? -}}
| {{yes|??? -}}
| {{yes|0.6.7 -}}
| {{yes|0.7.2 -}}
| {{yes|0.7.3 -}}
| {{yes|0.7.6.??? -}}
| {{yes|0.7.8.??? -}}
| {{yes|0.7.9.???1 -}}
| {{yes|0.7.9.2101 -}}
| {{yes|0.7.9.2301 -}}
| {{yes|0.7.9.270 -}}
| {{yes|0.7.9.290 -}}
| {{yes|0.8.3.4701 -}}
| {{yes|0.8.4.518 -}}
| {{yes|0.8.6.565 -}}
| {{yes|0.8.? -}}
| {{yes|0.8.? -}}
| {{yes|0.8.9.655 -}}
| {{yes|0.9.?1 -}}
| {{yes|0.9.5 -}}
| colspan="7" {{no}}
|-
| [[Seas0nPass]] (Windows)
| {{yes|??? -}}
| {{yes|??? -}}
| {{yes|??? -}}
| {{yes|??? -}}
| {{yes|0.3.7.???? -}}
| {{yes|0.3.13.???? -}}
| {{yes|0.3.29.???? -}}
| colspan="2" {{yes|0.3.37.????1 -}}
| {{yes|0.3.42.33351 -}}
| {{yes|0.3.44.???? -}}
| {{yes|0.3.45.4035 -}}
| {{yes|0.8.3.55921}}
| {{yes|0.8.4.6306 -}}
| {{yes|0.8.6.7558 -}}
| {{yes|0.8.? -}}
| {{yes|0.8.? -}}
| {{yes|0.8.9.11241 -}}
| {{yes|0.9.?1 -}}
| {{yes|0.9.5 -}}
| colspan="7" {{no}}
|-
| [[sn0wbreeze]]
| {{partial|no package management GUI}}
| colspan="3" {{no}}
| {{yes|2.5-2.7.1}}
| colspan="10" {{no}}
| colspan="3" {{yes|2.9.8}}
| colspan="8" {{no}}
|-
| [[unthredera1n]]
| {{partial|no package management GUI}}
| colspan="14" {{yes}}
| colspan="11" {{no}}
|}
1 [[Tethered jailbreak]]. 
2 User needs to manually add [[PwnageTool]] firmware bundle into application. 
3 Point at 6.0 IPSW. Also [[Tethered jailbreak]].

==== [[j33ap|Apple TV 3G (AppleTV3,1)]] ====
{| class="wikitable" style="font-size: smaller; text-align: center;"
|-
! rowspan="2" | [[Jailbreak]] Tool
! colspan="14" | Works with [[firmware]]...
|-
| 5.0/5.1
| 5.0.1/5.1
| 5.0.2/5.1.1
| 5.1/6.0
| 5.1.1/6.0.1
| 5.2/6.1
| 5.2.1/6.1.3
| 5.3/6.1.4
| 6.0/7.0.1
| 6.0/7.0.2
| 6.0.1/7.0.3
| 6.0.2/7.0.4
| 6.0.2/7.0.6
| 6.1/7.1
|-
| [[Absinthe]]
| colspan="14" {{no}}
|-
| [[evasi0n]]
| colspan="14" {{no}}
|-
| [[redsn0w]]
| colspan="14" {{no}}
|-
| [[Seas0npass]]
| colspan="14" {{no}}
|-
| [[Sn0wbreeze]]
| colspan="14" {{no}}
|}

==== [[j33iap|Apple TV 3G (AppleTV3,2)]] ====
{| class="wikitable" style="font-size: smaller; text-align: center;"
|-
! rowspan="2" | [[Jailbreak]] Tool
! colspan="9" | Works with [[firmware]]...
|-
| 5.2/6.1
| 5.2.1/6.1.3
| 5.3/6.1.4
| 6.0/7.0.1
| 6.0/7.0.2
| 6.0.1/7.0.3
| 6.0.2/7.0.4
| 6.0.2/7.0.6
| 6.1/7.1
|-
| [[Absinthe]]
| colspan="9" {{no}}
|-
| [[evasi0n]]
| colspan="9" {{no}}
|-
| [[redsn0w]]
| colspan="9" {{no}}
|-
| [[Seas0npass]]
| colspan="9" {{no}}
|-
| [[Sn0wbreeze]]
| colspan="9" {{no}}
|}

{{:Jailbreak/Deprecated iPads}}

=== [[iPad 2]] ===
{| class="wikitable" style="font-size: smaller; text-align: center;"
|-
! rowspan="2" | [[Jailbreak]] Tool
! colspan="21" | Works with [[firmware]]...
|-
| 4.3
| 4.3.1
| 4.3.2
| 4.3.3
| 4.3.4
| 4.3.5
| 5.0
| 5.0.1
| 5.1
| 5.1.1
| 6.0
| 6.0.1
| 6.1
| 6.1.2
| 6.1.3
| 7.0
| 7.0.2
| 7.0.3
| 7.0.4
| 7.0.6
| 7.1
|-
| [[Absinthe]]
| colspan="7" {{no}}
| {{yes|0.2-0.4}}
| {{no}}
| {{yes|2.01-2.0.4}}
| colspan="11" {{no}}
|-
| [[evasi0n]]
| colspan="10" {{no}}
| colspan="3" {{yes|1.0}}
| {{yes|1.4}}
| colspan="7" {{no}}
|-
| [[evasi0n7]]
| colspan="15" {{no}}
| colspan="4" {{yes|1.0.0}}
| {{yes|1.0.6}}
| {{no}}
|-
| [[p0sixspwn]]
| colspan="14" {{no}}
| {{yes|1.0}}
| colspan="6" {{no}}
|-
| [[redsn0w]]
| colspan="7" {{no}}
| {{yes|0.9.10b7-0.9.11b4}}
| {{no}}
| {{yes|0.9.12b1}}
| colspan="11" {{no}}
|-
| [[Saffron]]
| colspan="3" {{no}}
| {{yes}}
| colspan="17" {{no}}
|}
1 Not compatible with [[k93aap|iPad2,4]]

=== [[iPad 3]] ===
{| class="wikitable" style="font-size: smaller; text-align: center;"
|-
! rowspan="2" | [[Jailbreak]] Tool
! colspan="13" | Works with [[firmware]]...
|-
| 5.1
| 5.1.1
| 6.0
| 6.0.1
| 6.1
| 6.1.2
| 6.1.3
| 7.0
| 7.0.2
| 7.0.3
| 7.0.4
| 7.0.6
| 7.1
|-
| [[Absinthe]]
| {{no}}
| {{yes|2.0-2.0.4}}
| colspan="11" {{no}}
|-
| [[evasi0n]]
| colspan="2" {{no}}
| colspan="3" {{yes|1.0}}
| {{yes|1.4}}
| colspan="7" {{no}}
|-
| [[evasi0n7]]
| colspan="7" {{no}}
| colspan="4" {{yes|1.0.0}}
| {{yes|1.0.6}}
| {{no}}
|-
| [[p0sixspwn]]
| colspan="6" {{no}}
| {{yes|1.0}}
| colspan="6" {{no}}
|-
| [[redsn0w]]
| {{no}}
| {{yes|0.9.12b1}}
| colspan="11" {{no}}
|}

=== [[iPad 4]] ===
{| class="wikitable" style="font-size: smaller; text-align: center;"
|-
! rowspan="2" | [[Jailbreak]] Tool
! colspan="11" | Works with [[firmware]]...
|-
| 6.0
| 6.0.1
| 6.1
| 6.1.2
| 6.1.3
| 7.0
| 7.0.2
| 7.0.3
| 7.0.4
| 7.0.6
| 7.1
|-
| [[evasi0n]]
| colspan="3" {{yes|1.0}}
| {{yes|1.4}}
| colspan="7" {{no}}
|-
| [[evasi0n7]]
| colspan="5" {{no}}
| colspan="4" {{yes|1.0.0}}
| {{yes|1.0.6}}
| {{no}}
|-
| [[p0sixspwn]]
| colspan="4" {{no}}
| {{yes|1.0}}
| colspan="6" {{no}}
|}

=== [[iPad Air]] ===
{| class="wikitable" style="font-size: smaller; text-align: center;"
|-
! rowspan="2" | [[Jailbreak]] Tool
! colspan="4" | Works with [[firmware]]...
|-
| 7.0.3
| 7.0.4
| 7.0.6
| 7.1
|-
| [[evasi0n7]]
| colspan="2" {{yes|1.0.0}}
| {{yes|1.0.6}}
| {{no}}
|}

=== [[iPad mini 1G]] ===
{| class="wikitable" style="font-size: smaller; text-align: center;"
|-
! rowspan="2" | [[Jailbreak]] Tool
! colspan="12" | Works with [[firmware]]...
|-
| 6.0
| 6.0.1
| 6.0.2
| 6.1
| 6.1.2
| 6.1.3
| 7.0
| 7.0.2
| 7.0.3
| 7.0.4
| 7.0.6
| 7.1
|-
| [[evasi0n]]
| colspan="4" {{yes|1.0}}
| {{yes|1.4}}
| colspan="7" {{no}}
|-
| [[evasi0n7]]
| colspan="6" {{no}}
| colspan="4" {{yes|1.0.0}}
| {{yes|1.0.6}}
| {{no}}
|-
| [[p0sixspwn]]
| colspan="5" {{no}}
| {{yes|1.0}}
| colspan="6" {{no}}
|}

=== [[iPad mini 2G]] ===
{| class="wikitable" style="font-size: smaller; text-align: center;"
|-
! rowspan="2" | [[Jailbreak]] Tool
! colspan="4" | Works with [[firmware]]...
|-
| 7.0.3
| 7.0.4
| 7.0.6
| 7.1
|-
| [[evasi0n7]]
| colspan="2" {{yes|1.0.0}}
| {{yes|1.0.6}}
| {{no}}
|}

{{:Jailbreak/Deprecated iPhones}}

=== [[N90ap|iPhone 4 (iPhone3,1)]] ===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
! rowspan="2" | [[Jailbreak]] Tool
! colspan="27" | Works with [[firmware]]...
|-
| [[Apex 8A293 (iPhone3,1)|4.0]]
| [[Apex 8A306 (iPhone3,1)|4.0.1]]
| [[Apex 8A400 (iPhone3,1)|4.0.2]]
| [[Baker 8B117 (iPhone3,1)|4.1]]
| [[Jasper 8C148 (iPhone3,1)|4.2.1]]
| [[Durango 8F190 (iPhone3,1)|4.3]]
| [[Durango 8G4 (iPhone3,1)|4.3.1]]
| [[Durango 8H7 (iPhone3,1)|4.3.2]]
| [[Durango 8J2 (iPhone3,1)|4.3.3]]
| [[Durango 8K2 (iPhone3,1)|4.3.4]]
| [[Durango 8L1 (iPhone3,1)|4.3.5]]
| [[Telluride 9A334 (iPhone3,1)|5.0]]
| [[Telluride 9A405 (iPhone3,1)|5.0.1]]
| [[Hoodoo 9B176 (iPhone3,1)|5.1]]
| [[Hoodoo 9B206 (iPhone3,1)|5.1.1 (9B206)]]
| [[Hoodoo 9B208 (iPhone3,1)|5.1.1 (9B208)]]
| [[Sundance 10A403 (iPhone3,1)|6.0]]
| [[Sundance 10A523 (iPhone3,1)|6.0.1]]
| [[Brighton 10B144 (iPhone3,1)|6.1]]
| [[Brighton 10B146 (iPhone3,1)|6.1.2]]
| [[BrightonMaps 10B329 (iPhone3,1)|6.1.3]]
| [[Innsbruck 11A465 (iPhone3,1)|7.0]]
| [[Innsbruck 11A501 (iPhone3,1)|7.0.2]]
| [[InnsbruckTaos 11B511 (iPhone3,1)|7.0.3]]
| [[InnsbruckTaos 11B554a (iPhone3,1)|7.0.4]]
| [[InnsbruckTaos 11B651 (iPhone3,1)|7.0.6]]
| [[Sochi 11D169 (iPhone3,1)|7.1]]
|-
| [[Absinthe]]
| colspan="14" {{no}}
| {{yes|2.0}}
| {{yes|2.0.2}}
| colspan="11" {{no}}
|-
| [[evasi0n]]
| colspan="16" {{no}}
| colspan="3" {{yes|1.0}}
| {{yes|1.4}}
| colspan="7" {{no}}
|-
| [[evasi0n7]]
| colspan="21" {{no}}
| colspan="4" {{yes|1.0.0}}
| {{yes|1.0.6}}
| {{no}}
|-
| [[Greenpois0n (jailbreak)|greenpois0n]]
| colspan="3" {{no}}
| {{yes|RC4}}
| {{yes|RC5-RC6.1}}
| colspan="22" {{no}}
|-
| [[limera1n]]
| colspan="4" {{yes}}
| colspan="23" {{no}}
|-
| [[p0sixspwn]]
| colspan="20" {{no}}
| {{yes|1.0}}
| colspan="6" {{no}}
|-
| [[PwnageTool]]
| colspan="3" {{no}}
| {{yes|4.1-4.1.3}}
| {{yes|4.2}}
| {{partial|4.21 3}}
| {{yes|4.3}}
| {{yes|4.3.2}}
| {{yes|4.3.3-4.3.3.1}}
| colspan="3" {{partial|4.3.31 3}}
| {{yes|5.0.1}}
| {{no}}
| colspan="2" {{yes|5.1.1}}
| colspan="11" {{no}}
|-
| [[redsn0w]]
| colspan="3" {{no}}
| {{yes|0.9.6b2-0.9.6rc16}}
| {{partial|0.9.6b41-0.9.6rc16 or 0.9.7b61 2}}
| {{partial|0.9.6rc91-0.9.6rc161}}
| {{partial|0.9.6rc91-0.9.6rc16}}
| {{partial|0.9.6rc131-0.9.6rc16}}
| {{yes|0.9.6rc16}}
| {{partial|0.9.8b31}}
| {{partial|0.9.8b71}}
| {{partial|0.9.9b31}}
| {{yes|0.9.10b6}}
| {{partial|0.9.10b61}}
| colspan="2" {{yes|0.9.12b1-0.9.14b2}}
| {{partial|0.9.15b11}}
| colspan="4" {{partial|0.9.15b14}}
| colspan="6" {{no}}
|-
| [[Saffron]]
| colspan="5" {{no}}
| colspan="4" {{yes}}
| colspan="18" {{no}}
|-
| [[sn0wbreeze]]
| colspan="3" {{no}}
| {{yes|2.1}}
| {{yes|2.2}}
| {{partial|2.3b41}}
| {{yes|2.5}}
| {{yes|2.6-2.6.1}}
| {{yes|2.7-2.7.1}}
| colspan="2" {{no}}
| {{partial|2.8b81}}
| {{yes|2.9.1}}
| {{no}}
| colspan="2" {{yes|2.9.6}}
| colspan="3" {{yes|2.9.8}}
| {{yes|2.9.10}}
| {{partial|2.9.141}}
| colspan="6" {{no}}
|-
| [[Star]]
| colspan="2" {{yes}}
| colspan="25" {{no}}
|-
| [[unthredera1n]]
| colspan="5" {{no}}
| colspan="11" {{yes}}
| colspan="11" {{no}}
|}
1 [[Tethered jailbreak]]. 
2 If [[SHSH]]s were saved for iOS 4.2b3 and if you have a developer access to its IPSW, [[Jailbreak Monte]] can be used. 
3 Requires an unofficial firmware bundle. 
4 Requires pointing [[redsn0w]] at 6.0 [[IPSW File Format|IPSW]]. Also [[Tethered jailbreak]].

=== [[N90bap|iPhone 4 (iPhone3,2)]] ===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
! rowspan="2" | [[Jailbreak]] Tool
! colspan="11" | Works with [[firmware]]...
|-
| [[Sundance 10A403 (iPhone3,2)|6.0]]
| [[Sundance 10A523 (iPhone3,2)|6.0.1]]
| [[Brighton 10B144 (iPhone3,2)|6.1]]
| [[Brighton 10B146 (iPhone3,2)|6.1.2]]
| [[BrightonMaps 10B329 (iPhone3,2)|6.1.3]]
| [[Innsbruck 11A465 (iPhone3,2)|7.0]]
| [[Innsbruck 11A501 (iPhone3,2)|7.0.2]]
| [[InnsbruckTaos 11B511 (iPhone3,2)|7.0.3]]
| [[InnsbruckTaos 11B554a (iPhone3,2)|7.0.4]]
| [[InnsbruckTaos 11B651 (iPhone3,2)|7.0.6]]
| [[Sochi 11D169 (iPhone3,2)|7.1]]
|-
| [[evasi0n]]
| colspan="3" {{yes|1.0}}
| {{yes|1.4}}
| colspan="7" {{no}}
|-
| [[evasi0n7]]
| colspan="5" {{no}}
| colspan="4" {{yes|1.0.0}}
| {{yes|1.0.6}}
| {{no}}
|-
| [[p0sixspwn]]
| colspan="4" {{no}}
| {{yes|1.0}}
| colspan="6" {{no}}
|-
| [[redsn0w]]
| colspan="5" {{partial|0.9.15b32}}
| colspan="6" {{no}}
|-
| [[sn0wbreeze]]
| colspan="3" {{yes|2.9.8}}
| {{yes|2.9.10}}
| {{partial|2.9.141}}
| colspan="6" {{no}}
|}

1 [[Tethered jailbreak]]. 
2 Requires pointing [[redsn0w]] at 6.0 [[IPSW File Format|IPSW]]. Also [[Tethered jailbreak]].

=== [[N92ap|iPhone 4 (iPhone3,3)]] ===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
! rowspan="2" | [[Jailbreak]] Tool
! colspan="21" | Works with [[firmware]]...
|-
| [[Phoenix 8E128 (iPhone3,3)|4.2.5]]
| [[Phoenix 8E200 (iPhone3,3)|4.2.6]]
| [[Phoenix 8E303 (iPhone3,3)|4.2.7]]
| [[Phoenix 8E401 (iPhone3,3)|4.2.8]]
| [[Phoenix 8E501 (iPhone3,3)|4.2.9]]
| [[Phoenix 8E600 (iPhone3,3)|4.2.10]]
| [[Telluride 9A334 (iPhone3,3)|5.0]]
| [[Telluride 9A405 (iPhone3,3)|5.0.1]]
| [[Hoodoo 9B176 (iPhone3,3)|5.1]]
| [[Hoodoo 9B206 (iPhone3,3)|5.1.1]]
| [[Sundance 10A403 (iPhone3,3)|6.0]]
| [[Sundance 10A523 (iPhone3,3)|6.0.1]]
| [[Brighton 10B141 (iPhone3,3)|6.1]]
| [[Brighton 10B146 (iPhone3,3)|6.1.2]]
| [[BrightonMaps 10B329 (iPhone3,3)|6.1.3]]
| [[Innsbruck 11A465 (iPhone3,3)|7.0]]
| [[Innsbruck 11A501 (iPhone3,3)|7.0.2]]
| [[InnsbruckTaos 11B511 (iPhone3,3)|7.0.3]]
| [[InnsbruckTaos 11B554a (iPhone3,3)|7.0.4]]
| [[InnsbruckTaos 11B651 (iPhone3,3)|7.0.6]]
| [[Sochi 11D167 (iPhone3,3)|7.1]]
|-
| [[Absinthe]]
| colspan="7" {{no}}
| {{yes|2.0}}
| {{no}}
| {{yes|2.0}}
| colspan="11" {{no}}
|-
| [[evasi0n]]
| colspan="10" {{no}}
| colspan="3" {{yes|1.0}}
| {{yes|1.4}}
| colspan="7" {{no}}
|-
| [[evasi0n7]]
| colspan="15" {{no}}
| colspan="4" {{yes|1.0.0}}
| {{yes|1.0.6}}
| {{no}}
|-
| [[Greenpois0n (jailbreak)|greenpois0n]]
| {{no}}
| {{yes|RC5 b4-RC6.1}}
| colspan="19" {{no}}
|-
| [[p0sixspwn]]
| colspan="14" {{no}}
| {{yes|1.0}}
| colspan="6" {{no}}
|-
| [[PwnageTool]]
| {{no}}
| {{yes|4.2}}
| {{no}}
| {{yes|4.22}}
| colspan="3" {{no}}
| {{yes|5.0.1}}
| colspan="13" {{no}}
|-
| [[redsn0w]]
| {{no}}
| {{yes|0.9.6rc9-0.9.10b8b}}
| {{yes|0.9.8b2-0.9.10b8b}}
| {{yes|0.9.6rc18-0.9.10b8b}}
| {{partial|0.9.8b31-0.9.10b8b1}}
| {{partial|0.9.8b71-0.9.10b8b1}}
| {{partial|0.9.9b31-0.9.10b8b1}}
| {{partial|0.9.9b91-0.9.10b8b}}
| {{partial|0.9.10b61-0.9.10b8b1}}
| {{yes|0.9.12b1}}
| {{partial|0.9.14b11}}
| colspan="4" {{partial|0.9.15b33}}
| colspan="6" {{no}}
|-
| [[Saffron]]
| {{no}}
| colspan="3" {{yes}}
| colspan="17" {{no}}
|-
| [[sn0wbreeze]]
| {{no}}
| {{yes|2.2-2.9.3}}
| {{yes|2.6-2.9.3}}
| {{yes|2.7-2.9.3}}
| colspan="2" {{no}}
| {{partial|2.8b91-2.9.31}}
| {{partial|2.8b111-2.9.3}}
| {{partial|2.9.21-2.9.31}}
| {{yes|2.9.7}}
| colspan="3" {{yes|2.9.8}}
| {{yes|2.9.10}}
| {{partial|2.9.141}}
| colspan="6" {{no}}
|-
| [[unthredera1n]]
| {{no}}
| colspan="9" {{yes}}
| colspan="11" {{no}}
|}
1 [[Tethered jailbreak]]. 
2 Requires unofficial bundle. 
3 Requires pointing [[redsn0w]] at 6.0 [[IPSW File Format|IPSW]]. Also [[Tethered jailbreak]].

=== [[N94ap|iPhone 4S]] ===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
! rowspan="2" | [[Jailbreak]] Tool
! colspan="17" | Works with [[firmware]]...
|-
| [[Telluride 9A334 (iPhone4,1)|5.0]]
| [[Telluride 9A405 (iPhone4,1)|5.0.1]]
| [[Telluride 9A406 (iPhone4,1)|5.0.1 (9A406)]]
| [[Hoodoo 9B179 (iPhone4,1)|5.1]]
| [[Hoodoo 9B206 (iPhone4,1)|5.1.1]]
| [[Sundance 10A403 (iPhone4,1)|6.0]]
| [[Sundance 10A523 (iPhone4,1)|6.0.1]]
| [[Brighton 10B142 (iPhone4,1)|6.1]]
| [[Brighton 10B145 (iPhone4,1)|6.1.1]]
| [[Brighton 10B146 (iPhone4,1)|6.1.2]]
| [[BrightonMaps 10B329 (iPhone4,1)|6.1.3]]
| [[Innsbruck 11A465 (iPhone4,1)|7.0]]
| [[Innsbruck 11A501 (iPhone4,1)|7.0.2]]
| [[InnsbruckTaos 11B511 (iPhone4,1)|7.0.3]]
| [[InnsbruckTaos 11B554a (iPhone4,1)|7.0.4]]
| [[InnsbruckTaos 11B651 (iPhone4,1)|7.0.6]]
| [[Sochi 11D167 (iPhone4,1)|7.1]]
|-
| [[Absinthe]]
| colspan="3" {{yes|0.1.2-1}}
| {{no}}
| {{yes|2.0}}
| colspan="12" {{no}}
|-
| [[evasi0n]]
| colspan="5" {{no}}
| colspan="3" {{yes|1.0}}
| {{yes|1.3}}
| {{yes|1.4}}
| colspan="8" {{no}}
|-
| [[evasi0n7]]
| colspan="11" {{no}}
| colspan="4" {{yes|1.0.0}}
| {{yes|1.0.6}}
| {{no}}
|-
| [[p0sixspwn]]
| colspan="10" {{no}}
| {{yes|1.0}}
| colspan="6" {{no}}
|-
| [[redsn0w]]
| {{no}}
| {{yes|0.9.10b7}}
| {{yes|0.9.11b2}}
| {{no}}
| {{yes|0.9.12b1}}
| colspan="12" {{no}}
|}

=== [[iPhone 5]] ===
{| class="wikitable" style="font-size: smaller; text-align: center;"
|-
! rowspan="2" | [[Jailbreak]] Tool
! colspan="14" | Works with [[firmware]]...
|-
| 6.0
| 6.0.1
| 6.0.2
| 6.1
| 6.1.2
| 6.1.3
| 6.1.4
| 7.0
| 7.0.2
| 7.0.3
| 7.0.4
| 7.0.6
| 7.1
|-
| [[evasi0n]]
| colspan="5" {{yes|1.0}}
| {{yes|1.4}}
| colspan="8" {{no}}
|-
| [[evasi0n7]]
| colspan="7" {{no}}
| colspan="4" {{yes|1.0.0}}
| {{yes|1.0.6}}
| {{no}}
|-
| [[p0sixspwn]]
| colspan="5" {{no}}
| colspan="2" {{yes|1.0}}
| colspan="7" {{no}}
|}

=== [[n48ap|iPhone 5c (iPhone5,3)]] ===
{| class="wikitable" style="font-size: smaller; text-align: center;"
|-
! rowspan="2" | [[Jailbreak]] Tool
! colspan="7" | Works with [[firmware]]...
|-
| 7.0
| 7.0.1
| 7.0.2
| 7.0.3
| 7.0.4
| 7.0.6
| 7.1
|-
| [[evasi0n7]]
| colspan="5" {{yes|1.0.0}}
| {{yes|1.0.6}}
| {{no}}
|}

=== [[n49ap|iPhone 5c (iPhone5,4)]] ===
{| class="wikitable" style="font-size: smaller; text-align: center;"
|-
! rowspan="2" | [[Jailbreak]] Tool
! colspan="8" | Works with [[firmware]]...
|-
| 7.0
| 7.0.1
| 7.0.2
| 7.0.3
| 7.0.4
| 7.0.5
| 7.0.6
| 7.1
|-
| [[evasi0n7]]
| colspan="5" {{yes|1.0.0}}
| {{yes|1.0.5}}
| {{yes|1.0.6}}
| {{no}}
|}

=== [[n51ap|iPhone 5s (iPhone6,1)]] ===
{| class="wikitable" style="font-size: smaller; text-align: center;"
|-
! rowspan="2" | [[Jailbreak]] Tool
! colspan="7" | Works with [[firmware]]...
|-
| 7.0
| 7.0.1
| 7.0.2
| 7.0.3
| 7.0.4
| 7.0.6
| 7.1
|-
| [[evasi0n7]]
| colspan="5" {{yes|1.0.0}}
| {{yes|1.0.6}}
| {{no}}
|}

=== [[n53ap|iPhone 5s (iPhone6,2)]] ===
{| class="wikitable" style="font-size: smaller; text-align: center;"
|-
! rowspan="2" | [[Jailbreak]] Tool
! colspan="8" | Works with [[firmware]]...
|-
| 7.0
| 7.0.1
| 7.0.2
| 7.0.3
| 7.0.4
| 7.0.5
| 7.0.6
| 7.1
|-
| [[evasi0n7]]
| colspan="5" {{yes|1.0.0}}
| {{yes|1.0.5}}
| {{yes|1.0.6}}
| {{no}}
|}

{{:Jailbreak/Deprecated iPod touches}}

=== [[iPod touch 5G]] ===
{| class="wikitable" style="font-size: smaller; text-align: center;"
|-
! rowspan="2" | [[Jailbreak]] Tool
! colspan="11" | Works with [[firmware]]...
|-
| 6.0
| 6.0.1
| 6.1
| 6.1.2
| 6.1.3
| 7.0
| 7.0.2
| 7.0.3
| 7.0.4
| 7.0.6
| 7.1
|-
| [[evasi0n]]
| colspan="3" {{yes|1.0}}
| {{yes|1.4}}
| colspan="7" {{no}}
|-
| [[evasi0n7]]
| colspan="5" {{no}}
| colspan="4" {{yes|1.0.0}}
| {{yes|1.0.6}}
| {{no}}
|-
| [[p0sixspwn]]
| colspan="4" {{no}}
| {{yes|1.0}}
| colspan="6" {{no}}
|}

P0sixspwn

2014-03-12T11:23:34Z

Flexpert: /* Desktop Download */ added description for 1.0.7 from blog post

{{lowercase}}
'''p0sixspwn''' is an [[untethered jailbreak]] for iOS 6.1.3-6.1.5 by [[User:winocm|winocm]], [[User:Ih8sn0w|iH8sn0w]] and [https://twitter.com/SquiffyPwn SquiffyPwn]. It was initially made available as an Cydia package on [[Saurik]]'s repo to untether already jailbroken devices. It works with all devices that support iOS 6.1.3-6.1.5 and 5.2.1 - 5.3 on [[k66ap|Apple TV 2G]]. On 30 December 2013, a Mac OS X program was released to perform a jailbreak. A Windows program was released on 3 January 2014.

== Cydia Package Changelog ==
* '''1.0-5''' the initial release of the untether
* '''1.0-9''' [[n90ap|iPhone 4 (iPhone3,1)]] boot loop fix
* '''1.1-1''' Automatically reboot after 30 seconds if device did not boot. (iH8sn0w's repo only)
* '''1.1-2''' Automatically reboot after one minute if device did not boot due to 30 seconds was too quick. (iH8sn0w's repo only)
* '''1.1-3''' Automatically reboot after two minutes if device did not boot due to 60 seconds was too quick. (iH8sn0w's repo only)
* '''1.2-1''' Various bug fixes.
* '''1.3-2''' Fixes iMessage, LTE issues and Apple TV 2G support.
* '''1.4-1''' Support iOS 6.1.6.

==Desktop Download==
{| class="wikitable"
! Version
! OS
! SHA-1 Hash
! Download
! Changes
|-
! 1.0.0
| rowspan="3" | [[wikipedia:OS X|OS X]]
| <code>b5a66f4e58ab4c813fc851d479b28188eb5115ec</code>
| style="text-decoration: line-through;" | [https://mega.co.nz/#!0xtw0DAT!YVZmNXsn-kl1kH655zgpMGz8hSVVgk8FU3qlTPNfSdU Mega]
|
* Initial release.
|-
! 1.0.1
| <code>ae5b3907660b161b2ff94a2e2cfef97195404a89</code>
| style="text-decoration: line-through;" | [https://mega.co.nz/#!l8lniKxL!ODQrFDGbOUpm2hvU-mQggm25IgNk3_TmSO1r7tlU178 Mega]
|
* Resolves issues with [[iPod touch 5G]] not being detected.
|-
! 1.0.2
| <code>259e95fd16468260c8831ca17186f50b7d14ba41</code>
| [https://mega.co.nz/#!DVtmGLqa!BX2-OQUliBcfdlenMLa93mKxk244KpD9Z71p_DAeil8 Mega]
|
* Resolves issues with LTE/data.
|-
! 1.0.3
| rowspan="2" | [[wikipedia:Microsoft Windows|Windows]]
| <code>060c95cda0e5ad861bd225ca19324e6ebd3c0a5d</code>
| style="text-decoration: line-through;" | [https://mega.co.nz/#!x0sk1SjB!S86WIGnifrgVhf5aoFQiPHl5aMJvS3miIeTTy9pLL_w Mega]
|
* Initial release for Windows.
|-
! 1.0.4
| <code>0a40a9780ba0dd9f0476d12950b4fb0026c8559a</code>
| style="text-decoration: line-through;" | [https://mega.co.nz/#!Vl9zFJYC!JaCsqwnNNDJvj_4t0APjC2XPBg0ZuUwMSNNz2MGb4Xw Mega]
|
* Added README and time adjustments for slow PC's.
|-
! rowspan="2" | 1.0.5
| [[wikipedia:OS X|OS X]]
| <code>b99fb1de846c406a15bbd710b623ddd78e139e5e</code>
| style="text-decoration: line-through;" | [https://mega.co.nz/#!B5lxxDLD!YrvjGhvVDxm2ah94hafI7TJWfm9EK0aWsh4_7YN78qE Mega]
| rowspan="2" |
* Fixes some issues.
* Support for Mac OS X Snow Leopard.
|-
| [[wikipedia:Microsoft Windows|Windows]]
| <code>7c782a39ed123f70594e2438eaacc95340e363e3</code>
| style="text-decoration: line-through;" class="rborderplz nobrradiusplz" | [https://mega.co.nz/#!l1UFgJiA!Ogbi6Q1GsKZZMZzEhi8w1zvlHXEh0QuDBIGdjfktHb0 Mega]
|-
! rowspan="2" | 1.0.7
| [[wikipedia:OS X|OS X]]
| <code>7f4f867a2e3739e8ee70f7bc7e47afe9871c69b6</code>
| [https://mega.co.nz/#!Y8M2VAiS!Bq4NRjrlZXE754uNqSJT90mUzwsSGMPVa2PWsp78344 Mega]
| rowspan="2" |
* Fixes Cydia sometimes not showing up
|-
| [[wikipedia:Microsoft Windows|Windows]]
| <code>868a05ba26fd679a28c3eac0c4dc2c0cbb5e9529</code>
| class="rborderplz nobrradiusplz" | [https://mega.co.nz/#!E0sESCiC!c-ulVmjoa9qtPDe0MBIQgz9D2H03NgCxjBKZmAUPKRc Mega]
|}

== Exploits ==
* [[posix_spawn kernel information leak]] (by [[i0n1c]]) (proof? what is it used for?)
* [[mach_msg_ool_descriptor_ts for heap shaping]] (proof/quotes? no information found)
* [[AMFID_code_signing_evasion]]
* [[DeveloperDiskImage race condition]] (by [[comex]]) (proof/quotes? no information found)
* [[Symbolic Link Vulnerability]]
* [[launchd.conf untether]]

== External Links ==
*[http://blog.ih8sn0w.com/2013/12/613-615-3gsa4-untether-cydia-package.html iH8sn0w's blog post on the release.]
* [http://p0sixspwn.com/ p0sixspwn]

[[Category:Hacking Software]]
[[Category:Jailbreaks]]

Jailbreak

2014-03-05T12:38:40Z

Flexpert: /* Apple TV 2G */ Seas0nPass: updated and corrected fw version support from [http://forum.firecore.com/topic/3418]

{{float toc|right}}
This is the process by which full execute and write access is obtained on all the partitions of the iPhone. It is done by patching [[/private/etc/fstab]] to mount the System partition as read-write. This is entirely different from an [[unlock]]. Jailbreaking is the first action that must be taken before things like unofficial [[activation]] (hacktivation), and unofficial unlocking can be applied.

The original jailbreak also included modifying the [[AFC]] service (used by [[iTunes]] to access the filesystem) to give full filesystem access from root. This was later updated to create a new service ([[AFC]]2) that allows access to the full filesystem.

Modern jailbreaks also include patching the kernel to get around code signing and other restrictions. See [[Kernel Patches]].

NOTE: The legality of jailbreaking your device varies with each country/region. [http://en.wikipedia.org/wiki/IOS_jailbreaking#Legal_status Wikipedia has a summary of legality for some countries.]

Version numbers are the first to jailbreak and last is the last supported version. Last will only be listed if a newer version is out that does not support the device and iOS.

==See Also==
* [[failbreak]]

== Exploits which were used in order to jailbreak 1.x ==
=== 1.0.2 ===
* [[Restore Mode]] ([[iBoot (Bootloader)|iBoot]] had a command named cp, which had access to the whole filesystem)
=== 1.1.1 ===
* [[Symlinks]] (an upgrade jailbreak)
* [[LibTiff|libtiff exploit]] (Adapted from the PSP scene, used by [[JailbreakMe]])
=== 1.1.2 ===
* [[Mknod]] (an upgrade jailbreak)
=== 1.1.3 / 1.1.4 / 1.1.5 ===
* [[Soft Upgrade]] (an upgrade jailbreak)
* [[Ramdisk Hack]]
* [[Dual Boot Exploit]] - Works up to [[iOS]] 2.0 beta 3
* [[diags]] - Works up to [[iOS]] 2.0 beta 5

== Exploits which are used in order to jailbreak 2.x ==
=== 2.0 / 2.0.1 / 2.0.2 / 2.1 ===
* [[Pwnage]] + [[Pwnage 2.0]]
=== 2.1.1 ===
* [[ARM7 Go]] ([[tethered jailbreak]])
=== 2.2 ===
* [[Pwnage]] + [[Pwnage 2.0]] ([[m68ap|iPhone]], [[n45ap|iPod touch]], and [[n82ap|iPhone 3G]])
=== 2.2.1 ===
* [[Pwnage]] + [[Pwnage 2.0]] ([[m68ap|iPhone]], [[n45ap|iPod touch]], and [[n82ap|iPhone 3G]])
* [[0x24000 Segment Overflow]] + [[ARM7 Go]] (from iOS 2.1.1) ([[n72ap|iPod touch 2G]])

== Exploits which are used in order to jailbreak 3.x ==
=== 3.0 / 3.0.1 ===
* [[Pwnage]] + [[Pwnage 2.0]] ([[m68ap|iPhone]], [[n45ap|iPod touch]], and [[n82ap|iPhone 3G]])
* [[ARM7 Go]] (from iOS 2.1.1) + [[0x24000 Segment Overflow]] ( [[n72ap|iPod touch 2G]])
* [[Pwnage]] + [[iBoot Environment Variable Overflow]] ([[m68ap|iPhone]], [[n45ap|iPod touch]], and [[n82ap|iPhone 3G]])
* [[0x24000 Segment Overflow]] + [[iBoot Environment Variable Overflow]] ([[n72ap|iPod touch 2G]] and [[n88ap|iPhone 3GS]])
=== 3.1 / 3.1.1 ===
* [[Pwnage]] + [[Pwnage 2.0]] (together for [[untethered jailbreak]] on [[m68ap|iPhone]], [[n45ap|iPod touch]], and [[n82ap|iPhone 3G]])
* [[usb_control_msg(0x21, 2) Exploit]] ([[tethered jailbreak]] on [[n72ap|iPod touch 2G]] [[Bootrom 240.5.1|new bootrom]], [[n88ap|iPhone 3GS]] [[Bootrom 359.3.2|new bootrom]], and [[n18ap|iPod touch 3G]])
* [[0x24000 Segment Overflow]] + [[usb_control_msg(0x21, 2) Exploit]] ([[n72ap|iPod touch 2G]] [[Bootrom 240.4|old bootrom]] and [[n88ap|iPhone 3GS]] [[Bootrom 359.3|old bootrom]])
=== 3.1.2 ===
* [[Pwnage]] + [[Pwnage 2.0]] (together for [[untethered jailbreak]] on [[m68ap|iPhone]], [[n45ap|iPod touch]], and [[n82ap|iPhone 3G]])
* [[usb_control_msg(0x21, 2) Exploit]] ([[tethered jailbreak]] on [[n72ap|iPod touch 2G]] [[Bootrom 240.5.1|new bootrom]], [[n88ap|iPhone 3GS]] [[Bootrom 359.3.2|new bootrom]], and [[n18ap|iPod touch 3G]])
* [[0x24000 Segment Overflow]] + [[usb_control_msg(0x21, 2) Exploit]] ([[n72ap|iPod touch 2G]] [[Bootrom 240.4|old bootrom]] and [[n88ap|iPhone 3GS]] [[Bootrom 359.3|old bootrom]])
* [[MobileBackup Copy Exploit]] + [[Incomplete Codesign Exploit]] + [[BPF_STX Kernel Write Exploit]] (all devices, used in [[Spirit]])
* [[Malformed CFF Vulnerability]] + [[Incomplete Codesign Exploit]] + [[IOSurface Kernel Exploit]] (all devices, used in [[Star]])
=== 3.1.3 ===
* [[Pwnage]] + [[Pwnage 2.0]] (together for [[untethered jailbreak]] on [[m68ap|iPhone]], [[n45ap|iPod touch]], and [[n82ap|iPhone 3G]])
* [[0x24000 Segment Overflow]] (for [[n72ap|iPod touch 2G]] and [[n88ap|iPhone 3GS]] devices with older bootroms)
** + [[Limera1n Exploit]] ([[n88ap|iPhone 3GS]] [[Bootrom 359.3|old bootrom]], used in [[sn0wbreeze]])
** + [[usb_control_msg(0xA1, 1) Exploit]] ([[n72ap|iPod touch 2G]] [[Bootrom 240.4|old bootrom]], used in [[sn0wbreeze]])
* [[usb_control_msg(0xA1, 1) Exploit]]+ [[Incomplete Codesign Exploit]] + [[BPF_STX Kernel Write Exploit]] ([[n72ap|iPod touch 2G]] [[Bootrom 240.5.1|new bootrom]], used in [[sn0wbreeze]])
* [[Limera1n Exploit]] + [[Incomplete Codesign Exploit]] + [[BPF_STX Kernel Write Exploit]] ([[N18ap|iPod touch 3G]] and [[n88ap|iPhone 3GS]] [[Bootrom 359.3.2|new bootrom]], used in [[sn0wbreeze]])
* [[MobileBackup Copy Exploit]] + [[Incomplete Codesign Exploit]] + [[BPF_STX Kernel Write Exploit]] (all devices, used in [[Spirit]])
* [[Malformed CFF Vulnerability]] + [[Incomplete Codesign Exploit]] + [[IOSurface Kernel Exploit]] (all devices, used in [[Star]])

=== 3.2 ===
* [[MobileBackup Copy Exploit]] + [[Incomplete Codesign Exploit]] + [[BPF_STX Kernel Write Exploit]] (all devices, used in [[Spirit]])
* [[Malformed CFF Vulnerability]] + [[Incomplete Codesign Exploit]] + [[IOSurface Kernel Exploit]] ([[k48ap|iPad]], used in [[Star]])
* [[Limera1n Exploit]] + [[Incomplete Codesign Exploit]] + [[BPF_STX Kernel Write Exploit]] ([[K48ap|iPad]] used in [[sn0wbreeze]] 2.9.x)
=== 3.2.1 ===
* [[Malformed CFF Vulnerability]] + [[Incomplete Codesign Exploit]] + [[IOSurface Kernel Exploit]] ([[k48ap|iPad]], used in [[Star]])
* [[Limera1n Exploit]] + [[Incomplete Codesign Exploit]] + [[IOSurface Kernel Exploit]] ([[k48ap|iPad]], used in [[sn0wbreeze]] 2.9.x)
=== 3.2.2 ===
* [[Limera1n Exploit]] + [[Packet Filter Kernel Exploit]] ([[k48ap|iPad]])

== Exploits which are used in order to jailbreak 4.x ==
=== 4.0 / 4.0.1 ===
* [[Pwnage]] + [[Pwnage 2.0]] ([[n82ap|iPhone 3G]])
* [[0x24000 Segment Overflow]] ([[n72ap|iPod touch 2G]] and [[n88ap|iPhone 3GS]] devices with older bootroms)
* [[Malformed CFF Vulnerability]] + [[Incomplete Codesign Exploit]] + [[IOSurface Kernel Exploit]] (all devices, used in [[Star]])
* [[Limera1n Exploit]] + [[Packet Filter Kernel Exploit]] ([[n88ap|iPhone 3GS]] New bootrom, [[N18ap|iPod touch 3G]], [[n90ap|iPhone 4 (iPhone3,1)]])

=== 4.0.2 ===
* [[Pwnage]] + [[Pwnage 2.0]] ([[n82ap|iPhone 3G]])
* [[ARM7 Go]] (from iOS 2.1.1) + [[0x24000 Segment Overflow]] ([[n72ap|iPod touch 2G]])
* [[0x24000 Segment Overflow]] ([[n88ap|iPhone 3GS]])
* [[limera1n]]'s bootrom exploit + [[Packet Filter Kernel Exploit]] ([[n88ap|iPhone 3GS]] [[Bootrom 359.3.2|new bootrom]], [[n18ap|iPod touch 3G]], [[n90ap|iPhone 4 (iPhone3,1)]], and [[n81ap|iPod touch 4G]])

=== 4.1 ===
* [[Pwnage]] + [[Pwnage 2.0]] (together to jailbreak the [[n82ap|iPhone 3G]])
* [[ARM7 Go]] (from iOS 2.1.1) + [[0x24000 Segment Overflow]] (together for [[untethered jailbreak]] on [[n72ap|iPod touch 2G]] [[Bootrom 240.4|old bootrom]])
* [[limera1n]]'s bootrom exploit + [[0x24000 Segment Overflow]] (together for [[untethered jailbreak]] on [[n88ap|iPhone 3GS]] [[Bootrom 359.3|old bootrom]])
* [[limera1n]]'s bootrom exploit + [[Packet Filter Kernel Exploit]] (together for [[untethered jailbreak]] on [[n88ap|iPhone 3GS]] [[Bootrom 359.3.2|new bootrom]], [[n18ap|iPod touch 3G]], [[n90ap|iPhone 4 (iPhone3,1)]], [[n81ap|iPod touch 4G]], and [[k66ap|Apple TV 2G]]))
* [[usb_control_msg(0xA1, 1) Exploit]] + [[Packet Filter Kernel Exploit]] (together for [[untethered jailbreak]] on [[n72ap|iPod touch 2G]])

=== 4.2.1 ===
* [[Pwnage]] + [[Pwnage 2.0]] (together to jailbreak the [[n82ap|iPhone 3G]])
* [[ARM7 Go]] (from iOS 2.1.1) + [[0x24000 Segment Overflow]] (together for [[untethered jailbreak]] on [[n72ap|iPod touch 2G]] [[Bootrom 240.4|old bootrom]])
* [[limera1n]]'s bootrom exploit + [[0x24000 Segment Overflow]] (together for [[untethered jailbreak]] on [[n88ap|iPhone 3GS]] [[Bootrom 359.3|old bootrom]])
* [[limera1n]]'s bootrom exploit + [[HFS Legacy Volume Name Stack Buffer Overflow]] (together for [[untethered jailbreak]] on [[n88ap|iPhone 3GS]] [[Bootrom 359.3.2|new bootrom]], [[n18ap|iPod touch 3G]], [[k48ap|iPad]], [[n90ap|iPhone 4 (iPhone3,1)]], [[n81ap|iPod touch 4G]], and [[k66ap|Apple TV 2G]])
* [[usb_control_msg(0xA1, 1) Exploit]] + [[HFS Legacy Volume Name Stack Buffer Overflow]] (together for [[untethered jailbreak]] on [[n72ap|iPod touch 2G]])

=== 4.2.6 / 4.2.7 / 4.2.8 ===
* [[limera1n]]'s bootrom exploit + [[HFS Legacy Volume Name Stack Buffer Overflow]] (together for [[untethered jailbreak]] on [[n92ap|iPhone 4 (iPhone3,3)]])
* [[T1 Font Integer Overflow]] (used for [[Saffron]])

=== 4.2.9 / 4.2.10 ===
* [[limera1n]]'s bootrom exploit (Tethered jailbreak on [[n92ap|iPhone 4 (iPhone3,3)]])

=== 4.3 ===
* [[limera1n]]'s bootrom exploit + [[0x24000 Segment Overflow]] (together for [[untethered jailbreak]] on [[n88ap|iPhone 3GS]] [[Bootrom 359.3|old bootrom]])
* [[limera1n]]'s bootrom exploit ([[tethered jailbreak]] on [[n88ap|iPhone 3GS]] [[Bootrom 359.3.2|new bootrom]], [[n18ap|iPod touch 3G]], [[k48ap|iPad]], [[n90ap|iPhone 4 (iPhone3,1)]], [[n81ap|iPod touch 4G]], and [[k66ap|Apple TV 2G]])
* [[T1 Font Integer Overflow]] (used for [[Saffron]])

=== 4.3.1 / 4.3.2 / 4.3.3 ===
* [[limera1n]]'s bootrom exploit + [[0x24000 Segment Overflow]] (together for [[untethered jailbreak]] on [[n88ap|iPhone 3GS]] [[Bootrom 359.3|old bootrom]])
* [[limera1n]]'s bootrom exploit + [[ndrv_setspec() Integer Overflow]] (together for [[untethered jailbreak]] on [[n88ap|iPhone 3GS]] [[Bootrom 359.3.2|new bootrom]], [[n18ap|iPod touch 3G]], [[k48ap|iPad]], [[n90ap|iPhone 4 (iPhone3,1)]], and [[n81ap|iPod touch 4G]])
* [[T1 Font Integer Overflow]] (used for [[Saffron]])

=== 4.3.4 / 4.3.5 ===
* [[limera1n]]'s bootrom exploit + [[0x24000 Segment Overflow]] (together for [[untethered jailbreak]] on [[n88ap|iPhone 3GS]] with [[Bootrom 359.3|old bootrom]])
* [[limera1n]]'s bootrom exploit (Tethered jailbreak) on [[n88ap|iPhone 3GS]] with [[Bootrom 359.3.2|new bootrom]], [[n18ap|iPod touch 3G]], [[k48ap|iPad]], [[n90ap|iPhone 4 (iPhone3,1)]], and [[n81ap|iPod touch 4G]])

== Exploits which are used in order to jailbreak 5.x ==
=== 5.0 ===
* [[limera1n]]'s bootrom exploit + [[0x24000 Segment Overflow]] (together for [[untethered jailbreak]] on [[n88ap|iPhone 3GS]] with [[Bootrom 359.3|old bootrom]])
* [[limera1n]]'s bootrom exploit (Tethered jailbreak) on [[n88ap|iPhone 3GS]] with [[Bootrom 359.3.2|new bootrom]], [[n18ap|iPod touch 3G]], [[k48ap|iPad]], [[iPhone 4]], and [[n81ap|iPod touch 4G]])
* [[Racoon String Format Overflow Exploit]] (used both for payload injection and untether)+[[HFS Heap Overflow]]- [[n94ap|iPhone 4S]] only

===5.0.1===
* [[limera1n]]'s bootrom exploit + [[0x24000 Segment Overflow]] (together for [[untethered jailbreak]] on [[n88ap|iPhone 3GS]] with [[Bootrom 359.3|old bootrom]])
* [[limera1n]]'s bootrom exploit + [[Racoon String Format Overflow Exploit]]+[[HFS Heap Overflow]] on [[n88ap|iPhone 3GS]] with [[Bootrom 359.3.2|new bootrom]], [[n18ap|iPod touch 3G]], [[k48ap|iPad]], [[iPhone 4]], and [[n81ap|iPod touch 4G]])
* [[Racoon String Format Overflow Exploit]] (used both for payload injection and untether)+[[HFS Heap Overflow]] - [[iPad 2]] and [[iPhone 4S]] with [[Absinthe]]

===5.1===
* [[limera1n]]'s bootrom exploit (Tethered jailbreak) on [[n88ap|iPhone 3GS]] with [[Bootrom 359.3.2|new bootrom]], [[n18ap|iPod touch 3G]], [[k48ap|iPad]], [[iPhone 4]], and [[n81ap|iPod touch 4G]])
* [[limera1n]]'s bootrom exploit + [[0x24000 Segment Overflow]] (together for [[untethered jailbreak]] on [[n88ap|iPhone 3GS]] with [[Bootrom 359.3|old bootrom]])

===5.1.1===
* [[limera1n Exploit]] + [[0x24000 Segment Overflow]] (together for [[untethered jailbreak]] on [[n88ap|iPhone 3GS]] with [[Bootrom 359.3|old bootrom]])
* [[limera1n Exploit]] + [[Rocky Racoon]] (together for [[untethered jailbreak]] on [[n88ap|iPhone 3GS]] with [[Bootrom 359.3.2|new bootrom]], [[iPhone 4]], [[n18ap|iPod touch 3G]], and [[n81ap|iPod touch 4G]])

== Exploits which are used in order to jailbreak 6.x ==
=== 6.0 / 6.0.1 / 6.0.2 / 6.1 / 6.1.1 / 6.1.2 ===
* [[limera1n]]'s bootrom exploit (Tethered jailbreak) on [[n88ap|iPhone 3GS]] with [[Bootrom 359.3.2|new bootrom]], [[iPhone 4]], and [[n81ap|iPod touch 4G]])
* [[limera1n]]'s bootrom exploit + [[0x24000 Segment Overflow]] (together for [[untethered jailbreak]] on [[n88ap|iPhone 3GS]] with [[Bootrom 359.3|old bootrom]])
* [[Symbolic Link Vulnerability]]
* [[Timezone Vulnerability]]
* [[Shebang Trick]]
* [[AMFID code signing evasion]]
* [[launchd.conf untether]]
* [[IOUSBDeviceFamily Vulnerability]]
* [[ARM Exception Vector Info Leak]]
* [[dynamic memmove() locating]]
* [[vm_map_copy_t corruption for arbitrary memory disclosure]]
* [[kernel memory write via ROP gadget]]

== Exploits which are used in order to jailbreak 7.x ==
* ?

== Jailbreak Tools ==
==== [[k66ap|Apple TV 2G]] ====
{| class="wikitable" style="font-size: smaller; text-align: center;"
|-
! rowspan="2" | [[Jailbreak]] Tool
! colspan="25" | Works with [[firmware]]...
|-
| [[Mojave 8M89 (Apple TV 2G)|4.0/4.1]]
| [[Jasper 8C150 (Apple TV 2G)|4.1/4.2]]
| [[Jasper 8C154 (Apple TV 2G)|4.1.1/4.2.1]]
| [[Durango 8F191m (Apple TV 2G)|4.2/4.3]]
| [[DurangoTide 8F202 (Apple TV 2G)|4.2.1/4.3]]
| [[DurangoTide 8F305 (Apple TV 2G)|4.2.2/4.3]]
| [[DurangoTideCuba 8F455 (Apple TV 2G)‎|4.3]]
| [[Telluride 9A334v (Apple TV 2G)|4.4/5.0]]
| [[Telluride 9A335a (Apple TV 2G)|4.4.1/5.0]]
| [[Telluride 9A336a (Apple TV 2G)|4.4.2/5.0]]
| [[Telluride 9A405l (Apple TV 2G)|4.4.3/5.0.1]]
| [[Telluride 9A406a (Apple TV 2G)|4.4.4/5.0.1]]
| [[Hoodoo 9B179b (Apple TV 2G)|5.0/5.1]]
| [[Hoodoo 9B206f (Apple TV 2G)|5.0.1/5.1.1]]
| [[HoodooTide 9B830 (Apple TV 2G)|5.0.2/5.1.1]]
| [[Sundance 10A406e (Apple TV 2G)|5.1/6.0]]
| [[SundanceTide 10A801 (Apple TV 2G)|5.1.1/6.0.1]]
| [[Brighton 10B144b (Apple TV 2G)|5.2/6.1]]
| [[BrightonMaps 10B329a (Apple TV 2G)|5.2.1/6.1.3]]
| [[BrightonTide 10B809 (Apple TV 2G)|5.3/6.1.4]]
| [[Innsbruck 11A470a (Apple TV 2G)|6.0/7.0.1]]
| [[Innsbruck 11A502 (Apple TV 2G)|6.0/7.0.2]]
| [[InnsbruckTaos 11B511d (Apple TV 2G)|6.0.1/7.0.3]]
| [[InnsbruckTaos 11B554a (Apple TV 2G)|6.0.2/7.0.4]]
| [[InnsbruckTaos 11B651 (Apple TV 2G)|6.0.2/7.0.6]]
|-
| [[evasi0n]]
| colspan="15" {{no}}
| colspan="3" {{yes|1.0}}
| colspan="7" {{no}}
|-
| [[Greenpois0n (jailbreak)|greenpois0n]]
| {{partial|no package management GUI}}
| {{no}}
| {{yes|RC6-RC6.1}}
| colspan="22" {{no}}
|-
| [[limera1n]]
| {{partial|no package management GUI}}
| colspan="24" {{no}}
|-
| [[p0sixspwn]]
| colspan="18" {{no}}
| colspan="2" {{yes|1.0}}
| colspan="5" {{no}}
|-
| [[PwnageTool]]
| {{partial|no package management GUI}}
| {{partial|Restore from a custom firmware with unofficial bundle1}}
| {{yes|4.2}}
| {{no}}
| {{yes|4.3-4.3.3.1}}
| {{yes|4.3-4.3.3.12}}
| colspan="7" {{no}}
| {{partial|5.1.1 (no package management GUI)}}
| colspan="11" {{no}}
|-
| [[redsn0w]]
| colspan="4" {{no}}
| {{yes|0.9.6rc16}}
| colspan="10" {{no}}
| {{yes|0.9.15b11}}
| colspan="5" {{yes|0.9.15b33}}
| colspan="4" {{no}}
|-
| [[Seas0nPass]] (Mac)
| {{yes|??? -}}
| {{yes|??? -}}
| {{yes|0.6.7 -}}
| {{yes|0.7.2 -}}
| {{yes|0.7.3 -}}
| {{yes|0.7.6.??? -}}
| {{yes|0.7.8.??? -}}
| {{yes|0.7.9.???1 -}}
| {{yes|0.7.9.2101 -}}
| {{yes|0.7.9.2301 -}}
| {{yes|0.7.9.270 -}}
| {{yes|0.7.9.290 -}}
| {{yes|0.8.3.4701 -}}
| {{yes|0.8.4.518 -}}
| {{yes|0.8.6.565 -}}
| {{yes|0.8.? -}}
| {{yes|0.8.? -}}
| {{yes|0.8.9.655 -}}
| {{yes|0.9.?1 -}}
| {{yes|0.9.5 -}}
| colspan="6" {{no}}
|-
| [[Seas0nPass]] (Windows)
| {{yes|??? -}}
| {{yes|??? -}}
| {{yes|??? -}}
| {{yes|??? -}}
| {{yes|0.3.7.???? -}}
| {{yes|0.3.13.???? -}}
| {{yes|0.3.29.???? -}}
| colspan="2" {{yes|0.3.37.????1 -}}
| {{yes|0.3.42.33351 -}}
| {{yes|0.3.44.???? -}}
| {{yes|0.3.45.4035 -}}
| {{yes|0.8.3.55921}}
| {{yes|0.8.4.6306 -}}
| {{yes|0.8.6.7558 -}}
| {{yes|0.8.? -}}
| {{yes|0.8.? -}}
| {{yes|0.8.9.11241 -}}
| {{yes|0.9.?1 -}}
| {{yes|0.9.5 -}}
| colspan="6" {{no}}
|-
| [[sn0wbreeze]]
| {{partial|no package management GUI}}
| colspan="3" {{no}}
| {{yes|2.5-2.7.1}}
| colspan="10" {{no}}
| colspan="3" {{yes|2.9.8}}
| colspan="7" {{no}}
|-
| [[unthredera1n]]
| {{partial|no package management GUI}}
| colspan="14" {{yes}}
| colspan="10" {{no}}
|}
1 [[Tethered jailbreak]]. 
2 User needs to manually add [[PwnageTool]] firmware bundle into application. 
3 Point at 6.0 IPSW. Also [[Tethered jailbreak]].

==== [[j33ap|Apple TV 3G (AppleTV3,1)]] ====
{| class="wikitable" style="font-size: smaller; text-align: center;"
|-
! rowspan="2" | [[Jailbreak]] Tool
! colspan="13" | Works with [[firmware]]...
|-
| 5.0/5.1
| 5.0.1/5.1
| 5.0.2/5.1.1
| 5.1/6.0
| 5.1.1/6.0.1
| 5.2/6.1
| 5.2.1/6.1.3
| 5.3/6.1.4
| 6.0/7.0.1
| 6.0/7.0.2
| 6.0.1/7.0.3
| 6.0.2/7.0.4
| 6.0.2/7.0.6
|-
| [[Absinthe]]
| colspan="13" {{no}}
|-
| [[evasi0n]]
| colspan="13" {{no}}
|-
| [[redsn0w]]
| colspan="13" {{no}}
|-
| [[Seas0npass]]
| colspan="13" {{no}}
|-
| [[Sn0wbreeze]]
| colspan="13" {{no}}
|}

==== [[j33iap|Apple TV 3G (AppleTV3,2)]] ====
{| class="wikitable" style="font-size: smaller; text-align: center;"
|-
! rowspan="2" | [[Jailbreak]] Tool
! colspan="8" | Works with [[firmware]]...
|-
| 5.2/6.1
| 5.2.1/6.1.3
| 5.3/6.1.4
| 6.0/7.0.1
| 6.0/7.0.2
| 6.0.1/7.0.3
| 6.0.2/7.0.4
| 6.0.2/7.0.6
|-
| [[Absinthe]]
| colspan="8" {{no}}
|-
| [[evasi0n]]
| colspan="8" {{no}}
|-
| [[redsn0w]]
| colspan="8" {{no}}
|-
| [[Seas0npass]]
| colspan="8" {{no}}
|-
| [[Sn0wbreeze]]
| colspan="8" {{no}}
|}

{{:Jailbreak/Deprecated iPads}}

=== [[iPad 2]] ===
{| class="wikitable" style="font-size: smaller; text-align: center;"
|-
! rowspan="2" | [[Jailbreak]] Tool
! colspan="20" | Works with [[firmware]]...
|-
| 4.3
| 4.3.1
| 4.3.2
| 4.3.3
| 4.3.4
| 4.3.5
| 5.0
| 5.0.1
| 5.1
| 5.1.1
| 6.0
| 6.0.1
| 6.1
| 6.1.2
| 6.1.3
| 7.0
| 7.0.2
| 7.0.3
| 7.0.4
| 7.0.6
|-
| [[Absinthe]]
| colspan="7" {{no}}
| {{yes|0.2-0.4}}
| {{no}}
| {{yes|2.01-2.0.4}}
| colspan="10" {{no}}
|-
| [[evasi0n]]
| colspan="10" {{no}}
| colspan="3" {{yes|1.0}}
| {{yes|1.4}}
| colspan="6" {{no}}
|-
| [[evasi0n7]]
| colspan="15" {{no}}
| colspan="4" {{yes|1.0.0}}
| {{yes|1.0.6}}
|-
| [[p0sixspwn]]
| colspan="14" {{no}}
| {{yes|1.0}}
| colspan="5" {{no}}
|-
| [[redsn0w]]
| colspan="7" {{no}}
| {{yes|0.9.10b7-0.9.11b4}}
| {{no}}
| {{yes|0.9.12b1}}
| colspan="10" {{no}}
|-
| [[Saffron]]
| colspan="3" {{no}}
| {{yes}}
| colspan="16" {{no}}
|}
1 Not compatible with [[k93aap|iPad2,4]]

=== [[iPad 3]] ===
{| class="wikitable" style="font-size: smaller; text-align: center;"
|-
! rowspan="2" | [[Jailbreak]] Tool
! colspan="12" | Works with [[firmware]]...
|-
| 5.1
| 5.1.1
| 6.0
| 6.0.1
| 6.1
| 6.1.2
| 6.1.3
| 7.0
| 7.0.2
| 7.0.3
| 7.0.4
| 7.0.6
|-
| [[Absinthe]]
| {{no}}
| {{yes|2.0-2.0.4}}
| colspan="10" {{no}}
|-
| [[evasi0n]]
| colspan="2" {{no}}
| colspan="3" {{yes|1.0}}
| {{yes|1.4}}
| colspan="6" {{no}}
|-
| [[evasi0n7]]
| colspan="7" {{no}}
| colspan="4" {{yes|1.0.0}}
| {{yes|1.0.6}}
|-
| [[p0sixspwn]]
| colspan="6" {{no}}
| {{yes|1.0}}
| colspan="5" {{no}}
|-
| [[redsn0w]]
| {{no}}
| {{yes|0.9.12b1}}
| colspan="10" {{no}}
|}

=== [[iPad 4]] ===
{| class="wikitable" style="font-size: smaller; text-align: center;"
|-
! rowspan="2" | [[Jailbreak]] Tool
! colspan="10" | Works with [[firmware]]...
|-
| 6.0
| 6.0.1
| 6.1
| 6.1.2
| 6.1.3
| 7.0
| 7.0.2
| 7.0.3
| 7.0.4
| 7.0.6
|-
| [[evasi0n]]
| colspan="3" {{yes|1.0}}
| {{yes|1.4}}
| colspan="6" {{no}}
|-
| [[evasi0n7]]
| colspan="5" {{no}}
| colspan="4" {{yes|1.0.0}}
| {{yes|1.0.6}}
|-
| [[p0sixspwn]]
| colspan="4" {{no}}
| {{yes|1.0}}
| colspan="5" {{no}}
|}

=== [[iPad Air]] ===
{| class="wikitable" style="font-size: smaller; text-align: center;"
|-
! rowspan="2" | [[Jailbreak]] Tool
! colspan="3" | Works with [[firmware]]...
|-
| 7.0.3
| 7.0.4
| 7.0.6
|-
| [[evasi0n7]]
| colspan="2" {{yes|1.0.0}}
| {{yes|1.0.6}}
|}

=== [[iPad mini 1G]] ===
{| class="wikitable" style="font-size: smaller; text-align: center;"
|-
! rowspan="2" | [[Jailbreak]] Tool
! colspan="11" | Works with [[firmware]]...
|-
| 6.0
| 6.0.1
| 6.0.2
| 6.1
| 6.1.2
| 6.1.3
| 7.0
| 7.0.2
| 7.0.3
| 7.0.4
| 7.0.6
|-
| [[evasi0n]]
| colspan="4" {{yes|1.0}}
| {{yes|1.4}}
| colspan="6" {{no}}
|-
| [[evasi0n7]]
| colspan="6" {{no}}
| colspan="4" {{yes|1.0.0}}
| {{yes|1.0.6}}
|-
| [[p0sixspwn]]
| colspan="5" {{no}}
| {{yes|1.0}}
| colspan="5" {{no}}
|}

=== [[iPad mini 2G]] ===
{| class="wikitable" style="font-size: smaller; text-align: center;"
|-
! rowspan="2" | [[Jailbreak]] Tool
! colspan="3" | Works with [[firmware]]...
|-
| 7.0.3
| 7.0.4
| 7.0.6
|-
| [[evasi0n7]]
| colspan="2" {{yes|1.0.0}}
| {{yes|1.0.6}}
|}

{{:Jailbreak/Deprecated iPhones}}

=== [[N90ap|iPhone 4 (iPhone3,1)]] ===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
! rowspan="2" | [[Jailbreak]] Tool
! colspan="26" | Works with [[firmware]]...
|-
| [[Apex 8A293 (iPhone3,1)|4.0]]
| [[Apex 8A306 (iPhone3,1)|4.0.1]]
| [[Apex 8A400 (iPhone3,1)|4.0.2]]
| [[Baker 8B117 (iPhone3,1)|4.1]]
| [[Jasper 8C148 (iPhone3,1)|4.2.1]]
| [[Durango 8F190 (iPhone3,1)|4.3]]
| [[Durango 8G4 (iPhone3,1)|4.3.1]]
| [[Durango 8H7 (iPhone3,1)|4.3.2]]
| [[Durango 8J2 (iPhone3,1)|4.3.3]]
| [[Durango 8K2 (iPhone3,1)|4.3.4]]
| [[Durango 8L1 (iPhone3,1)|4.3.5]]
| [[Telluride 9A334 (iPhone3,1)|5.0]]
| [[Telluride 9A405 (iPhone3,1)|5.0.1]]
| [[Hoodoo 9B176 (iPhone3,1)|5.1]]
| [[Hoodoo 9B206 (iPhone3,1)|5.1.1 (9B206)]]
| [[Hoodoo 9B208 (iPhone3,1)|5.1.1 (9B208)]]
| [[Sundance 10A403 (iPhone3,1)|6.0]]
| [[Sundance 10A523 (iPhone3,1)|6.0.1]]
| [[Brighton 10B144 (iPhone3,1)|6.1]]
| [[Brighton 10B146 ()|6.1.2]]
| [[BrightonMaps 10B329 (iPhone3,1)|6.1.3]]
| [[Innsbruck 11A465 (iPhone3,1)|7.0]]
| [[Innsbruck 11A501 (iPhone3,1)|7.0.2]]
| [[InnsbruckTaos 11B511 (iPhone3,1)|7.0.3]]
| [[InnsbruckTaos 11B554a (iPhone3,1)|7.0.4]]
| [[InnsbruckTaos 11B651 (iPhone3,1)|7.0.6]]
|-
| [[Absinthe]]
| colspan="14" {{no}}
| {{yes|2.0}}
| {{yes|2.0.2}}
| colspan="10" {{no}}
|-
| [[evasi0n]]
| colspan="16" {{no}}
| colspan="3" {{yes|1.0}}
| {{yes|1.4}}
| colspan="6" {{no}}
|-
| [[evasi0n7]]
| colspan="21" {{no}}
| colspan="4" {{yes|1.0.0}}
| {{yes|1.0.6}}
|-
| [[Greenpois0n (jailbreak)|greenpois0n]]
| colspan="3" {{no}}
| {{yes|RC4}}
| {{yes|RC5-RC6.1}}
| colspan="21" {{no}}
|-
| [[limera1n]]
| colspan="4" {{yes}}
| colspan="22" {{no}}
|-
| [[p0sixspwn]]
| colspan="20" {{no}}
| {{yes|1.0}}
| colspan="5" {{no}}
|-
| [[PwnageTool]]
| colspan="3" {{no}}
| {{yes|4.1-4.1.3}}
| {{yes|4.2}}
| {{partial|4.21 3}}
| {{yes|4.3}}
| {{yes|4.3.2}}
| {{yes|4.3.3-4.3.3.1}}
| colspan="3" {{partial|4.3.31 3}}
| {{yes|5.0.1}}
| {{no}}
| colspan="2" {{yes|5.1.1}}
| colspan="10" {{no}}
|-
| [[redsn0w]]
| colspan="3" {{no}}
| {{yes|0.9.6b2-0.9.6rc16}}
| {{partial|0.9.6b41-0.9.6rc16 or 0.9.7b61 2}}
| {{partial|0.9.6rc91-0.9.6rc161}}
| {{partial|0.9.6rc91-0.9.6rc16}}
| {{partial|0.9.6rc131-0.9.6rc16}}
| {{yes|0.9.6rc16}}
| {{partial|0.9.8b31}}
| {{partial|0.9.8b71}}
| {{partial|0.9.9b31}}
| {{yes|0.9.10b6}}
| {{partial|0.9.10b61}}
| colspan="2" {{yes|0.9.12b1-0.9.14b2}}
| {{partial|0.9.15b11}}
| colspan="4" {{partial|0.9.15b14}}
| colspan="5" {{no}}
|-
| [[Saffron]]
| colspan="5" {{no}}
| colspan="4" {{yes}}
| colspan="17" {{no}}
|-
| [[sn0wbreeze]]
| colspan="3" {{no}}
| {{yes|2.1}}
| {{yes|2.2}}
| {{partial|2.3b41}}
| {{yes|2.5}}
| {{yes|2.6-2.6.1}}
| {{yes|2.7-2.7.1}}
| colspan="2" {{no}}
| {{partial|2.8b81}}
| {{yes|2.9.1}}
| {{no}}
| colspan="2" {{yes|2.9.6}}
| colspan="3" {{yes|2.9.8}}
| {{yes|2.9.10}}
| {{partial|2.9.141}}
| colspan="5" {{no}}
|-
| [[Star]]
| colspan="2" {{yes}}
| colspan="24" {{no}}
|-
| [[unthredera1n]]
| colspan="5" {{no}}
| colspan="11" {{yes}}
| colspan="10" {{no}}
|}
1 [[Tethered jailbreak]]. 
2 If [[SHSH]]s were saved for iOS 4.2b3 and if you have a developer access to its IPSW, [[Jailbreak Monte]] can be used. 
3 Requires an unofficial firmware bundle. 
4 Requires pointing [[redsn0w]] at 6.0 [[IPSW File Format|IPSW]]. Also [[Tethered jailbreak]].

=== [[N90bap|iPhone 4 (iPhone3,2)]] ===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
! rowspan="2" | [[Jailbreak]] Tool
! colspan="10" | Works with [[firmware]]...
|-
| [[Sundance 10A403 (iPhone3,2)|6.0]]
| [[Sundance 10A523 (iPhone3,2)|6.0.1]]
| [[Brighton 10B144 (iPhone3,2)|6.1]]
| [[Brighton 10B146 (iPhone3,2)|6.1.2]]
| [[BrightonMaps 10B329 (iPhone3,2)|6.1.3]]
| [[Innsbruck 11A465 (iPhone3,2)|7.0]]
| [[Innsbruck 11A501 (iPhone3,2)|7.0.2]]
| [[InnsbruckTaos 11B511 (iPhone3,2)|7.0.3]]
| [[InnsbruckTaos 11B554a (iPhone3,2)|7.0.4]]
| [[InnsbruckTaos 11B651 (iPhone3,2)|7.0.6]]
|-
| [[evasi0n]]
| colspan="3" {{yes|1.0}}
| {{yes|1.4}}
| colspan="6" {{no}}
|-
| [[evasi0n7]]
| colspan="5" {{no}}
| colspan="4" {{yes|1.0.0}}
| {{yes|1.0.6}}
|-
| [[p0sixspwn]]
| colspan="4" {{no}}
| {{yes|1.0}}
| colspan="5" {{no}}
|-
| [[redsn0w]]
| colspan="5" {{partial|0.9.15b3}}
| colspan="5" {{no}}
|-
| [[sn0wbreeze]]
| colspan="3" {{yes|2.9.8}}
| {{yes|2.9.10}}
| {{partial|2.9.141}}
| colspan="5" {{no}}
|}

Must point [[redsn0w]] at the 6.0 IPSW. Tethered.

=== [[N92ap|iPhone 4 (iPhone3,3)]] ===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
! rowspan="2" | [[Jailbreak]] Tool
! colspan="20" | Works with [[firmware]]...
|-
| [[Phoenix 8E128 (iPhone3,3)|4.2.5]]
| [[Phoenix 8E200 (iPhone3,3)|4.2.6]]
| [[Phoenix 8E303 (iPhone3,3)|4.2.7]]
| [[Phoenix 8E401 (iPhone3,3)|4.2.8]]
| [[Phoenix 8E501 (iPhone3,3)|4.2.9]]
| [[Phoenix 8E600 (iPhone3,3)|4.2.10]]
| [[Telluride 9A334 (iPhone3,3)|5.0]]
| [[Telluride 9A405 (iPhone3,3)|5.0.1]]
| [[Hoodoo 9B176 (iPhone3,3)|5.1]]
| [[Hoodoo 9B206 (iPhone3,3)|5.1.1]]
| [[Sundance 10A403 (iPhone3,3)|6.0]]
| [[Sundance 10A523 (iPhone3,3)|6.0.1]]
| [[Brighton 10B141 (iPhone3,3)|6.1]]
| [[Brighton 10B146 (iPhone3,3)|6.1.2]]
| [[BrightonMaps 10B329 (iPhone3,3)|6.1.3]]
| [[Innsbruck 11A465 (iPhone3,3)|7.0]]
| [[Innsbruck 11A501 (iPhone3,3)|7.0.2]]
| [[InnsbruckTaos 11B511 (iPhone3,3)|7.0.3]]
| [[InnsbruckTaos 11B554a (iPhone3,3)|7.0.4]]
| [[InnsbruckTaos 11B651 (iPhone3,3)|7.0.6]]
|-
| [[Absinthe]]
| colspan="7" {{no}}
| {{yes|2.0}}
| {{no}}
| {{yes|2.0}}
| colspan="10" {{no}}
|-
| [[evasi0n]]
| colspan="10" {{no}}
| colspan="3" {{yes|1.0}}
| {{yes|1.4}}
| colspan="6" {{no}}
|-
| [[evasi0n7]]
| colspan="15" {{no}}
| colspan="4" {{yes|1.0.0}}
| {{yes|1.0.6}}
|-
| [[Greenpois0n (jailbreak)|greenpois0n]]
| {{no}}
| {{yes|RC5 b4-RC6.1}}
| colspan="18" {{no}}
|-
| [[p0sixspwn]]
| colspan="14" {{no}}
| {{yes|1.0}}
| colspan="5" {{no}}
|-
| [[PwnageTool]]
| {{no}}
| {{yes|4.2}}
| {{no}}
| {{yes|4.22}}
| colspan="3" {{no}}
| {{yes|5.0.1}}
| colspan="12" {{no}}
|-
| [[redsn0w]]
| {{no}}
| {{yes|0.9.6rc9-0.9.10b8b}}
| {{yes|0.9.8b2-0.9.10b8b}}
| {{yes|0.9.6rc18-0.9.10b8b}}
| {{partial|0.9.8b31-0.9.10b8b1}}
| {{partial|0.9.8b71-0.9.10b8b1}}
| {{partial|0.9.9b31-0.9.10b8b1}}
| {{partial|0.9.9b91-0.9.10b8b}}
| {{partial|0.9.10b61-0.9.10b8b1}}
| {{yes|0.9.12b1}}
| {{partial|0.9.14b11}}
| colspan="4" {{partial|0.9.15b33}}
| colspan="5" {{no}}
|-
| [[Saffron]]
| {{no}}
| colspan="3" {{yes}}
| colspan="16" {{no}}
|-
| [[sn0wbreeze]]
| {{no}}
| {{yes|2.2-2.9.3}}
| {{yes|2.6-2.9.3}}
| {{yes|2.7-2.9.3}}
| colspan="2" {{no}}
| {{partial|2.8b91-2.9.31}}
| {{partial|2.8b111-2.9.3}}
| {{partial|2.9.21-2.9.31}}
| {{yes|2.9.7}}
| colspan="3" {{yes|2.9.8}}
| {{yes|2.9.10}}
| {{partial|2.9.141}}
| colspan="5" {{no}}
|-
| [[unthredera1n]]
| {{no}}
| colspan="9" {{yes}}
| colspan="10" {{no}}
|}
1 [[Tethered jailbreak]]. 
2 Requires unofficial bundle. 
3 Requires pointing [[redsn0w]] at 6.0 [[IPSW File Format|IPSW]]. Also [[Tethered jailbreak]].

=== [[N94ap|iPhone 4S]] ===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
! rowspan="2" | [[Jailbreak]] Tool
! colspan="16" | Works with [[firmware]]...
|-
| 5.0
| 5.0.1 (9A405)
| [[Telluride 9A406 (iPhone 4S)|5.0.1 (9A406)]]
| 5.1
| 5.1.1
| 6.0
| 6.0.1
| 6.1
| 6.1.1
| 6.1.2
| 6.1.3
| 7.0
| 7.0.2
| 7.0.3
| 7.0.4
| 7.0.6
|-
| [[Absinthe]]
| colspan="3" {{yes|0.1.2-1}}
| {{no}}
| {{yes|2.0}}
| colspan="11" {{no}}
|-
| [[evasi0n]]
| colspan="5" {{no}}
| colspan="3" {{yes|1.0}}
| {{yes|1.3}}
| {{yes|1.4}}
| colspan="7" {{no}}
|-
| [[evasi0n7]]
| colspan="11" {{no}}
| colspan="4" {{yes|1.0.0}}
| {{yes|1.0.6}}
|-
| [[p0sixspwn]]
| colspan="10" {{no}}
| {{yes|1.0}}
| colspan="5" {{no}}
|-
| [[redsn0w]]
| {{no}}
| {{yes|0.9.10b7}}
| {{yes|0.9.11b2}}
| {{no}}
| {{yes|0.9.12b1}}
| colspan="11" {{no}}
|}

=== [[iPhone 5]] ===
{| class="wikitable" style="font-size: smaller; text-align: center;"
|-
! rowspan="2" | [[Jailbreak]] Tool
! colspan="13" | Works with [[firmware]]...
|-
| 6.0
| 6.0.1
| 6.0.2
| 6.1
| 6.1.2
| 6.1.3
| 6.1.4
| 7.0
| 7.0.2
| 7.0.3
| 7.0.4
| 7.0.6
|-
| [[evasi0n]]
| colspan="5" {{yes|1.0}}
| {{yes|1.4}}
| colspan="7" {{no}}
|-
| [[evasi0n7]]
| colspan="7" {{no}}
| colspan="4" {{yes|1.0.0}}
| {{yes|1.0.6}}
|-
| [[p0sixspwn]]
| colspan="5" {{no}}
| colspan="2" {{yes|1.0}}
| colspan="6" {{no}}
|}

=== [[n48ap|iPhone 5c (iPhone5,3)]] ===
{| class="wikitable" style="font-size: smaller; text-align: center;"
|-
! rowspan="2" | [[Jailbreak]] Tool
! colspan="6" | Works with [[firmware]]...
|-
| 7.0
| 7.0.1
| 7.0.2
| 7.0.3
| 7.0.4
| 7.0.6
|-
| [[evasi0n7]]
| colspan="5" {{yes|1.0.0}}
| {{yes|1.0.6}}
|}

=== [[n49ap|iPhone 5c (iPhone5,4)]] ===
{| class="wikitable" style="font-size: smaller; text-align: center;"
|-
! rowspan="2" | [[Jailbreak]] Tool
! colspan="7" | Works with [[firmware]]...
|-
| 7.0
| 7.0.1
| 7.0.2
| 7.0.3
| 7.0.4
| 7.0.5
| 7.0.6
|-
| [[evasi0n7]]
| colspan="5" {{yes|1.0.0}}
| {{yes|1.0.5}}
| {{yes|1.0.6}}
|}

=== [[n51ap|iPhone 5s (iPhone6,1)]] ===
{| class="wikitable" style="font-size: smaller; text-align: center;"
|-
! rowspan="2" | [[Jailbreak]] Tool
! colspan="6" | Works with [[firmware]]...
|-
| 7.0
| 7.0.1
| 7.0.2
| 7.0.3
| 7.0.4
| 7.0.6
|-
| [[evasi0n7]]
| colspan="5" {{yes|1.0.0}}
| {{yes|1.0.6}}
|}

=== [[n53ap|iPhone 5s (iPhone6,2)]] ===
{| class="wikitable" style="font-size: smaller; text-align: center;"
|-
! rowspan="2" | [[Jailbreak]] Tool
! colspan="7" | Works with [[firmware]]...
|-
| 7.0
| 7.0.1
| 7.0.2
| 7.0.3
| 7.0.4
| 7.0.5
| 7.0.6
|-
| [[evasi0n7]]
| colspan="5" {{yes|1.0.0}}
| {{yes|1.0.5}}
| {{yes|1.0.6}}
|}

{{:Jailbreak/Deprecated iPod touches}}

=== [[iPod touch 5G]] ===
{| class="wikitable" style="font-size: smaller; text-align: center;"
|-
! rowspan="2" | [[Jailbreak]] Tool
! colspan="10" | Works with [[firmware]]...
|-
| 6.0
| 6.0.1
| 6.1
| 6.1.2
| 6.1.3
| 7.0
| 7.0.2
| 7.0.3
| 7.0.4
| 7.0.6
|-
| [[evasi0n]]
| colspan="3" {{yes|1.0}}
| {{yes|1.4}}
| colspan="6" {{no}}
|-
| [[evasi0n7]]
| colspan="5" {{no}}
| colspan="4" {{yes|1.0.0}}
| {{yes|1.0.6}}
|-
| [[p0sixspwn]]
| colspan="4" {{no}}
| {{yes|1.0}}
| colspan="5" {{no}}
|}

Jailbreak

2014-03-05T11:42:52Z

Flexpert: /* Apple TV 2G */ switch fw name order to marketing-version/iOS-version for fw<4.3 to match the rest

{{float toc|right}}
This is the process by which full execute and write access is obtained on all the partitions of the iPhone. It is done by patching [[/private/etc/fstab]] to mount the System partition as read-write. This is entirely different from an [[unlock]]. Jailbreaking is the first action that must be taken before things like unofficial [[activation]] (hacktivation), and unofficial unlocking can be applied.

The original jailbreak also included modifying the [[AFC]] service (used by [[iTunes]] to access the filesystem) to give full filesystem access from root. This was later updated to create a new service ([[AFC]]2) that allows access to the full filesystem.

Modern jailbreaks also include patching the kernel to get around code signing and other restrictions. See [[Kernel Patches]].

NOTE: The legality of jailbreaking your device varies with each country/region. [http://en.wikipedia.org/wiki/IOS_jailbreaking#Legal_status Wikipedia has a summary of legality for some countries.]

Version numbers are the first to jailbreak and last is the last supported version. Last will only be listed if a newer version is out that does not support the device and iOS.

==See Also==
* [[failbreak]]

== Exploits which were used in order to jailbreak 1.x ==
=== 1.0.2 ===
* [[Restore Mode]] ([[iBoot (Bootloader)|iBoot]] had a command named cp, which had access to the whole filesystem)
=== 1.1.1 ===
* [[Symlinks]] (an upgrade jailbreak)
* [[LibTiff|libtiff exploit]] (Adapted from the PSP scene, used by [[JailbreakMe]])
=== 1.1.2 ===
* [[Mknod]] (an upgrade jailbreak)
=== 1.1.3 / 1.1.4 / 1.1.5 ===
* [[Soft Upgrade]] (an upgrade jailbreak)
* [[Ramdisk Hack]]
* [[Dual Boot Exploit]] - Works up to [[iOS]] 2.0 beta 3
* [[diags]] - Works up to [[iOS]] 2.0 beta 5

== Exploits which are used in order to jailbreak 2.x ==
=== 2.0 / 2.0.1 / 2.0.2 / 2.1 ===
* [[Pwnage]] + [[Pwnage 2.0]]
=== 2.1.1 ===
* [[ARM7 Go]] ([[tethered jailbreak]])
=== 2.2 ===
* [[Pwnage]] + [[Pwnage 2.0]] ([[m68ap|iPhone]], [[n45ap|iPod touch]], and [[n82ap|iPhone 3G]])
=== 2.2.1 ===
* [[Pwnage]] + [[Pwnage 2.0]] ([[m68ap|iPhone]], [[n45ap|iPod touch]], and [[n82ap|iPhone 3G]])
* [[0x24000 Segment Overflow]] + [[ARM7 Go]] (from iOS 2.1.1) ([[n72ap|iPod touch 2G]])

== Exploits which are used in order to jailbreak 3.x ==
=== 3.0 / 3.0.1 ===
* [[Pwnage]] + [[Pwnage 2.0]] ([[m68ap|iPhone]], [[n45ap|iPod touch]], and [[n82ap|iPhone 3G]])
* [[ARM7 Go]] (from iOS 2.1.1) + [[0x24000 Segment Overflow]] ( [[n72ap|iPod touch 2G]])
* [[Pwnage]] + [[iBoot Environment Variable Overflow]] ([[m68ap|iPhone]], [[n45ap|iPod touch]], and [[n82ap|iPhone 3G]])
* [[0x24000 Segment Overflow]] + [[iBoot Environment Variable Overflow]] ([[n72ap|iPod touch 2G]] and [[n88ap|iPhone 3GS]])
=== 3.1 / 3.1.1 ===
* [[Pwnage]] + [[Pwnage 2.0]] (together for [[untethered jailbreak]] on [[m68ap|iPhone]], [[n45ap|iPod touch]], and [[n82ap|iPhone 3G]])
* [[usb_control_msg(0x21, 2) Exploit]] ([[tethered jailbreak]] on [[n72ap|iPod touch 2G]] [[Bootrom 240.5.1|new bootrom]], [[n88ap|iPhone 3GS]] [[Bootrom 359.3.2|new bootrom]], and [[n18ap|iPod touch 3G]])
* [[0x24000 Segment Overflow]] + [[usb_control_msg(0x21, 2) Exploit]] ([[n72ap|iPod touch 2G]] [[Bootrom 240.4|old bootrom]] and [[n88ap|iPhone 3GS]] [[Bootrom 359.3|old bootrom]])
=== 3.1.2 ===
* [[Pwnage]] + [[Pwnage 2.0]] (together for [[untethered jailbreak]] on [[m68ap|iPhone]], [[n45ap|iPod touch]], and [[n82ap|iPhone 3G]])
* [[usb_control_msg(0x21, 2) Exploit]] ([[tethered jailbreak]] on [[n72ap|iPod touch 2G]] [[Bootrom 240.5.1|new bootrom]], [[n88ap|iPhone 3GS]] [[Bootrom 359.3.2|new bootrom]], and [[n18ap|iPod touch 3G]])
* [[0x24000 Segment Overflow]] + [[usb_control_msg(0x21, 2) Exploit]] ([[n72ap|iPod touch 2G]] [[Bootrom 240.4|old bootrom]] and [[n88ap|iPhone 3GS]] [[Bootrom 359.3|old bootrom]])
* [[MobileBackup Copy Exploit]] + [[Incomplete Codesign Exploit]] + [[BPF_STX Kernel Write Exploit]] (all devices, used in [[Spirit]])
* [[Malformed CFF Vulnerability]] + [[Incomplete Codesign Exploit]] + [[IOSurface Kernel Exploit]] (all devices, used in [[Star]])
=== 3.1.3 ===
* [[Pwnage]] + [[Pwnage 2.0]] (together for [[untethered jailbreak]] on [[m68ap|iPhone]], [[n45ap|iPod touch]], and [[n82ap|iPhone 3G]])
* [[0x24000 Segment Overflow]] (for [[n72ap|iPod touch 2G]] and [[n88ap|iPhone 3GS]] devices with older bootroms)
** + [[Limera1n Exploit]] ([[n88ap|iPhone 3GS]] [[Bootrom 359.3|old bootrom]], used in [[sn0wbreeze]])
** + [[usb_control_msg(0xA1, 1) Exploit]] ([[n72ap|iPod touch 2G]] [[Bootrom 240.4|old bootrom]], used in [[sn0wbreeze]])
* [[usb_control_msg(0xA1, 1) Exploit]]+ [[Incomplete Codesign Exploit]] + [[BPF_STX Kernel Write Exploit]] ([[n72ap|iPod touch 2G]] [[Bootrom 240.5.1|new bootrom]], used in [[sn0wbreeze]])
* [[Limera1n Exploit]] + [[Incomplete Codesign Exploit]] + [[BPF_STX Kernel Write Exploit]] ([[N18ap|iPod touch 3G]] and [[n88ap|iPhone 3GS]] [[Bootrom 359.3.2|new bootrom]], used in [[sn0wbreeze]])
* [[MobileBackup Copy Exploit]] + [[Incomplete Codesign Exploit]] + [[BPF_STX Kernel Write Exploit]] (all devices, used in [[Spirit]])
* [[Malformed CFF Vulnerability]] + [[Incomplete Codesign Exploit]] + [[IOSurface Kernel Exploit]] (all devices, used in [[Star]])

=== 3.2 ===
* [[MobileBackup Copy Exploit]] + [[Incomplete Codesign Exploit]] + [[BPF_STX Kernel Write Exploit]] (all devices, used in [[Spirit]])
* [[Malformed CFF Vulnerability]] + [[Incomplete Codesign Exploit]] + [[IOSurface Kernel Exploit]] ([[k48ap|iPad]], used in [[Star]])
* [[Limera1n Exploit]] + [[Incomplete Codesign Exploit]] + [[BPF_STX Kernel Write Exploit]] ([[K48ap|iPad]] used in [[sn0wbreeze]] 2.9.x)
=== 3.2.1 ===
* [[Malformed CFF Vulnerability]] + [[Incomplete Codesign Exploit]] + [[IOSurface Kernel Exploit]] ([[k48ap|iPad]], used in [[Star]])
* [[Limera1n Exploit]] + [[Incomplete Codesign Exploit]] + [[IOSurface Kernel Exploit]] ([[k48ap|iPad]], used in [[sn0wbreeze]] 2.9.x)
=== 3.2.2 ===
* [[Limera1n Exploit]] + [[Packet Filter Kernel Exploit]] ([[k48ap|iPad]])

== Exploits which are used in order to jailbreak 4.x ==
=== 4.0 / 4.0.1 ===
* [[Pwnage]] + [[Pwnage 2.0]] ([[n82ap|iPhone 3G]])
* [[0x24000 Segment Overflow]] ([[n72ap|iPod touch 2G]] and [[n88ap|iPhone 3GS]] devices with older bootroms)
* [[Malformed CFF Vulnerability]] + [[Incomplete Codesign Exploit]] + [[IOSurface Kernel Exploit]] (all devices, used in [[Star]])
* [[Limera1n Exploit]] + [[Packet Filter Kernel Exploit]] ([[n88ap|iPhone 3GS]] New bootrom, [[N18ap|iPod touch 3G]], [[n90ap|iPhone 4 (iPhone3,1)]])

=== 4.0.2 ===
* [[Pwnage]] + [[Pwnage 2.0]] ([[n82ap|iPhone 3G]])
* [[ARM7 Go]] (from iOS 2.1.1) + [[0x24000 Segment Overflow]] ([[n72ap|iPod touch 2G]])
* [[0x24000 Segment Overflow]] ([[n88ap|iPhone 3GS]])
* [[limera1n]]'s bootrom exploit + [[Packet Filter Kernel Exploit]] ([[n88ap|iPhone 3GS]] [[Bootrom 359.3.2|new bootrom]], [[n18ap|iPod touch 3G]], [[n90ap|iPhone 4 (iPhone3,1)]], and [[n81ap|iPod touch 4G]])

=== 4.1 ===
* [[Pwnage]] + [[Pwnage 2.0]] (together to jailbreak the [[n82ap|iPhone 3G]])
* [[ARM7 Go]] (from iOS 2.1.1) + [[0x24000 Segment Overflow]] (together for [[untethered jailbreak]] on [[n72ap|iPod touch 2G]] [[Bootrom 240.4|old bootrom]])
* [[limera1n]]'s bootrom exploit + [[0x24000 Segment Overflow]] (together for [[untethered jailbreak]] on [[n88ap|iPhone 3GS]] [[Bootrom 359.3|old bootrom]])
* [[limera1n]]'s bootrom exploit + [[Packet Filter Kernel Exploit]] (together for [[untethered jailbreak]] on [[n88ap|iPhone 3GS]] [[Bootrom 359.3.2|new bootrom]], [[n18ap|iPod touch 3G]], [[n90ap|iPhone 4 (iPhone3,1)]], [[n81ap|iPod touch 4G]], and [[k66ap|Apple TV 2G]]))
* [[usb_control_msg(0xA1, 1) Exploit]] + [[Packet Filter Kernel Exploit]] (together for [[untethered jailbreak]] on [[n72ap|iPod touch 2G]])

=== 4.2.1 ===
* [[Pwnage]] + [[Pwnage 2.0]] (together to jailbreak the [[n82ap|iPhone 3G]])
* [[ARM7 Go]] (from iOS 2.1.1) + [[0x24000 Segment Overflow]] (together for [[untethered jailbreak]] on [[n72ap|iPod touch 2G]] [[Bootrom 240.4|old bootrom]])
* [[limera1n]]'s bootrom exploit + [[0x24000 Segment Overflow]] (together for [[untethered jailbreak]] on [[n88ap|iPhone 3GS]] [[Bootrom 359.3|old bootrom]])
* [[limera1n]]'s bootrom exploit + [[HFS Legacy Volume Name Stack Buffer Overflow]] (together for [[untethered jailbreak]] on [[n88ap|iPhone 3GS]] [[Bootrom 359.3.2|new bootrom]], [[n18ap|iPod touch 3G]], [[k48ap|iPad]], [[n90ap|iPhone 4 (iPhone3,1)]], [[n81ap|iPod touch 4G]], and [[k66ap|Apple TV 2G]])
* [[usb_control_msg(0xA1, 1) Exploit]] + [[HFS Legacy Volume Name Stack Buffer Overflow]] (together for [[untethered jailbreak]] on [[n72ap|iPod touch 2G]])

=== 4.2.6 / 4.2.7 / 4.2.8 ===
* [[limera1n]]'s bootrom exploit + [[HFS Legacy Volume Name Stack Buffer Overflow]] (together for [[untethered jailbreak]] on [[n92ap|iPhone 4 (iPhone3,3)]])
* [[T1 Font Integer Overflow]] (used for [[Saffron]])

=== 4.2.9 / 4.2.10 ===
* [[limera1n]]'s bootrom exploit (Tethered jailbreak on [[n92ap|iPhone 4 (iPhone3,3)]])

=== 4.3 ===
* [[limera1n]]'s bootrom exploit + [[0x24000 Segment Overflow]] (together for [[untethered jailbreak]] on [[n88ap|iPhone 3GS]] [[Bootrom 359.3|old bootrom]])
* [[limera1n]]'s bootrom exploit ([[tethered jailbreak]] on [[n88ap|iPhone 3GS]] [[Bootrom 359.3.2|new bootrom]], [[n18ap|iPod touch 3G]], [[k48ap|iPad]], [[n90ap|iPhone 4 (iPhone3,1)]], [[n81ap|iPod touch 4G]], and [[k66ap|Apple TV 2G]])
* [[T1 Font Integer Overflow]] (used for [[Saffron]])

=== 4.3.1 / 4.3.2 / 4.3.3 ===
* [[limera1n]]'s bootrom exploit + [[0x24000 Segment Overflow]] (together for [[untethered jailbreak]] on [[n88ap|iPhone 3GS]] [[Bootrom 359.3|old bootrom]])
* [[limera1n]]'s bootrom exploit + [[ndrv_setspec() Integer Overflow]] (together for [[untethered jailbreak]] on [[n88ap|iPhone 3GS]] [[Bootrom 359.3.2|new bootrom]], [[n18ap|iPod touch 3G]], [[k48ap|iPad]], [[n90ap|iPhone 4 (iPhone3,1)]], and [[n81ap|iPod touch 4G]])
* [[T1 Font Integer Overflow]] (used for [[Saffron]])

=== 4.3.4 / 4.3.5 ===
* [[limera1n]]'s bootrom exploit + [[0x24000 Segment Overflow]] (together for [[untethered jailbreak]] on [[n88ap|iPhone 3GS]] with [[Bootrom 359.3|old bootrom]])
* [[limera1n]]'s bootrom exploit (Tethered jailbreak) on [[n88ap|iPhone 3GS]] with [[Bootrom 359.3.2|new bootrom]], [[n18ap|iPod touch 3G]], [[k48ap|iPad]], [[n90ap|iPhone 4 (iPhone3,1)]], and [[n81ap|iPod touch 4G]])

== Exploits which are used in order to jailbreak 5.x ==
=== 5.0 ===
* [[limera1n]]'s bootrom exploit + [[0x24000 Segment Overflow]] (together for [[untethered jailbreak]] on [[n88ap|iPhone 3GS]] with [[Bootrom 359.3|old bootrom]])
* [[limera1n]]'s bootrom exploit (Tethered jailbreak) on [[n88ap|iPhone 3GS]] with [[Bootrom 359.3.2|new bootrom]], [[n18ap|iPod touch 3G]], [[k48ap|iPad]], [[iPhone 4]], and [[n81ap|iPod touch 4G]])
* [[Racoon String Format Overflow Exploit]] (used both for payload injection and untether)+[[HFS Heap Overflow]]- [[n94ap|iPhone 4S]] only

===5.0.1===
* [[limera1n]]'s bootrom exploit + [[0x24000 Segment Overflow]] (together for [[untethered jailbreak]] on [[n88ap|iPhone 3GS]] with [[Bootrom 359.3|old bootrom]])
* [[limera1n]]'s bootrom exploit + [[Racoon String Format Overflow Exploit]]+[[HFS Heap Overflow]] on [[n88ap|iPhone 3GS]] with [[Bootrom 359.3.2|new bootrom]], [[n18ap|iPod touch 3G]], [[k48ap|iPad]], [[iPhone 4]], and [[n81ap|iPod touch 4G]])
* [[Racoon String Format Overflow Exploit]] (used both for payload injection and untether)+[[HFS Heap Overflow]] - [[iPad 2]] and [[iPhone 4S]] with [[Absinthe]]

===5.1===
* [[limera1n]]'s bootrom exploit (Tethered jailbreak) on [[n88ap|iPhone 3GS]] with [[Bootrom 359.3.2|new bootrom]], [[n18ap|iPod touch 3G]], [[k48ap|iPad]], [[iPhone 4]], and [[n81ap|iPod touch 4G]])
* [[limera1n]]'s bootrom exploit + [[0x24000 Segment Overflow]] (together for [[untethered jailbreak]] on [[n88ap|iPhone 3GS]] with [[Bootrom 359.3|old bootrom]])

===5.1.1===
* [[limera1n Exploit]] + [[0x24000 Segment Overflow]] (together for [[untethered jailbreak]] on [[n88ap|iPhone 3GS]] with [[Bootrom 359.3|old bootrom]])
* [[limera1n Exploit]] + [[Rocky Racoon]] (together for [[untethered jailbreak]] on [[n88ap|iPhone 3GS]] with [[Bootrom 359.3.2|new bootrom]], [[iPhone 4]], [[n18ap|iPod touch 3G]], and [[n81ap|iPod touch 4G]])

== Exploits which are used in order to jailbreak 6.x ==
=== 6.0 / 6.0.1 / 6.0.2 / 6.1 / 6.1.1 / 6.1.2 ===
* [[limera1n]]'s bootrom exploit (Tethered jailbreak) on [[n88ap|iPhone 3GS]] with [[Bootrom 359.3.2|new bootrom]], [[iPhone 4]], and [[n81ap|iPod touch 4G]])
* [[limera1n]]'s bootrom exploit + [[0x24000 Segment Overflow]] (together for [[untethered jailbreak]] on [[n88ap|iPhone 3GS]] with [[Bootrom 359.3|old bootrom]])
* [[Symbolic Link Vulnerability]]
* [[Timezone Vulnerability]]
* [[Shebang Trick]]
* [[AMFID code signing evasion]]
* [[launchd.conf untether]]
* [[IOUSBDeviceFamily Vulnerability]]
* [[ARM Exception Vector Info Leak]]
* [[dynamic memmove() locating]]
* [[vm_map_copy_t corruption for arbitrary memory disclosure]]
* [[kernel memory write via ROP gadget]]

== Exploits which are used in order to jailbreak 7.x ==
* ?

== Jailbreak Tools ==
==== [[k66ap|Apple TV 2G]] ====
{| class="wikitable" style="font-size: smaller; text-align: center;"
|-
! rowspan="2" | [[Jailbreak]] Tool
! colspan="25" | Works with [[firmware]]...
|-
| [[Mojave 8M89 (Apple TV 2G)|4.0/4.1]]
| [[Jasper 8C150 (Apple TV 2G)|4.1/4.2]]
| [[Jasper 8C154 (Apple TV 2G)|4.1.1/4.2.1]]
| [[Durango 8F191m (Apple TV 2G)|4.2/4.3]]
| [[DurangoTide 8F202 (Apple TV 2G)|4.2.1/4.3]]
| [[DurangoTide 8F305 (Apple TV 2G)|4.2.2/4.3]]
| [[DurangoTideCuba 8F455 (Apple TV 2G)‎|4.3]]
| [[Telluride 9A334v (Apple TV 2G)|4.4/5.0]]
| [[Telluride 9A335a (Apple TV 2G)|4.4.1/5.0]]
| [[Telluride 9A336a (Apple TV 2G)|4.4.2/5.0]]
| [[Telluride 9A405l (Apple TV 2G)|4.4.3/5.0.1]]
| [[Telluride 9A406a (Apple TV 2G)|4.4.4/5.0.1]]
| [[Hoodoo 9B179b (Apple TV 2G)|5.0/5.1]]
| [[Hoodoo 9B206f (Apple TV 2G)|5.0.1/5.1.1]]
| [[HoodooTide 9B830 (Apple TV 2G)|5.0.2/5.1.1]]
| [[Sundance 10A406e (Apple TV 2G)|5.1/6.0]]
| [[SundanceTide 10A801 (Apple TV 2G)|5.1.1/6.0.1]]
| [[Brighton 10B144b (Apple TV 2G)|5.2/6.1]]
| [[BrightonMaps 10B329a (Apple TV 2G)|5.2.1/6.1.3]]
| [[BrightonTide 10B809 (Apple TV 2G)|5.3/6.1.4]]
| [[Innsbruck 11A470a (Apple TV 2G)|6.0/7.0.1]]
| [[Innsbruck 11A502 (Apple TV 2G)|6.0/7.0.2]]
| [[InnsbruckTaos 11B511d (Apple TV 2G)|6.0.1/7.0.3]]
| [[InnsbruckTaos 11B554a (Apple TV 2G)|6.0.2/7.0.4]]
| [[InnsbruckTaos 11B651 (Apple TV 2G)|6.0.2/7.0.6]]
|-
| [[evasi0n]]
| colspan="15" {{no}}
| colspan="3" {{yes|1.0}}
| colspan="7" {{no}}
|-
| [[Greenpois0n (jailbreak)|greenpois0n]]
| {{partial|no package management GUI}}
| {{no}}
| {{yes|RC6-RC6.1}}
| colspan="22" {{no}}
|-
| [[limera1n]]
| {{partial|no package management GUI}}
| colspan="24" {{no}}
|-
| [[p0sixspwn]]
| colspan="18" {{no}}
| colspan="2" {{yes|1.0}}
| colspan="5" {{no}}
|-
| [[PwnageTool]]
| {{partial|no package management GUI}}
| {{partial|Restore from a custom firmware with unofficial bundle1}}
| {{yes|4.2}}
| {{no}}
| {{yes|4.3-4.3.3.1}}
| {{yes|4.3-4.3.3.12}}
| colspan="7" {{no}}
| {{partial|5.1.1 (no package management GUI)}}
| colspan="11" {{no}}
|-
| [[redsn0w]]
| colspan="4" {{no}}
| {{yes|0.9.6rc16}}
| colspan="10" {{no}}
| {{yes|0.9.15b11}}
| colspan="5" {{yes|0.9.15b33}}
| colspan="4" {{no}}
|-
| [[Seas0nPass]] (Mac)
| colspan="2" {{no}}
| {{yes|0.6.71 - 0.7.1}}
| {{yes|0.7.21}}
| {{yes|0.7.31 - 0.7.5}}
| {{yes|0.7.6.??? - 0.7.7.???}}
| {{yes|0.7.8.???}}
| {{yes|0.7.9.???1}}
| {{yes|0.7.9.2101}}
| {{yes|0.7.9.2301}}
| {{yes|0.7.9.2701}}
| {{yes|0.7.9.2901 - 0.8.0.320}}
| {{yes|0.8.3.4701}}
| {{yes|0.8.4.5181 - 0.8.5.555}}
| {{yes|0.8.6.565}}
| colspan="2" {{no}}
| {{yes|0.8.9.655}}
| {{no}}
| {{yes|2.4}}
| colspan="6" {{no}}
|-
| [[Seas0nPass]] (Windows)
| colspan="4" {{no}}
| {{yes|0.3.7.????}}
| {{yes|0.3.13.????}}
| {{yes|0.3.29.???? - 0.3.45.4035}}
| colspan="2" {{yes|0.3.37.????1}}
| {{yes|0.3.42.33351}}
| {{yes|0.3.44.????1}}
| {{yes|0.3.45.40351 - 0.8.3.5592}}
| {{yes|0.8.3.55921}}
| {{yes|0.8.4.63061 - 0.8.5.6546}}
| {{yes|0.8.6.7558}}
| colspan="2" {{no}}
| {{yes|0.8.9.11241}}
| {{no}}
| {{yes|2.4}}
| colspan="6" {{no}}
|-
| [[sn0wbreeze]]
| {{partial|no package management GUI}}
| colspan="3" {{no}}
| {{yes|2.5-2.7.1}}
| colspan="10" {{no}}
| colspan="3" {{yes|2.9.8}}
| colspan="7" {{no}}
|-
| [[unthredera1n]]
| {{partial|no package management GUI}}
| colspan="14" {{yes}}
| colspan="10" {{no}}
|}
1 [[Tethered jailbreak]]. 
2 User needs to manually add [[PwnageTool]] firmware bundle into application. 
3 Point at 6.0 IPSW. Also [[Tethered jailbreak]].

==== [[j33ap|Apple TV 3G (AppleTV3,1)]] ====
{| class="wikitable" style="font-size: smaller; text-align: center;"
|-
! rowspan="2" | [[Jailbreak]] Tool
! colspan="13" | Works with [[firmware]]...
|-
| 5.0/5.1
| 5.0.1/5.1
| 5.0.2/5.1.1
| 5.1/6.0
| 5.1.1/6.0.1
| 5.2/6.1
| 5.2.1/6.1.3
| 5.3/6.1.4
| 6.0/7.0.1
| 6.0/7.0.2
| 6.0.1/7.0.3
| 6.0.2/7.0.4
| 6.0.2/7.0.6
|-
| [[Absinthe]]
| colspan="13" {{no}}
|-
| [[evasi0n]]
| colspan="13" {{no}}
|-
| [[redsn0w]]
| colspan="13" {{no}}
|-
| [[Seas0npass]]
| colspan="13" {{no}}
|-
| [[Sn0wbreeze]]
| colspan="13" {{no}}
|}

==== [[j33iap|Apple TV 3G (AppleTV3,2)]] ====
{| class="wikitable" style="font-size: smaller; text-align: center;"
|-
! rowspan="2" | [[Jailbreak]] Tool
! colspan="8" | Works with [[firmware]]...
|-
| 5.2/6.1
| 5.2.1/6.1.3
| 5.3/6.1.4
| 6.0/7.0.1
| 6.0/7.0.2
| 6.0.1/7.0.3
| 6.0.2/7.0.4
| 6.0.2/7.0.6
|-
| [[Absinthe]]
| colspan="8" {{no}}
|-
| [[evasi0n]]
| colspan="8" {{no}}
|-
| [[redsn0w]]
| colspan="8" {{no}}
|-
| [[Seas0npass]]
| colspan="8" {{no}}
|-
| [[Sn0wbreeze]]
| colspan="8" {{no}}
|}

{{:Jailbreak/Deprecated iPads}}

=== [[iPad 2]] ===
{| class="wikitable" style="font-size: smaller; text-align: center;"
|-
! rowspan="2" | [[Jailbreak]] Tool
! colspan="20" | Works with [[firmware]]...
|-
| 4.3
| 4.3.1
| 4.3.2
| 4.3.3
| 4.3.4
| 4.3.5
| 5.0
| 5.0.1
| 5.1
| 5.1.1
| 6.0
| 6.0.1
| 6.1
| 6.1.2
| 6.1.3
| 7.0
| 7.0.2
| 7.0.3
| 7.0.4
| 7.0.6
|-
| [[Absinthe]]
| colspan="7" {{no}}
| {{yes|0.2-0.4}}
| {{no}}
| {{yes|2.01-2.0.4}}
| colspan="10" {{no}}
|-
| [[evasi0n]]
| colspan="10" {{no}}
| colspan="3" {{yes|1.0}}
| {{yes|1.4}}
| colspan="6" {{no}}
|-
| [[evasi0n7]]
| colspan="15" {{no}}
| colspan="4" {{yes|1.0.0}}
| {{yes|1.0.6}}
|-
| [[p0sixspwn]]
| colspan="14" {{no}}
| {{yes|1.0}}
| colspan="5" {{no}}
|-
| [[redsn0w]]
| colspan="7" {{no}}
| {{yes|0.9.10b7-0.9.11b4}}
| {{no}}
| {{yes|0.9.12b1}}
| colspan="10" {{no}}
|-
| [[Saffron]]
| colspan="3" {{no}}
| {{yes}}
| colspan="16" {{no}}
|}
1 Not compatible with [[k93aap|iPad2,4]]

=== [[iPad 3]] ===
{| class="wikitable" style="font-size: smaller; text-align: center;"
|-
! rowspan="2" | [[Jailbreak]] Tool
! colspan="12" | Works with [[firmware]]...
|-
| 5.1
| 5.1.1
| 6.0
| 6.0.1
| 6.1
| 6.1.2
| 6.1.3
| 7.0
| 7.0.2
| 7.0.3
| 7.0.4
| 7.0.6
|-
| [[Absinthe]]
| {{no}}
| {{yes|2.0-2.0.4}}
| colspan="10" {{no}}
|-
| [[evasi0n]]
| colspan="2" {{no}}
| colspan="3" {{yes|1.0}}
| {{yes|1.4}}
| colspan="6" {{no}}
|-
| [[evasi0n7]]
| colspan="7" {{no}}
| colspan="4" {{yes|1.0.0}}
| {{yes|1.0.6}}
|-
| [[p0sixspwn]]
| colspan="6" {{no}}
| {{yes|1.0}}
| colspan="5" {{no}}
|-
| [[redsn0w]]
| {{no}}
| {{yes|0.9.12b1}}
| colspan="10" {{no}}
|}

=== [[iPad 4]] ===
{| class="wikitable" style="font-size: smaller; text-align: center;"
|-
! rowspan="2" | [[Jailbreak]] Tool
! colspan="10" | Works with [[firmware]]...
|-
| 6.0
| 6.0.1
| 6.1
| 6.1.2
| 6.1.3
| 7.0
| 7.0.2
| 7.0.3
| 7.0.4
| 7.0.6
|-
| [[evasi0n]]
| colspan="3" {{yes|1.0}}
| {{yes|1.4}}
| colspan="6" {{no}}
|-
| [[evasi0n7]]
| colspan="5" {{no}}
| colspan="4" {{yes|1.0.0}}
| {{yes|1.0.6}}
|-
| [[p0sixspwn]]
| colspan="4" {{no}}
| {{yes|1.0}}
| colspan="5" {{no}}
|}

=== [[iPad Air]] ===
{| class="wikitable" style="font-size: smaller; text-align: center;"
|-
! rowspan="2" | [[Jailbreak]] Tool
! colspan="3" | Works with [[firmware]]...
|-
| 7.0.3
| 7.0.4
| 7.0.6
|-
| [[evasi0n7]]
| colspan="2" {{yes|1.0.0}}
| {{yes|1.0.6}}
|}

=== [[iPad mini 1G]] ===
{| class="wikitable" style="font-size: smaller; text-align: center;"
|-
! rowspan="2" | [[Jailbreak]] Tool
! colspan="11" | Works with [[firmware]]...
|-
| 6.0
| 6.0.1
| 6.0.2
| 6.1
| 6.1.2
| 6.1.3
| 7.0
| 7.0.2
| 7.0.3
| 7.0.4
| 7.0.6
|-
| [[evasi0n]]
| colspan="4" {{yes|1.0}}
| {{yes|1.4}}
| colspan="6" {{no}}
|-
| [[evasi0n7]]
| colspan="6" {{no}}
| colspan="4" {{yes|1.0.0}}
| {{yes|1.0.6}}
|-
| [[p0sixspwn]]
| colspan="5" {{no}}
| {{yes|1.0}}
| colspan="5" {{no}}
|}

=== [[iPad mini 2G]] ===
{| class="wikitable" style="font-size: smaller; text-align: center;"
|-
! rowspan="2" | [[Jailbreak]] Tool
! colspan="3" | Works with [[firmware]]...
|-
| 7.0.3
| 7.0.4
| 7.0.6
|-
| [[evasi0n7]]
| colspan="2" {{yes|1.0.0}}
| {{yes|1.0.6}}
|}

{{:Jailbreak/Deprecated iPhones}}

=== [[N90ap|iPhone 4 (iPhone3,1)]] ===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
! rowspan="2" | [[Jailbreak]] Tool
! colspan="26" | Works with [[firmware]]...
|-
| [[Apex 8A293 (iPhone3,1)|4.0]]
| [[Apex 8A306 (iPhone3,1)|4.0.1]]
| [[Apex 8A400 (iPhone3,1)|4.0.2]]
| [[Baker 8B117 (iPhone3,1)|4.1]]
| [[Jasper 8C148 (iPhone3,1)|4.2.1]]
| [[Durango 8F190 (iPhone3,1)|4.3]]
| [[Durango 8G4 (iPhone3,1)|4.3.1]]
| [[Durango 8H7 (iPhone3,1)|4.3.2]]
| [[Durango 8J2 (iPhone3,1)|4.3.3]]
| [[Durango 8K2 (iPhone3,1)|4.3.4]]
| [[Durango 8L1 (iPhone3,1)|4.3.5]]
| [[Telluride 9A334 (iPhone3,1)|5.0]]
| [[Telluride 9A405 (iPhone3,1)|5.0.1]]
| [[Hoodoo 9B176 (iPhone3,1)|5.1]]
| [[Hoodoo 9B206 (iPhone3,1)|5.1.1 (9B206)]]
| [[Hoodoo 9B208 (iPhone3,1)|5.1.1 (9B208)]]
| [[Sundance 10A403 (iPhone3,1)|6.0]]
| [[Sundance 10A523 (iPhone3,1)|6.0.1]]
| [[Brighton 10B144 (iPhone3,1)|6.1]]
| [[Brighton 10B146 ()|6.1.2]]
| [[BrightonMaps 10B329 (iPhone3,1)|6.1.3]]
| [[Innsbruck 11A465 (iPhone3,1)|7.0]]
| [[Innsbruck 11A501 (iPhone3,1)|7.0.2]]
| [[InnsbruckTaos 11B511 (iPhone3,1)|7.0.3]]
| [[InnsbruckTaos 11B554a (iPhone3,1)|7.0.4]]
| [[InnsbruckTaos 11B651 (iPhone3,1)|7.0.6]]
|-
| [[Absinthe]]
| colspan="14" {{no}}
| {{yes|2.0}}
| {{yes|2.0.2}}
| colspan="10" {{no}}
|-
| [[evasi0n]]
| colspan="16" {{no}}
| colspan="3" {{yes|1.0}}
| {{yes|1.4}}
| colspan="6" {{no}}
|-
| [[evasi0n7]]
| colspan="21" {{no}}
| colspan="4" {{yes|1.0.0}}
| {{yes|1.0.6}}
|-
| [[Greenpois0n (jailbreak)|greenpois0n]]
| colspan="3" {{no}}
| {{yes|RC4}}
| {{yes|RC5-RC6.1}}
| colspan="21" {{no}}
|-
| [[limera1n]]
| colspan="4" {{yes}}
| colspan="22" {{no}}
|-
| [[p0sixspwn]]
| colspan="20" {{no}}
| {{yes|1.0}}
| colspan="5" {{no}}
|-
| [[PwnageTool]]
| colspan="3" {{no}}
| {{yes|4.1-4.1.3}}
| {{yes|4.2}}
| {{partial|4.21 3}}
| {{yes|4.3}}
| {{yes|4.3.2}}
| {{yes|4.3.3-4.3.3.1}}
| colspan="3" {{partial|4.3.31 3}}
| {{yes|5.0.1}}
| {{no}}
| colspan="2" {{yes|5.1.1}}
| colspan="10" {{no}}
|-
| [[redsn0w]]
| colspan="3" {{no}}
| {{yes|0.9.6b2-0.9.6rc16}}
| {{partial|0.9.6b41-0.9.6rc16 or 0.9.7b61 2}}
| {{partial|0.9.6rc91-0.9.6rc161}}
| {{partial|0.9.6rc91-0.9.6rc16}}
| {{partial|0.9.6rc131-0.9.6rc16}}
| {{yes|0.9.6rc16}}
| {{partial|0.9.8b31}}
| {{partial|0.9.8b71}}
| {{partial|0.9.9b31}}
| {{yes|0.9.10b6}}
| {{partial|0.9.10b61}}
| colspan="2" {{yes|0.9.12b1-0.9.14b2}}
| {{partial|0.9.15b11}}
| colspan="4" {{partial|0.9.15b14}}
| colspan="5" {{no}}
|-
| [[Saffron]]
| colspan="5" {{no}}
| colspan="4" {{yes}}
| colspan="17" {{no}}
|-
| [[sn0wbreeze]]
| colspan="3" {{no}}
| {{yes|2.1}}
| {{yes|2.2}}
| {{partial|2.3b41}}
| {{yes|2.5}}
| {{yes|2.6-2.6.1}}
| {{yes|2.7-2.7.1}}
| colspan="2" {{no}}
| {{partial|2.8b81}}
| {{yes|2.9.1}}
| {{no}}
| colspan="2" {{yes|2.9.6}}
| colspan="3" {{yes|2.9.8}}
| {{yes|2.9.10}}
| {{partial|2.9.141}}
| colspan="5" {{no}}
|-
| [[Star]]
| colspan="2" {{yes}}
| colspan="24" {{no}}
|-
| [[unthredera1n]]
| colspan="5" {{no}}
| colspan="11" {{yes}}
| colspan="10" {{no}}
|}
1 [[Tethered jailbreak]]. 
2 If [[SHSH]]s were saved for iOS 4.2b3 and if you have a developer access to its IPSW, [[Jailbreak Monte]] can be used. 
3 Requires an unofficial firmware bundle. 
4 Requires pointing [[redsn0w]] at 6.0 [[IPSW File Format|IPSW]]. Also [[Tethered jailbreak]].

=== [[N90bap|iPhone 4 (iPhone3,2)]] ===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
! rowspan="2" | [[Jailbreak]] Tool
! colspan="10" | Works with [[firmware]]...
|-
| [[Sundance 10A403 (iPhone3,2)|6.0]]
| [[Sundance 10A523 (iPhone3,2)|6.0.1]]
| [[Brighton 10B144 (iPhone3,2)|6.1]]
| [[Brighton 10B146 (iPhone3,2)|6.1.2]]
| [[BrightonMaps 10B329 (iPhone3,2)|6.1.3]]
| [[Innsbruck 11A465 (iPhone3,2)|7.0]]
| [[Innsbruck 11A501 (iPhone3,2)|7.0.2]]
| [[InnsbruckTaos 11B511 (iPhone3,2)|7.0.3]]
| [[InnsbruckTaos 11B554a (iPhone3,2)|7.0.4]]
| [[InnsbruckTaos 11B651 (iPhone3,2)|7.0.6]]
|-
| [[evasi0n]]
| colspan="3" {{yes|1.0}}
| {{yes|1.4}}
| colspan="6" {{no}}
|-
| [[evasi0n7]]
| colspan="5" {{no}}
| colspan="4" {{yes|1.0.0}}
| {{yes|1.0.6}}
|-
| [[p0sixspwn]]
| colspan="4" {{no}}
| {{yes|1.0}}
| colspan="5" {{no}}
|-
| [[redsn0w]]
| colspan="5" {{partial|0.9.15b3}}
| colspan="5" {{no}}
|-
| [[sn0wbreeze]]
| colspan="3" {{yes|2.9.8}}
| {{yes|2.9.10}}
| {{partial|2.9.141}}
| colspan="5" {{no}}
|}

Must point [[redsn0w]] at the 6.0 IPSW. Tethered.

=== [[N92ap|iPhone 4 (iPhone3,3)]] ===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
! rowspan="2" | [[Jailbreak]] Tool
! colspan="20" | Works with [[firmware]]...
|-
| [[Phoenix 8E128 (iPhone3,3)|4.2.5]]
| [[Phoenix 8E200 (iPhone3,3)|4.2.6]]
| [[Phoenix 8E303 (iPhone3,3)|4.2.7]]
| [[Phoenix 8E401 (iPhone3,3)|4.2.8]]
| [[Phoenix 8E501 (iPhone3,3)|4.2.9]]
| [[Phoenix 8E600 (iPhone3,3)|4.2.10]]
| [[Telluride 9A334 (iPhone3,3)|5.0]]
| [[Telluride 9A405 (iPhone3,3)|5.0.1]]
| [[Hoodoo 9B176 (iPhone3,3)|5.1]]
| [[Hoodoo 9B206 (iPhone3,3)|5.1.1]]
| [[Sundance 10A403 (iPhone3,3)|6.0]]
| [[Sundance 10A523 (iPhone3,3)|6.0.1]]
| [[Brighton 10B141 (iPhone3,3)|6.1]]
| [[Brighton 10B146 (iPhone3,3)|6.1.2]]
| [[BrightonMaps 10B329 (iPhone3,3)|6.1.3]]
| [[Innsbruck 11A465 (iPhone3,3)|7.0]]
| [[Innsbruck 11A501 (iPhone3,3)|7.0.2]]
| [[InnsbruckTaos 11B511 (iPhone3,3)|7.0.3]]
| [[InnsbruckTaos 11B554a (iPhone3,3)|7.0.4]]
| [[InnsbruckTaos 11B651 (iPhone3,3)|7.0.6]]
|-
| [[Absinthe]]
| colspan="7" {{no}}
| {{yes|2.0}}
| {{no}}
| {{yes|2.0}}
| colspan="10" {{no}}
|-
| [[evasi0n]]
| colspan="10" {{no}}
| colspan="3" {{yes|1.0}}
| {{yes|1.4}}
| colspan="6" {{no}}
|-
| [[evasi0n7]]
| colspan="15" {{no}}
| colspan="4" {{yes|1.0.0}}
| {{yes|1.0.6}}
|-
| [[Greenpois0n (jailbreak)|greenpois0n]]
| {{no}}
| {{yes|RC5 b4-RC6.1}}
| colspan="18" {{no}}
|-
| [[p0sixspwn]]
| colspan="14" {{no}}
| {{yes|1.0}}
| colspan="5" {{no}}
|-
| [[PwnageTool]]
| {{no}}
| {{yes|4.2}}
| {{no}}
| {{yes|4.22}}
| colspan="3" {{no}}
| {{yes|5.0.1}}
| colspan="12" {{no}}
|-
| [[redsn0w]]
| {{no}}
| {{yes|0.9.6rc9-0.9.10b8b}}
| {{yes|0.9.8b2-0.9.10b8b}}
| {{yes|0.9.6rc18-0.9.10b8b}}
| {{partial|0.9.8b31-0.9.10b8b1}}
| {{partial|0.9.8b71-0.9.10b8b1}}
| {{partial|0.9.9b31-0.9.10b8b1}}
| {{partial|0.9.9b91-0.9.10b8b}}
| {{partial|0.9.10b61-0.9.10b8b1}}
| {{yes|0.9.12b1}}
| {{partial|0.9.14b11}}
| colspan="4" {{partial|0.9.15b33}}
| colspan="5" {{no}}
|-
| [[Saffron]]
| {{no}}
| colspan="3" {{yes}}
| colspan="16" {{no}}
|-
| [[sn0wbreeze]]
| {{no}}
| {{yes|2.2-2.9.3}}
| {{yes|2.6-2.9.3}}
| {{yes|2.7-2.9.3}}
| colspan="2" {{no}}
| {{partial|2.8b91-2.9.31}}
| {{partial|2.8b111-2.9.3}}
| {{partial|2.9.21-2.9.31}}
| {{yes|2.9.7}}
| colspan="3" {{yes|2.9.8}}
| {{yes|2.9.10}}
| {{partial|2.9.141}}
| colspan="5" {{no}}
|-
| [[unthredera1n]]
| {{no}}
| colspan="9" {{yes}}
| colspan="10" {{no}}
|}
1 [[Tethered jailbreak]]. 
2 Requires unofficial bundle. 
3 Requires pointing [[redsn0w]] at 6.0 [[IPSW File Format|IPSW]]. Also [[Tethered jailbreak]].

=== [[N94ap|iPhone 4S]] ===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
! rowspan="2" | [[Jailbreak]] Tool
! colspan="16" | Works with [[firmware]]...
|-
| 5.0
| 5.0.1 (9A405)
| [[Telluride 9A406 (iPhone 4S)|5.0.1 (9A406)]]
| 5.1
| 5.1.1
| 6.0
| 6.0.1
| 6.1
| 6.1.1
| 6.1.2
| 6.1.3
| 7.0
| 7.0.2
| 7.0.3
| 7.0.4
| 7.0.6
|-
| [[Absinthe]]
| colspan="3" {{yes|0.1.2-1}}
| {{no}}
| {{yes|2.0}}
| colspan="11" {{no}}
|-
| [[evasi0n]]
| colspan="5" {{no}}
| colspan="3" {{yes|1.0}}
| {{yes|1.3}}
| {{yes|1.4}}
| colspan="7" {{no}}
|-
| [[evasi0n7]]
| colspan="11" {{no}}
| colspan="4" {{yes|1.0.0}}
| {{yes|1.0.6}}
|-
| [[p0sixspwn]]
| colspan="10" {{no}}
| {{yes|1.0}}
| colspan="5" {{no}}
|-
| [[redsn0w]]
| {{no}}
| {{yes|0.9.10b7}}
| {{yes|0.9.11b2}}
| {{no}}
| {{yes|0.9.12b1}}
| colspan="11" {{no}}
|}

=== [[iPhone 5]] ===
{| class="wikitable" style="font-size: smaller; text-align: center;"
|-
! rowspan="2" | [[Jailbreak]] Tool
! colspan="13" | Works with [[firmware]]...
|-
| 6.0
| 6.0.1
| 6.0.2
| 6.1
| 6.1.2
| 6.1.3
| 6.1.4
| 7.0
| 7.0.2
| 7.0.3
| 7.0.4
| 7.0.6
|-
| [[evasi0n]]
| colspan="5" {{yes|1.0}}
| {{yes|1.4}}
| colspan="7" {{no}}
|-
| [[evasi0n7]]
| colspan="7" {{no}}
| colspan="4" {{yes|1.0.0}}
| {{yes|1.0.6}}
|-
| [[p0sixspwn]]
| colspan="5" {{no}}
| colspan="2" {{yes|1.0}}
| colspan="6" {{no}}
|}

=== [[n48ap|iPhone 5c (iPhone5,3)]] ===
{| class="wikitable" style="font-size: smaller; text-align: center;"
|-
! rowspan="2" | [[Jailbreak]] Tool
! colspan="6" | Works with [[firmware]]...
|-
| 7.0
| 7.0.1
| 7.0.2
| 7.0.3
| 7.0.4
| 7.0.6
|-
| [[evasi0n7]]
| colspan="5" {{yes|1.0.0}}
| {{yes|1.0.6}}
|}

=== [[n49ap|iPhone 5c (iPhone5,4)]] ===
{| class="wikitable" style="font-size: smaller; text-align: center;"
|-
! rowspan="2" | [[Jailbreak]] Tool
! colspan="7" | Works with [[firmware]]...
|-
| 7.0
| 7.0.1
| 7.0.2
| 7.0.3
| 7.0.4
| 7.0.5
| 7.0.6
|-
| [[evasi0n7]]
| colspan="5" {{yes|1.0.0}}
| {{yes|1.0.5}}
| {{yes|1.0.6}}
|}

=== [[n51ap|iPhone 5s (iPhone6,1)]] ===
{| class="wikitable" style="font-size: smaller; text-align: center;"
|-
! rowspan="2" | [[Jailbreak]] Tool
! colspan="6" | Works with [[firmware]]...
|-
| 7.0
| 7.0.1
| 7.0.2
| 7.0.3
| 7.0.4
| 7.0.6
|-
| [[evasi0n7]]
| colspan="5" {{yes|1.0.0}}
| {{yes|1.0.6}}
|}

=== [[n53ap|iPhone 5s (iPhone6,2)]] ===
{| class="wikitable" style="font-size: smaller; text-align: center;"
|-
! rowspan="2" | [[Jailbreak]] Tool
! colspan="7" | Works with [[firmware]]...
|-
| 7.0
| 7.0.1
| 7.0.2
| 7.0.3
| 7.0.4
| 7.0.5
| 7.0.6
|-
| [[evasi0n7]]
| colspan="5" {{yes|1.0.0}}
| {{yes|1.0.5}}
| {{yes|1.0.6}}
|}

{{:Jailbreak/Deprecated iPod touches}}

=== [[iPod touch 5G]] ===
{| class="wikitable" style="font-size: smaller; text-align: center;"
|-
! rowspan="2" | [[Jailbreak]] Tool
! colspan="10" | Works with [[firmware]]...
|-
| 6.0
| 6.0.1
| 6.1
| 6.1.2
| 6.1.3
| 7.0
| 7.0.2
| 7.0.3
| 7.0.4
| 7.0.6
|-
| [[evasi0n]]
| colspan="3" {{yes|1.0}}
| {{yes|1.4}}
| colspan="6" {{no}}
|-
| [[evasi0n7]]
| colspan="5" {{no}}
| colspan="4" {{yes|1.0.0}}
| {{yes|1.0.6}}
|-
| [[p0sixspwn]]
| colspan="4" {{no}}
| {{yes|1.0}}
| colspan="5" {{no}}
|}