The iPhone Wiki - User contributions [en]

Unc0ver

2020-06-03T20:56:11Z

Kiddepants: Removed by request

{{lowercase}}{{Infobox software
| name = unc0ver
| title = unc0ver
| developer = [https://twitter.com/pwn20wnd pwn20wnd]<br />[https://twitter.com/sbingner sbingner]
| released = {{Start date|2018|10|13|df=yes}}
| latest release version = v5.0.1
| latest release date = {{Start date and age|2020|05|24|df=yes}}
| operating system = iOS
| language = English
| genre = Jailbreaking
| website = [https://unc0ver.dev The Official Website]<br />[https://www.reddit.com/9nwxei/ The Reddit thread]<br />[https://github.com/pwn20wndstuff/Undecimus The GitHub repo]
}}
'''unc0ver''' is a [[semi-untethered jailbreak]] for all devices running iOS 11.0 through 13.5.

In order to download the latest IPA, download links from the README section has been moved to the releases section of the repository (you can find this by looking under the colored bars where you can find the releases page which is in the middle, alongside branches and contributors).
==Release History==
{| class="wikitable"
|-
! Version
! Date
! Changes
|-
| RC1
| {{date|2018|10|13}}
|
* Initial release
|-
| RC2
| rowspan="5" | {{date|2018|10|14}}
|
* Add the Dynastic repo by default
* Fix a bug in firmware checker
|-
| RC3
|
* Add a switch to manually enable restoring RootFS
* Stop erasing user preferences when restoring RootFS
* Fix bugs
|-
| RC4
|
* Add a label to display the uptime
* Add a label to display the app's version number
* Spawn to the PATH
* Stop bundling system fonts
|-
| RC5
|
* Run videosubscriptionsd in the jailed state
* Fix a bug in firmware and update checker
|-
| RC6
|
* Start logging again
* Improve update checker
* Fix multi_path
|-
| RC7
| {{date|2018|10|17}}
|
* Fix a bug in RootFS Restore and multi_path
|-
| RC8
| {{date|2018|10|18}}
|
* Fix a bug in RootFS Remount
* Add a work in progress warning for some firmwares
|-
| RC9
| {{date|2018|10|19}}
|
* Fix a bug in RootFS Remount
* Add even more detailed error messages
* Add a switch to increase the memory limit to improve the stability
* Improve the compatibility layer to work correctly with some tweaks that were specifically made for the other jailbreaks
|-
| v1
| {{date|2018|10|20}}
|
* Fix a bug in RootFS Restore and Remount
* Make the settings tab match with the rest of the UI
* Fix bugs
|-
| v1.0.1
| {{date|2018|10|21}}
|
* Disable the RootFS Restore for the unstable versions
|-
| v1.0.2
| {{date|2018|10|22}}
|
* Enable and fix the RootFS Restore for all versions
|-
| v1.0.3
| {{date|2018|10|23}}
|
* Fix the beta firmwares
|-
| v1.1
| {{date|2018|10|27}}
|
* Automatically select the best exploit
* Rewrite the versions checker
* Improve assertion
* Show the code which has failed in the error messages
* Improve memory management
* Optimize and clean up the code
* Fix the Storage settings
* Switch to a new technique to disable auto updates
* Remove so much useless logging
* Only set the boot-nonce if the switch is on without checking if it exists or not
* Log offsets
* Remove static sleeps to improve the speed
* Fix series of bugs and leave no known bug
|-
| v1.1.1
| rowspan="2" | {{date|2018|11|03}}
|
* Add a label to show the ECID
* Add a button to open the source code
* Improve auto layout
* Fix various bugs within RootFS interaction, Icon cache refresher, Version checker, Exploit selector, jailbreak state detector and others
|-
| v1.1.2
|
* Improve auto layout and code
* Significantly improve Empty_List (VFS) exploit
* Slightly improve Multi_Path (MPTCP)
|-
| v1.1.3
| rowspan="2" | {{date|2018|11|06}}
|
* Fix a bug in starting jailbreakd
|-
| v1.1.4
|
* Fix a bug in finding offsets
|-
| v2.0
| {{date|2018|11|30}}
|
* Initial Cydia Substrate support
* OTA upgrades for the jailbreak patches from Cydia without rebooting
* A new button to restart SpringBoard from the jailed state
* A switch to (re)install OpenSSH
* A switch to reinstall Cydia
* A switch to restart backboardd only so that you can jailbreak with broken tweaks
* Fix and update bootstrap
* Fix for the jailbreakd error
* Battery life fixes
* ELOD (Electra Loop Of Death) mitigations
* Improve the speed of system reload
* Fixes for countless bugs
* Enable Restart and Restart SpringBoard buttons on iOS 11.4 - 11.4.1 (Jailbreak itself doesn't work on iOS 11.4 - 11.4.1)
* Improve the reliability of the Restart button
* Fix the broken multi_path entitlement check
* Add the compatibility layer for the other jailbreaks back to fix the apps like iCleaner
* Fix the famous snapshot creation bug
* Add a button to manually reset the logs instead of automatically resetting them when the diagnostics button is tapped
* Fix the trust cache injection bug
|-
| v2.0.1
| {{date|2018|12|02}}
|
* The official release of v2.0 with a version number bump to make tracking versions easier
|-
| v2.0.2
| {{date|2018|12|06}}
|
* Fix bugs in the app
* Improve the the speed of the jailbreak
* Update bundled resources
* Switch to a new technique for blocking revokes
|-
| v2.1
| {{date|2018|12|14}}
|
* Make internal changes to make fixing issues easier
* Add T-Mobile support for the revoke disabler
* Make re-jailbreaking without restarting possible
* Make switching from Electra possible without restoring RootFS
* Update bundled resources
* Fix a bug in extracting bootstrap
* Only quit the app if the error is fatal
* Fix a bug in loading daemons
* Make the jailbreaking process faster and more stable
* Add more feedback to the user interface
* Other fixes and improvements
* Fix a bug in extracting bootstrap that was introduced with the previous build
* Fix a bug in installing Cydia that was introduced with the previous build
* Fix a bug in switching from Electra without restoring RootFS
* Update "No Tweaks" mode to support new "Disable Loader" option in Cydia Substrate
* Added the ability to completely disable jailbreakd when Substrate is installed via a future Cydia update.
* Add internal support for completely disabling jailbreakd with a Resources update
* Make a special alert for the exploit error to make it more clear
* Automatically reboot when the user taps "OK" on the exploit error
* Improve the version checker
* Fix a really weird bug in the system that would stop Cydia Substrate from loading tweaks although this bug isn't caused by the tool
* Make the UI support different font sizes or styles (E.g. Bold Text)
* Add the initial localization support (No localizations included yet)
* Reduce the number of stages
* Fix a bug in installing OpenSSH
* Switch to Sam Bingner's new superb trust cache injector thereby enable support for dual-hash signatures
* Don't update the hosts file unless it is needed
* Unblock Saurik's repo if it is blocked
* Reduce the number of stages
* Remove unnecessary checks
* Avoid applying unnecessary kernel patches unless they are needed
* Make sure that the system snapshot was correctly mounted before using it
* Unmount the system snapshot after root filesystem snapshot bypass or restore
* Simplify the credits view
* Don't do unnecessary logging
* Improve empty_list (vfs) exploit's success rate
* Fix runCommand to correctly log
* Don't run jailbreakd if Cydia Substrate is installed
* Don't set the boot nonce if it already is
* Make obvious internal changes
* Make jailbreaking obviously faster
* Fix a brutal kernel memory leak
* Fix shutdown or halt leading to a reboot
* Fix a logic error that would disable jailbreak patches when Substrate was installed but Load Daemons was disabled that was introduced with the previous build
* Fix a bug in RootFS Restore for iOS 11.0 - 11.2.6 that was introduced with the previous build
* Fix a bug in trust cache injection
* Improve update checker
* Make jailbreaking obviously faster
* Fix a bug in RootFS Restore for iOS 11.0 - 11.2.6 that would cause it to not work on some devices
* Fix a bug in update checker
* Fix a bug in the posix_spawn wrapper that would cause weird issues on some devices (Known for causing the "(24/40)" issue)
|-
| v2.1.1
| {{date|2019|01|05}}
|
* Make jailbreaking faster
* Don't error out if the hosts file doesn't exist
* Ignore dependencies in Cydia reinstallation
* Fix false positives
* Clean Cydia's user data in RootFS Restore
* Fix a snapshot name confusion bug in RootFS Restore
* Fix another bug in RootFS Restore
* Improve memory management
* Use less external binaries
* Completely clean Cydia's user data in RootFS Restore
|-
| v2.1.3
| rowspan="2" | {{date|2019|01|26}}
|
* Fix a bug in patch finder that affected the shenanigans finder on specific iOS versions
* Switch to a better versioning system
* Make downgrading from v2.2.0 possible (Unreleased as of now)
|-
| v2.1.4
|
*Decrease the app's size from 63MBs to 22MBs by optimizing assets
|-
| v2.2.0
| rowspan="3" | {{date|2019|01|30}}
|
* Install Cydia Substrate if it's not already installed
* Validate Cydia Substrate files and reinstall it if the validation fails
* Fix a bug in switching from Electra without RootFS Restore
* Clean up the kernel data structure patches to improve the performance and the security
* Remove Substitute support files in the filesystem
* Remove Substitute support links in the filesystem
* Uninstall Electra's Cydia Upgrade Helper if it is present
* Improve preference management
* Switch to a more efficient versioning system
* Use a new implementation of the system's libarchive to extract the bootstrap to increase the perfomance
* Update rsync to increase the performance and the stability of RootFS Restore
* Improve memory management
* Re-Extract bootstrap if it was extracted on a different iOS version
* Credit Saurik in the credits view for Cydia and Substrate
* Avoid writing to the disk when not necessary
* Add a verbose log window for the jailbreak
* Make the exploits slightly faster
* Make the jailbreak significantly faster and more performant
* Jailbreak itself now takes almost less than a second run (Exploit not included)
* Fix a bug in patch finder that would cause the sandbox escape to fail on certain devices
* Fix theoretical bugs
* Improve assertion
* Performance improvements
* Fix a bug in logging
* Update bootstrap
* Enable overwriting files in the bootstrap extractor
* Fix switching from Electra without restoring root filesystem
* Fix certain error descriptions
* Fix RootFS Restore on certain devices
* Add a switch to hide the log window
* Decrease the app's size from 81MBs to 25MBs by optimizing assets
* Add a switch to reset Cydia cache on request
* Rewrite Cydia installation
* Install a local repo
* Remove bootstrap
* Hide the local APT repo from Cydia
|-
| v2.2.1
|
* Fix a bug in installing Cydia / extracting bootstrap
|-
| v2.2.2
|
* Fully fix a bug in installing Cydia / extracting bootstrap
|-
| v2.2.3
| {{date|2019|01|31}}
|
* Fix a bug with extracting rsync
|-
| v3.0.0
| {{date|2019|04|19}}
|
* Add support for iOS 12.0-12.1.2.
|-
| v3.0.1
| {{date|2019|04|23}}
|
* Iterate the proc list with proper data locks in Unrestrict to fix a possible race condition in the kernel (Important stability fix)
* Fix a typo in the app
* Fix a bug in logging
* Add iOS 12.1.3 - 12.2 support for the restart button
|-
| v3.1
| {{date|2019|05|23}}
|
* Rewrite the kernel patches from scratch to improve the stability and the reliability of the jailbreak
* Rewrite the preference management system from scratch to optimize the jailbreak
* Rewrite the diagnostics system from scratch to provide more useful information
* Rewrite unrestrict libary from scratch to improve the stability of the system after jailbreak
* Add support for switching from the other iOS 12 jailbreaks without restoring the root filesystem and losing data
* Make Unrestrict add sandbox exceptions for mach_lookup and mach_register
* Fix issues with processes looking up Substrate port on iOS 12 to fix stability and performance issues
* Fix support for the broken versions of RocketBootstrap and hid-support tweaks
* Fix the iMessage audio crash
* Fix FaceTime calls disappearing on some devices
* Fix Camera crash on some devices
* Update the local APT repo to include the latest updates from the Elucubratus repository, including the updated uikittools with rewritten uicache and sbreload commands to make refreshing the icon cache and reloading the SpringBoard significantly faster when installing packages from Cydia
* Refresh the icon cache during the root filesystem restore to fix jailbreak apps staying on the home screen after restoring the root filesystem
* Update mobilesubstrate to version 0.9.7033 to disable loader in the securityd daemon to fix a freeze issue on iOS 12
* Significantly improve the reliability of the jailbreak when using the machswap or the machswap2 exploit
* Wait for the user to tap OK on the jailbreak completed alert before respringing the device
* Improve the jailbreak's self-repairability feature
* Add a progress HUD to display the status of the jailbreak process
* Optimize the code
* Improve assertion
* Add error-specific error messages
* Display info about the device on launch
* Clean up logging
* Reconfigure the "Reload System Daemons" and "Enable get-task-allow" preferences
* Make "Enable get-task-allow" a default option
|-
| v3.1.1
| rowspan="2" | {{date|2019|05|24}}
|
* Fix running root filesystem restore when not in the jailbroken state on iOS 11
* Add an option to automatically restart the SpringBoard once the jailbreak is done instead of waiting for the user to tap the OK button (Requested by a Redditor)
|-
| v3.1.2
|
* Fix a bug in the settings user interface on smaller devices
* Add an option to hide the progress HUD (Requested by a Redditor)
|-
| v3.1.3
| {{date|2019|05|28}}
|
* Fix a bug in updating the status
* Fix a logic bug in remounting the root filesystem (Addresses https://www.reddit.com/r/jailbreak/comments/btxqng/help_still_cant_jb_on_ios_1211_using_the_newest/)
* Make machswap and machswap2 not depend on stealing kernel's credentials to fix a possible reliability issue
* Update kernel patches to use a safer allocation method
* Fix missing information in the jailbreak completed notice
* Fix false information in the jailbreak completed notice
|-
| v3.2
| {{date|2019|06|01}}
|
* Redesign the user interface (https://twitter.com/HiMyNameIsUbik/status/1134938278489182208)
* Add dark mode for the user interface
* Add info buttons for the options
* Increase the reliability of the jailbreak with the machswap and machswap2 exploits
* Update jailbreak-resources to fix an issue with the CS_DEBUGGED option
|-
| v3.2.1
| {{date|2019|06|02}}
|
* Fix several typos in the app
* Update the bundled uikittools
* Ignore refresh icon cache failures unless they are actually fatal
|-
| v3.3.0
| {{date|2019|07|14}}
|
* Add the Sock Puppet exploit for iOS 12.0-12.2 support on A8X-A11 devices
* Remove the empty_list and multi_path exploits
* Replace the kernel exploit segmented switch with picker view
* Add code substitution platform picker view
|-
| v3.3.1
| rowspan="2" | {{date|2019|07|16}}
|
* Improve the speed of the jailbreak process by a few seconds
* Fix a bug in dark mode on the iPads
|-
| v3.3.2
|
* Fix a bug in finding kernel offsets on iOS 11
|-
| v3.3.3
| {{date|2019|07|18}}
|
* Fix the Sock Puppet kernel exploit on iOS 11
* Fix the Voucher Swap exploit's compatibility status with iPad Air 2 and iPad Mini 4 on iOS 11
|-
| v3.3.4
| rowspan="4" | {{date|2019|07|19}}
|
* Add the Sock Port exploit by [https://twitter.com/jakeashacks @jakeashacks] for iOS 11.0-12.1.4 on A7-A9X devices
|-
| v3.3.5
|
* Fix a reliability bug in Sock Port
* Fix Sock Puppet on A8X
|-
| v3.3.6
|
* Fix Sock Port failing on 4K devices
|-
| v3.3.7
|
* Improve the reliability of the Sock Port kernel exploit on 4K devices
|-
| v3.3.8
| {{date|2019|07|22}}
|
* Use the rewritten SockPort 2.0 exploit with ~100% reliability, ~100 milliseconds run time and support for all devices on iOS 11.0-12.2 (12.1.3-12.2 on A12-A12X excluded)
* Fix the jailbreak on iOS 12.2 iPhones and iPods
|-
| v3.4.0
| {{date|2019|07|23}}
|
* Replace the SockPort 2.0 exploit with the SockPuppet 2.0 exploit with better reliability and stability on older devices
|-
| v3.4.1
| rowspan="2" | {{date|2019|07|25}}
|
* Fix the sandbox swap error when using the exploits that are not SockPuppet
* Add the SockPort 1.5 exploit by [https://github.com/jakeajames @jakeajames] for A7-A9X devices (Reliability: ~95% from extensive testing)
* Disable the SockPuppet exploit on A7-A7X due to reliability issues
* Add iOS 12.3~b1 support to the jailbreak (Verified working on iPhone 5s)
* Fix a theoretical reliability bug with SockPuppet
|-
| v3.4.2
|
* Fix the SockPuppet kernel exploit not displaying on A8-A8X devices
|-
| v3.5.0
| {{date|2019|08|18}}
|
* Add iOS 12.4 support to the Sock Puppet (A8-A11) and Sock Port (A7-A7X) exploits
|-
| v3.5.1
| rowspan="3" | {{date|2019|08|19}}
|
* Add the updated SockPuppet 3.0 exploit by @umanghere
* Remove the SockPort and SockPort2 exploits
* Update system-memory-reset fix to fix random reboots
* Add Apple to the credits section for development
* Fix error at stage 2 when jailbreaking after updating from a lower firmware while preserving the app data
* Fix the app crashing up on stared up on iOS 11
|-
| v3.5.2
|
* Fix the SockPuppet 3.0 exploit on iPad Mini 4 and iPad Air 2
|-
| v3.5.3
|
* Add WIP partial support for A12-A12X devices on iOS 12.1.3, 12.1.4, 12.2 and 12.4 with support for setting HSP#4 as TFP0, setting kernel_task info, exporting kernel_task port, dumping APTicket, logging KASLR shift and ECID and disabling auto updates
|-
| v3.5.4
| rowspan="2" | {{date|2019|08|22}}
|
* Add full-fledged SSH support with root-shell for A12-A12X devices on iOS 12.1.3-12.4
* Add support for arbitrary unsigned code execution on A12-A12 devices on iOS 12.1.3-12.4
(Note: Object files will have to be signed with a CMS blob using the codesign utility)
* Add support for running expired or revoked apps on A12-A12X devices on iOS 12.1.3-12.4
* Fix instant or random reboots after jailbreaking with the SockPuppet3.0 exploit on A7-A12X devices on iOS 11.0-12.4
Note: Code injection is not supported on A12-A12X devices as of yet
|-
| v3.5.5
|
* Fixes issues with the jailbreak introduced with the last update
* Fixes iOS 11 support
|-
| v3.5.6
| {{date|2019|08|24}}
|
* Add support for remounting the RootFS as read-write on A12-A12X devices running iOS 12.1.3-12.4
* Adds support for restoring the RootFS on A12-A12X devices running iOS 12.1.3-12.4
|-
| v3.6.0
| rowspan="2" | {{date|2019|09|08}}
|
* Completely redesign and rewrite all jailbreak patches from scratch.
* Make the jailbreak patches static and not dynamic, Meaning that the system stability will be completely stock after the jailbreak.
* Fix the app crashing on launch when signed with provisioning profiles with non-ASCII characters.
* Internally prepare jailbreak patches for full-fledged A12-A12X support.
* Make the jailbreak significantly and noticeably more reliable and faster to run.
* Add the SockPort 3.0 exploit for improved reliability on iOS 12.4 and devices with low RAM.
* Fix SSH support for arm64e devices running iOS 12.0-12.1.2.
* Make it possible to jailbreak with corrupted SystemVersion.plist on iOS 12.4.
* Make the jailbreak perform proper clean up to preserve system stability in case of a failure.
* Fix the jbctl command-line utility.
* Switch to a new technique for setting the system boot nonce generator that works on all arm64e devices running iOS12.0-12.4, (Thanks to [https://github.com/0x7ff @0x7ff] for the idea).
* Fix a bug with the initial Cydia installation getting stuck sometimes.
* Significantly speed up the initial Cydia installation process.
* Internally prepare upcoming stable substitute support.
* Internally prepare Cydia and its resources for full-fledged arm64e support.
|-
| v3.6.1
|
* Improves auto-exploit selection.
|-
| v3.6.2
| rowspan="2" | {{date|2019|09|09}}
|
* Fix an issue with the kernel virtual memory access APIs on A7-A8 devices that rendered the jailbreak useless by causing it to fail to copy big kernel data (Error known as: "Unable to copy container profile in kernel memory.")
|-
| v3.6.3
|
* Fix an issue with finding kernel offsets on A8
|-
| v3.7.0~b2
| rowspan="2" | {{date|2019|10|14}}
|
* Full-fledged A12-A12X support with Cydia and system-wide tweak injection
* Fix Camera on A12-A12X devices
* Fix GPS on A12-A12X devices
* Fix App Store purchases on A12-A12X devices
* Fix Face ID on A12-A12X devices
* Fix performance issues on A12-A12X devices
* Fix stability issues on A12-A12X devices
* Fix reload system daemons issues on A12-A12X devices
* Fix general stability issues with system services on A12-A12X devices
* Fix system shutdown on A12-A12X devices
* Fix system restart on A12-A12X devices
* Fix USB on A12-A12X devices
* Fix Xcode debugging on A12-A12X devices
* Fix a bug in libsubstitute that broke the TetherMe tweak A12-A12X devices
* Enable full-fledged AMFI/CoreTrust bypass on A12-A12X devices
* Fix memory management issues on A12-A12X devices
* Fix tweak injection to MobileSafari on A12-A12X devices
* Make reload system daemons reload services with launchctl instead of ldrestart
* Reload system daemons before restarting SpringBoard
|-
| v3.7.0~b3
|
* Correct a problem with reload system daemons when using Substrate (non-A12 devices)
|-
| v3.7.0~b4
| {{date|2019|12|02}}
|
* Update bundled Cydia to prompt for network access on China devices
* Rename the bundled mobilesubstrate to match other jailbreaks
* Update the bundled substitute to 0.1.0
|-
| v3.8.0~b1
| {{date|2019|12|09}}
|
* Add iOS 12.4.1 support for A12 iPhones (iPads not supported at this time)
|-
| v4.0.0
| {{date|2020|02|15}}
|
* Full-fledged support for A12-A13 devices on iOS 13.0-13.3 with Cydia and system-wide tweak injection
|-
| v4.0.1
| {{date|2020|02|16}}
|
* Fix App Store for A12-A13
* Fix push notifications for A12-A13
* Improve reliability for A12-A13 devices on iOS 13.0-13.3
|-
| v4.0.2
| {{date|2020|02|17}}
|
* Fix iOS 13.0-13.2.3 support
* Fix injection into WebContent
|-
| v4.0.3
| {{date|2020|02|19}}
|
* Fully fix App Store on A12-A13
* Fix a newly introduced bug that affected system services on A12-A13
* Improve the exploit reliability by guiding the user on proper use on A12-A13
|-
| v4.1.0
| {{date|2020|02|23}}
|
* Replace the oob_timestamp exploit by [https://twitter.com/bazad @bazad] with the time_waste exploit by [https://twitter.com/jakeashacks @jakeashacks] for 99% stage 1 (exploit) reliability on iOS 13.0-13.3
* Fix compatibility issues with iOS 11.0-12.4 and 13.0-13.2.3
|-
| v4.2.0
| {{date|2020|02|25}}
|
* Fix issues with system services on A12-A13 (i.e. iMessage notifications)
* Add iOS 13.0-13.3 support for A8-A11 devices
* Fix temporary freeze after the jailbreak completed alert
|-
| v4.2.1
| {{date|2020|02|26}}
|
* Fix a bug that caused unreliability in starting up substitute
* Fix an issue that broke battery settings and caused extra battery drain
|-
| v4.3.1
| {{date|2020|03|08}}
|
* Bumped version to 4.3.1 due to a github bug causing an older file to be temporarily available
* Add support for rebooting the userspace for the first time in a jailbreak
* Add support for injecting to the entire userspace
* Add support for looking up or registering services from the sandbox with the cy: prefix for developers
* Reboot the userspace after jailbreaking
* Make major design changes to preserve stock system performance
* Fix random reboots, freezes, memory issues and any known problem that affected system services or apps
* Fix persistent software update blocker on iOS 13 (Works in the jailed state too)
* Fix a design problem that affected the Succession restore tool
* Automatically re-enable software updates when restoring RootFS
|-
| v5.0.0
| {{date|2020|05|23}}
|
* Full-fledged support for all devices on iOS 11.0-13.5 with Cydia and tweak injection
|-
| v5.0.1
| {{date|2020|05|24}}
|
* Full-fledged support for all devices on iOS 11.0-13.5 with Cydia and tweak injection
* Enable unrestricted storage access to jailbreak applications for sandbox backwards compatibility<br>while keeping security intact by leaving the security restrictions enabled for system and user applications
* Update Phone Rebel case models and bundled packages
|}

[[Category:Jailbreaks]]
[[Category:Jailbreaking]]

Jailbreak Exploits

2020-05-26T17:04:29Z

Kiddepants: Asked Pwn about this, he said to remove.

This page lists the '''exploits''' used in [[jailbreak]]s.

== Common exploits ==
These exploits are not dependent on any firmware; as such, they are used in numerous jailbreaking programs.

* [[Pwnage]] + [[Pwnage 2.0]] (together to jailbreak the [[M68AP|iPhone]], [[N45AP|iPod touch]], and [[N82AP|iPhone 3G]])
* [[ARM7 Go]] (from iOS 2.1.1) (for [[tethered jailbreak]] on [[N72AP|iPod touch (2nd generation)]])
* [[0x24000 Segment Overflow]] (for [[untethered jailbreak]] on [[N88AP|iPhone 3GS]] with [[Bootrom 359.3|old bootrom]] and [[N72AP|iPod touch (2nd generation)]] with [[Bootrom 240.4|old bootrom]]; another exploit as the [[limera1n Exploit]] is required)
* [[limera1n Exploit]] (for [[tethered jailbreak]] on [[N88AP|iPhone 3GS]], [[N18AP|iPod touch (3rd generation)]], [[K48AP|iPad]], [[iPhone 4]], [[N81AP|iPod touch (4th generation)]] and [[K66AP|Apple TV (2nd generation)]])
* [[usb_control_msg(0xA1, 1) Exploit]] (also known as "steaks4uce") (for [[tethered jailbreak]] on [[N72AP|iPod touch (2nd generation)]])

== Jailbreak Programs ==
=== [[PwnageTool]] (2.0 - 5.1.1) ===
* uses different common exploits
* uses the exploits listed below to untether up to iOS 5.1.1

=== [[redsn0w]] (3.0 - 6.0) ===
* uses different common exploits
* uses the same exploits as [[Absinthe|Absinthe]] and [[Absinthe|Absinthe 2.0]] to jailbreak iOS 5.0/5.0.1 and 5.1.1
* uses the exploits listed below to untether up to iOS 5.1.1

=== [[sn0wbreeze]] (3.1.3 - 6.1.3) ===
* uses different common exploits
* uses the exploits listed below to untether up to iOS 6.1.2

== Programs used to jailbreak 1.x ==
=== [[AppTapp Installer]] (1.0 / 1.0.1 / 1.0.2) ===
* iBoot <code>cp</code>-command exploit

=== [[iBrickr]] (1.0 / 1.0.1 / 1.0.2) ===
* iBoot <code>cp</code>-command exploit

=== [[AppSnapp]]/[[JailbreakMe|JailbreakMe 1.0]] (1.0 / 1.0.1 / 1.0.2 / 1.1.1) ===
* [[LibTiff|libtiff exploit]] (Adapted from the PSP scene, used by [[JailbreakMe]]) ({{cve|2006-3459}})

=== [[mknod|OktoPrep]] (1.1.2) ===
"Upgrade" to 1.1.2 from a jailbroken 1.1.1
* [[mknod]]

=== [[Soft Upgrade]] (1.1.3) ===
"Upgrade" to 1.1.3 from a running jailbroken 1.1.2

=== [[ZiPhone]] (1.1.3 / 1.1.4 / 1.1.5) ===
* [[Ramdisk Hack]]

=== [[iLiberty+|iLiberty / iLiberty+]] (1.1.3 / 1.1.4 / 1.1.5) ===

== Programs used to jailbreak 2.x ==
=== [[QuickPwn]] (2.0 - 2.2.1) ===
* uses [[Pwnage]] and [[Pwnage 2.0]]

=== [[Redsn0w Lite]] (2.1.1) ===
* [[ARM7 Go]] (for [[N72AP|iPod touch (2nd generation)]] only)

== Programs used to jailbreak 3.x ==
=== [[purplera1n]] (3.0) ===
* [[iBoot Environment Variable Overflow]] ({{cve|2009-2795}})
* uses [[0x24000 Segment Overflow]]

=== [[blackra1n]] (3.1 / 3.1.1 / 3.1.2) ===
* [[usb_control_msg(0x21, 2) Exploit]] ({{cve|2010-0038}})
* uses [[0x24000 Segment Overflow]]

=== [[Spirit]] (3.1.2 / 3.1.3 / 3.2) ===
* [[MobileBackup Copy Exploit]]
* [[Incomplete Codesign Exploit]]
* [[BPF_STX Kernel Write Exploit]]

=== [[Star|JailbreakMe 2.0 / Star]] (3.1.2 / 3.1.3 / 3.2 / 3.2.1) ===
* [[Malformed CFF Vulnerability]] ({{cve|2010-1797}})
* [[Incomplete Codesign Exploit]]
* [[IOSurface Kernel Exploit]] ({{cve|2010-2973}})

=== [[limera1n]] / [[greenpois0n (jailbreak)|greenpois0n]] (3.2.2) ===
* uses different common exploits
* [[Packet Filter Kernel Exploit]]

== Programs used to jailbreak 4.x ==
=== [[Star|JailbreakMe 2.0 / Star]] (4.0 / 4.0.1) ===
* [[Malformed CFF Vulnerability]] ({{cve|2010-1797}})
* [[Incomplete Codesign Exploit]]
* [[IOSurface Kernel Exploit]] ({{cve|2010-2973}})

=== [[limera1n]] (4.0 / 4.0.1 / 4.0.2 / 4.1) ===
* uses different common exploits
* [[Packet Filter Kernel Exploit]]

=== [[greenpois0n (jailbreak)|greenpois0n]] (4.1) ===
* uses different common exploits
* [[Packet Filter Kernel Exploit]]

=== [[greenpois0n (jailbreak)|greenpois0n]] (4.2.1) ===
* uses different common exploits
* [[HFS Legacy Volume Name Stack Buffer Overflow]]

=== [[Saffron|JailbreakMe 3.0 / Saffron]] (4.2.6 / 4.2.7 / 4.2.8) ===
* [[T1 Font Integer Overflow]] ({{cve|2011-0226}})
* [[HFS Legacy Volume Name Stack Buffer Overflow]]

=== [[unthredeh4il]] (4.2.6 - 4.2.10) ===
Except for the [[iPad (3rd generation)]]
* MobileBackup2 Copy Exploit
* a new Packet Filter Kernel Exploit ({{cve|2012-3728}})
* [[AMFID code signing evasion]] ({{cve|2013-0977}})
* [[launchd.conf untether]]
* [[Timezone Vulnerability]]

=== [[Saffron|JailbreakMe 3.0 / Saffron]] (4.3 / 4.3.1 / 4.3.2 / 4.3.3) ===
Except for the [[N18AP|iPod touch (3rd generation)]] on iOS 4.3.1.
* [[T1 Font Integer Overflow]] ({{cve|2011-0226}})
* [[IOMobileFrameBuffer Privilege Escalation Exploit]] ({{cve|2011-0227}})

=== i0nic's Untether (4.3.1 / 4.3.2 / 4.3.3) ===
used in [[redsn0w]] to untether iOS 4.3.1 / 4.3.2 / 4.3.3
* [[ndrv_setspec() Integer Overflow]]

=== [[unthredeh4il]] (4.3 - 4.3.5) ===
Except for the [[iPad (3rd generation)]]
* MobileBackup2 Copy Exploit
* a new Packet Filter Kernel Exploit ({{cve|2012-3728}})
* [[AMFID code signing evasion]] ({{cve|2013-0977}})
* [[launchd.conf untether]]
* [[Timezone Vulnerability]]

== Programs used to jailbreak 5.x ==

=== [[Absinthe]] (5.0 on [[N94AP|iPhone 4S]] only / 5.0.1 on [[iPad 2]] and [[iPhone 4S]]) ===
* [[Racoon String Format Overflow Exploit]] ({{cve|2012-0646}}) (used both for payload injection and untether)
* [[HFS Heap Overflow]] ({{cve|2012-0642}})
* unknown exploit ({{cve|2012-0643}})

=== [[Corona|Corona Untether]] (5.0.1) ===
* [[Racoon String Format Overflow Exploit]] ({{cve|2012-0646}})
* [[HFS Heap Overflow]] ({{cve|2012-0642}})
* unknown exploit ({{cve|2012-0643}})

=== [[Absinthe|Absinthe 2.0]] and [[Rocky Racoon|Rocky Racoon Untether]] (5.1.1) ===
* a new Packet Filter Kernel Exploit ({{cve|2012-3728}})
* Racoon DNS4/WINS4 table buffer overflow ({{cve|2012-3727}})
* MobileBackup2 Copy Exploit

=== [[unthredeh4il]] (5.0-5.1.1) ===
Except for the [[iPad (3rd generation)]]
* MobileBackup2 Copy Exploit
* a new Packet Filter Kernel Exploit ({{cve|2012-3728}})
* [[AMFID code signing evasion]] ({{cve|2013-0977}})
* [[launchd.conf untether]]
* [[Timezone Vulnerability]]

== Programs used to jailbreak 6.x ==
=== [[evasi0n]] (6.0 / 6.0.1 / 6.0.2 / 6.1 / 6.1.1 / 6.1.2) ===
* [[Symbolic Link Vulnerability]] ({{cve|2013-0979}})
* [[Timezone Vulnerability]]
* [[Shebang Trick]] ({{cve|2013-5154}})
* [[AMFID code signing evasion]]
* [[launchd.conf untether]]
* [[IOUSBDeviceFamily Vulnerability]] ({{cve|2013-0981}})
* [[ARM Exception Vector Info Leak]] ({{cve|2013-0978}})
* [[dynamic memmove() locating]]
* [[vm_map_copy_t corruption for arbitrary memory disclosure]]
* [[kernel memory write via ROP gadget]]
* [[Overlapping Segment Attack]] ({{cve|2013-0977}})

=== [[p0sixspwn]] (6.1.3 / 6.1.4 / 6.1.5 / 6.1.6) ===
* [[posix_spawn kernel information leak]] ({{cve|2013-3954}}) (by [[i0n1c]])
* [[posix_spawn kernel exploit]] ({{cve|2013-3954}}) (by [[i0n1c]])
* [[mach_msg_ool_descriptor_ts for heap shaping]] ({{cve|2013-3953}})
* [[AMFID_code_signing_evasi0n7]] ({{cve|2014-1273}})
* [[DeveloperDiskImage race condition]] (by [[comex]])
* [[launchd.conf untether]]

== Programs used to jailbreak 7.x ==
=== [[evasi0n7]] (7.0 / 7.0.1 / 7.0.2 / 7.0.3 / 7.0.4 / 7.0.5 / 7.0.6) ===
{{Section Stub}}
* [[Symbolic Link Vulnerability]] ({{cve|2013-5133}})
* [[AMFID_code_signing_evasi0n7]] ({{cve|2014-1273}})
* CrashHouseKeeping chmod vulnerability ({{cve|2014-1272}})
* ptmx_get_ioctl ioctl crafted call ({{cve|2014-1278}})

=== [[Geeksn0w]] (7.1 / 7.1.1) ===
* [[limera1n]]'s bootrom exploit ([[Tethered jailbreak]]) on [[iPhone 4]]

=== [[Pangu]] (7.1 / 7.1.1 / 7.1.2) ===
* Mach-O OSBundleHeaders info leak ({{cve|2014-4491}}) (Pangu v1.0.0)
* AppleKeyStore::initUserClient info leak ({{cve|2014-4407}}) (Pangu >v1.0.0)
* break_early_random (by [[i0n1c]] and Tarjei Mandt of Azimuth) ({{cve|2014-4422}})
* mach_port_kobject exploit {{cve|2014-4496}} - used to recover the permutation value and addresses of kernel objects
* IOSharedDataQueue notification port overwrite ({{cve|2014-4461}})
* "syslogd chown" vulnerability
* enterprise certificate (no real exploit, used for initial "unsigned" code execution)
* "foo_extracted" symlink vulnerability (used to write to /var) ({{cve|2014-4386}})
* /tmp/bigfile (a big file for improvement of the reliability of a race condition)
* VoIP backgrounding trick (used to auto restart the app)
* hidden segment attack

== Programs used to jailbreak 8.x ==
=== [[Pangu8]] (8.0 / 8.0.1 / 8.0.2 / 8.1) ===
* an exploit for a bug in /usr/libexec/neagent (source @iH8sn0w)
* enterprise certificate (inside the IPA)
* a kind of dylib injection into a system process (see IPA)
* a dmg mount command (looks like the Developer DMG) (syslog while jailbreaking)
* a sandboxing problem in debugserver ({{cve|2014-4457}})
* mach_port_kobject exploit {{cve|2014-4496}} - used to recover the permutation value and addresses of kernel objects
* the same kernel exploit as used in [[Pangu|the first Pangu]] ({{cve|2014-4461}}) (source @iH8sn0w) - now used to also leak kernel memory (source @Morpheus______)
* enable-dylibs-to-override-cache
* a new ovelapping segment attack ({{cve|2014-4455}})

=== [[TaiG]] and [[PPJailbreak]] (8.0 / 8.0.1 / 8.0.2 / 8.1 / 8.1.1 / 8.1.2) ===
(See also details at [http://newosxbook.com/articles/TaiG.html newosxbook.com])
* A new AFC symlink attack ({{cve|2014-4480}}) - to get onto the device filesystem
* [[DeveloperDiskImage race condition]] (by [[comex]], also used in p0sixspwn) - to mount a fake DDI and instantly overwrite (via union) libmis/xpcd_cache
* A new overlapping segment attack [in a modified version], dyld, ({{cve|2014-4455}}) - negative LC_SEGMENT - to allow libmis and xpcdcache to load
* libmis redirection of MISValidateSignature (as per evasion) to kCFEqual, with overlapping segment variant on TaiG (Segment at end of file, negative)
* enable-dylibs-to-override-cache - force loading of dynamic libraries from filesystem (where available) instead of the shared cache (overriding libmis/xpcd_cache)
* MobileStorageMounter exploit ({{cve|2015-1062}})
* Backup exploit used to access restricted parts of the filesystem ({{cve|2015-1087}})

Kernel:

* Mach-O OSBundleHeaders info leak ({{cve|2014-4491}}) - leaks slid addresses
* mach_port_kobject exploit {{cve|2014-4496}} - used to recover the permutation value and addresses of kernel objects
* IOHIDFamily Kernel exploit ({{cve|2014-4487}}) - to overwrite memory

=== [[TaiG]] and [[PPJailbreak]] (8.1.3 / 8.2 / 8.3 / 8.4) ===
(See also details at http://newosxbook.com/articles/28DaysLater.html and http://newosxbook.com/articles/HIDeAndSeek.html)
* [[DeveloperDiskImage race condition]] (also used in TaiG for 8.0-8.1.2 but modified) - to mount a fake DDI
* enable-dylibs-to-override-cache - force loading of dynamic libraries from filesystem (where available) instead of the shared cache (overriding libmis)
* Symbolic linking to AFC ({{cve|2015-5746}})
* Backup exploit to write to protected regions of the disk ({{cve|2015-5752}})
* Code signing exploit ({{cve|2015-3802}})
* Code signing exploit ({{cve|2015-3803}})
* Code signing exploit ({{cve|2015-3805}})
* Code signing exploit ({{cve|2015-3806}})
* IOHIDFamily exploit ({{cve|2015-5774}})
* Air Traffic exploit to allow attackers to access arbitrary filesystem locations via vectors related to asset handling ({{cve|2015-5766}})

=== [[EtasonJB]] and [[Home Depot]] (8.4.1) ===

* OSUnserialize Information leak ({{cve|2016-4655}})
* Kernel exploit ({{cve|2016-4656}})

== Programs used to jailbreak 9.x ==
=== [[Pangu9]] (9.0 / 9.0.1 / 9.0.2 / 9.1) ===
* Photos exploit to gain arbitrary unsandboxed file system access as mobile to load outdated DDI. ({{cve|2015-7037}})
* MobileStorageMounter allowed older DeveloperDiskImages to be mounted, resulting in unsandboxed unsigned code execution due to known weaknesses in entitled executables. ({{cve|2015-7051}})
* IOHIDFamily Use-After-Free for kernel information leak / code execution as mobile. ({{cve|2015-6974}})
* dyld exploit in dyld shared cache handling to override MISValidateSignature in libmis.dylib for persistency ({{cve|2015-7079}})
* Racing KPP for some of the patches.
* AMFI MAC Hooks were in non-__const __DATA section, so wouldn't be integrity checked by KPP, allowing to replace MAC hooks required for code-signing. ({{cve|2015-7055}})

=== [[Pangu9]] (9.2 / 9.2.1 / 9.3 / 9.3.1 / 9.3.2 / 9.3.3) ===
* IOMobileFrameBuffer exploit to execute arbitrary code with kernel privileges. ({{cve|2016-4654}})

=== [[jbme]] (9.2 / 9.2.1 / 9.3 / 9.3.1 / 9.3.2 / 9.3.3) ===
* Webkit exploit ({{cve|2016-4657}})

=== [[Home Depot]] (9.1-9.3.4) ===
* OSUnserialize Information leak ({{cve|2016-4655}})
* Kernel exploit ({{cve|2016-4656}})

=== [[JailbreakMe 4.0]] (9.1-9.3.4) ===
* OSUnserialize Information leak ({{cve|2016-4655}})
* Kernel exploit ({{cve|2016-4656}})
* Webkit exploit ({{cve|2016-4657}})

=== [[Phœnix]] (9.3.5 / 9.3.6) ===
* OSUnserialize Information leak ({{cve|2016-4655}})
* mach_port_register Kernel exploit ({{cve|2016-4669}})

== Programs used to jailbreak 10.x ==

=== [[extra_recipe+yaluX]] (10.0-10.1.1) ===

* set_dp_control_port exploit to execute arbitrary code with kernel privileges. ({{cve|2016-7644}})

=== [[yalu102]] (10.0.1-10.2) ===

* mach_voucher_extract_attr_recipe_trap memory corruption. ({{cve|2017-2370}})

=== [[doubleH3lix]] (10.0.1 - 10.3.3) ===

* IOSurface Kernel Exploit ({{cve|2017-13861}})

=== [[Meridian]] (10.0 - 10.3.3) ===

* IOSurface Kernel Exploit ({{cve|2017-13861}})

=== [[TotallyNotSpyware]] (10.0 - 10.3.3) ===

* IOSurface Kernel Exploit ({{cve|2017-13861}})
* WebKit JIT optimization bug exploit ({{cve|2018-4233}})

=== [[H3lix]] (10.0.1 - 10.3.4) ===

* IOSurface Kernel Exploit ({{cve|2017-13861}})

== Programs used to jailbreak 11.x ==

===[[Unc0ver]] (11.0-11.4.1)===

11.0 - 11.1.2

* IOSurface Kernel Exploit ({{cve|2017-13861}})

11.0 - 11.3.1

* mptcp_usr_connectx (multi_path) ({{cve|2018-4241}})
* getvolattrlist (empty_list) ({{cve|2018-4243}})

11.0 - 11.4.1

* voucher_swap ({{cve|2019-6225}})

===[[Electra]] (11.0-11.4.1)===

11.0 - 11.1.2

* IOSurface Kernel Exploit ({{cve|2017-13861}})

11.2 - 11.3.1

* mptcp_usr_connectx (multi_path) ({{cve|2018-4241}})
* getvolattrlist (empty_list) ({{cve|2018-4243}})

11.2 - 11.4.1

* v1ntex ({{cve|2019-6225}})

== Programs used to jailbreak 12.x ==

===[[Chimera]] (12.0 - 12.2 / 12.4)===

12.0 - 12.1.2

* voucher_swap ({{cve|2019-6225}})

12.0 - 12.2/12.4

* sockpuppet ({{cve|2019-8527}})

===[[Unc0ver]] (12.0 - 12.2 / 12.4 / 12.4.1)===

12.0 - 12.1.2

* voucher_swap ({{cve|2019-6225}})

12.0 - 12.2/12.4

* sockpuppet ({{cve|2019-8527}})

===[[checkra1n]] (12.3 - 12.4.7)===

* [[Checkm8_Exploit | checkm8]] ({{cve|2019-8900}})

== Programs used to jailbreak 13.x ==

===[[Unc0ver]] (13.0 - 13.5)===

* oob_timestamp ({{cve|2020-3837}})

===[[checkra1n]] (13.0 - 13.5)===

* [[Checkm8_Exploit | checkm8]] ({{cve|2019-8900}})

Jailbreak Exploits

2020-05-26T03:30:16Z

Kiddepants: oops my bad lol

This page lists the '''exploits''' used in [[jailbreak]]s.

== Common exploits ==
These exploits are not dependent on any firmware; as such, they are used in numerous jailbreaking programs.

* [[Pwnage]] + [[Pwnage 2.0]] (together to jailbreak the [[M68AP|iPhone]], [[N45AP|iPod touch]], and [[N82AP|iPhone 3G]])
* [[ARM7 Go]] (from iOS 2.1.1) (for [[tethered jailbreak]] on [[N72AP|iPod touch (2nd generation)]])
* [[0x24000 Segment Overflow]] (for [[untethered jailbreak]] on [[N88AP|iPhone 3GS]] with [[Bootrom 359.3|old bootrom]] and [[N72AP|iPod touch (2nd generation)]] with [[Bootrom 240.4|old bootrom]]; another exploit as the [[limera1n Exploit]] is required)
* [[limera1n Exploit]] (for [[tethered jailbreak]] on [[N88AP|iPhone 3GS]], [[N18AP|iPod touch (3rd generation)]], [[K48AP|iPad]], [[iPhone 4]], [[N81AP|iPod touch (4th generation)]] and [[K66AP|Apple TV (2nd generation)]])
* [[usb_control_msg(0xA1, 1) Exploit]] (also known as "steaks4uce") (for [[tethered jailbreak]] on [[N72AP|iPod touch (2nd generation)]])

== Jailbreak Programs ==
=== [[PwnageTool]] (2.0 - 5.1.1) ===
* uses different common exploits
* uses the exploits listed below to untether up to iOS 5.1.1

=== [[redsn0w]] (3.0 - 6.0) ===
* uses different common exploits
* uses the same exploits as [[Absinthe|Absinthe]] and [[Absinthe|Absinthe 2.0]] to jailbreak iOS 5.0/5.0.1 and 5.1.1
* uses the exploits listed below to untether up to iOS 5.1.1

=== [[sn0wbreeze]] (3.1.3 - 6.1.3) ===
* uses different common exploits
* uses the exploits listed below to untether up to iOS 6.1.2

== Programs used to jailbreak 1.x ==
=== [[AppTapp Installer]] (1.0 / 1.0.1 / 1.0.2) ===
* iBoot <code>cp</code>-command exploit

=== [[iBrickr]] (1.0 / 1.0.1 / 1.0.2) ===
* iBoot <code>cp</code>-command exploit

=== [[AppSnapp]]/[[JailbreakMe|JailbreakMe 1.0]] (1.0 / 1.0.1 / 1.0.2 / 1.1.1) ===
* [[LibTiff|libtiff exploit]] (Adapted from the PSP scene, used by [[JailbreakMe]]) ({{cve|2006-3459}})

=== [[mknod|OktoPrep]] (1.1.2) ===
"Upgrade" to 1.1.2 from a jailbroken 1.1.1
* [[mknod]]

=== [[Soft Upgrade]] (1.1.3) ===
"Upgrade" to 1.1.3 from a running jailbroken 1.1.2

=== [[ZiPhone]] (1.1.3 / 1.1.4 / 1.1.5) ===
* [[Ramdisk Hack]]

=== [[iLiberty+|iLiberty / iLiberty+]] (1.1.3 / 1.1.4 / 1.1.5) ===

== Programs used to jailbreak 2.x ==
=== [[QuickPwn]] (2.0 - 2.2.1) ===
* uses [[Pwnage]] and [[Pwnage 2.0]]

=== [[Redsn0w Lite]] (2.1.1) ===
* [[ARM7 Go]] (for [[N72AP|iPod touch (2nd generation)]] only)

== Programs used to jailbreak 3.x ==
=== [[purplera1n]] (3.0) ===
* [[iBoot Environment Variable Overflow]] ({{cve|2009-2795}})
* uses [[0x24000 Segment Overflow]]

=== [[blackra1n]] (3.1 / 3.1.1 / 3.1.2) ===
* [[usb_control_msg(0x21, 2) Exploit]] ({{cve|2010-0038}})
* uses [[0x24000 Segment Overflow]]

=== [[Spirit]] (3.1.2 / 3.1.3 / 3.2) ===
* [[MobileBackup Copy Exploit]]
* [[Incomplete Codesign Exploit]]
* [[BPF_STX Kernel Write Exploit]]

=== [[Star|JailbreakMe 2.0 / Star]] (3.1.2 / 3.1.3 / 3.2 / 3.2.1) ===
* [[Malformed CFF Vulnerability]] ({{cve|2010-1797}})
* [[Incomplete Codesign Exploit]]
* [[IOSurface Kernel Exploit]] ({{cve|2010-2973}})

=== [[limera1n]] / [[greenpois0n (jailbreak)|greenpois0n]] (3.2.2) ===
* uses different common exploits
* [[Packet Filter Kernel Exploit]]

== Programs used to jailbreak 4.x ==
=== [[Star|JailbreakMe 2.0 / Star]] (4.0 / 4.0.1) ===
* [[Malformed CFF Vulnerability]] ({{cve|2010-1797}})
* [[Incomplete Codesign Exploit]]
* [[IOSurface Kernel Exploit]] ({{cve|2010-2973}})

=== [[limera1n]] (4.0 / 4.0.1 / 4.0.2 / 4.1) ===
* uses different common exploits
* [[Packet Filter Kernel Exploit]]

=== [[greenpois0n (jailbreak)|greenpois0n]] (4.1) ===
* uses different common exploits
* [[Packet Filter Kernel Exploit]]

=== [[greenpois0n (jailbreak)|greenpois0n]] (4.2.1) ===
* uses different common exploits
* [[HFS Legacy Volume Name Stack Buffer Overflow]]

=== [[Saffron|JailbreakMe 3.0 / Saffron]] (4.2.6 / 4.2.7 / 4.2.8) ===
* [[T1 Font Integer Overflow]] ({{cve|2011-0226}})
* [[HFS Legacy Volume Name Stack Buffer Overflow]]

=== [[unthredeh4il]] (4.2.6 - 4.2.10) ===
Except for the [[iPad (3rd generation)]]
* MobileBackup2 Copy Exploit
* a new Packet Filter Kernel Exploit ({{cve|2012-3728}})
* [[AMFID code signing evasion]] ({{cve|2013-0977}})
* [[launchd.conf untether]]
* [[Timezone Vulnerability]]

=== [[Saffron|JailbreakMe 3.0 / Saffron]] (4.3 / 4.3.1 / 4.3.2 / 4.3.3) ===
Except for the [[N18AP|iPod touch (3rd generation)]] on iOS 4.3.1.
* [[T1 Font Integer Overflow]] ({{cve|2011-0226}})
* [[IOMobileFrameBuffer Privilege Escalation Exploit]] ({{cve|2011-0227}})

=== i0nic's Untether (4.3.1 / 4.3.2 / 4.3.3) ===
used in [[redsn0w]] to untether iOS 4.3.1 / 4.3.2 / 4.3.3
* [[ndrv_setspec() Integer Overflow]]

=== [[unthredeh4il]] (4.3 - 4.3.5) ===
Except for the [[iPad (3rd generation)]]
* MobileBackup2 Copy Exploit
* a new Packet Filter Kernel Exploit ({{cve|2012-3728}})
* [[AMFID code signing evasion]] ({{cve|2013-0977}})
* [[launchd.conf untether]]
* [[Timezone Vulnerability]]

== Programs used to jailbreak 5.x ==

=== [[Absinthe]] (5.0 on [[N94AP|iPhone 4S]] only / 5.0.1 on [[iPad 2]] and [[iPhone 4S]]) ===
* [[Racoon String Format Overflow Exploit]] ({{cve|2012-0646}}) (used both for payload injection and untether)
* [[HFS Heap Overflow]] ({{cve|2012-0642}})
* unknown exploit ({{cve|2012-0643}})

=== [[Corona|Corona Untether]] (5.0.1) ===
* [[Racoon String Format Overflow Exploit]] ({{cve|2012-0646}})
* [[HFS Heap Overflow]] ({{cve|2012-0642}})
* unknown exploit ({{cve|2012-0643}})

=== [[Absinthe|Absinthe 2.0]] and [[Rocky Racoon|Rocky Racoon Untether]] (5.1.1) ===
* a new Packet Filter Kernel Exploit ({{cve|2012-3728}})
* Racoon DNS4/WINS4 table buffer overflow ({{cve|2012-3727}})
* MobileBackup2 Copy Exploit

=== [[unthredeh4il]] (5.0-5.1.1) ===
Except for the [[iPad (3rd generation)]]
* MobileBackup2 Copy Exploit
* a new Packet Filter Kernel Exploit ({{cve|2012-3728}})
* [[AMFID code signing evasion]] ({{cve|2013-0977}})
* [[launchd.conf untether]]
* [[Timezone Vulnerability]]

== Programs used to jailbreak 6.x ==
=== [[evasi0n]] (6.0 / 6.0.1 / 6.0.2 / 6.1 / 6.1.1 / 6.1.2) ===
* [[Symbolic Link Vulnerability]] ({{cve|2013-0979}})
* [[Timezone Vulnerability]]
* [[Shebang Trick]] ({{cve|2013-5154}})
* [[AMFID code signing evasion]]
* [[launchd.conf untether]]
* [[IOUSBDeviceFamily Vulnerability]] ({{cve|2013-0981}})
* [[ARM Exception Vector Info Leak]] ({{cve|2013-0978}})
* [[dynamic memmove() locating]]
* [[vm_map_copy_t corruption for arbitrary memory disclosure]]
* [[kernel memory write via ROP gadget]]
* [[Overlapping Segment Attack]] ({{cve|2013-0977}})

=== [[p0sixspwn]] (6.1.3 / 6.1.4 / 6.1.5 / 6.1.6) ===
* [[posix_spawn kernel information leak]] ({{cve|2013-3954}}) (by [[i0n1c]])
* [[posix_spawn kernel exploit]] ({{cve|2013-3954}}) (by [[i0n1c]])
* [[mach_msg_ool_descriptor_ts for heap shaping]] ({{cve|2013-3953}})
* [[AMFID_code_signing_evasi0n7]] ({{cve|2014-1273}})
* [[DeveloperDiskImage race condition]] (by [[comex]])
* [[launchd.conf untether]]

== Programs used to jailbreak 7.x ==
=== [[evasi0n7]] (7.0 / 7.0.1 / 7.0.2 / 7.0.3 / 7.0.4 / 7.0.5 / 7.0.6) ===
{{Section Stub}}
* [[Symbolic Link Vulnerability]] ({{cve|2013-5133}})
* [[AMFID_code_signing_evasi0n7]] ({{cve|2014-1273}})
* CrashHouseKeeping chmod vulnerability ({{cve|2014-1272}})
* ptmx_get_ioctl ioctl crafted call ({{cve|2014-1278}})

=== [[Geeksn0w]] (7.1 / 7.1.1) ===
* [[limera1n]]'s bootrom exploit ([[Tethered jailbreak]]) on [[iPhone 4]]

=== [[Pangu]] (7.1 / 7.1.1 / 7.1.2) ===
* Mach-O OSBundleHeaders info leak ({{cve|2014-4491}}) (Pangu v1.0.0)
* AppleKeyStore::initUserClient info leak ({{cve|2014-4407}}) (Pangu >v1.0.0)
* break_early_random (by [[i0n1c]] and Tarjei Mandt of Azimuth) ({{cve|2014-4422}})
* mach_port_kobject exploit {{cve|2014-4496}} - used to recover the permutation value and addresses of kernel objects
* IOSharedDataQueue notification port overwrite ({{cve|2014-4461}})
* "syslogd chown" vulnerability
* enterprise certificate (no real exploit, used for initial "unsigned" code execution)
* "foo_extracted" symlink vulnerability (used to write to /var) ({{cve|2014-4386}})
* /tmp/bigfile (a big file for improvement of the reliability of a race condition)
* VoIP backgrounding trick (used to auto restart the app)
* hidden segment attack

== Programs used to jailbreak 8.x ==
=== [[Pangu8]] (8.0 / 8.0.1 / 8.0.2 / 8.1) ===
* an exploit for a bug in /usr/libexec/neagent (source @iH8sn0w)
* enterprise certificate (inside the IPA)
* a kind of dylib injection into a system process (see IPA)
* a dmg mount command (looks like the Developer DMG) (syslog while jailbreaking)
* a sandboxing problem in debugserver ({{cve|2014-4457}})
* mach_port_kobject exploit {{cve|2014-4496}} - used to recover the permutation value and addresses of kernel objects
* the same kernel exploit as used in [[Pangu|the first Pangu]] ({{cve|2014-4461}}) (source @iH8sn0w) - now used to also leak kernel memory (source @Morpheus______)
* enable-dylibs-to-override-cache
* a new ovelapping segment attack ({{cve|2014-4455}})

=== [[TaiG]] and [[PPJailbreak]] (8.0 / 8.0.1 / 8.0.2 / 8.1 / 8.1.1 / 8.1.2) ===
(See also details at [http://newosxbook.com/articles/TaiG.html newosxbook.com])
* A new AFC symlink attack ({{cve|2014-4480}}) - to get onto the device filesystem
* [[DeveloperDiskImage race condition]] (by [[comex]], also used in p0sixspwn) - to mount a fake DDI and instantly overwrite (via union) libmis/xpcd_cache
* A new overlapping segment attack [in a modified version], dyld, ({{cve|2014-4455}}) - negative LC_SEGMENT - to allow libmis and xpcdcache to load
* libmis redirection of MISValidateSignature (as per evasion) to kCFEqual, with overlapping segment variant on TaiG (Segment at end of file, negative)
* enable-dylibs-to-override-cache - force loading of dynamic libraries from filesystem (where available) instead of the shared cache (overriding libmis/xpcd_cache)
* MobileStorageMounter exploit ({{cve|2015-1062}})
* Backup exploit used to access restricted parts of the filesystem ({{cve|2015-1087}})

Kernel:

* Mach-O OSBundleHeaders info leak ({{cve|2014-4491}}) - leaks slid addresses
* mach_port_kobject exploit {{cve|2014-4496}} - used to recover the permutation value and addresses of kernel objects
* IOHIDFamily Kernel exploit ({{cve|2014-4487}}) - to overwrite memory

=== [[TaiG]] and [[PPJailbreak]] (8.1.3 / 8.2 / 8.3 / 8.4) ===
(See also details at http://newosxbook.com/articles/28DaysLater.html and http://newosxbook.com/articles/HIDeAndSeek.html)
* [[DeveloperDiskImage race condition]] (also used in TaiG for 8.0-8.1.2 but modified) - to mount a fake DDI
* enable-dylibs-to-override-cache - force loading of dynamic libraries from filesystem (where available) instead of the shared cache (overriding libmis)
* Symbolic linking to AFC ({{cve|2015-5746}})
* Backup exploit to write to protected regions of the disk ({{cve|2015-5752}})
* Code signing exploit ({{cve|2015-3802}})
* Code signing exploit ({{cve|2015-3803}})
* Code signing exploit ({{cve|2015-3805}})
* Code signing exploit ({{cve|2015-3806}})
* IOHIDFamily exploit ({{cve|2015-5774}})
* Air Traffic exploit to allow attackers to access arbitrary filesystem locations via vectors related to asset handling ({{cve|2015-5766}})

=== [[EtasonJB]] and [[Home Depot]] (8.4.1) ===

* OSUnserialize Information leak ({{cve|2016-4655}})
* Kernel exploit ({{cve|2016-4656}})

== Programs used to jailbreak 9.x ==
=== [[Pangu9]] (9.0 / 9.0.1 / 9.0.2 / 9.1) ===
* Photos exploit to gain arbitrary unsandboxed file system access as mobile to load outdated DDI. ({{cve|2015-7037}})
* MobileStorageMounter allowed older DeveloperDiskImages to be mounted, resulting in unsandboxed unsigned code execution due to known weaknesses in entitled executables. ({{cve|2015-7051}})
* IOHIDFamily Use-After-Free for kernel information leak / code execution as mobile. ({{cve|2015-6974}})
* dyld exploit in dyld shared cache handling to override MISValidateSignature in libmis.dylib for persistency ({{cve|2015-7079}})
* Racing KPP for some of the patches.
* AMFI MAC Hooks were in non-__const __DATA section, so wouldn't be integrity checked by KPP, allowing to replace MAC hooks required for code-signing. ({{cve|2015-7055}})

=== [[Pangu9]] (9.2 / 9.2.1 / 9.3 / 9.3.1 / 9.3.2 / 9.3.3) ===
* IOMobileFrameBuffer exploit to execute arbitrary code with kernel privileges. ({{cve|2016-4654}})

=== [[jbme]] (9.2 / 9.2.1 / 9.3 / 9.3.1 / 9.3.2 / 9.3.3) ===
* Webkit exploit ({{cve|2016-4657}})

=== [[Home Depot]] (9.1-9.3.4) ===
* OSUnserialize Information leak ({{cve|2016-4655}})
* Kernel exploit ({{cve|2016-4656}})

=== [[JailbreakMe 4.0]] (9.1-9.3.4) ===
* OSUnserialize Information leak ({{cve|2016-4655}})
* Kernel exploit ({{cve|2016-4656}})
* Webkit exploit ({{cve|2016-4657}})

=== [[Phœnix]] (9.3.5 / 9.3.6) ===
* OSUnserialize Information leak ({{cve|2016-4655}})
* mach_port_register Kernel exploit ({{cve|2016-4669}})

== Programs used to jailbreak 10.x ==

=== [[extra_recipe+yaluX]] (10.0-10.1.1) ===

* set_dp_control_port exploit to execute arbitrary code with kernel privileges. ({{cve|2016-7644}})

=== [[yalu102]] (10.0.1-10.2) ===

* mach_voucher_extract_attr_recipe_trap memory corruption. ({{cve|2017-2370}})

=== [[doubleH3lix]] (10.0.1 - 10.3.3) ===

* IOSurface Kernel Exploit ({{cve|2017-13861}})

=== [[Meridian]] (10.0 - 10.3.3) ===

* IOSurface Kernel Exploit ({{cve|2017-13861}})

=== [[TotallyNotSpyware]] (10.0 - 10.3.3) ===

* IOSurface Kernel Exploit ({{cve|2017-13861}})
* WebKit JIT optimization bug exploit ({{cve|2018-4233}})

=== [[H3lix]] (10.0.1 - 10.3.4) ===

* IOSurface Kernel Exploit ({{cve|2017-13861}})

== Programs used to jailbreak 11.x ==

===[[Unc0ver]] (11.0-11.4.1)===

11.0 - 11.1.2

* IOSurface Kernel Exploit ({{cve|2017-13861}})

11.0 - 11.3.1

* mptcp_usr_connectx (multi_path) ({{cve|2018-4241}})
* getvolattrlist (empty_list) ({{cve|2018-4243}})

11.0 - 11.4.1

* voucher_swap ({{cve|2019-6225}})

===[[Electra]] (11.0-11.4.1)===

11.0 - 11.1.2

* IOSurface Kernel Exploit ({{cve|2017-13861}})

11.2 - 11.3.1

* mptcp_usr_connectx (multi_path) ({{cve|2018-4241}})
* getvolattrlist (empty_list) ({{cve|2018-4243}})

11.2 - 11.4.1

* v1ntex ({{cve|2019-6225}})

== Programs used to jailbreak 12.x ==

===[[Chimera]] (12.0 - 12.2 / 12.4)===

12.0 - 12.1.2

* voucher_swap ({{cve|2019-6225}})

12.0 - 12.2/12.4

* sockpuppet ({{cve|2019-8527}})

===[[Unc0ver]] (12.0 - 12.2 / 12.4 / 12.4.1)===

12.0 - 12.1.2

* voucher_swap ({{cve|2019-6225}})

12.0 - 12.2/12.4

* sockpuppet ({{cve|2019-8527}})

12.4.1

* ZecOps Kernel Exploit ({{cve|2019-8794}})

===[[checkra1n]] (12.3 - 12.4.7)===

* [[Checkm8_Exploit | checkm8]] ({{cve|2019-8900}})

== Programs used to jailbreak 13.x ==

===[[Unc0ver]] (13.0 - 13.5)===

* oob_timestamp ({{cve|2020-3837}})

===[[checkra1n]] (13.0 - 13.5)===

* [[Checkm8_Exploit | checkm8]] ({{cve|2019-8900}})

Jailbreak Exploits

2020-05-25T05:45:00Z

Kiddepants: Update with currently signed 13.5 and unc0ver release :D

This page lists the '''exploits''' used in [[jailbreak]]s.

== Common exploits ==
These exploits are not dependent on any firmware; as such, they are used in numerous jailbreaking programs.

* [[Pwnage]] + [[Pwnage 2.0]] (together to jailbreak the [[M68AP|iPhone]], [[N45AP|iPod touch]], and [[N82AP|iPhone 3G]])
* [[ARM7 Go]] (from iOS 2.1.1) (for [[tethered jailbreak]] on [[N72AP|iPod touch (2nd generation)]])
* [[0x24000 Segment Overflow]] (for [[untethered jailbreak]] on [[N88AP|iPhone 3GS]] with [[Bootrom 359.3|old bootrom]] and [[N72AP|iPod touch (2nd generation)]] with [[Bootrom 240.4|old bootrom]]; another exploit as the [[limera1n Exploit]] is required)
* [[limera1n Exploit]] (for [[tethered jailbreak]] on [[N88AP|iPhone 3GS]], [[N18AP|iPod touch (3rd generation)]], [[K48AP|iPad]], [[iPhone 4]], [[N81AP|iPod touch (4th generation)]] and [[K66AP|Apple TV (2nd generation)]])
* [[usb_control_msg(0xA1, 1) Exploit]] (also known as "steaks4uce") (for [[tethered jailbreak]] on [[N72AP|iPod touch (2nd generation)]])

== Jailbreak Programs ==
=== [[PwnageTool]] (2.0 - 5.1.1) ===
* uses different common exploits
* uses the exploits listed below to untether up to iOS 5.1.1

=== [[redsn0w]] (3.0 - 6.0) ===
* uses different common exploits
* uses the same exploits as [[Absinthe|Absinthe]] and [[Absinthe|Absinthe 2.0]] to jailbreak iOS 5.0/5.0.1 and 5.1.1
* uses the exploits listed below to untether up to iOS 5.1.1

=== [[sn0wbreeze]] (3.1.3 - 6.1.3) ===
* uses different common exploits
* uses the exploits listed below to untether up to iOS 6.1.2

== Programs used to jailbreak 1.x ==
=== [[AppTapp Installer]] (1.0 / 1.0.1 / 1.0.2) ===
* iBoot <code>cp</code>-command exploit

=== [[iBrickr]] (1.0 / 1.0.1 / 1.0.2) ===
* iBoot <code>cp</code>-command exploit

=== [[AppSnapp]]/[[JailbreakMe|JailbreakMe 1.0]] (1.0 / 1.0.1 / 1.0.2 / 1.1.1) ===
* [[LibTiff|libtiff exploit]] (Adapted from the PSP scene, used by [[JailbreakMe]]) ({{cve|2006-3459}})

=== [[mknod|OktoPrep]] (1.1.2) ===
"Upgrade" to 1.1.2 from a jailbroken 1.1.1
* [[mknod]]

=== [[Soft Upgrade]] (1.1.3) ===
"Upgrade" to 1.1.3 from a running jailbroken 1.1.2

=== [[ZiPhone]] (1.1.3 / 1.1.4 / 1.1.5) ===
* [[Ramdisk Hack]]

=== [[iLiberty+|iLiberty / iLiberty+]] (1.1.3 / 1.1.4 / 1.1.5) ===

== Programs used to jailbreak 2.x ==
=== [[QuickPwn]] (2.0 - 2.2.1) ===
* uses [[Pwnage]] and [[Pwnage 2.0]]

=== [[Redsn0w Lite]] (2.1.1) ===
* [[ARM7 Go]] (for [[N72AP|iPod touch (2nd generation)]] only)

== Programs used to jailbreak 3.x ==
=== [[purplera1n]] (3.0) ===
* [[iBoot Environment Variable Overflow]] ({{cve|2009-2795}})
* uses [[0x24000 Segment Overflow]]

=== [[blackra1n]] (3.1 / 3.1.1 / 3.1.2) ===
* [[usb_control_msg(0x21, 2) Exploit]] ({{cve|2010-0038}})
* uses [[0x24000 Segment Overflow]]

=== [[Spirit]] (3.1.2 / 3.1.3 / 3.2) ===
* [[MobileBackup Copy Exploit]]
* [[Incomplete Codesign Exploit]]
* [[BPF_STX Kernel Write Exploit]]

=== [[Star|JailbreakMe 2.0 / Star]] (3.1.2 / 3.1.3 / 3.2 / 3.2.1) ===
* [[Malformed CFF Vulnerability]] ({{cve|2010-1797}})
* [[Incomplete Codesign Exploit]]
* [[IOSurface Kernel Exploit]] ({{cve|2010-2973}})

=== [[limera1n]] / [[greenpois0n (jailbreak)|greenpois0n]] (3.2.2) ===
* uses different common exploits
* [[Packet Filter Kernel Exploit]]

== Programs used to jailbreak 4.x ==
=== [[Star|JailbreakMe 2.0 / Star]] (4.0 / 4.0.1) ===
* [[Malformed CFF Vulnerability]] ({{cve|2010-1797}})
* [[Incomplete Codesign Exploit]]
* [[IOSurface Kernel Exploit]] ({{cve|2010-2973}})

=== [[limera1n]] (4.0 / 4.0.1 / 4.0.2 / 4.1) ===
* uses different common exploits
* [[Packet Filter Kernel Exploit]]

=== [[greenpois0n (jailbreak)|greenpois0n]] (4.1) ===
* uses different common exploits
* [[Packet Filter Kernel Exploit]]

=== [[greenpois0n (jailbreak)|greenpois0n]] (4.2.1) ===
* uses different common exploits
* [[HFS Legacy Volume Name Stack Buffer Overflow]]

=== [[Saffron|JailbreakMe 3.0 / Saffron]] (4.2.6 / 4.2.7 / 4.2.8) ===
* [[T1 Font Integer Overflow]] ({{cve|2011-0226}})
* [[HFS Legacy Volume Name Stack Buffer Overflow]]

=== [[unthredeh4il]] (4.2.6 - 4.2.10) ===
Except for the [[iPad (3rd generation)]]
* MobileBackup2 Copy Exploit
* a new Packet Filter Kernel Exploit ({{cve|2012-3728}})
* [[AMFID code signing evasion]] ({{cve|2013-0977}})
* [[launchd.conf untether]]
* [[Timezone Vulnerability]]

=== [[Saffron|JailbreakMe 3.0 / Saffron]] (4.3 / 4.3.1 / 4.3.2 / 4.3.3) ===
Except for the [[N18AP|iPod touch (3rd generation)]] on iOS 4.3.1.
* [[T1 Font Integer Overflow]] ({{cve|2011-0226}})
* [[IOMobileFrameBuffer Privilege Escalation Exploit]] ({{cve|2011-0227}})

=== i0nic's Untether (4.3.1 / 4.3.2 / 4.3.3) ===
used in [[redsn0w]] to untether iOS 4.3.1 / 4.3.2 / 4.3.3
* [[ndrv_setspec() Integer Overflow]]

=== [[unthredeh4il]] (4.3 - 4.3.5) ===
Except for the [[iPad (3rd generation)]]
* MobileBackup2 Copy Exploit
* a new Packet Filter Kernel Exploit ({{cve|2012-3728}})
* [[AMFID code signing evasion]] ({{cve|2013-0977}})
* [[launchd.conf untether]]
* [[Timezone Vulnerability]]

== Programs used to jailbreak 5.x ==

=== [[Absinthe]] (5.0 on [[N94AP|iPhone 4S]] only / 5.0.1 on [[iPad 2]] and [[iPhone 4S]]) ===
* [[Racoon String Format Overflow Exploit]] ({{cve|2012-0646}}) (used both for payload injection and untether)
* [[HFS Heap Overflow]] ({{cve|2012-0642}})
* unknown exploit ({{cve|2012-0643}})

=== [[Corona|Corona Untether]] (5.0.1) ===
* [[Racoon String Format Overflow Exploit]] ({{cve|2012-0646}})
* [[HFS Heap Overflow]] ({{cve|2012-0642}})
* unknown exploit ({{cve|2012-0643}})

=== [[Absinthe|Absinthe 2.0]] and [[Rocky Racoon|Rocky Racoon Untether]] (5.1.1) ===
* a new Packet Filter Kernel Exploit ({{cve|2012-3728}})
* Racoon DNS4/WINS4 table buffer overflow ({{cve|2012-3727}})
* MobileBackup2 Copy Exploit

=== [[unthredeh4il]] (5.0-5.1.1) ===
Except for the [[iPad (3rd generation)]]
* MobileBackup2 Copy Exploit
* a new Packet Filter Kernel Exploit ({{cve|2012-3728}})
* [[AMFID code signing evasion]] ({{cve|2013-0977}})
* [[launchd.conf untether]]
* [[Timezone Vulnerability]]

== Programs used to jailbreak 6.x ==
=== [[evasi0n]] (6.0 / 6.0.1 / 6.0.2 / 6.1 / 6.1.1 / 6.1.2) ===
* [[Symbolic Link Vulnerability]] ({{cve|2013-0979}})
* [[Timezone Vulnerability]]
* [[Shebang Trick]] ({{cve|2013-5154}})
* [[AMFID code signing evasion]]
* [[launchd.conf untether]]
* [[IOUSBDeviceFamily Vulnerability]] ({{cve|2013-0981}})
* [[ARM Exception Vector Info Leak]] ({{cve|2013-0978}})
* [[dynamic memmove() locating]]
* [[vm_map_copy_t corruption for arbitrary memory disclosure]]
* [[kernel memory write via ROP gadget]]
* [[Overlapping Segment Attack]] ({{cve|2013-0977}})

=== [[p0sixspwn]] (6.1.3 / 6.1.4 / 6.1.5 / 6.1.6) ===
* [[posix_spawn kernel information leak]] ({{cve|2013-3954}}) (by [[i0n1c]])
* [[posix_spawn kernel exploit]] ({{cve|2013-3954}}) (by [[i0n1c]])
* [[mach_msg_ool_descriptor_ts for heap shaping]] ({{cve|2013-3953}})
* [[AMFID_code_signing_evasi0n7]] ({{cve|2014-1273}})
* [[DeveloperDiskImage race condition]] (by [[comex]])
* [[launchd.conf untether]]

== Programs used to jailbreak 7.x ==
=== [[evasi0n7]] (7.0 / 7.0.1 / 7.0.2 / 7.0.3 / 7.0.4 / 7.0.5 / 7.0.6) ===
{{Section Stub}}
* [[Symbolic Link Vulnerability]] ({{cve|2013-5133}})
* [[AMFID_code_signing_evasi0n7]] ({{cve|2014-1273}})
* CrashHouseKeeping chmod vulnerability ({{cve|2014-1272}})
* ptmx_get_ioctl ioctl crafted call ({{cve|2014-1278}})

=== [[Geeksn0w]] (7.1 / 7.1.1) ===
* [[limera1n]]'s bootrom exploit ([[Tethered jailbreak]]) on [[iPhone 4]]

=== [[Pangu]] (7.1 / 7.1.1 / 7.1.2) ===
* Mach-O OSBundleHeaders info leak ({{cve|2014-4491}}) (Pangu v1.0.0)
* AppleKeyStore::initUserClient info leak ({{cve|2014-4407}}) (Pangu >v1.0.0)
* break_early_random (by [[i0n1c]] and Tarjei Mandt of Azimuth) ({{cve|2014-4422}})
* mach_port_kobject exploit {{cve|2014-4496}} - used to recover the permutation value and addresses of kernel objects
* IOSharedDataQueue notification port overwrite ({{cve|2014-4461}})
* "syslogd chown" vulnerability
* enterprise certificate (no real exploit, used for initial "unsigned" code execution)
* "foo_extracted" symlink vulnerability (used to write to /var) ({{cve|2014-4386}})
* /tmp/bigfile (a big file for improvement of the reliability of a race condition)
* VoIP backgrounding trick (used to auto restart the app)
* hidden segment attack

== Programs used to jailbreak 8.x ==
=== [[Pangu8]] (8.0 / 8.0.1 / 8.0.2 / 8.1) ===
* an exploit for a bug in /usr/libexec/neagent (source @iH8sn0w)
* enterprise certificate (inside the IPA)
* a kind of dylib injection into a system process (see IPA)
* a dmg mount command (looks like the Developer DMG) (syslog while jailbreaking)
* a sandboxing problem in debugserver ({{cve|2014-4457}})
* mach_port_kobject exploit {{cve|2014-4496}} - used to recover the permutation value and addresses of kernel objects
* the same kernel exploit as used in [[Pangu|the first Pangu]] ({{cve|2014-4461}}) (source @iH8sn0w) - now used to also leak kernel memory (source @Morpheus______)
* enable-dylibs-to-override-cache
* a new ovelapping segment attack ({{cve|2014-4455}})

=== [[TaiG]] and [[PPJailbreak]] (8.0 / 8.0.1 / 8.0.2 / 8.1 / 8.1.1 / 8.1.2) ===
(See also details at [http://newosxbook.com/articles/TaiG.html newosxbook.com])
* A new AFC symlink attack ({{cve|2014-4480}}) - to get onto the device filesystem
* [[DeveloperDiskImage race condition]] (by [[comex]], also used in p0sixspwn) - to mount a fake DDI and instantly overwrite (via union) libmis/xpcd_cache
* A new overlapping segment attack [in a modified version], dyld, ({{cve|2014-4455}}) - negative LC_SEGMENT - to allow libmis and xpcdcache to load
* libmis redirection of MISValidateSignature (as per evasion) to kCFEqual, with overlapping segment variant on TaiG (Segment at end of file, negative)
* enable-dylibs-to-override-cache - force loading of dynamic libraries from filesystem (where available) instead of the shared cache (overriding libmis/xpcd_cache)
* MobileStorageMounter exploit ({{cve|2015-1062}})
* Backup exploit used to access restricted parts of the filesystem ({{cve|2015-1087}})

Kernel:

* Mach-O OSBundleHeaders info leak ({{cve|2014-4491}}) - leaks slid addresses
* mach_port_kobject exploit {{cve|2014-4496}} - used to recover the permutation value and addresses of kernel objects
* IOHIDFamily Kernel exploit ({{cve|2014-4487}}) - to overwrite memory

=== [[TaiG]] and [[PPJailbreak]] (8.1.3 / 8.2 / 8.3 / 8.4) ===
(See also details at http://newosxbook.com/articles/28DaysLater.html and http://newosxbook.com/articles/HIDeAndSeek.html)
* [[DeveloperDiskImage race condition]] (also used in TaiG for 8.0-8.1.2 but modified) - to mount a fake DDI
* enable-dylibs-to-override-cache - force loading of dynamic libraries from filesystem (where available) instead of the shared cache (overriding libmis)
* Symbolic linking to AFC ({{cve|2015-5746}})
* Backup exploit to write to protected regions of the disk ({{cve|2015-5752}})
* Code signing exploit ({{cve|2015-3802}})
* Code signing exploit ({{cve|2015-3803}})
* Code signing exploit ({{cve|2015-3805}})
* Code signing exploit ({{cve|2015-3806}})
* IOHIDFamily exploit ({{cve|2015-5774}})
* Air Traffic exploit to allow attackers to access arbitrary filesystem locations via vectors related to asset handling ({{cve|2015-5766}})

=== [[EtasonJB]] and [[Home Depot]] (8.4.1) ===

* OSUnserialize Information leak ({{cve|2016-4655}})
* Kernel exploit ({{cve|2016-4656}})

== Programs used to jailbreak 9.x ==
=== [[Pangu9]] (9.0 / 9.0.1 / 9.0.2 / 9.1) ===
* Photos exploit to gain arbitrary unsandboxed file system access as mobile to load outdated DDI. ({{cve|2015-7037}})
* MobileStorageMounter allowed older DeveloperDiskImages to be mounted, resulting in unsandboxed unsigned code execution due to known weaknesses in entitled executables. ({{cve|2015-7051}})
* IOHIDFamily Use-After-Free for kernel information leak / code execution as mobile. ({{cve|2015-6974}})
* dyld exploit in dyld shared cache handling to override MISValidateSignature in libmis.dylib for persistency ({{cve|2015-7079}})
* Racing KPP for some of the patches.
* AMFI MAC Hooks were in non-__const __DATA section, so wouldn't be integrity checked by KPP, allowing to replace MAC hooks required for code-signing. ({{cve|2015-7055}})

=== [[Pangu9]] (9.2 / 9.2.1 / 9.3 / 9.3.1 / 9.3.2 / 9.3.3) ===
* IOMobileFrameBuffer exploit to execute arbitrary code with kernel privileges. ({{cve|2016-4654}})

=== [[jbme]] (9.2 / 9.2.1 / 9.3 / 9.3.1 / 9.3.2 / 9.3.3) ===
* Webkit exploit ({{cve|2016-4657}})

=== [[Home Depot]] (9.1-9.3.4) ===
* OSUnserialize Information leak ({{cve|2016-4655}})
* Kernel exploit ({{cve|2016-4656}})

=== [[JailbreakMe 4.0]] (9.1-9.3.4) ===
* OSUnserialize Information leak ({{cve|2016-4655}})
* Kernel exploit ({{cve|2016-4656}})
* Webkit exploit ({{cve|2016-4657}})

=== [[Phœnix]] (9.3.5 / 9.3.6) ===
* OSUnserialize Information leak ({{cve|2016-4655}})
* mach_port_register Kernel exploit ({{cve|2016-4669}})

== Programs used to jailbreak 10.x ==

=== [[extra_recipe+yaluX]] (10.0-10.1.1) ===

* set_dp_control_port exploit to execute arbitrary code with kernel privileges. ({{cve|2016-7644}})

=== [[yalu102]] (10.0.1-10.2) ===

* mach_voucher_extract_attr_recipe_trap memory corruption. ({{cve|2017-2370}})

=== [[doubleH3lix]] (10.0.1 - 10.3.3) ===

* IOSurface Kernel Exploit ({{cve|2017-13861}})

=== [[Meridian]] (10.0 - 10.3.3) ===

* IOSurface Kernel Exploit ({{cve|2017-13861}})

=== [[TotallyNotSpyware]] (10.0 - 10.3.3) ===

* IOSurface Kernel Exploit ({{cve|2017-13861}})
* WebKit JIT optimization bug exploit ({{cve|2018-4233}})

=== [[H3lix]] (10.0.1 - 10.3.4) ===

* IOSurface Kernel Exploit ({{cve|2017-13861}})

== Programs used to jailbreak 11.x ==

===[[Unc0ver]] (11.0-11.4.1)===

11.0 - 11.1.2

* IOSurface Kernel Exploit ({{cve|2017-13861}})

11.0 - 11.3.1

* mptcp_usr_connectx (multi_path) ({{cve|2018-4241}})
* getvolattrlist (empty_list) ({{cve|2018-4243}})

11.0 - 11.4.1

* voucher_swap ({{cve|2019-6225}})

===[[Electra]] (11.0-11.4.1)===

11.0 - 11.1.2

* IOSurface Kernel Exploit ({{cve|2017-13861}})

11.2 - 11.3.1

* mptcp_usr_connectx (multi_path) ({{cve|2018-4241}})
* getvolattrlist (empty_list) ({{cve|2018-4243}})

11.2 - 11.4.1

* v1ntex ({{cve|2019-6225}})

== Programs used to jailbreak 12.x ==

===[[Chimera]] (12.0 - 12.2 / 12.4)===

12.0 - 12.1.2

* voucher_swap ({{cve|2019-6225}})

12.0 - 12.2/12.4

* sockpuppet ({{cve|2019-8527}})

===[[Unc0ver]] (12.0 - 12.2 / 12.4 / 12.4.1)===

12.0 - 12.1.2

* voucher_swap ({{cve|2019-6225}})

12.0 - 12.2/12.4

* sockpuppet ({{cve|2019-8527}})

12.4.1

===[[checkra1n]] (12.3 - 12.4.7)===

* ZecOps Kernel Exploit ({{cve|2019-8794}})

== Programs used to jailbreak 13.x ==

===[[Unc0ver]] (13.0 - 13.5)===

* oob_timestamp ({{cve|2020-3837}})

===[[checkra1n]] (13.0 - 13.5)===

* [[Checkm8_Exploit | checkm8]] ({{cve|2019-8900}})

Jailbreak Exploits

2020-05-25T05:39:37Z

Kiddepants: Please use only the original exploit name

This page lists the '''exploits''' used in [[jailbreak]]s.

== Common exploits ==
These exploits are not dependent on any firmware; as such, they are used in numerous jailbreaking programs.

* [[Pwnage]] + [[Pwnage 2.0]] (together to jailbreak the [[M68AP|iPhone]], [[N45AP|iPod touch]], and [[N82AP|iPhone 3G]])
* [[ARM7 Go]] (from iOS 2.1.1) (for [[tethered jailbreak]] on [[N72AP|iPod touch (2nd generation)]])
* [[0x24000 Segment Overflow]] (for [[untethered jailbreak]] on [[N88AP|iPhone 3GS]] with [[Bootrom 359.3|old bootrom]] and [[N72AP|iPod touch (2nd generation)]] with [[Bootrom 240.4|old bootrom]]; another exploit as the [[limera1n Exploit]] is required)
* [[limera1n Exploit]] (for [[tethered jailbreak]] on [[N88AP|iPhone 3GS]], [[N18AP|iPod touch (3rd generation)]], [[K48AP|iPad]], [[iPhone 4]], [[N81AP|iPod touch (4th generation)]] and [[K66AP|Apple TV (2nd generation)]])
* [[usb_control_msg(0xA1, 1) Exploit]] (also known as "steaks4uce") (for [[tethered jailbreak]] on [[N72AP|iPod touch (2nd generation)]])

== Jailbreak Programs ==
=== [[PwnageTool]] (2.0 - 5.1.1) ===
* uses different common exploits
* uses the exploits listed below to untether up to iOS 5.1.1

=== [[redsn0w]] (3.0 - 6.0) ===
* uses different common exploits
* uses the same exploits as [[Absinthe|Absinthe]] and [[Absinthe|Absinthe 2.0]] to jailbreak iOS 5.0/5.0.1 and 5.1.1
* uses the exploits listed below to untether up to iOS 5.1.1

=== [[sn0wbreeze]] (3.1.3 - 6.1.3) ===
* uses different common exploits
* uses the exploits listed below to untether up to iOS 6.1.2

== Programs used to jailbreak 1.x ==
=== [[AppTapp Installer]] (1.0 / 1.0.1 / 1.0.2) ===
* iBoot <code>cp</code>-command exploit

=== [[iBrickr]] (1.0 / 1.0.1 / 1.0.2) ===
* iBoot <code>cp</code>-command exploit

=== [[AppSnapp]]/[[JailbreakMe|JailbreakMe 1.0]] (1.0 / 1.0.1 / 1.0.2 / 1.1.1) ===
* [[LibTiff|libtiff exploit]] (Adapted from the PSP scene, used by [[JailbreakMe]]) ({{cve|2006-3459}})

=== [[mknod|OktoPrep]] (1.1.2) ===
"Upgrade" to 1.1.2 from a jailbroken 1.1.1
* [[mknod]]

=== [[Soft Upgrade]] (1.1.3) ===
"Upgrade" to 1.1.3 from a running jailbroken 1.1.2

=== [[ZiPhone]] (1.1.3 / 1.1.4 / 1.1.5) ===
* [[Ramdisk Hack]]

=== [[iLiberty+|iLiberty / iLiberty+]] (1.1.3 / 1.1.4 / 1.1.5) ===

== Programs used to jailbreak 2.x ==
=== [[QuickPwn]] (2.0 - 2.2.1) ===
* uses [[Pwnage]] and [[Pwnage 2.0]]

=== [[Redsn0w Lite]] (2.1.1) ===
* [[ARM7 Go]] (for [[N72AP|iPod touch (2nd generation)]] only)

== Programs used to jailbreak 3.x ==
=== [[purplera1n]] (3.0) ===
* [[iBoot Environment Variable Overflow]] ({{cve|2009-2795}})
* uses [[0x24000 Segment Overflow]]

=== [[blackra1n]] (3.1 / 3.1.1 / 3.1.2) ===
* [[usb_control_msg(0x21, 2) Exploit]] ({{cve|2010-0038}})
* uses [[0x24000 Segment Overflow]]

=== [[Spirit]] (3.1.2 / 3.1.3 / 3.2) ===
* [[MobileBackup Copy Exploit]]
* [[Incomplete Codesign Exploit]]
* [[BPF_STX Kernel Write Exploit]]

=== [[Star|JailbreakMe 2.0 / Star]] (3.1.2 / 3.1.3 / 3.2 / 3.2.1) ===
* [[Malformed CFF Vulnerability]] ({{cve|2010-1797}})
* [[Incomplete Codesign Exploit]]
* [[IOSurface Kernel Exploit]] ({{cve|2010-2973}})

=== [[limera1n]] / [[greenpois0n (jailbreak)|greenpois0n]] (3.2.2) ===
* uses different common exploits
* [[Packet Filter Kernel Exploit]]

== Programs used to jailbreak 4.x ==
=== [[Star|JailbreakMe 2.0 / Star]] (4.0 / 4.0.1) ===
* [[Malformed CFF Vulnerability]] ({{cve|2010-1797}})
* [[Incomplete Codesign Exploit]]
* [[IOSurface Kernel Exploit]] ({{cve|2010-2973}})

=== [[limera1n]] (4.0 / 4.0.1 / 4.0.2 / 4.1) ===
* uses different common exploits
* [[Packet Filter Kernel Exploit]]

=== [[greenpois0n (jailbreak)|greenpois0n]] (4.1) ===
* uses different common exploits
* [[Packet Filter Kernel Exploit]]

=== [[greenpois0n (jailbreak)|greenpois0n]] (4.2.1) ===
* uses different common exploits
* [[HFS Legacy Volume Name Stack Buffer Overflow]]

=== [[Saffron|JailbreakMe 3.0 / Saffron]] (4.2.6 / 4.2.7 / 4.2.8) ===
* [[T1 Font Integer Overflow]] ({{cve|2011-0226}})
* [[HFS Legacy Volume Name Stack Buffer Overflow]]

=== [[unthredeh4il]] (4.2.6 - 4.2.10) ===
Except for the [[iPad (3rd generation)]]
* MobileBackup2 Copy Exploit
* a new Packet Filter Kernel Exploit ({{cve|2012-3728}})
* [[AMFID code signing evasion]] ({{cve|2013-0977}})
* [[launchd.conf untether]]
* [[Timezone Vulnerability]]

=== [[Saffron|JailbreakMe 3.0 / Saffron]] (4.3 / 4.3.1 / 4.3.2 / 4.3.3) ===
Except for the [[N18AP|iPod touch (3rd generation)]] on iOS 4.3.1.
* [[T1 Font Integer Overflow]] ({{cve|2011-0226}})
* [[IOMobileFrameBuffer Privilege Escalation Exploit]] ({{cve|2011-0227}})

=== i0nic's Untether (4.3.1 / 4.3.2 / 4.3.3) ===
used in [[redsn0w]] to untether iOS 4.3.1 / 4.3.2 / 4.3.3
* [[ndrv_setspec() Integer Overflow]]

=== [[unthredeh4il]] (4.3 - 4.3.5) ===
Except for the [[iPad (3rd generation)]]
* MobileBackup2 Copy Exploit
* a new Packet Filter Kernel Exploit ({{cve|2012-3728}})
* [[AMFID code signing evasion]] ({{cve|2013-0977}})
* [[launchd.conf untether]]
* [[Timezone Vulnerability]]

== Programs used to jailbreak 5.x ==

=== [[Absinthe]] (5.0 on [[N94AP|iPhone 4S]] only / 5.0.1 on [[iPad 2]] and [[iPhone 4S]]) ===
* [[Racoon String Format Overflow Exploit]] ({{cve|2012-0646}}) (used both for payload injection and untether)
* [[HFS Heap Overflow]] ({{cve|2012-0642}})
* unknown exploit ({{cve|2012-0643}})

=== [[Corona|Corona Untether]] (5.0.1) ===
* [[Racoon String Format Overflow Exploit]] ({{cve|2012-0646}})
* [[HFS Heap Overflow]] ({{cve|2012-0642}})
* unknown exploit ({{cve|2012-0643}})

=== [[Absinthe|Absinthe 2.0]] and [[Rocky Racoon|Rocky Racoon Untether]] (5.1.1) ===
* a new Packet Filter Kernel Exploit ({{cve|2012-3728}})
* Racoon DNS4/WINS4 table buffer overflow ({{cve|2012-3727}})
* MobileBackup2 Copy Exploit

=== [[unthredeh4il]] (5.0-5.1.1) ===
Except for the [[iPad (3rd generation)]]
* MobileBackup2 Copy Exploit
* a new Packet Filter Kernel Exploit ({{cve|2012-3728}})
* [[AMFID code signing evasion]] ({{cve|2013-0977}})
* [[launchd.conf untether]]
* [[Timezone Vulnerability]]

== Programs used to jailbreak 6.x ==
=== [[evasi0n]] (6.0 / 6.0.1 / 6.0.2 / 6.1 / 6.1.1 / 6.1.2) ===
* [[Symbolic Link Vulnerability]] ({{cve|2013-0979}})
* [[Timezone Vulnerability]]
* [[Shebang Trick]] ({{cve|2013-5154}})
* [[AMFID code signing evasion]]
* [[launchd.conf untether]]
* [[IOUSBDeviceFamily Vulnerability]] ({{cve|2013-0981}})
* [[ARM Exception Vector Info Leak]] ({{cve|2013-0978}})
* [[dynamic memmove() locating]]
* [[vm_map_copy_t corruption for arbitrary memory disclosure]]
* [[kernel memory write via ROP gadget]]
* [[Overlapping Segment Attack]] ({{cve|2013-0977}})

=== [[p0sixspwn]] (6.1.3 / 6.1.4 / 6.1.5 / 6.1.6) ===
* [[posix_spawn kernel information leak]] ({{cve|2013-3954}}) (by [[i0n1c]])
* [[posix_spawn kernel exploit]] ({{cve|2013-3954}}) (by [[i0n1c]])
* [[mach_msg_ool_descriptor_ts for heap shaping]] ({{cve|2013-3953}})
* [[AMFID_code_signing_evasi0n7]] ({{cve|2014-1273}})
* [[DeveloperDiskImage race condition]] (by [[comex]])
* [[launchd.conf untether]]

== Programs used to jailbreak 7.x ==
=== [[evasi0n7]] (7.0 / 7.0.1 / 7.0.2 / 7.0.3 / 7.0.4 / 7.0.5 / 7.0.6) ===
{{Section Stub}}
* [[Symbolic Link Vulnerability]] ({{cve|2013-5133}})
* [[AMFID_code_signing_evasi0n7]] ({{cve|2014-1273}})
* CrashHouseKeeping chmod vulnerability ({{cve|2014-1272}})
* ptmx_get_ioctl ioctl crafted call ({{cve|2014-1278}})

=== [[Geeksn0w]] (7.1 / 7.1.1) ===
* [[limera1n]]'s bootrom exploit ([[Tethered jailbreak]]) on [[iPhone 4]]

=== [[Pangu]] (7.1 / 7.1.1 / 7.1.2) ===
* Mach-O OSBundleHeaders info leak ({{cve|2014-4491}}) (Pangu v1.0.0)
* AppleKeyStore::initUserClient info leak ({{cve|2014-4407}}) (Pangu >v1.0.0)
* break_early_random (by [[i0n1c]] and Tarjei Mandt of Azimuth) ({{cve|2014-4422}})
* mach_port_kobject exploit {{cve|2014-4496}} - used to recover the permutation value and addresses of kernel objects
* IOSharedDataQueue notification port overwrite ({{cve|2014-4461}})
* "syslogd chown" vulnerability
* enterprise certificate (no real exploit, used for initial "unsigned" code execution)
* "foo_extracted" symlink vulnerability (used to write to /var) ({{cve|2014-4386}})
* /tmp/bigfile (a big file for improvement of the reliability of a race condition)
* VoIP backgrounding trick (used to auto restart the app)
* hidden segment attack

== Programs used to jailbreak 8.x ==
=== [[Pangu8]] (8.0 / 8.0.1 / 8.0.2 / 8.1) ===
* an exploit for a bug in /usr/libexec/neagent (source @iH8sn0w)
* enterprise certificate (inside the IPA)
* a kind of dylib injection into a system process (see IPA)
* a dmg mount command (looks like the Developer DMG) (syslog while jailbreaking)
* a sandboxing problem in debugserver ({{cve|2014-4457}})
* mach_port_kobject exploit {{cve|2014-4496}} - used to recover the permutation value and addresses of kernel objects
* the same kernel exploit as used in [[Pangu|the first Pangu]] ({{cve|2014-4461}}) (source @iH8sn0w) - now used to also leak kernel memory (source @Morpheus______)
* enable-dylibs-to-override-cache
* a new ovelapping segment attack ({{cve|2014-4455}})

=== [[TaiG]] and [[PPJailbreak]] (8.0 / 8.0.1 / 8.0.2 / 8.1 / 8.1.1 / 8.1.2) ===
(See also details at [http://newosxbook.com/articles/TaiG.html newosxbook.com])
* A new AFC symlink attack ({{cve|2014-4480}}) - to get onto the device filesystem
* [[DeveloperDiskImage race condition]] (by [[comex]], also used in p0sixspwn) - to mount a fake DDI and instantly overwrite (via union) libmis/xpcd_cache
* A new overlapping segment attack [in a modified version], dyld, ({{cve|2014-4455}}) - negative LC_SEGMENT - to allow libmis and xpcdcache to load
* libmis redirection of MISValidateSignature (as per evasion) to kCFEqual, with overlapping segment variant on TaiG (Segment at end of file, negative)
* enable-dylibs-to-override-cache - force loading of dynamic libraries from filesystem (where available) instead of the shared cache (overriding libmis/xpcd_cache)
* MobileStorageMounter exploit ({{cve|2015-1062}})
* Backup exploit used to access restricted parts of the filesystem ({{cve|2015-1087}})

Kernel:

* Mach-O OSBundleHeaders info leak ({{cve|2014-4491}}) - leaks slid addresses
* mach_port_kobject exploit {{cve|2014-4496}} - used to recover the permutation value and addresses of kernel objects
* IOHIDFamily Kernel exploit ({{cve|2014-4487}}) - to overwrite memory

=== [[TaiG]] and [[PPJailbreak]] (8.1.3 / 8.2 / 8.3 / 8.4) ===
(See also details at http://newosxbook.com/articles/28DaysLater.html and http://newosxbook.com/articles/HIDeAndSeek.html)
* [[DeveloperDiskImage race condition]] (also used in TaiG for 8.0-8.1.2 but modified) - to mount a fake DDI
* enable-dylibs-to-override-cache - force loading of dynamic libraries from filesystem (where available) instead of the shared cache (overriding libmis)
* Symbolic linking to AFC ({{cve|2015-5746}})
* Backup exploit to write to protected regions of the disk ({{cve|2015-5752}})
* Code signing exploit ({{cve|2015-3802}})
* Code signing exploit ({{cve|2015-3803}})
* Code signing exploit ({{cve|2015-3805}})
* Code signing exploit ({{cve|2015-3806}})
* IOHIDFamily exploit ({{cve|2015-5774}})
* Air Traffic exploit to allow attackers to access arbitrary filesystem locations via vectors related to asset handling ({{cve|2015-5766}})

=== [[EtasonJB]] and [[Home Depot]] (8.4.1) ===

* OSUnserialize Information leak ({{cve|2016-4655}})
* Kernel exploit ({{cve|2016-4656}})

== Programs used to jailbreak 9.x ==
=== [[Pangu9]] (9.0 / 9.0.1 / 9.0.2 / 9.1) ===
* Photos exploit to gain arbitrary unsandboxed file system access as mobile to load outdated DDI. ({{cve|2015-7037}})
* MobileStorageMounter allowed older DeveloperDiskImages to be mounted, resulting in unsandboxed unsigned code execution due to known weaknesses in entitled executables. ({{cve|2015-7051}})
* IOHIDFamily Use-After-Free for kernel information leak / code execution as mobile. ({{cve|2015-6974}})
* dyld exploit in dyld shared cache handling to override MISValidateSignature in libmis.dylib for persistency ({{cve|2015-7079}})
* Racing KPP for some of the patches.
* AMFI MAC Hooks were in non-__const __DATA section, so wouldn't be integrity checked by KPP, allowing to replace MAC hooks required for code-signing. ({{cve|2015-7055}})

=== [[Pangu9]] (9.2 / 9.2.1 / 9.3 / 9.3.1 / 9.3.2 / 9.3.3) ===
* IOMobileFrameBuffer exploit to execute arbitrary code with kernel privileges. ({{cve|2016-4654}})

=== [[jbme]] (9.2 / 9.2.1 / 9.3 / 9.3.1 / 9.3.2 / 9.3.3) ===
* Webkit exploit ({{cve|2016-4657}})

=== [[Home Depot]] (9.1-9.3.4) ===
* OSUnserialize Information leak ({{cve|2016-4655}})
* Kernel exploit ({{cve|2016-4656}})

=== [[JailbreakMe 4.0]] (9.1-9.3.4) ===
* OSUnserialize Information leak ({{cve|2016-4655}})
* Kernel exploit ({{cve|2016-4656}})
* Webkit exploit ({{cve|2016-4657}})

=== [[Phœnix]] (9.3.5 / 9.3.6) ===
* OSUnserialize Information leak ({{cve|2016-4655}})
* mach_port_register Kernel exploit ({{cve|2016-4669}})

== Programs used to jailbreak 10.x ==

=== [[extra_recipe+yaluX]] (10.0-10.1.1) ===

* set_dp_control_port exploit to execute arbitrary code with kernel privileges. ({{cve|2016-7644}})

=== [[yalu102]] (10.0.1-10.2) ===

* mach_voucher_extract_attr_recipe_trap memory corruption. ({{cve|2017-2370}})

=== [[doubleH3lix]] (10.0.1 - 10.3.3) ===

* IOSurface Kernel Exploit ({{cve|2017-13861}})

=== [[Meridian]] (10.0 - 10.3.3) ===

* IOSurface Kernel Exploit ({{cve|2017-13861}})

=== [[TotallyNotSpyware]] (10.0 - 10.3.3) ===

* IOSurface Kernel Exploit ({{cve|2017-13861}})
* WebKit JIT optimization bug exploit ({{cve|2018-4233}})

=== [[H3lix]] (10.0.1 - 10.3.4) ===

* IOSurface Kernel Exploit ({{cve|2017-13861}})

== Programs used to jailbreak 11.x ==

===[[Unc0ver]] (11.0-11.4.1)===

11.0 - 11.1.2

* IOSurface Kernel Exploit ({{cve|2017-13861}})

11.0 - 11.3.1

* mptcp_usr_connectx (multi_path) ({{cve|2018-4241}})
* getvolattrlist (empty_list) ({{cve|2018-4243}})

11.0 - 11.4.1

* voucher_swap ({{cve|2019-6225}})

===[[Electra]] (11.0-11.4.1)===

11.0 - 11.1.2

* IOSurface Kernel Exploit ({{cve|2017-13861}})

11.2 - 11.3.1

* mptcp_usr_connectx (multi_path) ({{cve|2018-4241}})
* getvolattrlist (empty_list) ({{cve|2018-4243}})

11.2 - 11.4.1

* v1ntex ({{cve|2019-6225}})

== Programs used to jailbreak 12.x ==

===[[Chimera]] (12.0 - 12.2 / 12.4)===

12.0 - 12.1.2

* voucher_swap ({{cve|2019-6225}})

12.0 - 12.2/12.4

* sockpuppet ({{cve|2019-8527}})

===[[Unc0ver]] (12.0 - 12.2 / 12.4 / 12.4.1)===

12.0 - 12.1.2

* voucher_swap ({{cve|2019-6225}})

12.0 - 12.2/12.4

* sockpuppet ({{cve|2019-8527}})

12.4.1

* ZecOps Kernel Exploit ({{cve|2019-8794}})

== Programs used to jailbreak 13.x ==

===[[Unc0ver]] (13.0 - 13.3)===

* oob_timestamp ({{cve|2020-3837}})

===[[checkra1n]] (12.3 - 13.3.1)===

* [[Checkm8_Exploit | checkm8]] ({{cve|2019-8900}})

IBoot32Patcher

2020-05-23T06:05:08Z

Kiddepants: Add note about necessary boot arg patch for some iOS versions.

'''iBoot32Patcher''' is a 32-bit [[iBoot]] patching program made by [[User:Ih8sn0w|iH8sn0w]]. This program patches things such as signature checking, allows custom boot-args to be set, changing a command handler's pointer, and more.

== Uses ==
* Creating Odysseus and PwnageTool bundles
* Dual-Booting
* Downgrades
* Jailbreaking

== Source Code ==
* [https://github.com/iH8sn0w/iBoot32Patcher iBoot32Patcher] (Some iOS versions are unable to patch correctly when trying to add boot-args to iBEC, for example, 3GS iBEC on 6.x. Also, setting boot-args for <=4.2.1. This requires a simple one byte patch. The patch will fix both of these errors.)

User:Kiddepants

2020-05-18T03:53:12Z

Kiddepants: Update my iOS

I'm just a young guy who's interested in jailbreaks and dual-booting. I'm not the type of guy to tell you everything about me, just the important stuff you wanna hear. I'm also a friendly guy and I love to laugh.

Twitter: [https://twitter.com/Vyce_Merculous @Vyce_Merculous]

GitHub: [https://github.com/Merculous @Merculous]

My Discord Server (Dualbooting, iOS, etc.) https://discord.gg/7U565V5

=== iDevices ===
{| class="wikitable"
|-
! Device
! Variant
! Storage
! iOS
! Currently Jailbroken?
! Status
! Extras
|-
| [[iPhone 3G]]
| [[N82AP]]
| 8GB
| 4.2.1
| {{Yes}}
| Shattered Screen
| I got pissed at a game lol
|-
| rowspan="2" | [[iPhone 3GS]]
| rowspan="2" | [[N88AP]]
| rowspan="2" | 16GB
| rowspan="2" | 6.1.6
| {{No}}
| Replaced Battery and broken charging port
| [[Bootrom 359.3|Old Bootrom]]
|-
| rowspan="5" {{Yes}}
| Replaced Screen (from the old bootrom one :P)
| [[Bootrom 359.3.2|New Bootrom]]
|-
| rowspan="2" | [[iPhone 4]]
| [[N90AP]]
| rowspan="2" | 32GB
| rowspan="2" | 7.1.2
| rowspan="3" | Main Dual-Booting Device
| rowspan="2" | Testing Device
|-
| [[N92AP]]
|-
| rowspan="2" | [[iPhone 4S]]
| rowspan="2" | [[N94AP]]
| 16GB
| rowspan="2" | 8.4.1
| Came on iOS 7.1.2 :P I saved the blob for it too ( I lost the blob :/ )
|-
| 32GB
| Activated thanks to [https://twitter.com/SoNick_14 SoNick_14]
| Turns out I saved the blobs with the DieID and not the UniqueChipID (ECID) :/
|-
| rowspan="3" | [[iPhone 5]]
| [[N41AP]]
| 64GB
| 10.3.3
| {{No}}
| iCloud Locked :/
| Only device I still have that I grabbed blobs from the signing window mishap on Apple's end :P
|-
| [[N42AP]]
| 32GB
| 8.1.2
| rowspan="3" {{Yes}}
| Has multiple broken parts (which I'll fix :P)
| Came with iOS 8.1.2 (let's not lose another blob)
|-
| [[N48AP]]
| rowspan="3" | 16GB
| 8.1
| Was still on iOS 8.1 FTW!
| Is my sisters old iPhone too lol
|-
| [[iPhone 5s]]
| [[N51AP]]
| 10.3.3
| Downgraded to iOS 10.3.3 with OTA blobs, checkm8, and iBoot64Patcher :D
| Jailbroken with [[TotallyNotSpyware]]
|-
| [[iPhone 6]]
| [[N61AP]]
| 12.1.2
| {{No}}
| iCloud locked
| Just a spare device to upload A8 AES keys using checkm8 (for now)
|-
| [[iPhone XS Max]]
| [[D331pAP]]
| 64GB
| 13.3
| {{Yes}}
| Daily Driver
| Jailbroken with [[Unc0ver]]
|}

Dalaman 15D100 (iPod7,1)

2020-05-10T23:22:30Z

Kiddepants: Created page with "{{keys | Version = 11.2.6 | Build = 15D100 | Device = iPod7,1 | Codename = Dalaman | DownloadURL = htt..."

{{keys
| Version = 11.2.6
| Build = 15D100
| Device = iPod7,1
| Codename = Dalaman
| DownloadURL = http://appldnld.apple.com/ios11.2.6/091-69581-20180220-0638A8F4-1331-11E8-A0C5-18A2E0A71A1F/iPodtouch_11.2.6_15D100_Restore.ipsw

| RootFS = 058-95101-065
| RootFSKey = Not Encrypted

| UpdateRamdisk = 058-95281-066
| UpdateRamdiskIV = Not Encrypted

| RestoreRamdisk = 058-94922-067
| RestoreRamdiskIV = Not Encrypted

| AppleLogo = applelogo@2x~iphone.im4p
| AppleLogoIV = Not Encrypted

| BatteryCharging0 = batterycharging0@2x~iphone.im4p
| BatteryCharging0IV = Not Encrypted

| BatteryCharging1 = batterycharging1@2x~iphone.im4p
| BatteryCharging1IV = Not Encrypted

| BatteryFull = batteryfull@2x~iphone.im4p
| BatteryFullIV = Not Encrypted

| BatteryLow0 = batterylow0@2x~iphone.im4p
| BatteryLow0IV = Not Encrypted

| BatteryLow1 = batterylow1@2x~iphone.im4p
| BatteryLow1IV = Not Encrypted

| DeviceTree = DeviceTree.n102ap.im4p
| DeviceTreeIV = Not Encrypted

| GlyphPlugin = glyphplugin@1136~iphone-lightning.im4p
| GlyphPluginIV = Not Encrypted

| iBEC = iBEC.n102.RELEASE.im4p
| iBECIV = 3cc6412a0acf0b59a6e9bca007c2666d
| iBECKey = 0c736933df7abfe8513b59090fc0eb6dcf5e7d325b4a2560d7162742f1b4d8f7

| iBoot = iBoot.n102.RELEASE.im4p
| iBootIV = bf61517e6bd882b73ab6f4f57bc6b7a6
| iBootKey = a2f0f4957a111896a7d1e597c72ea6e3bff3c1303574a6254379be7973e9551a

| iBSS = iBSS.n102.RELEASE.im4p
| iBSSIV = 7b126ff57cb0fc7d6083e704b22568b4
| iBSSKey = 0f747e91209cb0fb35a07bdde950bb616b8f24c3909668ac1e06968150b4313e

| Kernelcache = kernelcache.release.n102
| KernelcacheIV = Not Encrypted

| LLB = LLB.n102.RELEASE.im4p
| LLBIV = 392546f6762655ed815a4e09474683b2
| LLBKey = e1f81be59f51de28de9ade05c56171c727d2260ccea5fca5f4df685da55dfd04

| RecoveryMode = recoverymode@1136~ipod-lightning.im4p
| RecoveryModeIV = Not Encrypted

| SEPFirmware = sep-firmware.n102.RELEASE.im4p
| SEPFirmwareIV = Unknown
| SEPFirmwareKey = Unknown
| SEPFirmwareKBAG = d8734623b214b36b9a1f535596812cd4d98fa77ad82fab03b39ce9dea073040a7b14aa7fe8e979b438845f7162d75272

}}

Dalaman 15D60 (iPod7,1)

2020-05-10T23:19:52Z

Kiddepants: Created page with "{{keys | Version = 11.2.5 | Build = 15D60 | Device = iPod7,1 | Codename = Dalaman | DownloadURL = http..."

{{keys
| Version = 11.2.5
| Build = 15D60
| Device = iPod7,1
| Codename = Dalaman
| DownloadURL = http://appldnld.apple.com/ios11.2.5/091-61946-20180122-2A119562-FC96-11E7-9CB7-EC82E70393C2/iPodtouch_11.2.5_15D60_Restore.ipsw

| RootFS = 058-95101-064
| RootFSKey = Not Encrypted

| UpdateRamdisk = 058-95281-064
| UpdateRamdiskIV = Not Encrypted

| RestoreRamdisk = 058-94922-065
| RestoreRamdiskIV = Not Encrypted

| AppleLogo = applelogo@2x~iphone.im4p
| AppleLogoIV = Not Encrypted

| BatteryCharging0 = batterycharging0@2x~iphone.im4p
| BatteryCharging0IV = Not Encrypted

| BatteryCharging1 = batterycharging1@2x~iphone.im4p
| BatteryCharging1IV = Not Encrypted

| BatteryFull = batteryfull@2x~iphone.im4p
| BatteryFullIV = Not Encrypted

| BatteryLow0 = batterylow0@2x~iphone.im4p
| BatteryLow0IV = Not Encrypted

| BatteryLow1 = batterylow1@2x~iphone.im4p
| BatteryLow1IV = Not Encrypted

| DeviceTree = DeviceTree.n102ap.im4p
| DeviceTreeIV = Not Encrypted

| GlyphPlugin = glyphplugin@1136~iphone-lightning.im4p
| GlyphPluginIV = Not Encrypted

| iBEC = iBEC.n102.RELEASE.im4p
| iBECIV = 3cc6412a0acf0b59a6e9bca007c2666d
| iBECKey = 0c736933df7abfe8513b59090fc0eb6dcf5e7d325b4a2560d7162742f1b4d8f7

| iBoot = iBoot.n102.RELEASE.im4p
| iBootIV = bf61517e6bd882b73ab6f4f57bc6b7a6
| iBootKey = a2f0f4957a111896a7d1e597c72ea6e3bff3c1303574a6254379be7973e9551a

| iBSS = iBSS.n102.RELEASE.im4p
| iBSSIV = 7b126ff57cb0fc7d6083e704b22568b4
| iBSSKey = 0f747e91209cb0fb35a07bdde950bb616b8f24c3909668ac1e06968150b4313e

| Kernelcache = kernelcache.release.n102
| KernelcacheIV = Not Encrypted

| LLB = LLB.n102.RELEASE.im4p
| LLBIV = 392546f6762655ed815a4e09474683b2
| LLBKey = e1f81be59f51de28de9ade05c56171c727d2260ccea5fca5f4df685da55dfd04

| RecoveryMode = recoverymode@1136~ipod-lightning.im4p
| RecoveryModeIV = Not Encrypted

| SEPFirmware = sep-firmware.n102.RELEASE.im4p
| SEPFirmwareIV = Unknown
| SEPFirmwareKey = Unknown
| SEPFirmwareKBAG = d8734623b214b36b9a1f535596812cd4d98fa77ad82fab03b39ce9dea073040a7b14aa7fe8e979b438845f7162d75272

}}

Cinar 15C202 (iPod7,1)

2020-05-10T23:17:19Z

Kiddepants: Created page with "{{keys | Version = 11.2.2 | Build = 15C202 | Device = iPod7,1 | Codename = Cinar | DownloadURL = http:..."

{{keys
| Version = 11.2.2
| Build = 15C202
| Device = iPod7,1
| Codename = Cinar
| DownloadURL = http://appldnld.apple.com/ios11.2.2/091-58233-20170108-B8467F48-F0C8-11E7-9552-6A2D869EB6BD/iPodtouch_11.2.2_15C202_Restore.ipsw

| RootFS = 058-85967-130
| RootFSKey = Not Encrypted

| UpdateRamdisk = 058-85997-132
| UpdateRamdiskIV = Not Encrypted

| RestoreRamdisk = 058-85846-133
| RestoreRamdiskIV = Not Encrypted

| AppleLogo = applelogo@2x~iphone.im4p
| AppleLogoIV = Not Encrypted

| BatteryCharging0 = batterycharging0@2x~iphone.im4p
| BatteryCharging0IV = Not Encrypted

| BatteryCharging1 = batterycharging1@2x~iphone.im4p
| BatteryCharging1IV = Not Encrypted

| BatteryFull = batteryfull@2x~iphone.im4p
| BatteryFullIV = Not Encrypted

| BatteryLow0 = batterylow0@2x~iphone.im4p
| BatteryLow0IV = Not Encrypted

| BatteryLow1 = batterylow1@2x~iphone.im4p
| BatteryLow1IV = Not Encrypted

| DeviceTree = DeviceTree.n102ap.im4p
| DeviceTreeIV = Not Encrypted

| GlyphPlugin = glyphplugin@1136~iphone-lightning.im4p
| GlyphPluginIV = Not Encrypted

| iBEC = iBEC.n102.RELEASE.im4p
| iBECIV = f3b426474ea6543495fd5b11d50c9d76
| iBECKey = caccdcc6ee6ba6651ab16144ddef3ca43243e36b271b1d206d52b7b6a556ad9a

| iBoot = iBoot.n102.RELEASE.im4p
| iBootIV = 53851e49e3bf19b4e7e302eca6c98d4a
| iBootKey = 6e023e0e4830ff3a199b53c2654ef007086ed26014cb6855caebe1087d78aef0

| iBSS = iBSS.n102.RELEASE.im4p
| iBSSIV = d922b578345d465fc357875303b87f03
| iBSSKey = b513ddabab068cc2a45dfdd92150379bef59dc41b623fc0abed24a9e18afd4cd

| Kernelcache = kernelcache.release.n102
| KernelcacheIV = Not Encrypted

| LLB = LLB.n102.RELEASE.im4p
| LLBIV = 29d10c98ad16b53e801a80707d764c7b
| LLBKey = 532eae724d3e7af57c7fd6217dea1d76066fd448911fd06275bac77f0fa3ac99

| RecoveryMode = recoverymode@1136~ipod-lightning.im4p
| RecoveryModeIV = Not Encrypted

| SEPFirmware = sep-firmware.n102.RELEASE.im4p
| SEPFirmwareIV = Unknown
| SEPFirmwareKey = Unknown
| SEPFirmwareKBAG = 67f7744efc4db3f36066f641dc6a6d8ba8172177be65b8b15664b2b713e3f12e4c89c035a77f28814bc98d0c2684b314

}}

Cinar 15C153 (iPod7,1)

2020-05-10T23:14:51Z

Kiddepants: Created page with "{{keys | Version = 11.2.1 | Build = 15C153 | Device = iPod7,1 | Codename = Cinar | DownloadURL = http:..."

{{keys
| Version = 11.2.1
| Build = 15C153
| Device = iPod7,1
| Codename = Cinar
| DownloadURL = http://appldnld.apple.com/ios11.2.1/091-55027-20171213-5FCAFF86-DDFB-11E7-A506-0EE4FB2783B2/iPodtouch_11.2.1_15C153_Restore.ipsw

| RootFS = 058-85967-127
| RootFSKey = Not Encrypted

| UpdateRamdisk = 058-85997-129
| UpdateRamdiskIV = Not Encrypted

| RestoreRamdisk = 058-85846-130
| RestoreRamdiskIV = Not Encrypted

| AppleLogo = applelogo@2x~iphone.im4p
| AppleLogoIV = Not Encrypted

| BatteryCharging0 = batterycharging0@2x~iphone.im4p
| BatteryCharging0IV = Not Encrypted

| BatteryCharging1 = batterycharging1@2x~iphone.im4p
| BatteryCharging1IV = Not Encrypted

| BatteryFull = batteryfull@2x~iphone.im4p
| BatteryFullIV = Not Encrypted

| BatteryLow0 = batterylow0@2x~iphone.im4p
| BatteryLow0IV = Not Encrypted

| BatteryLow1 = batterylow1@2x~iphone.im4p
| BatteryLow1IV = Not Encrypted

| DeviceTree = DeviceTree.n102ap.im4p
| DeviceTreeIV = Not Encrypted

| GlyphPlugin = glyphplugin@1136~iphone-lightning.im4p
| GlyphPluginIV = Not Encrypted

| iBEC = iBEC.n102.RELEASE.im4p
| iBECIV = f3b426474ea6543495fd5b11d50c9d76
| iBECKey = caccdcc6ee6ba6651ab16144ddef3ca43243e36b271b1d206d52b7b6a556ad9a

| iBoot = iBoot.n102.RELEASE.im4p
| iBootIV = 53851e49e3bf19b4e7e302eca6c98d4a
| iBootKey = 6e023e0e4830ff3a199b53c2654ef007086ed26014cb6855caebe1087d78aef0

| iBSS = iBSS.n102.RELEASE.im4p
| iBSSIV = d922b578345d465fc357875303b87f03
| iBSSKey = b513ddabab068cc2a45dfdd92150379bef59dc41b623fc0abed24a9e18afd4cd

| Kernelcache = kernelcache.release.n102
| KernelcacheIV = Not Encrypted

| LLB = LLB.n102.RELEASE.im4p
| LLBIV = 29d10c98ad16b53e801a80707d764c7b
| LLBKey = 532eae724d3e7af57c7fd6217dea1d76066fd448911fd06275bac77f0fa3ac99

| RecoveryMode = recoverymode@1136~ipod-lightning.im4p
| RecoveryModeIV = Not Encrypted

| SEPFirmware = sep-firmware.n102.RELEASE.im4p
| SEPFirmwareIV = Unknown
| SEPFirmwareKey = Unknown
| SEPFirmwareKBAG = 67f7744efc4db3f36066f641dc6a6d8ba8172177be65b8b15664b2b713e3f12e4c89c035a77f28814bc98d0c2684b314

}}

Cinar 15C114 (iPod7,1)

2020-05-10T23:11:40Z

Kiddepants: Created page with "{{keys | Version = 11.2 | Build = 15C114 | Device = iPod7,1 | Codename = Cinar | DownloadURL = http://..."

{{keys
| Version = 11.2
| Build = 15C114
| Device = iPod7,1
| Codename = Cinar
| DownloadURL = http://appldnld.apple.com/ios11.2/091-51607-20171206-BA0D6AD0-D5F7-11E7-B7C0-32B9DC24E03F/iPodtouch_11.2_15C114_Restore.ipsw

| RootFS = 058-85967-124
| RootFSKey = Not Encrypted

| UpdateRamdisk = 058-85997-124
| UpdateRamdiskIV = Not Encrypted

| RestoreRamdisk = 058-85846-125
| RestoreRamdiskIV = Not Encrypted

| AppleLogo = applelogo@2x~iphone.im4p
| AppleLogoIV = Not Encrypted

| BatteryCharging0 = batterycharging0@2x~iphone.im4p
| BatteryCharging0IV = Not Encrypted

| BatteryCharging1 = batterycharging1@2x~iphone.im4p
| BatteryCharging1IV = Not Encrypted

| BatteryFull = batteryfull@2x~iphone.im4p
| BatteryFullIV = Not Encrypted

| BatteryLow0 = batterylow0@2x~iphone.im4p
| BatteryLow0IV = Not Encrypted

| BatteryLow1 = batterylow1@2x~iphone.im4p
| BatteryLow1IV = Not Encrypted

| DeviceTree = DeviceTree.n102ap.im4p
| DeviceTreeIV = Not Encrypted

| GlyphPlugin = glyphplugin@1136~iphone-lightning.im4p
| GlyphPluginIV = Not Encrypted

| iBEC = iBEC.n102.RELEASE.im4p
| iBECIV = c62ab8328735bd21080dc6a80a64817f
| iBECKey = 8618b22c17d1b0c3c3fae6fd3e6bfbcfd991d3a773d0587f29e0d403073104ff

| iBoot = iBoot.n102.RELEASE.im4p
| iBootIV = 44bb329caa3dd49bb5bb6ed8d6838b17
| iBootKey = 968567f3d8f3384ef540441a1992dfceadaf95628e587271c038df1bd0291635

| iBSS = iBSS.n102.RELEASE.im4p
| iBSSIV = 97dad8efa263724f87d6a77626495e75
| iBSSKey = 0328129ae63318ae2c49e91199a8be75f6a333af42d25a8806effa1483b041ab

| Kernelcache = kernelcache.release.n102
| KernelcacheIV = Not Encrypted

| LLB = LLB.n102.RELEASE.im4p
| LLBIV = dda3c6c8e88dbac099069250b07a3a1f
| LLBKey = a24874854925cb23c236ed8876a57cfa9c5d09b9be1f7daabd5868d6720666f3

| RecoveryMode = recoverymode@1136~ipod-lightning.im4p
| RecoveryModeIV = Not Encrypted

| SEPFirmware = sep-firmware.n102.RELEASE.im4p
| SEPFirmwareIV = Unknown
| SEPFirmwareKey = Unknown
| SEPFirmwareKBAG = 67ab10cefdf99b5eda118f65240d76d59399d4d55afbc4f3b56fcbb47f694edeb9e0a74e51ac2ad19daca36484d6749c

}}

Bursa 15B202 (iPod7,1)

2020-05-10T23:08:53Z

Kiddepants: Created page with "{{keys | Version = 11.1.2 | Build = 15B202 | Device = iPod7,1 | Codename = Bursa | DownloadURL = http:..."

{{keys
| Version = 11.1.2
| Build = 15B202
| Device = iPod7,1
| Codename = Bursa
| DownloadURL = http://appldnld.apple.com/ios11.1.2/091-46346-20171116-4F8EFD4A-C9C7-11E7-AF9C-77E0F451CBCD/iPodtouch_11.1.2_15B202_Restore.ipsw

| RootFS = 058-84501-100
| RootFSKey = Not Encrypted

| UpdateRamdisk = 058-85048-102
| UpdateRamdiskIV = Not Encrypted

| RestoreRamdisk = 058-84556-102
| RestoreRamdiskIV = Not Encrypted

| AppleLogo = applelogo@2x~iphone.im4p
| AppleLogoIV = Not Encrypted

| BatteryCharging0 = batterycharging0@2x~iphone.im4p
| BatteryCharging0IV = Not Encrypted

| BatteryCharging1 = batterycharging1@2x~iphone.im4p
| BatteryCharging1IV = Not Encrypted

| BatteryFull = batteryfull@2x~iphone.im4p
| BatteryFullIV = Not Encrypted

| BatteryLow0 = batterylow0@2x~iphone.im4p
| BatteryLow0IV = Not Encrypted

| BatteryLow1 = batterylow1@2x~iphone.im4p
| BatteryLow1IV = Not Encrypted

| DeviceTree = DeviceTree.n102ap.im4p
| DeviceTreeIV = Not Encrypted

| GlyphPlugin = glyphplugin@1136~iphone-lightning.im4p
| GlyphPluginIV = Not Encrypted

| iBEC = iBEC.n102.RELEASE.im4p
| iBECIV = 47ba94a1c5eea01dc16dd4d6adb768e4
| iBECKey = 10b85cbf7b2a98be28b10a486346dfe207867a585c267b7044900a4ae575b14e

| iBoot = iBoot.n102.RELEASE.im4p
| iBootIV = 2264cd1b6f659a26f9dd887279ecd273
| iBootKey = dea69e570c740f6a0869826bb54fc2b618b639102c026f18c62304625483e987

| iBSS = iBSS.n102.RELEASE.im4p
| iBSSIV = ac925ad7a69ab5a5c5561cdec7ead9b2
| iBSSKey = 14dfc416e84252871dced84aab790b130bb413da53b449af4cb1b457e5b7804f

| Kernelcache = kernelcache.release.n102
| KernelcacheIV = Not Encrypted

| LLB = LLB.n102.RELEASE.im4p
| LLBIV = 5d1855391659866f5fb927ff4c255a32
| LLBKey = bd0ea24e0d3c7b5cd6dbbb056af0ea402acf7161b794f9dee8508ff6d59b770e

| RecoveryMode = recoverymode@1136~ipod-lightning.im4p
| RecoveryModeIV = Not Encrypted

| SEPFirmware = sep-firmware.n102.RELEASE.im4p
| SEPFirmwareIV = Unknown
| SEPFirmwareKey = Unknown
| SEPFirmwareKBAG = d48c668b6b0cb6a6a05a0e5c4bea30ca946f6c291ee6d7af32c7b507b1ca09741ff61f2ad66389a10265447fedf31300

}}

Bursa 15B150 (iPod7,1)

2020-05-10T21:08:04Z

Kiddepants: Created page with "{{keys | Version = 11.1.1 | Build = 15B150 | Device = iPod7,1 | Codename = Bursa | DownloadURL = http:..."

{{keys
| Version = 11.1.1
| Build = 15B150
| Device = iPod7,1
| Codename = Bursa
| DownloadURL = http://appldnld.apple.com/ios11.1.1/091-42247-20171106-452305F0-C39A-11E7-BE39-3DBCF8FD2868/iPodtouch_11.1.1_15B150_Restore.ipsw

| RootFS = 058-84501-099
| RootFSKey = Not Encrypted

| UpdateRamdisk = 058-85048-099
| UpdateRamdiskIV = Not Encrypted

| RestoreRamdisk = 058-84556-099
| RestoreRamdiskIV = Not Encrypted

| AppleLogo = applelogo@2x~iphone.im4p
| AppleLogoIV = Not Encrypted

| BatteryCharging0 = batterycharging0@2x~iphone.im4p
| BatteryCharging0IV = Not Encrypted

| BatteryCharging1 = batterycharging1@2x~iphone.im4p
| BatteryCharging1IV = Not Encrypted

| BatteryFull = batteryfull@2x~iphone.im4p
| BatteryFullIV = Not Encrypted

| BatteryLow0 = batterylow0@2x~iphone.im4p
| BatteryLow0IV = Not Encrypted

| BatteryLow1 = batterylow1@2x~iphone.im4p
| BatteryLow1IV = Not Encrypted

| DeviceTree = DeviceTree.n102ap.im4p
| DeviceTreeIV = Not Encrypted

| GlyphPlugin = glyphplugin@1136~iphone-lightning.im4p
| GlyphPluginIV = Not Encrypted

| iBEC = iBEC.n102.RELEASE.im4p
| iBECIV = 47ba94a1c5eea01dc16dd4d6adb768e4
| iBECKey = 10b85cbf7b2a98be28b10a486346dfe207867a585c267b7044900a4ae575b14e

| iBoot = iBoot.n102.RELEASE.im4p
| iBootIV = 2264cd1b6f659a26f9dd887279ecd273
| iBootKey = dea69e570c740f6a0869826bb54fc2b618b639102c026f18c62304625483e987

| iBSS = iBSS.n102.RELEASE.im4p
| iBSSIV = ac925ad7a69ab5a5c5561cdec7ead9b2
| iBSSKey = 14dfc416e84252871dced84aab790b130bb413da53b449af4cb1b457e5b7804f

| Kernelcache = kernelcache.release.n102
| KernelcacheIV = Not Encrypted

| LLB = LLB.n102.RELEASE.im4p
| LLBIV = 5d1855391659866f5fb927ff4c255a32
| LLBKey = bd0ea24e0d3c7b5cd6dbbb056af0ea402acf7161b794f9dee8508ff6d59b770e

| RecoveryMode = recoverymode@1136~ipod-lightning.im4p
| RecoveryModeIV = Not Encrypted

| SEPFirmware = sep-firmware.n102.RELEASE.im4p
| SEPFirmwareIV = Unknown
| SEPFirmwareKey = Unknown
| SEPFirmwareKBAG = d48c668b6b0cb6a6a05a0e5c4bea30ca946f6c291ee6d7af32c7b507b1ca09741ff61f2ad66389a10265447fedf31300

}}

Bursa 15B93 (iPod7,1)

2020-05-10T21:04:57Z

Kiddepants: Created page with "{{keys | Version = 11.1 | Build = 15B93 | Device = iPod7,1 | Codename = Bursa | DownloadURL = http://a..."

{{keys
| Version = 11.1
| Build = 15B93
| Device = iPod7,1
| Codename = Bursa
| DownloadURL = http://appldnld.apple.com/ios11.1seed/091-41139-20171023-3D9A2180-B5DD-11E7-9D14-97555BD5B8E1/iPodtouch_11.1_15B93_Restore.ipsw

| RootFS = 058-84501-097
| RootFSKey = Not Encrypted

| UpdateRamdisk = 058-85048-096
| UpdateRamdiskIV = Not Encrypted

| RestoreRamdisk = 058-84556-096
| RestoreRamdiskIV = Not Encrypted

| AppleLogo = applelogo@2x~iphone.im4p
| AppleLogoIV = Not Encrypted

| BatteryCharging0 = batterycharging0@2x~iphone.im4p
| BatteryCharging0IV = Not Encrypted

| BatteryCharging1 = batterycharging1@2x~iphone.im4p
| BatteryCharging1IV = Not Encrypted

| BatteryFull = batteryfull@2x~iphone.im4p
| BatteryFullIV = Not Encrypted

| BatteryLow0 = batterylow0@2x~iphone.im4p
| BatteryLow0IV = Not Encrypted

| BatteryLow1 = batterylow1@2x~iphone.im4p
| BatteryLow1IV = Not Encrypted

| DeviceTree = DeviceTree.n102ap.im4p
| DeviceTreeIV = Not Encrypted

| GlyphPlugin = glyphplugin@1136~iphone-lightning.im4p
| GlyphPluginIV = Not Encrypted

| iBEC = iBEC.n102.RELEASE.im4p
| iBECIV = 47ba94a1c5eea01dc16dd4d6adb768e4
| iBECKey = 10b85cbf7b2a98be28b10a486346dfe207867a585c267b7044900a4ae575b14e

| iBoot = iBoot.n102.RELEASE.im4p
| iBootIV = 2264cd1b6f659a26f9dd887279ecd273
| iBootKey = dea69e570c740f6a0869826bb54fc2b618b639102c026f18c62304625483e987

| iBSS = iBSS.n102.RELEASE.im4p
| iBSSIV = ac925ad7a69ab5a5c5561cdec7ead9b2
| iBSSKey = 14dfc416e84252871dced84aab790b130bb413da53b449af4cb1b457e5b7804f

| Kernelcache = kernelcache.release.n102
| KernelcacheIV = Not Encrypted

| LLB = LLB.n102.RELEASE.im4p
| LLBIV = 5d1855391659866f5fb927ff4c255a32
| LLBKey = bd0ea24e0d3c7b5cd6dbbb056af0ea402acf7161b794f9dee8508ff6d59b770e

| RecoveryMode = recoverymode@1136~ipod-lightning.im4p
| RecoveryModeIV = Not Encrypted

| SEPFirmware = sep-firmware.n102.RELEASE.im4p
| SEPFirmwareIV = Unknown
| SEPFirmwareKey = Unknown
| SEPFirmwareKBAG = d48c668b6b0cb6a6a05a0e5c4bea30ca946f6c291ee6d7af32c7b507b1ca09741ff61f2ad66389a10265447fedf31300

}}

Tigris 15A432 (iPod7,1)

2020-05-10T21:01:32Z

Kiddepants: Created page with "{{keys | Version = 11.0.3 | Build = 15A432 | Device = iPod7,1 | Codename = Tigris | DownloadURL = http..."

{{keys
| Version = 11.0.3
| Build = 15A432
| Device = iPod7,1
| Codename = Tigris
| DownloadURL = http://appldnld.apple.com/ios11.0.3/091-38409-20171011-DF390008-AB95-11E7-AF98-41A9187BE358/iPodtouch_11.0.3_15A432_Restore.ipsw

| RootFS = 058-45574-484
| RootFSKey = Not Encrypted

| UpdateRamdisk = 058-59988-357
| UpdateRamdiskIV = Not Encrypted

| RestoreRamdisk = 058-59982-359
| RestoreRamdiskIV = Not Encrypted

| AppleLogo = applelogo@2x~iphone.im4p
| AppleLogoIV = Not Encrypted

| BatteryCharging0 = batterycharging0@2x~iphone.im4p
| BatteryCharging0IV = Not Encrypted

| BatteryCharging1 = batterycharging1@2x~iphone.im4p
| BatteryCharging1IV = Not Encrypted

| BatteryFull = batteryfull@2x~iphone.im4p
| BatteryFullIV = Not Encrypted

| BatteryLow0 = batterylow0@2x~iphone.im4p
| BatteryLow0IV = Not Encrypted

| BatteryLow1 = batterylow1@2x~iphone.im4p
| BatteryLow1IV = Not Encrypted

| DeviceTree = DeviceTree.n102ap.im4p
| DeviceTreeIV = Not Encrypted

| GlyphPlugin = glyphplugin@1136~iphone-lightning.im4p
| GlyphPluginIV = Not Encrypted

| iBEC = iBEC.n102.RELEASE.im4p
| iBECIV = f38a9c55aeb7146015d90f409d0d1a3f
| iBECKey = fe6ba26e302bbc7e0d01109e53ab6c3f909b7d393f49272c87646bb55dcee98f

| iBoot = iBoot.n102.RELEASE.im4p
| iBootIV = 9b59d4410a6b4f04a55a2e993bba31fa
| iBootKey = b7b8a5078ef2aa89e87c37eb530139430c57556350010366d037bde789f7736f

| iBSS = iBSS.n102.RELEASE.im4p
| iBSSIV = 6df06304a170982b5f9190fcafbf23d2
| iBSSKey = c9cdad3a0e75b4b805b230f8e4881ea1a9d198fb897a05b8d7fb34c05ee714e2

| Kernelcache = kernelcache.release.n102
| KernelcacheIV = Not Encrypted

| LLB = LLB.n102.RELEASE.im4p
| LLBIV = e00485fd0a35f8a77cab02c907c4aa50
| LLBKey = e3a7d00b268e38ef04cea6bda4d522fb15a7fd450da1bb46bd4f68d8669730b0

| RecoveryMode = recoverymode@1136~ipod-lightning.im4p
| RecoveryModeIV = Not Encrypted

| SEPFirmware = sep-firmware.n102.RELEASE.im4p
| SEPFirmwareIV = Unknown
| SEPFirmwareKey = Unknown
| SEPFirmwareKBAG = 469e43b8d0d24e1746602d1f569a6d6192e5b976f93b1a7cbe8a2ae01fab58368e7000f0a0a3b31e1c6b3f1c4b00294b

}}

Tigris 15A421 (iPod7,1)

2020-05-10T20:59:07Z

Kiddepants: Created page with "{{keys | Version = 11.0.2 | Build = 15A421 | Device = iPod7,1 | Codename = Tigris | DownloadURL = http..."

{{keys
| Version = 11.0.2
| Build = 15A421
| Device = iPod7,1
| Codename = Tigris
| DownloadURL = http://appldnld.apple.com/ios11.0.2/091-34638-20171003-39D0F78A-A486-11E7-AA81-1DDA63D90D56/iPodtouch_11.0.2_15A421_Restore.ipsw

| RootFS = 058-45574-483
| RootFSKey = Not Encrypted

| UpdateRamdisk = 058-59988-353
| UpdateRamdiskIV = Not Encrypted

| RestoreRamdisk = 058-59982-355
| RestoreRamdiskIV = Not Encrypted

| AppleLogo = applelogo@2x~iphone.im4p
| AppleLogoIV = Not Encrypted

| BatteryCharging0 = batterycharging0@2x~iphone.im4p
| BatteryCharging0IV = Not Encrypted

| BatteryCharging1 = batterycharging1@2x~iphone.im4p
| BatteryCharging1IV = Not Encrypted

| BatteryFull = batteryfull@2x~iphone.im4p
| BatteryFullIV = Not Encrypted

| BatteryLow0 = batterylow0@2x~iphone.im4p
| BatteryLow0IV = Not Encrypted

| BatteryLow1 = batterylow1@2x~iphone.im4p
| BatteryLow1IV = Not Encrypted

| DeviceTree = DeviceTree.n102ap.im4p
| DeviceTreeIV = Not Encrypted

| GlyphPlugin = glyphplugin@1136~iphone-lightning.im4p
| GlyphPluginIV = Not Encrypted

| iBEC = iBEC.n102.RELEASE.im4p
| iBECIV = f38a9c55aeb7146015d90f409d0d1a3f
| iBECKey = fe6ba26e302bbc7e0d01109e53ab6c3f909b7d393f49272c87646bb55dcee98f

| iBoot = iBoot.n102.RELEASE.im4p
| iBootIV = 9b59d4410a6b4f04a55a2e993bba31fa
| iBootKey = b7b8a5078ef2aa89e87c37eb530139430c57556350010366d037bde789f7736f

| iBSS = iBSS.n102.RELEASE.im4p
| iBSSIV = 6df06304a170982b5f9190fcafbf23d2
| iBSSKey = c9cdad3a0e75b4b805b230f8e4881ea1a9d198fb897a05b8d7fb34c05ee714e2

| Kernelcache = kernelcache.release.n102
| KernelcacheIV = Not Encrypted

| LLB = LLB.n102.RELEASE.im4p
| LLBIV = e00485fd0a35f8a77cab02c907c4aa50
| LLBKey = e3a7d00b268e38ef04cea6bda4d522fb15a7fd450da1bb46bd4f68d8669730b0

| RecoveryMode = recoverymode@1136~ipod-lightning.im4p
| RecoveryModeIV = Not Encrypted

| SEPFirmware = sep-firmware.n102.RELEASE.im4p
| SEPFirmwareIV = Unknown
| SEPFirmwareKey = Unknown
| SEPFirmwareKBAG = 469e43b8d0d24e1746602d1f569a6d6192e5b976f93b1a7cbe8a2ae01fab58368e7000f0a0a3b31e1c6b3f1c4b00294b

}}

Tigris 15A402 (iPod7,1)

2020-05-10T20:56:17Z

Kiddepants: Created page with "{{keys | Version = 11.0.1 | Build = 15A402 | Device = iPod7,1 | Codename = Tigris | DownloadURL = http..."

{{keys
| Version = 11.0.1
| Build = 15A402
| Device = iPod7,1
| Codename = Tigris
| DownloadURL = http://appldnld.apple.com/ios11.0.1/091-33987-20170925-2FCAEC6E-9ED2-11E7-A19E-68AAC568F843/iPodtouch_11.0.1_15A402_Restore.ipsw

| RootFS = 058-45574-481
| RootFSKey = Not Encrypted

| UpdateRamdisk = 058-59988-350
| UpdateRamdiskIV = Not Encrypted

| RestoreRamdisk = 058-59982-352
| RestoreRamdiskIV = Not Encrypted

| AppleLogo = applelogo@2x~iphone.im4p
| AppleLogoIV = Not Encrypted

| BatteryCharging0 = batterycharging0@2x~iphone.im4p
| BatteryCharging0IV = Not Encrypted

| BatteryCharging1 = batterycharging1@2x~iphone.im4p
| BatteryCharging1IV = Not Encrypted

| BatteryFull = batteryfull@2x~iphone.im4p
| BatteryFullIV = Not Encrypted

| BatteryLow0 = batterylow0@2x~iphone.im4p
| BatteryLow0IV = Not Encrypted

| BatteryLow1 = batterylow1@2x~iphone.im4p
| BatteryLow1IV = Not Encrypted

| DeviceTree = DeviceTree.n102ap.im4p
| DeviceTreeIV = Not Encrypted

| GlyphPlugin = glyphplugin@1136~iphone-lightning.im4p
| GlyphPluginIV = Not Encrypted

| iBEC = iBEC.n102.RELEASE.im4p
| iBECIV = ac5a59de5f3e8457f0030d83dc643c68
| iBECKey = 23f96dbfec8c04b75b29907a4f921050fa965ead9dc18d9f013644c87fd770e6

| iBoot = iBoot.n102.RELEASE.im4p
| iBootIV = e46050800cb669941bc9bd8b5608cad8
| iBootKey = 8bcbaefa0c551127b27eb746aa06f2c575d88675ea4d595bedf8c5ca63a28d3a

| iBSS = iBSS.n102.RELEASE.im4p
| iBSSIV = 5e20f9a25b924a01651b62b4b51b7f9c
| iBSSKey = d49625bb95ac9bf7ca4ab15488246aba5ea8faeaf1258cc496f7d17535851bcc

| Kernelcache = kernelcache.release.n102
| KernelcacheIV = Not Encrypted

| LLB = LLB.n102.RELEASE.im4p
| LLBIV = 72087917fc7bf9fb9e38753d55909d45
| LLBKey = 95181f79b57ee8be12f3af7bc49bc401fcca9cac8813a93687dc24a2d8b811e1

| RecoveryMode = recoverymode@1136~ipod-lightning.im4p
| RecoveryModeIV = Not Encrypted

| SEPFirmware = sep-firmware.n102.RELEASE.im4p
| SEPFirmwareIV = Unknown
| SEPFirmwareKey = Unknown
| SEPFirmwareKBAG = 5af3d65073878d293d90232bd2830b301dffe9554df129cb3ba02b3d55b2ab23b7c02a84a859e94d2fdb4eea1fbef777

}}

Tigris 15A372 (iPod7,1)

2020-05-10T20:53:22Z

Kiddepants: Created page with "{{keys | Version = 11.0 | Build = 15A372 | Device = iPod7,1 | Codename = Tigris | DownloadURL = http:/..."

{{keys
| Version = 11.0
| Build = 15A372
| Device = iPod7,1
| Codename = Tigris
| DownloadURL = http://appldnld.apple.com/ios11.0/091-31552-201700919-35A38376-9027-11E7-A2A2-2135B64D2808/iPodtouch_11.0_15A372_Restore.ipsw

| RootFS = 058-45574-478
| RootFSKey = Not Encrypted

| UpdateRamdisk = 058-59988-347
| UpdateRamdiskIV = Not Encrypted

| RestoreRamdisk = 058-59982-349
| RestoreRamdiskIV = Not Encrypted

| AppleLogo = applelogo@2x~iphone.im4p
| AppleLogoIV = Not Encrypted

| BatteryCharging0 = batterycharging0@2x~iphone.im4p
| BatteryCharging0IV = Not Encrypted

| BatteryCharging1 = batterycharging1@2x~iphone.im4p
| BatteryCharging1IV = Not Encrypted

| BatteryFull = batteryfull@2x~iphone.im4p
| BatteryFullIV = Not Encrypted

| BatteryLow0 = batterylow0@2x~iphone.im4p
| BatteryLow0IV = Not Encrypted

| BatteryLow1 = batterylow1@2x~iphone.im4p
| BatteryLow1IV = Not Encrypted

| DeviceTree = DeviceTree.n102ap.im4p
| DeviceTreeIV = Not Encrypted

| GlyphPlugin = glyphplugin@1136~iphone-lightning.im4p
| GlyphPluginIV = Not Encrypted

| iBEC = iBEC.n102.RELEASE.im4p
| iBECIV = 6a0c61bfc2393ce5c38190f1ce4d469b
| iBECKey = 8e772ce661dff1e64e3251373df3216dc709b419640920fc6168f6d30dcf6043

| iBoot = iBoot.n102.RELEASE.im4p
| iBootIV = 726e2378b0d4908c43e4440eee57c379
| iBootKey = 3e0bce1615fddad8193bb6c660923d8a242cbf68101b67242374a2522862c5be

| iBSS = iBSS.n102.RELEASE.im4p
| iBSSIV = dfe34c4a412124cab4efc6ea6b48ceb7
| iBSSKey = f37a73e66604fcc2eacc542da1c20a4a556feb71250e280f05b50eff32223fd2

| Kernelcache = kernelcache.release.n102
| KernelcacheIV = Not Encrypted

| LLB = LLB.n102.RELEASE.im4p
| LLBIV = 7608d7dfb080acc646c7c859b1eeb5a1
| LLBKey = 774a59b0753d9657999b05e10a4657073938640e9fae8757984a092debcb888a

| RecoveryMode = recoverymode@1136~ipod-lightning.im4p
| RecoveryModeIV = Not Encrypted

| SEPFirmware = sep-firmware.n102.RELEASE.im4p
| SEPFirmwareIV = Unknown
| SEPFirmwareKey = Unknown
| SEPFirmwareKBAG = 1d68cdbe4a336c5a5d9c131b8f00b0880a53b801505c5d9eafda69aec0af9a759341b90058a0b5a8cd33d30f5bcb6688

}}

Fatsa 15F79 (iPod7,1)

2020-05-10T20:49:30Z

Kiddepants: Created page with "{{keys | Version = 11.4 | Build = 15F79 | Device = iPod7,1 | Codename = Fatsa | DownloadURL = http://u..."

{{keys
| Version = 11.4
| Build = 15F79
| Device = iPod7,1
| Codename = Fatsa
| DownloadURL = http://updates-http.cdn-apple.com/2018/ios/091-64445-20180529-3B09B562-5ABE-11E8-AD48-DE57A3E35D9E/iPodtouch_11.4_15F79_Restore.ipsw

| RootFS = 048-10329-091
| RootFSKey = Not Encrypted

| UpdateRamdisk = 048-09632-091
| UpdateRamdiskIV = Not Encrypted

| RestoreRamdisk = 048-10014-091
| RestoreRamdiskIV = Not Encrypted

| AppleLogo = applelogo@2x~iphone.im4p
| AppleLogoIV = Not Encrypted

| BatteryCharging0 = batterycharging0@2x~iphone.im4p
| BatteryCharging0IV = Not Encrypted

| BatteryCharging1 = batterycharging1@2x~iphone.im4p
| BatteryCharging1IV = Not Encrypted

| BatteryFull = batteryfull@2x~iphone.im4p
| BatteryFullIV = Not Encrypted

| BatteryLow0 = batterylow0@2x~iphone.im4p
| BatteryLow0IV = Not Encrypted

| BatteryLow1 = batterylow1@2x~iphone.im4p
| BatteryLow1IV = Not Encrypted

| DeviceTree = DeviceTree.n102ap.im4p
| DeviceTreeIV = Not Encrypted

| GlyphPlugin = glyphplugin@1136~iphone-lightning.im4p
| GlyphPluginIV = Not Encrypted

| iBEC = iBEC.n102.RELEASE.im4p
| iBECIV = 0b3d69e7361a08bd1d4798c9fec6faa5
| iBECKey = dbaf8a1fc8631a416af029fe9284daefa6fdc1a6561b6b1460021bb4b4dcaac5

| iBoot = iBoot.n102.RELEASE.im4p
| iBootIV = a4910475d4e3a63562900f1f577abb3e
| iBootKey = 2fe251b0b44e3320d834c728de57e16057f3e7585acde7d2b7d5f1abb9f5a01e

| iBSS = iBSS.n102.RELEASE.im4p
| iBSSIV = 5a07145f7dbf64b3b06b4d8c287202bd
| iBSSKey = 5d55e3d5bc9b37f6efea61ae48450985a242ca51b71971005ca4764ce16b31c1

| Kernelcache = kernelcache.release.n102
| KernelcacheIV = Not Encrypted

| LLB = LLB.n102.RELEASE.im4p
| LLBIV = 7c5b6129e608b73744e67ad9f6d302f8
| LLBKey = fbbc3bbf1d7bf977ccaafc46fbf3bd1fb4994bb5f48745858611f5b9e3f38b8e

| RecoveryMode = recoverymode@1136~ipod-lightning.im4p
| RecoveryModeIV = Not Encrypted

| SEPFirmware = sep-firmware.n102.RELEASE.im4p
| SEPFirmwareIV = Unknown
| SEPFirmwareKey = Unknown
| SEPFirmwareKBAG = 7da396bd7ea4bd3344cf9c03150144117c69bfca9da65c3bf83f23630244dc51b90741cef458d64631510427f28673f0

}}

Emet 15E302 (iPod7,1)

2020-05-10T20:46:34Z

Kiddepants: Created page with "{{keys | Version = 11.3.1 | Build = 15E302 | Device = iPod7,1 | Codename = Emet | DownloadURL = http:/..."

{{keys
| Version = 11.3.1
| Build = 15E302
| Device = iPod7,1
| Codename = Emet
| DownloadURL = http://updates-http.cdn-apple.com/2018/ios/091-78169-20180419-8890E1BC-4023-11E8-98A6-47A7FBE594B0/iPodtouch_11.3.1_15E302_Restore.ipsw

| RootFS = 058-97413-130
| RootFSKey = Not Encrypted

| UpdateRamdisk = 058-97112-138
| UpdateRamdiskIV = Not Encrypted

| RestoreRamdisk = 058-97541-138
| RestoreRamdiskIV = Not Encrypted

| AppleLogo = applelogo@2x~iphone.im4p
| AppleLogoIV = Not Encrypted

| BatteryCharging0 = batterycharging0@2x~iphone.im4p
| BatteryCharging0IV = Not Encrypted

| BatteryCharging1 = batterycharging1@2x~iphone.im4p
| BatteryCharging1IV = Not Encrypted

| BatteryFull = batteryfull@2x~iphone.im4p
| BatteryFullIV = Not Encrypted

| BatteryLow0 = batterylow0@2x~iphone.im4p
| BatteryLow0IV = Not Encrypted

| BatteryLow1 = batterylow1@2x~iphone.im4p
| BatteryLow1IV = Not Encrypted

| DeviceTree = DeviceTree.n102ap.im4p
| DeviceTreeIV = Not Encrypted

| GlyphPlugin = glyphplugin@1136~iphone-lightning.im4p
| GlyphPluginIV = Not Encrypted

| iBEC = iBEC.n102.RELEASE.im4p
| iBECIV = 01228b6a0ac75f2e34a60b375de01b05
| iBECKey = 5422f2352e3abb257e3fd4f567d2fff629734c0035ebcad35b74e95399758072

| iBoot = iBoot.n102.RELEASE.im4p
| iBootIV = a6e59509392000c7ba6ef5a7be6ddea4
| iBootKey = e04c03bdcd6c40fd9e457a115a8b5409fc545e15ca43f28af5878a6bdd6099e0

| iBSS = iBSS.n102.RELEASE.im4p
| iBSSIV = ff3d74a966f5c272570897b36cfbff49
| iBSSKey = 0250c520eea6cfac35696351286ab785028710aaa7852292c59b36331e803a37

| Kernelcache = kernelcache.release.n102
| KernelcacheIV = Not Encrypted

| LLB = LLB.n102.RELEASE.im4p
| LLBIV = c6992f16dacd0f09cd98ba086a7f1ce2
| LLBKey = 6a67dc9ac8e0e48b2794727b19b11a1dee8eb3608692926757c173723a2702c9

| RecoveryMode = recoverymode@1136~ipod-lightning.im4p
| RecoveryModeIV = Not Encrypted

| SEPFirmware = sep-firmware.n102.RELEASE.im4p
| SEPFirmwareIV = Unknown
| SEPFirmwareKey = Unknown
| SEPFirmwareKBAG = 36ce16142f41836ee98a0c140982c33a1487caccc1e96db17914770ca1c01c9a5a032e489f904067f3ffd4fc812940dd

}}

Emet 15E216 (iPod7,1)

2020-05-10T20:43:16Z

Kiddepants: Created page with "{{keys | Version = 11.3 | Build = 15E216 | Device = iPod7,1 | Codename = Emet | DownloadURL = http://a..."

{{keys
| Version = 11.3
| Build = 15E216
| Device = iPod7,1
| Codename = Emet
| DownloadURL = http://appldnld.apple.com/ios11.0/091-31552-201700919-35A38376-9027-11E7-A2A2-2135B64D2808/iPodtouch_11.0_15A372_Restore.ipsw

| RootFS = 058-97413-127
| RootFSKey = Not Encrypted

| UpdateRamdisk = 058-97112-133
| UpdateRamdiskIV = Not Encrypted

| RestoreRamdisk = 058-97541-133
| RestoreRamdiskIV = Not Encrypted

| AppleLogo = applelogo@2x~iphone.im4p
| AppleLogoIV = Not Encrypted

| BatteryCharging0 = batterycharging0@2x~iphone.im4p
| BatteryCharging0IV = Not Encrypted

| BatteryCharging1 = batterycharging1@2x~iphone.im4p
| BatteryCharging1IV = Not Encrypted

| BatteryFull = batteryfull@2x~iphone.im4p
| BatteryFullIV = Not Encrypted

| BatteryLow0 = batterylow0@2x~iphone.im4p
| BatteryLow0IV = Not Encrypted

| BatteryLow1 = batterylow1@2x~iphone.im4p
| BatteryLow1IV = Not Encrypted

| DeviceTree = DeviceTree.n102ap.im4p
| DeviceTreeIV = Not Encrypted

| GlyphPlugin = glyphplugin@1136~iphone-lightning.im4p
| GlyphPluginIV = Not Encrypted

| iBEC = iBEC.n102.RELEASE.im4p
| iBECIV = 01228b6a0ac75f2e34a60b375de01b05
| iBECKey = 5422f2352e3abb257e3fd4f567d2fff629734c0035ebcad35b74e95399758072

| iBoot = iBoot.n102.RELEASE.im4p
| iBootIV = a6e59509392000c7ba6ef5a7be6ddea4
| iBootKey = e04c03bdcd6c40fd9e457a115a8b5409fc545e15ca43f28af5878a6bdd6099e0

| iBSS = iBSS.n102.RELEASE.im4p
| iBSSIV = ff3d74a966f5c272570897b36cfbff49
| iBSSKey = 0250c520eea6cfac35696351286ab785028710aaa7852292c59b36331e803a37

| Kernelcache = kernelcache.release.n102
| KernelcacheIV = Not Encrypted

| LLB = LLB.n102.RELEASE.im4p
| LLBIV = c6992f16dacd0f09cd98ba086a7f1ce2
| LLBKey = 6a67dc9ac8e0e48b2794727b19b11a1dee8eb3608692926757c173723a2702c9

| RecoveryMode = recoverymode@1136~ipod-lightning.im4p
| RecoveryModeIV = Not Encrypted

| SEPFirmware = sep-firmware.n102.RELEASE.im4p
| SEPFirmwareIV = Unknown
| SEPFirmwareKey = Unknown
| SEPFirmwareKBAG = 36ce16142f41836ee98a0c140982c33a1487caccc1e96db17914770ca1c01c9a5a032e489f904067f3ffd4fc812940dd

}}

Fatsa 15F79 (iPhone7,1)

2020-04-28T04:55:47Z

Kiddepants: Created page with "{{keys | Version = 11.4 | Build = 15F79 | Device = iPhone7,1 | Codename = Fatsa | Baseband = 6.60.0..."

{{keys
| Version = 11.4
| Build = 15F79
| Device = iPhone7,1
| Codename = Fatsa
| Baseband = 6.60.00
| DownloadURL = http://updates-http.cdn-apple.com/2018/ios/091-64768-20180529-3AFEF848-5ABE-11E8-B2A3-EB57A3E35D9E/iPhone_5.5_11.4_15F79_Restore.ipsw

| RootFS = 048-10054-090
| RootFSKey = Not Encrypted

| UpdateRamdisk = 048-09632-091
| UpdateRamdiskIV = Not Encrypted

| RestoreRamdisk = 048-10014-091
| RestoreRamdiskIV = Not Encrypted

| AppleLogo = applelogo@3x~iphone.im4p
| AppleLogoIV = Not Encrypted

| BatteryCharging0 = batterycharging0@3x~iphone.im4p
| BatteryCharging0IV = Not Encrypted

| BatteryCharging1 = batterycharging1@3x~iphone.im4p
| BatteryCharging1IV = Not Encrypted

| BatteryFull = batteryfull@3x~iphone.im4p
| BatteryFullIV = Not Encrypted

| BatteryLow0 = batterylow0@3x~iphone.im4p
| BatteryLow0IV = Not Encrypted

| BatteryLow1 = batterylow1@3x~iphone.im4p
| BatteryLow1IV = Not Encrypted

| DeviceTree = DeviceTree.n56ap.im4p
| DeviceTreeIV = Not Encrypted

| GlyphPlugin = glyphplugin@1920~iphone-lightning.im4p
| GlyphPluginIV = Not Encrypted

| iBEC = iBEC.n56.RELEASE.im4p
| iBECIV = 1fc080d7f886a463ab8a0aa66cc4826f
| iBECKey = 14f62e7af18c724f08b6beed813f320929e3b7cd901ca9984a6cfa09bb970b29

| iBoot = iBoot.n56.RELEASE.im4p
| iBootIV = 44c7fba74a2766bc3d5136456aae77bc
| iBootKey = d5eacf33b2b10e02262148f1b679749359ac0b8a6977b4f1fe145f000ffede88

| iBSS = iBSS.n56.RELEASE.im4p
| iBSSIV = 7b4746a415ce7b644b9a2488ba57835b
| iBSSKey = 727fb85d255f72a1a925de4414fdb2bebc1f55180b1ae22430c7747d74fded64

| Kernelcache = kernelcache.release.iphone7
| KernelcacheIV = Not Encrypted

| LLB = LLB.n56.RELEASE.im4p
| LLBIV = edd4a2aa7b370e021a7e55f43c433e09
| LLBKey = 843467ac4235ee878c412f590e30be14e09104d1184e81e8ae4ad7cdc158007f

| RecoveryMode = recoverymode@1920~iphone-lightning.im4p
| RecoveryModeIV = Not Encrypted

| SEPFirmware = sep-firmware.n56.RELEASE.im4p
| SEPFirmwareIV = Unknown
| SEPFirmwareKey = Unknown
| SEPFirmwareKBAG = a7e8fed47ac4dec7b673a5fd45d77abeb5180509d28a5aa0bd9c304a92ec76a90e91528fd48df2557ad0484590043d31

}}

Emet 15E302 (iPhone7,1)

2020-04-28T04:51:32Z

Kiddepants: Created page with "{{keys | Version = 11.3.1 | Build = 15E302 | Device = iPhone7,1 | Codename = Emet | Baseband = 6.55..."

{{keys
| Version = 11.3.1
| Build = 15E302
| Device = iPhone7,1
| Codename = Emet
| Baseband = 6.55.0
| DownloadURL = http://updates-http.cdn-apple.com/2018/ios/091-78191-20180419-88A0660A-4023-11E8-916D-4CA7FBE594B0/iPhone_5.5_11.3.1_15E302_Restore.ipsw

| RootFS = 058-96998-129
| RootFSKey = Not Encrypted

| UpdateRamdisk = 058-97112-138
| UpdateRamdiskIV = Not Encrypted

| RestoreRamdisk = 058-97541-138
| RestoreRamdiskIV = Not Encrypted

| AppleLogo = applelogo@3x~iphone.im4p
| AppleLogoIV = Not Encrypted

| BatteryCharging0 = batterycharging0@3x~iphone.im4p
| BatteryCharging0IV = Not Encrypted

| BatteryCharging1 = batterycharging1@3x~iphone.im4p
| BatteryCharging1IV = Not Encrypted

| BatteryFull = batteryfull@3x~iphone.im4p
| BatteryFullIV = Not Encrypted

| BatteryLow0 = batterylow0@3x~iphone.im4p
| BatteryLow0IV = Not Encrypted

| BatteryLow1 = batterylow1@3x~iphone.im4p
| BatteryLow1IV = Not Encrypted

| DeviceTree = DeviceTree.n56ap.im4p
| DeviceTreeIV = Not Encrypted

| GlyphPlugin = glyphplugin@1920~iphone-lightning.im4p
| GlyphPluginIV = Not Encrypted

| iBEC = iBEC.n56.RELEASE.im4p
| iBECIV = 25560fc21ea534e854a7aaa1da789e11
| iBECKey = 47cfc5f550d8fdecf7a466221901d7451ffc61bc4a487ba292b7fccf049fc9aa

| iBoot = iBoot.n56.RELEASE.im4p
| iBootIV = c53c116f45cc01008ed4a0f1f79725ce
| iBootKey = d2ed28845ff3a65804556611291d3294d0152446abced0492b74776353e376d1

| iBSS = iBSS.n56.RELEASE.im4p
| iBSSIV = d8a28f5b92904d5e782e178dac17f44f
| iBSSKey = a808d9a7104b7d030d2aecdd8519fd5b8a76b0bbde1c44291356759cf1132846

| Kernelcache = kernelcache.release.iphone7
| KernelcacheIV = Not Encrypted

| LLB = LLB.n56.RELEASE.im4p
| LLBIV = d56bd5614a3cbd1b33c954095912bc73
| LLBKey = da190198637d237d4c57253f024d0c95eb638eac44bb74ffcbc868d3605422a7

| RecoveryMode = recoverymode@1920~iphone-lightning.im4p
| RecoveryModeIV = Not Encrypted

| SEPFirmware = sep-firmware.n56.RELEASE.im4p
| SEPFirmwareIV = Unknown
| SEPFirmwareKey = Unknown
| SEPFirmwareKBAG = 32d8fdbac93b808fe0544f1ca757112493ac6616d97cc529024adf06ef1b81c9c5c4422fcd0381169f1e0c6164cae73d

}}

Emet 15E216 (iPhone7,1)

2020-04-28T04:47:28Z

Kiddepants: Created page with "{{keys | Version = 11.3 | Build = 15E216 | Device = iPhone7,1 | Codename = Emet | Baseband = 6.55.0..."

{{keys
| Version = 11.3
| Build = 15E216
| Device = iPhone7,1
| Codename = Emet
| Baseband = 6.55.00
| DownloadURL = http://appldnld.apple.com/ios11.3/091-40131-20180329-378E547E-2968-11E8-83E9-E8BDE6893228/iPhone_5.5_11.3_15E216_Restore.ipsw

| RootFS = 058-96998-126
| RootFSKey = Not Encrypted

| UpdateRamdisk = 058-97112-133
| UpdateRamdiskIV = Not Encrypted

| RestoreRamdisk = 058-97541-133
| RestoreRamdiskIV = Not Encrypted

| AppleLogo = applelogo@3x~iphone.im4p
| AppleLogoIV = Not Encrypted

| BatteryCharging0 = batterycharging0@3x~iphone.im4p
| BatteryCharging0IV = Not Encrypted

| BatteryCharging1 = batterycharging1@3x~iphone.im4p
| BatteryCharging1IV = Not Encrypted

| BatteryFull = batteryfull@3x~iphone.im4p
| BatteryFullIV = Not Encrypted

| BatteryLow0 = batterylow0@3x~iphone.im4p
| BatteryLow0IV = Not Encrypted

| BatteryLow1 = batterylow1@3x~iphone.im4p
| BatteryLow1IV = Not Encrypted

| DeviceTree = DeviceTree.n56ap.im4p
| DeviceTreeIV = Not Encrypted

| GlyphPlugin = glyphplugin@1920~iphone-lightning.im4p
| GlyphPluginIV = Not Encrypted

| iBEC = iBEC.n56.RELEASE.im4p
| iBECIV = 25560fc21ea534e854a7aaa1da789e11
| iBECKey = 47cfc5f550d8fdecf7a466221901d7451ffc61bc4a487ba292b7fccf049fc9aa

| iBoot = iBoot.n56.RELEASE.im4p
| iBootIV = c53c116f45cc01008ed4a0f1f79725ce
| iBootKey = d2ed28845ff3a65804556611291d3294d0152446abced0492b74776353e376d1

| iBSS = iBSS.n56.RELEASE.im4p
| iBSSIV = d8a28f5b92904d5e782e178dac17f44f
| iBSSKey = a808d9a7104b7d030d2aecdd8519fd5b8a76b0bbde1c44291356759cf1132846

| Kernelcache = kernelcache.release.iphone7
| KernelcacheIV = Not Encrypted

| LLB = LLB.n56.RELEASE.im4p
| LLBIV = d56bd5614a3cbd1b33c954095912bc73
| LLBKey = da190198637d237d4c57253f024d0c95eb638eac44bb74ffcbc868d3605422a7

| RecoveryMode = recoverymode@1920~iphone-lightning.im4p
| RecoveryModeIV = Not Encrypted

| SEPFirmware = sep-firmware.n56.RELEASE.im4p
| SEPFirmwareIV = Unknown
| SEPFirmwareKey = Unknown
| SEPFirmwareKBAG = 32d8fdbac93b808fe0544f1ca757112493ac6616d97cc529024adf06ef1b81c9c5c4422fcd0381169f1e0c6164cae73d

}}

Dalaman 15D100 (iPhone7,1)

2020-04-28T04:41:25Z

Kiddepants: Created page with "{{keys | Version = 11.2.6 | Build = 15D100 | Device = iPhone7,1 | Codename = Dalaman | Baseband = 6..."

{{keys
| Version = 11.2.6
| Build = 15D100
| Device = iPhone7,1
| Codename = Dalaman
| Baseband = 6.30.04
| DownloadURL = http://appldnld.apple.com/ios11.2.6/091-70002-20180220-063D5516-1331-11E8-819A-2AA2E0A71A1F/iPhone_5.5_11.2.6_15D100_Restore.ipsw

| RootFS = 058-95345-065
| RootFSKey = Not Encrypted

| UpdateRamdisk = 058-95281-066
| UpdateRamdiskIV = Not Encrypted

| RestoreRamdisk = 058-94922-067
| RestoreRamdiskIV = Not Encrypted

| AppleLogo = applelogo@3x~iphone.im4p
| AppleLogoIV = Not Encrypted

| BatteryCharging0 = batterycharging0@3x~iphone.im4p
| BatteryCharging0IV = Not Encrypted

| BatteryCharging1 = batterycharging1@3x~iphone.im4p
| BatteryCharging1IV = Not Encrypted

| BatteryFull = batteryfull@3x~iphone.im4p
| BatteryFullIV = Not Encrypted

| BatteryLow0 = batterylow0@3x~iphone.im4p
| BatteryLow0IV = Not Encrypted

| BatteryLow1 = batterylow1@3x~iphone.im4p
| BatteryLow1IV = Not Encrypted

| DeviceTree = DeviceTree.n56ap.im4p
| DeviceTreeIV = Not Encrypted

| GlyphPlugin = glyphplugin@1920~iphone-lightning.im4p
| GlyphPluginIV = Not Encrypted

| iBEC = iBEC.n56.RELEASE.im4p
| iBECIV = b5f5077b31745e15d6815b30296bfb56
| iBECKey = 5a39d540b0ddb0515996335d1bbe280b2c05b8f2dc752bca4fbad91baf2a1fd9

| iBoot = iBoot.n56.RELEASE.im4p
| iBootIV = 41976d4df0a8ff5150efa6a3b2959737
| iBootKey = f0186a993f08b660b48e0df36ab8a7e7cfd71fb54491d1d594d440c51a6b19c7

| iBSS = iBSS.n56.RELEASE.im4p
| iBSSIV = d185fae6448fd31c81f67a301a82ec4f
| iBSSKey = 42857bf785f560daf551443a5ba2d814f2ee3ac6ca1fd1bd3191753a459843df

| Kernelcache = kernelcache.release.iphone7
| KernelcacheIV = Not Encrypted

| LLB = LLB.n56.RELEASE.im4p
| LLBIV = 5adc139a560cbe9b9c910a13a7f0ca49
| LLBKey = d288466d6a1234f6ebfd3b6b4a6802c52f64937e1ebc9a19b597ee1f480e0a59

| RecoveryMode = recoverymode@1920~iphone-lightning.im4p
| RecoveryModeIV = Not Encrypted

| SEPFirmware = sep-firmware.n56.RELEASE.im4p
| SEPFirmwareIV = Unknown
| SEPFirmwareKey = Unknown
| SEPFirmwareKBAG = 6446dc3b160b6e7776443ed43e5f467d3d1ca4590250ce1a79177cd8377be9cb65bf396316658e69aa2177ad2985f056

}}

Dalaman 15D60 (iPhone7,1)

2020-04-28T04:37:39Z

Kiddepants: Created page with "{{keys | Version = 11.2.5 | Build = 15D60 | Device = iPhone7,1 | Codename = Dalaman | Baseband = 6...."

{{keys
| Version = 11.2.5
| Build = 15D60
| Device = iPhone7,1
| Codename = Dalaman
| Baseband = 6.30.04
| DownloadURL = http://appldnld.apple.com/ios11.2.5/091-62029-20180122-2A17BA5A-FC96-11E7-9358-AFE2EE2F24C7/iPhone_5.5_11.2.5_15D60_Restore.ipsw

| RootFS = 058-95345-064
| RootFSKey = Not Encrypted

| UpdateRamdisk = 058-95281-064
| UpdateRamdiskIV = Not Encrypted

| RestoreRamdisk = 058-94922-065
| RestoreRamdiskIV = Not Encrypted

| AppleLogo = applelogo@3x~iphone.im4p
| AppleLogoIV = Not Encrypted

| BatteryCharging0 = batterycharging0@3x~iphone.im4p
| BatteryCharging0IV = Not Encrypted

| BatteryCharging1 = batterycharging1@3x~iphone.im4p
| BatteryCharging1IV = Not Encrypted

| BatteryFull = batteryfull@3x~iphone.im4p
| BatteryFullIV = Not Encrypted

| BatteryLow0 = batterylow0@3x~iphone.im4p
| BatteryLow0IV = Not Encrypted

| BatteryLow1 = batterylow1@3x~iphone.im4p
| BatteryLow1IV = Not Encrypted

| DeviceTree = DeviceTree.n56ap.im4p
| DeviceTreeIV = Not Encrypted

| GlyphPlugin = glyphplugin@1920~iphone-lightning.im4p
| GlyphPluginIV = Not Encrypted

| iBEC = iBEC.n56.RELEASE.im4p
| iBECIV = b5f5077b31745e15d6815b30296bfb56
| iBECKey = 5a39d540b0ddb0515996335d1bbe280b2c05b8f2dc752bca4fbad91baf2a1fd9

| iBoot = iBoot.n56.RELEASE.im4p
| iBootIV = 41976d4df0a8ff5150efa6a3b2959737
| iBootKey = f0186a993f08b660b48e0df36ab8a7e7cfd71fb54491d1d594d440c51a6b19c7

| iBSS = iBSS.n56.RELEASE.im4p
| iBSSIV = d185fae6448fd31c81f67a301a82ec4f
| iBSSKey = 42857bf785f560daf551443a5ba2d814f2ee3ac6ca1fd1bd3191753a459843df

| Kernelcache = kernelcache.release.iphone7
| KernelcacheIV = Not Encrypted

| LLB = LLB.n56.RELEASE.im4p
| LLBIV = 5adc139a560cbe9b9c910a13a7f0ca49
| LLBKey = d288466d6a1234f6ebfd3b6b4a6802c52f64937e1ebc9a19b597ee1f480e0a59

| RecoveryMode = recoverymode@1920~iphone-lightning.im4p
| RecoveryModeIV = Not Encrypted

| SEPFirmware = sep-firmware.n56.RELEASE.im4p
| SEPFirmwareIV = Unknown
| SEPFirmwareKey = Unknown
| SEPFirmwareKBAG = 6446dc3b160b6e7776443ed43e5f467d3d1ca4590250ce1a79177cd8377be9cb65bf396316658e69aa2177ad2985f056

}}

Cinar 15C202 (iPhone7,1)

2020-04-28T04:32:46Z

Kiddepants: Created page with "{{keys | Version = 11.2.2 | Build = 15C202 | Device = iPhone7,1 | Codename = Cinar | Baseband = 6.3..."

{{keys
| Version = 11.2.2
| Build = 15C202
| Device = iPhone7,1
| Codename = Cinar
| Baseband = 6.30.04
| DownloadURL = http://appldnld.apple.com/ios11.2.2/091-58756-20170108-B849BB7C-F0C8-11E7-97FB-7D2D869EB6BD/iPhone_5.5_11.2.2_15C202_Restore.ipsw

| RootFS = 058-86124-133
| RootFSKey = Not Encrypted

| UpdateRamdisk = 058-85997-132
| UpdateRamdiskIV = Not Encrypted

| RestoreRamdisk = 058-85846-133
| RestoreRamdiskIV = Not Encrypted

| AppleLogo = applelogo@3x~iphone.im4p
| AppleLogoIV = Not Encrypted

| BatteryCharging0 = batterycharging0@3x~iphone.im4p
| BatteryCharging0IV = Not Encrypted

| BatteryCharging1 = batterycharging1@3x~iphone.im4p
| BatteryCharging1IV = Not Encrypted

| BatteryFull = batteryfull@3x~iphone.im4p
| BatteryFullIV = Not Encrypted

| BatteryLow0 = batterylow0@3x~iphone.im4p
| BatteryLow0IV = Not Encrypted

| BatteryLow1 = batterylow1@3x~iphone.im4p
| BatteryLow1IV = Not Encrypted

| DeviceTree = DeviceTree.n56ap.im4p
| DeviceTreeIV = Not Encrypted

| GlyphPlugin = glyphplugin@1920~iphone-lightning.im4p
| GlyphPluginIV = Not Encrypted

| iBEC = iBEC.n56.RELEASE.im4p
| iBECIV = 97e451e6fd21e7064b2d10fccc4dcaa0
| iBECKey = b91efc18b21c73dbecfd9792b771d24dc0ad7d638bdd4f81ced078bbf37bf0fe

| iBoot = iBoot.n56.RELEASE.im4p
| iBootIV = 76162642aadd43fc41a22f203662dfcf
| iBootKey = 9f35b25643ad52fbcba6858fa9fc8e48ce0605a70d6333aae4f0e2c199e55a93

| iBSS = iBSS.n56.RELEASE.im4p
| iBSSIV = edd43e9aaa825773361f3d13557b18c9
| iBSSKey = 02a9155d2f9e91143e029f548e3ecf26c4de952b673763372b106ed5add535f2

| Kernelcache = kernelcache.release.iphone7
| KernelcacheIV = Not Encrypted

| LLB = LLB.n56.RELEASE.im4p
| LLBIV = dd7c480d60f0ce56933bc8aff0415748
| LLBKey = a6872d0a313d7f12b3e966093fbc71efc31c58766b98a70223693a8b9ef8cdc8

| RecoveryMode = recoverymode@1920~iphone-lightning.im4p
| RecoveryModeIV = Not Encrypted

| SEPFirmware = sep-firmware.n56.RELEASE.im4p
| SEPFirmwareIV = Unknown
| SEPFirmwareKey = Unknown
| SEPFirmwareKBAG = 304abca6b31b43dd5c9774fc8578914613ffdb893bbbb0aa8b17ffabf354b704e40f6b607d9ea5ddb698d35d12f6eab8

}}

Cinar 15C153 (iPhone7,1)

2020-04-28T04:26:47Z

Kiddepants: Created page with "{{keys | Version = 11.2.1 | Build = 15C153 | Device = iPhone7,1 | Codename = Cinar | Baseband = 6.3..."

{{keys
| Version = 11.2.1
| Build = 15C153
| Device = iPhone7,1
| Codename = Cinar
| Baseband = 6.30.04
| DownloadURL = http://appldnld.apple.com/ios11.2.1/091-55083-20171213-5FBF8D72-DDFB-11E7-BC1A-13E4FB2783B2/iPhone_5.5_11.2.1_15C153_Restore.ipsw

| RootFS = 058-86124-130
| RootFSKey = Not Encrypted

| UpdateRamdisk = 058-85997-129
| UpdateRamdiskIV = Not Encrypted

| RestoreRamdisk = 058-85846-130
| RestoreRamdiskIV = Not Encrypted

| AppleLogo = applelogo@3x~iphone.im4p
| AppleLogoIV = Not Encrypted

| BatteryCharging0 = batterycharging0@3x~iphone.im4p
| BatteryCharging0IV = Not Encrypted

| BatteryCharging1 = batterycharging1@3x~iphone.im4p
| BatteryCharging1IV = Not Encrypted

| BatteryFull = batteryfull@3x~iphone.im4p
| BatteryFullIV = Not Encrypted

| BatteryLow0 = batterylow0@3x~iphone.im4p
| BatteryLow0IV = Not Encrypted

| BatteryLow1 = batterylow1@3x~iphone.im4p
| BatteryLow1IV = Not Encrypted

| DeviceTree = DeviceTree.n56ap.im4p
| DeviceTreeIV = Not Encrypted

| GlyphPlugin = glyphplugin@1920~iphone-lightning.im4p
| GlyphPluginIV = Not Encrypted

| iBEC = iBEC.n56.RELEASE.im4p
| iBECIV = 97e451e6fd21e7064b2d10fccc4dcaa0
| iBECKey = b91efc18b21c73dbecfd9792b771d24dc0ad7d638bdd4f81ced078bbf37bf0fe

| iBoot = iBoot.n56.RELEASE.im4p
| iBootIV = 76162642aadd43fc41a22f203662dfcf
| iBootKey = 9f35b25643ad52fbcba6858fa9fc8e48ce0605a70d6333aae4f0e2c199e55a93

| iBSS = iBSS.n56.RELEASE.im4p
| iBSSIV = edd43e9aaa825773361f3d13557b18c9
| iBSSKey = 02a9155d2f9e91143e029f548e3ecf26c4de952b673763372b106ed5add535f2

| Kernelcache = kernelcache.release.iphone7
| KernelcacheIV = Not Encrypted

| LLB = LLB.n56.RELEASE.im4p
| LLBIV = dd7c480d60f0ce56933bc8aff0415748
| LLBKey = a6872d0a313d7f12b3e966093fbc71efc31c58766b98a70223693a8b9ef8cdc8

| RecoveryMode = recoverymode@1920~iphone-lightning.im4p
| RecoveryModeIV = Not Encrypted

| SEPFirmware = sep-firmware.n56.RELEASE.im4p
| SEPFirmwareIV = Unknown
| SEPFirmwareKey = Unknown
| SEPFirmwareKBAG = 304abca6b31b43dd5c9774fc8578914613ffdb893bbbb0aa8b17ffabf354b704e40f6b607d9ea5ddb698d35d12f6eab8

}}

Cinar 15C114 (iPhone7,1)

2020-04-28T04:19:38Z

Kiddepants: Created page with "{{keys | Version = 11.2 | Build = 15C114 | Device = iPhone7,1 | Codename = Cinar | Baseband = 6.30...."

{{keys
| Version = 11.2
| Build = 15C114
| Device = iPhone7,1
| Codename = Cinar
| Baseband = 6.30.04
| DownloadURL = http://appldnld.apple.com/ios11.2/091-51337-20171206-BA0B91A6-D5F7-11E7-99AE-23B9DC24E03F/iPhone_5.5_11.2_15C114_Restore.ipsw

| RootFS = 058-86124-125
| RootFSKey = Not Encrypted

| UpdateRamdisk = 058-85997-124
| UpdateRamdiskIV = Not Encrypted

| RestoreRamdisk = 058-85846-125
| RestoreRamdiskIV = Not Encrypted

| AppleLogo = applelogo@3x~iphone.im4p
| AppleLogoIV = Not Encrypted

| BatteryCharging0 = batterycharging0@3x~iphone.im4p
| BatteryCharging0IV = Not Encrypted

| BatteryCharging1 = batterycharging1@3x~iphone.im4p
| BatteryCharging1IV = Not Encrypted

| BatteryFull = batteryfull@3x~iphone.im4p
| BatteryFullIV = Not Encrypted

| BatteryLow0 = batterylow0@3x~iphone.im4p
| BatteryLow0IV = Not Encrypted

| BatteryLow1 = batterylow1@3x~iphone.im4p
| BatteryLow1IV = Not Encrypted

| DeviceTree = DeviceTree.n56ap.im4p
| DeviceTreeIV = Not Encrypted

| GlyphPlugin = glyphplugin@1920~iphone-lightning.im4p
| GlyphPluginIV = Not Encrypted

| iBEC = iBEC.n56.RELEASE.im4p
| iBECIV = 724999e2b99205a2db4186c3fcfbdff8
| iBECKey = 8a0993ba6cfc353c28b9d976f93f7767c41e869e65e95fe1672810bbe32fc04f

| iBoot = iBoot.n56.RELEASE.im4p
| iBootIV = 8ec7d0543ab42405e55361b711a5ae64
| iBootKey = 1e5d0a244d557073fba3f87785b10952915a0d34c417a08ce6b5ca22e50cbf26

| iBSS = iBSS.n56.RELEASE.im4p
| iBSSIV = f533d0e1a493227ac2c51e0a06991045
| iBSSKey = c5178b0e8746b4845e3bf3205e8776f12ccd28725bb3d93b5c878f3f4106cde7

| Kernelcache = kernelcache.release.iphone7
| KernelcacheIV = Not Encrypted

| LLB = LLB.n56.RELEASE.im4p
| LLBIV = 60f2790e7af070c32ae914a5fb1273a2
| LLBKey = 468ae6f9bfeb7013506c3c799dd0e9ae932262060fe037092c5ddcd1d6dd053f

| RecoveryMode = recoverymode@1920~iphone-lightning.im4p
| RecoveryModeIV = Not Encrypted

| SEPFirmware = sep-firmware.n56.RELEASE.im4p
| SEPFirmwareIV = Unknown
| SEPFirmwareKey = Unknown
| SEPFirmwareKBAG = aff84943e587a21d923ccbf2b1416f0cca166ddb84a1c4c0744e7d9f8737dae12d3f33053fb83beb0fe708b7429fee89

}}

Bursa 15B202 (iPhone7,1)

2020-04-28T04:14:58Z

Kiddepants: Created page with "{{keys | Version = 11.1.2 | Build = 15B202 | Device = iPhone7,1 | Codename = Bursa | Baseband = 6.1..."

{{keys
| Version = 11.1.2
| Build = 15B202
| Device = iPhone7,1
| Codename = Bursa
| Baseband = 6.17.00
| DownloadURL = http://appldnld.apple.com/ios11.1.2/091-46846-20171116-4F98A0B6-C9C7-11E7-9B97-8BE0F451CBCD/iPhone_5.5_11.1.2_15B202_Restore.ipsw

| RootFS = 058-84846-099
| RootFSKey = Not Encrypted

| UpdateRamdisk = 058-85048-102
| UpdateRamdiskIV = Not Encrypted

| RestoreRamdisk = 058-84556-102
| RestoreRamdiskIV = Not Encrypted

| AppleLogo = applelogo@3x~iphone.im4p
| AppleLogoIV = Not Encrypted

| BatteryCharging0 = batterycharging0@3x~iphone.im4p
| BatteryCharging0IV = Not Encrypted

| BatteryCharging1 = batterycharging1@3x~iphone.im4p
| BatteryCharging1IV = Not Encrypted

| BatteryFull = batteryfull@3x~iphone.im4p
| BatteryFullIV = Not Encrypted

| BatteryLow0 = batterylow0@3x~iphone.im4p
| BatteryLow0IV = Not Encrypted

| BatteryLow1 = batterylow1@3x~iphone.im4p
| BatteryLow1IV = Not Encrypted

| DeviceTree = DeviceTree.n56ap.im4p
| DeviceTreeIV = Not Encrypted

| GlyphPlugin = glyphplugin@1920~iphone-lightning.im4p
| GlyphPluginIV = Not Encrypted

| iBEC = iBEC.n56.RELEASE.im4p
| iBECIV = b9e3c50f20eaedc9eef29fd026f4f89a
| iBECKey = 55f90750a0ff3865676a97bf2117f08a5b6ba2770d2c6e18c938353c1e46dd25

| iBoot = iBoot.n56.RELEASE.im4p
| iBootIV = b278bd8d003f6b0a8cd55c3efa801801
| iBootKey = afe20969724e1175c659cc61738d431532fd6cc2ecd4bbdce8b4bfe92da54acf

| iBSS = iBSS.n56.RELEASE.im4p
| iBSSIV = 70c13c102ac1543585a748e59cbe4294
| iBSSKey = 7d84c789a2fdd0d185e0edbcf631c7bd8e60cc5eac453c83e6ea2ead3f4d175e

| Kernelcache = kernelcache.release.iphone7
| KernelcacheIV = Not Encrypted

| LLB = LLB.n56.RELEASE.im4p
| LLBIV = ea0f078d4c00c73e78c6d6f0fa488834
| LLBKey = f4a47af6eb798017fea063edbfc258d3bdd854ea123c935c7a4d8001998439cc

| RecoveryMode = recoverymode@1920~iphone-lightning.im4p
| RecoveryModeIV = Not Encrypted

| SEPFirmware = sep-firmware.n56.RELEASE.im4p
| SEPFirmwareIV = Unknown
| SEPFirmwareKey = Unknown
| SEPFirmwareKBAG = 2ccc3408fe8488e8b9ffa39b45dd2ec8a6a0348dd4cc3606ec2ad46b3021e70d40eb6530dbddc6a52da66c39149867e6

}}

Bursa 15B150 (iPhone7,1)

2020-04-28T04:10:36Z

Kiddepants: Created page with "{{keys | Version = 11.1.1 | Build = 15B150 | Device = iPhone7,1 | Codename = Bursa | Baseband = 6.1..."

{{keys
| Version = 11.1.1
| Build = 15B150
| Device = iPhone7,1
| Codename = Bursa
| Baseband = 6.17.00
| DownloadURL = http://appldnld.apple.com/ios11.1.1/091-42060-20171106-4525F990-C39A-11E7-B0E4-37BCF8FD2868/iPhone_5.5_11.1.1_15B150_Restore.ipsw

| RootFS = 058-84846-098
| RootFSKey = Not Encrypted

| UpdateRamdisk = 058-85048-099
| UpdateRamdiskIV = Not Encrypted

| RestoreRamdisk = 058-84556-099
| RestoreRamdiskIV = Not Encrypted

| AppleLogo = applelogo@3x~iphone.im4p
| AppleLogoIV = Not Encrypted

| BatteryCharging0 = batterycharging0@3x~iphone.im4p
| BatteryCharging0IV = Not Encrypted

| BatteryCharging1 = batterycharging1@3x~iphone.im4p
| BatteryCharging1IV = Not Encrypted

| BatteryFull = batteryfull@3x~iphone.im4p
| BatteryFullIV = Not Encrypted

| BatteryLow0 = batterylow0@3x~iphone.im4p
| BatteryLow0IV = Not Encrypted

| BatteryLow1 = batterylow1@3x~iphone.im4p
| BatteryLow1IV = Not Encrypted

| DeviceTree = DeviceTree.n56ap.im4p
| DeviceTreeIV = Not Encrypted

| GlyphPlugin = glyphplugin@1920~iphone-lightning.im4p
| GlyphPluginIV = Not Encrypted

| iBEC = iBEC.n56.RELEASE.im4p
| iBECIV = b9e3c50f20eaedc9eef29fd026f4f89a
| iBECKey = 55f90750a0ff3865676a97bf2117f08a5b6ba2770d2c6e18c938353c1e46dd25

| iBoot = iBoot.n56.RELEASE.im4p
| iBootIV = b278bd8d003f6b0a8cd55c3efa801801
| iBootKey = afe20969724e1175c659cc61738d431532fd6cc2ecd4bbdce8b4bfe92da54acf

| iBSS = iBSS.n56.RELEASE.im4p
| iBSSIV = 70c13c102ac1543585a748e59cbe4294
| iBSSKey = 7d84c789a2fdd0d185e0edbcf631c7bd8e60cc5eac453c83e6ea2ead3f4d175e

| Kernelcache = kernelcache.release.iphone7
| KernelcacheIV = Not Encrypted

| LLB = LLB.n56.RELEASE.im4p
| LLBIV = ea0f078d4c00c73e78c6d6f0fa488834
| LLBKey = f4a47af6eb798017fea063edbfc258d3bdd854ea123c935c7a4d8001998439cc

| RecoveryMode = recoverymode@1920~iphone-lightning.im4p
| RecoveryModeIV = Not Encrypted

| SEPFirmware = sep-firmware.n56.RELEASE.im4p
| SEPFirmwareIV = Unknown
| SEPFirmwareKey = Unknown
| SEPFirmwareKBAG = 2ccc3408fe8488e8b9ffa39b45dd2ec8a6a0348dd4cc3606ec2ad46b3021e70d40eb6530dbddc6a52da66c39149867e6

}}

Bursa 15B93 (iPhone7,1)

2020-04-28T04:05:27Z

Kiddepants: Created page with "{{keys | Version = 11.1 | Build = 15B93 | Device = iPhone7,1 | Codename = Bursa | Baseband = 6.17.0..."

{{keys
| Version = 11.1
| Build = 15B93
| Device = iPhone7,1
| Codename = Bursa
| Baseband = 6.17.00
| DownloadURL = http://appldnld.apple.com/ios11.1seed/091-41085-20171023-3D951A64-B5DD-11E7-9BBE-84555BD5B8E1/iPhone_5.5_11.1_15B93_Restore.ipsw

| RootFS = 058-84846-096
| RootFSKey = Not Encrypted

| UpdateRamdisk = 058-85048-096
| UpdateRamdiskIV = Not Encrypted

| RestoreRamdisk = 058-84556-096
| RestoreRamdiskIV = Not Encrypted

| AppleLogo = applelogo@3x~iphone.im4p
| AppleLogoIV = Not Encrypted

| BatteryCharging0 = batterycharging0@3x~iphone.im4p
| BatteryCharging0IV = Not Encrypted

| BatteryCharging1 = batterycharging1@3x~iphone.im4p
| BatteryCharging1IV = Not Encrypted

| BatteryFull = batteryfull@3x~iphone.im4p
| BatteryFullIV = Not Encrypted

| BatteryLow0 = batterylow0@3x~iphone.im4p
| BatteryLow0IV = Not Encrypted

| BatteryLow1 = batterylow1@3x~iphone.im4p
| BatteryLow1IV = Not Encrypted

| DeviceTree = DeviceTree.n56ap.im4p
| DeviceTreeIV = Not Encrypted

| GlyphPlugin = glyphplugin@1920~iphone-lightning.im4p
| GlyphPluginIV = Not Encrypted

| iBEC = iBEC.n56.RELEASE.im4p
| iBECIV = b9e3c50f20eaedc9eef29fd026f4f89a
| iBECKey = 55f90750a0ff3865676a97bf2117f08a5b6ba2770d2c6e18c938353c1e46dd25

| iBoot = iBoot.n56.RELEASE.im4p
| iBootIV = b278bd8d003f6b0a8cd55c3efa801801
| iBootKey = afe20969724e1175c659cc61738d431532fd6cc2ecd4bbdce8b4bfe92da54acf

| iBSS = iBSS.n56.RELEASE.im4p
| iBSSIV = 70c13c102ac1543585a748e59cbe4294
| iBSSKey = 7d84c789a2fdd0d185e0edbcf631c7bd8e60cc5eac453c83e6ea2ead3f4d175e

| Kernelcache = kernelcache.release.iphone7
| KernelcacheIV = Not Encrypted

| LLB = LLB.n56.RELEASE.im4p
| LLBIV = ea0f078d4c00c73e78c6d6f0fa488834
| LLBKey = f4a47af6eb798017fea063edbfc258d3bdd854ea123c935c7a4d8001998439cc

| RecoveryMode = recoverymode@1920~iphone-lightning.im4p
| RecoveryModeIV = Not Encrypted

| SEPFirmware = sep-firmware.n56.RELEASE.im4p
| SEPFirmwareIV = Unknown
| SEPFirmwareKey = Unknown
| SEPFirmwareKBAG = 2ccc3408fe8488e8b9ffa39b45dd2ec8a6a0348dd4cc3606ec2ad46b3021e70d40eb6530dbddc6a52da66c39149867e6

}}

Tigris 15A432 (iPhone7,1)

2020-04-28T04:01:29Z

Kiddepants: Created page with "{{keys | Version = 11.0.3 | Build = 15A432 | Device = iPhone7,1 | Codename = Tigris | Baseband = 6...."

{{keys
| Version = 11.0.3
| Build = 15A432
| Device = iPhone7,1
| Codename = Tigris
| Baseband = 6.17.00
| DownloadURL = http://appldnld.apple.com/ios11.0.3/091-38098-20171011-DF342A88-AB95-11E7-93D2-34A9187BE358/iPhone_5.5_11.0.3_15A432_Restore.ipsw

| RootFS = 058-45584-484
| RootFSKey = Not Encrypted

| UpdateRamdisk = 058-59988-357
| UpdateRamdiskIV = Not Encrypted

| RestoreRamdisk = 058-59982-359
| RestoreRamdiskIV = Not Encrypted

| AppleLogo = applelogo@3x~iphone.im4p
| AppleLogoIV = Not Encrypted

| BatteryCharging0 = batterycharging0@3x~iphone.im4p
| BatteryCharging0IV = Not Encrypted

| BatteryCharging1 = batterycharging1@3x~iphone.im4p
| BatteryCharging1IV = Not Encrypted

| BatteryFull = batteryfull@3x~iphone.im4p
| BatteryFullIV = Not Encrypted

| BatteryLow0 = batterylow0@3x~iphone.im4p
| BatteryLow0IV = Not Encrypted

| BatteryLow1 = batterylow1@3x~iphone.im4p
| BatteryLow1IV = Not Encrypted

| DeviceTree = DeviceTree.n56ap.im4p
| DeviceTreeIV = Not Encrypted

| GlyphPlugin = glyphplugin@1920~iphone-lightning.im4p
| GlyphPluginIV = Not Encrypted

| iBEC = iBEC.n56.RELEASE.im4p
| iBECIV = 7852e23b4147b937193fbe9a49a34e3e
| iBECKey = b7411e105cb0c13a5e3bfa9400d64a55caf4d9efd2ec04f5136b7a0c13c40fb6

| iBoot = iBoot.n56.RELEASE.im4p
| iBootIV = 48c6d3662f05bb3b51fa9730e4c734f6
| iBootKey = 9da0a4198afb4b3355c9993e8aedf0d48a5965a9ec222dee738895140394007a

| iBSS = iBSS.n56.RELEASE.im4p
| iBSSIV = b937320073334501e23512bf07d222e5
| iBSSKey = 2f56738f75a25c823ebd2083401a7d82cc4585b0c6c8edb9f28fef4d56e820cb

| Kernelcache = kernelcache.release.iphone7
| KernelcacheIV = Not Encrypted

| LLB = LLB.n56.RELEASE.im4p
| LLBIV = e74abe4496f38bd9446f5f09e2fedee7
| LLBKey = fd26ff25320b826388bfb1dd5be6c766a8a6bc2f8cb4a003fb25cfebdab0e305

| RecoveryMode = recoverymode@1920~iphone-lightning.im4p
| RecoveryModeIV = Not Encrypted

| SEPFirmware = sep-firmware.n56.RELEASE.im4p
| SEPFirmwareIV = Unknown
| SEPFirmwareKey = Unknown
| SEPFirmwareKBAG = ae53a16c7d23f9f149ebf8a2a107d7adde1adbd56c38c126c5b359bdfe650660114e10f6859258f149de380e1c40f047

}}

Tigris 15A421 (iPhone7,1)

2020-04-24T06:26:01Z

Kiddepants: Created page with "{{keys | Version = 11.0.2 | Build = 15A421 | Device = iPhone7,1 | Codename = Tigris | Baseband = 6...."

{{keys
| Version = 11.0.2
| Build = 15A421
| Device = iPhone7,1
| Codename = Tigris
| Baseband = 6.17.00
| DownloadURL = http://appldnld.apple.com/ios11.0.2/091-34491-20171003-39B73660-A486-11E7-98B1-1EDA63D90D56/iPhone_5.5_11.0.2_15A421_Restore.ipsw

| RootFS = 058-45584-483
| RootFSKey = Not Encrypted

| UpdateRamdisk = 058-59988-353
| UpdateRamdiskIV = Not Encrypted

| RestoreRamdisk = 058-59982-355
| RestoreRamdiskIV = Not Encrypted

| AppleLogo = applelogo@3x~iphone.im4p
| AppleLogoIV = Not Encrypted

| BatteryCharging0 = batterycharging0@3x~iphone.im4p
| BatteryCharging0IV = Not Encrypted

| BatteryCharging1 = batterycharging1@3x~iphone.im4p
| BatteryCharging1IV = Not Encrypted

| BatteryFull = batteryfull@3x~iphone.im4p
| BatteryFullIV = Not Encrypted

| BatteryLow0 = batterylow0@3x~iphone.im4p
| BatteryLow0IV = Not Encrypted

| BatteryLow1 = batterylow1@3x~iphone.im4p
| BatteryLow1IV = Not Encrypted

| DeviceTree = DeviceTree.n56ap.im4p
| DeviceTreeIV = Not Encrypted

| GlyphPlugin = glyphplugin@1920~iphone-lightning.im4p
| GlyphPluginIV = Not Encrypted

| iBEC = iBEC.n56.RELEASE.im4p
| iBECIV = 7852e23b4147b937193fbe9a49a34e3e
| iBECKey = b7411e105cb0c13a5e3bfa9400d64a55caf4d9efd2ec04f5136b7a0c13c40fb6

| iBoot = iBoot.n56.RELEASE.im4p
| iBootIV = 48c6d3662f05bb3b51fa9730e4c734f6
| iBootKey = 9da0a4198afb4b3355c9993e8aedf0d48a5965a9ec222dee738895140394007a

| iBSS = iBSS.n56.RELEASE.im4p
| iBSSIV = b937320073334501e23512bf07d222e5
| iBSSKey = 2f56738f75a25c823ebd2083401a7d82cc4585b0c6c8edb9f28fef4d56e820cb

| Kernelcache = kernelcache.release.iphone7
| KernelcacheIV = Not Encrypted

| LLB = LLB.n56.RELEASE.im4p
| LLBIV = e74abe4496f38bd9446f5f09e2fedee7
| LLBKey = fd26ff25320b826388bfb1dd5be6c766a8a6bc2f8cb4a003fb25cfebdab0e305

| RecoveryMode = recoverymode@1920~iphone-lightning.im4p
| RecoveryModeIV = Not Encrypted

| SEPFirmware = sep-firmware.n56.RELEASE.im4p
| SEPFirmwareIV = Unknown
| SEPFirmwareKey = Unknown
| SEPFirmwareKBAG = ae53a16c7d23f9f149ebf8a2a107d7adde1adbd56c38c126c5b359bdfe650660114e10f6859258f149de380e1c40f047

}}

Tigris 15A402 (iPhone7,1)

2020-04-24T06:08:43Z

Kiddepants: Created page with "{{keys | Version = 11.0.1 | Build = 15A402 | Device = iPhone7,1 | Codename = Tigris | Baseband = 6...."

{{keys
| Version = 11.0.1
| Build = 15A402
| Device = iPhone7,1
| Codename = Tigris
| Baseband = 6.17.00
| DownloadURL = http://appldnld.apple.com/ios11.0.1/091-34214-20170925-2FD91DC0-9ED2-11E7-ADFA-79AAC568F843/iPhone_5.5_11.0.1_15A402_Restore.ipsw

| RootFS = 058-45584-481
| RootFSKey = Not Encrypted

| UpdateRamdisk = 058-59988-350
| UpdateRamdiskIV = Not Encrypted

| RestoreRamdisk = 058-59982-352
| RestoreRamdiskIV = Not Encrypted

| AppleLogo = applelogo@3x~iphone.im4p
| AppleLogoIV = Not Encrypted

| BatteryCharging0 = batterycharging0@3x~iphone.im4p
| BatteryCharging0IV = Not Encrypted

| BatteryCharging1 = batterycharging1@3x~iphone.im4p
| BatteryCharging1IV = Not Encrypted

| BatteryFull = batteryfull@3x~iphone.im4p
| BatteryFullIV = Not Encrypted

| BatteryLow0 = batterylow0@3x~iphone.im4p
| BatteryLow0IV = Not Encrypted

| BatteryLow1 = batterylow1@3x~iphone.im4p
| BatteryLow1IV = Not Encrypted

| DeviceTree = DeviceTree.n56ap.im4p
| DeviceTreeIV = Not Encrypted

| GlyphPlugin = glyphplugin@1920~iphone-lightning.im4p
| GlyphPluginIV = Not Encrypted

| iBEC = iBEC.n56.RELEASE.im4p
| iBECIV = ce039b183a07bad277703368386df145
| iBECKey = 46ca023eabc30cdcf4e3988cc7ad33ca915aa3f1da0561289c3d6ffb6e21348f

| iBoot = iBoot.n56.RELEASE.im4p
| iBootIV = 49463bda255f0d24c3ac750f5f30395a
| iBootKey = f4cef795626b8d47fec6f88cc63dcc13ceea8e299ea5e8b4d2ad639a88ac91b7

| iBSS = iBSS.n56.RELEASE.im4p
| iBSSIV = 202598da7b8f156fe706a8f929f9c3f7
| iBSSKey = ad4c615bce7753f3a55d21a3f709fcc7da94a425e122b797ad69b01d1c82b185

| Kernelcache = kernelcache.release.iphone7
| KernelcacheIV = Not Encrypted

| LLB = LLB.n56.RELEASE.im4p
| LLBIV = 1c19987337967145f36bdd7782de6ab0
| LLBKey = e1e931104a05c5f01374b2d399b0327cf3f1314c7ba4d1747a56b758b1223cbd

| RecoveryMode = recoverymode@1920~iphone-lightning.im4p
| RecoveryModeIV = Not Encrypted

| SEPFirmware = sep-firmware.n56.RELEASE.im4p
| SEPFirmwareIV = Unknown
| SEPFirmwareKey = Unknown
| SEPFirmwareKBAG = e3a1480fe1f2019026b46220f03ba4c6fd924defa425c1a2b240ab63599350cf5fcec8b19788f56f6a5e04529588be6c

}}

Tigris 15A372 (iPhone7,1)

2020-04-24T06:03:48Z

Kiddepants: Created page with "{{keys | Version = 11.0 | Build = 15A372 | Device = iPhone7,1 | Codename = Tigris | Baseband = 6.17..."

{{keys
| Version = 11.0
| Build = 15A372
| Device = iPhone7,1
| Codename = Tigris
| Baseband = 6.17.00
| DownloadURL = http://appldnld.apple.com/ios11.0/091-31643-201700919-35B3D3FC-9027-11E7-941D-2735B64D2808/iPhone_5.5_11.0_15A372_Restore.ipsw

| RootFS = 058-45584-478
| RootFSKey = Not Encrypted

| UpdateRamdisk = 058-59988-347
| UpdateRamdiskIV = Not Encrypted

| RestoreRamdisk = 058-59982-349
| RestoreRamdiskIV = Not Encrypted

| AppleLogo = applelogo@3x~iphone.im4p
| AppleLogoIV = Not Encrypted

| BatteryCharging0 = batterycharging0@3x~iphone.im4p
| BatteryCharging0IV = Not Encrypted

| BatteryCharging1 = batterycharging1@3x~iphone.im4p
| BatteryCharging1IV = Not Encrypted

| BatteryFull = batteryfull@3x~iphone.im4p
| BatteryFullIV = Not Encrypted

| BatteryLow0 = batterylow0@3x~iphone.im4p
| BatteryLow0IV = Not Encrypted

| BatteryLow1 = batterylow1@3x~iphone.im4p
| BatteryLow1IV = Not Encrypted

| DeviceTree = DeviceTree.n56ap.im4p
| DeviceTreeIV = Not Encrypted

| GlyphPlugin = glyphplugin@1920~iphone-lightning.im4p
| GlyphPluginIV = Not Encrypted

| iBEC = iBEC.n56.RELEASE.im4p
| iBECIV = b233e776604fe56b7cd237110440758e
| iBECKey = 821219f0d1c7459abec4c3cc4255240cc3ca213f90c690f8729b9aa3235ddf78

| iBoot = iBoot.n56.RELEASE.im4p
| iBootIV = 7a9db83012836930695f2b6aaf67f9b6
| iBootKey = 88b29fe5b99dbdabf7f220d9bfca94e00b3d96f6d4d17587f1a37165703878e8

| iBSS = iBSS.n56.RELEASE.im4p
| iBSSIV = c0e9a3fc56a9e2b19c6a61e264cd131e
| iBSSKey = 525f2bdaa29ad185325cc2968108d79511516a30e7a75a24a6ac1d95d3f22dfe

| Kernelcache = kernelcache.release.iphone7
| KernelcacheIV = Not Encrypted

| LLB = LLB.n56.RELEASE.im4p
| LLBIV = 0cb3778f90a22a9250445e539678f6ba
| LLBKey = 7a84ece039ab558122da1f906afb64a39bc0253d3109b1029980f379d8afe759

| RecoveryMode = recoverymode@1920~iphone-lightning.im4p
| RecoveryModeIV = Not Encrypted

| SEPFirmware = sep-firmware.n56.RELEASE.im4p
| SEPFirmwareIV = Unknown
| SEPFirmwareKey = Unknown
| SEPFirmwareKBAG = 7e1288fad1742c407e2126738b0160331d0e177bf613cfd8efe17ddaea29c99d116e603898d60e45708da9fac6d2cfd8

}}

PeaceG 16G102 (iPhone7,2)

2020-04-24T05:42:19Z

Kiddepants: Created page with "{{keys | Version = 12.4.1 | Build = 16G102 | Device = iPhone7,2 | Codename = PeaceG | Baseband = 7...."

{{keys
| Version = 12.4.1
| Build = 16G102
| Device = iPhone7,2
| Codename = PeaceG
| Baseband = 7.80.04
| DownloadURL = http://updates-http.cdn-apple.com/2019SummerFCS/fullrestores/061-05179/A45E35B2-C4E7-11E9-9918-19610AD8B7A1/iPhone_4.7_12.4.1_16G102_Restore.ipsw

| RootFS = 048-76490-095
| RootFSKey = Not Encrypted

| UpdateRamdisk = 048-76167-096
| UpdateRamdiskIV = Not Encrypted

| RestoreRamdisk = 048-78047-096
| RestoreRamdiskIV = Not Encrypted

| AppleLogo = applelogo@2x~iphone.im4p
| AppleLogoIV = Not Encrypted

| BatteryCharging0 = batterycharging0@2x~iphone.im4p
| BatteryCharging0IV = Not Encrypted

| BatteryCharging1 = batterycharging1@2x~iphone.im4p
| BatteryCharging1IV = Not Encrypted

| BatteryFull = batteryfull@2x~iphone.im4p
| BatteryFullIV = Not Encrypted

| BatteryLow0 = batterylow0@2x~iphone.im4p
| BatteryLow0IV = Not Encrypted

| BatteryLow1 = batterylow1@2x~iphone.im4p
| BatteryLow1IV = Not Encrypted

| DeviceTree = DeviceTree.n61ap.im4p
| DeviceTreeIV = Not Encrypted

| GlyphPlugin = glyphplugin@1334~iphone-lightning.im4p
| GlyphPluginIV = Not Encrypted

| iBEC = iBEC.n61.RELEASE.im4p
| iBECIV = cd4ce0e1edc721258f37556f4767d6c7
| iBECKey = 62d2f3d8a9a7161320d43d88476905fb5132b34cd97ccf9d14d9860d0ec2cf41

| iBoot = iBoot.n61.RELEASE.im4p
| iBootIV = fc844a8fd16692bcfbcc09a8d61a8baa
| iBootKey = b4947988635695173efed8cdfa5c282266da7baa06aff733248d2453fda31a6d

| iBSS = iBSS.n61.RELEASE.im4p
| iBSSIV = 2237e1a3f637055a1ad11eef485f036e
| iBSSKey = 97f4cda4d59e4aeae12bcd8afa9beff39173e9d568b0470c9c7a5076353f6e9f

| Kernelcache = kernelcache.release.iphone7
| KernelcacheIV = Not Encrypted

| LLB = LLB.n61.RELEASE.im4p
| LLBIV = 9f2093d67f5482f415007a4c85797fe6
| LLBKey = c51ae27c4e0e34b02450505451a347dda13c35f2f68b9f304160adc34bfd88ee

| RecoveryMode = recoverymode@1334~iphone-lightning.im4p
| RecoveryModeIV = Not Encrypted

| SEPFirmware = sep-firmware.n61.RELEASE.im4p
| SEPFirmwareIV = Unknown
| SEPFirmwareKey = Unknown
| SEPFirmwareKBAG = f9a26de33ff3b6a9787d716e0773c0cba0c63198129af72c6aa8f5a8339e694d937354a03a2bda37e2a063fb72705ad0

}}

PeaceSecYukonE 16G183 (iPhone7,2)

2020-03-25T06:56:19Z

Kiddepants: yeet

{{keys
| Version = 12.4.6
| Build = 16G183
| Device = iPhone7,2
| Codename = PeaceSecYukonE
| Baseband = 7.80.04
| DownloadURL = http://updates-http.cdn-apple.com/2020WinterFCS/fullrestores/061-73640/E67A9967-06A9-4846-A34F-6EAECA4A132E/iPhone_4.7_12.4.6_16G183_Restore.ipsw

| RootFS = 038-36700-005
| RootFSKey = Not Encrypted

| UpdateRamdisk = 038-36713-005
| UpdateRamdiskIV = Not Encrypted

| RestoreRamdisk = 038-36771-005
| RestoreRamdiskIV = Not Encrypted

| AppleLogo = applelogo@2x~iphone.im4p
| AppleLogoIV = Not Encrypted

| BatteryCharging0 = batterycharging0@2x~iphone.im4p
| BatteryCharging0IV = Not Encrypted

| BatteryCharging1 = batterycharging1@2x~iphone.im4p
| BatteryCharging1IV = Not Encrypted

| BatteryFull = batteryfull@2x~iphone.im4p
| BatteryFullIV = Not Encrypted

| BatteryLow0 = batterylow0@2x~iphone.im4p
| BatteryLow0IV = Not Encrypted

| BatteryLow1 = batterylow1@2x~iphone.im4p
| BatteryLow1IV = Not Encrypted

| DeviceTree = DeviceTree.n61ap.im4p
| DeviceTreeIV = Not Encrypted

| GlyphPlugin = glyphplugin@1334~iphone-lightning.im4p
| GlyphPluginIV = Not Encrypted

| iBEC = iBEC.n61.RELEASE.im4p
| iBECIV = 7fbf2866399f9ec7f52e75971d0da14c
| iBECKey = 09053efb14fe93844984a087333c71a0b59fb23a14ae1469bb14627c37550aab

| iBoot = iBoot.n61.RELEASE.im4p
| iBootIV = 750ea1b236c3c3342ff0a556326f34ed
| iBootKey = 6ddcd41fe465c88187c8b50ed5dcf4e270456c729c87091fecb136ea0b99c784

| iBSS = iBSS.n61.RELEASE.im4p
| iBSSIV = cfc04f5d0cc1e7937376942f6f87245c
| iBSSKey = 184aa2f7d0312097af357d0180976e1251760ec0a2bc9babc320dde1c7ffdc38

| Kernelcache = kernelcache.release.iphone7
| KernelcacheIV = Not Encrypted

| LLB = LLB.n61.RELEASE.im4p
| LLBIV = 9d22174c6a68e3fd119a95da1b4911fc
| LLBKey = abe08f35b753b46e8dd9b4a690154b4a81305e513c379d574f23d5c8f5105984

| RecoveryMode = recoverymode@1334~iphone-lightning.im4p
| RecoveryModeIV = Not Encrypted

| SEPFirmware = sep-firmware.n61.RELEASE.im4p
| SEPFirmwareIV = Unknown
| SEPFirmwareKey = Unknown
| SEPFirmwareKBAG = 88eda5a3a325c9235dfe78c49bc176f672a2a3955097a7d3452de76374d9237e6dddb8a52678ddffe22257fea08c0085

}}

Jailbreak Exploits

2020-03-24T16:00:21Z

Kiddepants: Oof haven't updated page this in a fat minute

This page lists the '''exploits''' used in [[jailbreak]]s.

== Common exploits ==
These exploits are not dependent on any firmware; as such, they are used in numerous jailbreaking programs.

* [[Pwnage]] + [[Pwnage 2.0]] (together to jailbreak the [[M68AP|iPhone]], [[N45AP|iPod touch]], and [[N82AP|iPhone 3G]])
* [[ARM7 Go]] (from iOS 2.1.1) (for [[tethered jailbreak]] on [[N72AP|iPod touch (2nd generation)]])
* [[0x24000 Segment Overflow]] (for [[untethered jailbreak]] on [[N88AP|iPhone 3GS]] with [[Bootrom 359.3|old bootrom]] and [[N72AP|iPod touch (2nd generation)]] with [[Bootrom 240.4|old bootrom]]; another exploit as the [[limera1n Exploit]] is required)
* [[limera1n Exploit]] (for [[tethered jailbreak]] on [[N88AP|iPhone 3GS]], [[N18AP|iPod touch (3rd generation)]], [[K48AP|iPad]], [[iPhone 4]], [[N81AP|iPod touch (4th generation)]] and [[K66AP|Apple TV (2nd generation)]])
* [[usb_control_msg(0xA1, 1) Exploit]] (also known as "steaks4uce") (for [[tethered jailbreak]] on [[N72AP|iPod touch (2nd generation)]])

== Jailbreak Programs ==
=== [[PwnageTool]] (2.0 - 5.1.1) ===
* uses different common exploits
* uses the exploits listed below to untether up to iOS 5.1.1

=== [[redsn0w]] (3.0 - 6.0) ===
* uses different common exploits
* uses the same exploits as [[Absinthe|Absinthe]] and [[Absinthe|Absinthe 2.0]] to jailbreak iOS 5.0/5.0.1 and 5.1.1
* uses the exploits listed below to untether up to iOS 5.1.1

=== [[sn0wbreeze]] (3.1.3 - 6.1.3) ===
* uses different common exploits
* uses the exploits listed below to untether up to iOS 6.1.2

== Programs used to jailbreak 1.x ==
=== [[AppTapp Installer]] (1.0 / 1.0.1 / 1.0.2) ===
* iBoot <code>cp</code>-command exploit

=== [[iBrickr]] (1.0 / 1.0.1 / 1.0.2) ===
* iBoot <code>cp</code>-command exploit

=== [[AppSnapp]]/[[JailbreakMe|JailbreakMe 1.0]] (1.0 / 1.0.1 / 1.0.2 / 1.1.1) ===
* [[LibTiff|libtiff exploit]] (Adapted from the PSP scene, used by [[JailbreakMe]]) ({{cve|2006-3459}})

=== [[mknod|OktoPrep]] (1.1.2) ===
"Upgrade" to 1.1.2 from a jailbroken 1.1.1
* [[mknod]]

=== [[Soft Upgrade]] (1.1.3) ===
"Upgrade" to 1.1.3 from a running jailbroken 1.1.2

=== [[ZiPhone]] (1.1.3 / 1.1.4 / 1.1.5) ===
* [[Ramdisk Hack]]

=== [[iLiberty+|iLiberty / iLiberty+]] (1.1.3 / 1.1.4 / 1.1.5) ===

== Programs used to jailbreak 2.x ==
=== [[QuickPwn]] (2.0 - 2.2.1) ===
* uses [[Pwnage]] and [[Pwnage 2.0]]

=== [[Redsn0w Lite]] (2.1.1) ===
* [[ARM7 Go]] (for [[N72AP|iPod touch (2nd generation)]] only)

== Programs used to jailbreak 3.x ==
=== [[purplera1n]] (3.0) ===
* [[iBoot Environment Variable Overflow]] ({{cve|2009-2795}})
* uses [[0x24000 Segment Overflow]]

=== [[blackra1n]] (3.1 / 3.1.1 / 3.1.2) ===
* [[usb_control_msg(0x21, 2) Exploit]] ({{cve|2010-0038}})
* uses [[0x24000 Segment Overflow]]

=== [[Spirit]] (3.1.2 / 3.1.3 / 3.2) ===
* [[MobileBackup Copy Exploit]]
* [[Incomplete Codesign Exploit]]
* [[BPF_STX Kernel Write Exploit]]

=== [[Star|JailbreakMe 2.0 / Star]] (3.1.2 / 3.1.3 / 3.2 / 3.2.1) ===
* [[Malformed CFF Vulnerability]] ({{cve|2010-1797}})
* [[Incomplete Codesign Exploit]]
* [[IOSurface Kernel Exploit]] ({{cve|2010-2973}})

=== [[limera1n]] / [[greenpois0n (jailbreak)|greenpois0n]] (3.2.2) ===
* uses different common exploits
* [[Packet Filter Kernel Exploit]]

== Programs used to jailbreak 4.x ==
=== [[Star|JailbreakMe 2.0 / Star]] (4.0 / 4.0.1) ===
* [[Malformed CFF Vulnerability]] ({{cve|2010-1797}})
* [[Incomplete Codesign Exploit]]
* [[IOSurface Kernel Exploit]] ({{cve|2010-2973}})

=== [[limera1n]] (4.0 / 4.0.1 / 4.0.2 / 4.1) ===
* uses different common exploits
* [[Packet Filter Kernel Exploit]]

=== [[greenpois0n (jailbreak)|greenpois0n]] (4.1) ===
* uses different common exploits
* [[Packet Filter Kernel Exploit]]

=== [[greenpois0n (jailbreak)|greenpois0n]] (4.2.1) ===
* uses different common exploits
* [[HFS Legacy Volume Name Stack Buffer Overflow]]

=== [[Saffron|JailbreakMe 3.0 / Saffron]] (4.2.6 / 4.2.7 / 4.2.8) ===
* [[T1 Font Integer Overflow]] ({{cve|2011-0226}})
* [[HFS Legacy Volume Name Stack Buffer Overflow]]

=== [[unthredeh4il]] (4.2.6 - 4.2.10) ===
Except for the [[iPad (3rd generation)]]
* MobileBackup2 Copy Exploit
* a new Packet Filter Kernel Exploit ({{cve|2012-3728}})
* [[AMFID code signing evasion]] ({{cve|2013-0977}})
* [[launchd.conf untether]]
* [[Timezone Vulnerability]]

=== [[Saffron|JailbreakMe 3.0 / Saffron]] (4.3 / 4.3.1 / 4.3.2 / 4.3.3) ===
Except for the [[N18AP|iPod touch (3rd generation)]] on iOS 4.3.1.
* [[T1 Font Integer Overflow]] ({{cve|2011-0226}})
* [[IOMobileFrameBuffer Privilege Escalation Exploit]] ({{cve|2011-0227}})

=== i0nic's Untether (4.3.1 / 4.3.2 / 4.3.3) ===
used in [[redsn0w]] to untether iOS 4.3.1 / 4.3.2 / 4.3.3
* [[ndrv_setspec() Integer Overflow]]

=== [[unthredeh4il]] (4.3 - 4.3.5) ===
Except for the [[iPad (3rd generation)]]
* MobileBackup2 Copy Exploit
* a new Packet Filter Kernel Exploit ({{cve|2012-3728}})
* [[AMFID code signing evasion]] ({{cve|2013-0977}})
* [[launchd.conf untether]]
* [[Timezone Vulnerability]]

== Programs used to jailbreak 5.x ==

=== [[Absinthe]] (5.0 on [[N94AP|iPhone 4S]] only / 5.0.1 on [[iPad 2]] and [[iPhone 4S]]) ===
* [[Racoon String Format Overflow Exploit]] ({{cve|2012-0646}}) (used both for payload injection and untether)
* [[HFS Heap Overflow]] ({{cve|2012-0642}})
* unknown exploit ({{cve|2012-0643}})

=== [[Corona|Corona Untether]] (5.0.1) ===
* [[Racoon String Format Overflow Exploit]] ({{cve|2012-0646}})
* [[HFS Heap Overflow]] ({{cve|2012-0642}})
* unknown exploit ({{cve|2012-0643}})

=== [[Absinthe|Absinthe 2.0]] and [[Rocky Racoon|Rocky Racoon Untether]] (5.1.1) ===
* a new Packet Filter Kernel Exploit ({{cve|2012-3728}})
* Racoon DNS4/WINS4 table buffer overflow ({{cve|2012-3727}})
* MobileBackup2 Copy Exploit

=== [[unthredeh4il]] (5.0-5.1.1) ===
Except for the [[iPad (3rd generation)]]
* MobileBackup2 Copy Exploit
* a new Packet Filter Kernel Exploit ({{cve|2012-3728}})
* [[AMFID code signing evasion]] ({{cve|2013-0977}})
* [[launchd.conf untether]]
* [[Timezone Vulnerability]]

== Programs used to jailbreak 6.x ==
=== [[evasi0n]] (6.0 / 6.0.1 / 6.0.2 / 6.1 / 6.1.1 / 6.1.2) ===
* [[Symbolic Link Vulnerability]] ({{cve|2013-0979}})
* [[Timezone Vulnerability]]
* [[Shebang Trick]] ({{cve|2013-5154}})
* [[AMFID code signing evasion]]
* [[launchd.conf untether]]
* [[IOUSBDeviceFamily Vulnerability]] ({{cve|2013-0981}})
* [[ARM Exception Vector Info Leak]] ({{cve|2013-0978}})
* [[dynamic memmove() locating]]
* [[vm_map_copy_t corruption for arbitrary memory disclosure]]
* [[kernel memory write via ROP gadget]]
* [[Overlapping Segment Attack]] ({{cve|2013-0977}})

=== [[p0sixspwn]] (6.1.3 / 6.1.4 / 6.1.5 / 6.1.6) ===
* [[posix_spawn kernel information leak]] ({{cve|2013-3954}}) (by [[i0n1c]])
* [[posix_spawn kernel exploit]] ({{cve|2013-3954}}) (by [[i0n1c]])
* [[mach_msg_ool_descriptor_ts for heap shaping]] ({{cve|2013-3953}})
* [[AMFID_code_signing_evasi0n7]] ({{cve|2014-1273}})
* [[DeveloperDiskImage race condition]] (by [[comex]])
* [[launchd.conf untether]]

== Programs used to jailbreak 7.x ==
=== [[evasi0n7]] (7.0 / 7.0.1 / 7.0.2 / 7.0.3 / 7.0.4 / 7.0.5 / 7.0.6) ===
{{Section Stub}}
* [[Symbolic Link Vulnerability]] ({{cve|2013-5133}})
* [[AMFID_code_signing_evasi0n7]] ({{cve|2014-1273}})
* CrashHouseKeeping chmod vulnerability ({{cve|2014-1272}})
* ptmx_get_ioctl ioctl crafted call ({{cve|2014-1278}})

=== [[Geeksn0w]] (7.1 / 7.1.1) ===
* [[limera1n]]'s bootrom exploit ([[Tethered jailbreak]]) on [[iPhone 4]]

=== [[Pangu]] (7.1 / 7.1.1 / 7.1.2) ===
* Mach-O OSBundleHeaders info leak ({{cve|2014-4491}}) (Pangu v1.0.0)
* AppleKeyStore::initUserClient info leak ({{cve|2014-4407}}) (Pangu >v1.0.0)
* break_early_random (by [[i0n1c]] and Tarjei Mandt of Azimuth) ({{cve|2014-4422}})
* mach_port_kobject exploit {{cve|2014-4496}} - used to recover the permutation value and addresses of kernel objects
* IOSharedDataQueue notification port overwrite ({{cve|2014-4461}})
* "syslogd chown" vulnerability
* enterprise certificate (no real exploit, used for initial "unsigned" code execution)
* "foo_extracted" symlink vulnerability (used to write to /var) ({{cve|2014-4386}})
* /tmp/bigfile (a big file for improvement of the reliability of a race condition)
* VoIP backgrounding trick (used to auto restart the app)
* hidden segment attack

== Programs used to jailbreak 8.x ==
=== [[Pangu8]] (8.0 / 8.0.1 / 8.0.2 / 8.1) ===
* an exploit for a bug in /usr/libexec/neagent (source @iH8sn0w)
* enterprise certificate (inside the IPA)
* a kind of dylib injection into a system process (see IPA)
* a dmg mount command (looks like the Developer DMG) (syslog while jailbreaking)
* a sandboxing problem in debugserver ({{cve|2014-4457}})
* mach_port_kobject exploit {{cve|2014-4496}} - used to recover the permutation value and addresses of kernel objects
* the same kernel exploit as used in [[Pangu|the first Pangu]] ({{cve|2014-4461}}) (source @iH8sn0w) - now used to also leak kernel memory (source @Morpheus______)
* enable-dylibs-to-override-cache
* a new ovelapping segment attack ({{cve|2014-4455}})

=== [[TaiG]] and [[PPJailbreak]] (8.0 / 8.0.1 / 8.0.2 / 8.1 / 8.1.1 / 8.1.2) ===
(See also details at [http://newosxbook.com/articles/TaiG.html newosxbook.com])
* A new AFC symlink attack ({{cve|2014-4480}}) - to get onto the device filesystem
* [[DeveloperDiskImage race condition]] (by [[comex]], also used in p0sixspwn) - to mount a fake DDI and instantly overwrite (via union) libmis/xpcd_cache
* A new overlapping segment attack [in a modified version], dyld, ({{cve|2014-4455}}) - negative LC_SEGMENT - to allow libmis and xpcdcache to load
* libmis redirection of MISValidateSignature (as per evasion) to kCFEqual, with overlapping segment variant on TaiG (Segment at end of file, negative)
* enable-dylibs-to-override-cache - force loading of dynamic libraries from filesystem (where available) instead of the shared cache (overriding libmis/xpcd_cache)
* MobileStorageMounter exploit ({{cve|2015-1062}})
* Backup exploit used to access restricted parts of the filesystem ({{cve|2015-1087}})

Kernel:

* Mach-O OSBundleHeaders info leak ({{cve|2014-4491}}) - leaks slid addresses
* mach_port_kobject exploit {{cve|2014-4496}} - used to recover the permutation value and addresses of kernel objects
* IOHIDFamily Kernel exploit ({{cve|2014-4487}}) - to overwrite memory

=== [[TaiG]] and [[PPJailbreak]] (8.1.3 / 8.2 / 8.3 / 8.4) ===
(See also details at http://newosxbook.com/articles/28DaysLater.html and http://newosxbook.com/articles/HIDeAndSeek.html)
* [[DeveloperDiskImage race condition]] (also used in TaiG for 8.0-8.1.2 but modified) - to mount a fake DDI
* enable-dylibs-to-override-cache - force loading of dynamic libraries from filesystem (where available) instead of the shared cache (overriding libmis)
* Symbolic linking to AFC ({{cve|2015-5746}})
* Backup exploit to write to protected regions of the disk ({{cve|2015-5752}})
* Code signing exploit ({{cve|2015-3802}})
* Code signing exploit ({{cve|2015-3803}})
* Code signing exploit ({{cve|2015-3805}})
* Code signing exploit ({{cve|2015-3806}})
* IOHIDFamily exploit ({{cve|2015-5774}})
* Air Traffic exploit to allow attackers to access arbitrary filesystem locations via vectors related to asset handling ({{cve|2015-5766}})

=== [[EtasonJB]] and [[Home Depot]] (8.4.1) ===

* OSUnserialize Information leak ({{cve|2016-4655}})
* Kernel exploit ({{cve|2016-4656}})

== Programs used to jailbreak 9.x ==
=== [[Pangu9]] (9.0 / 9.0.1 / 9.0.2 / 9.1) ===
* Photos exploit to gain arbitrary unsandboxed file system access as mobile to load outdated DDI. ({{cve|2015-7037}})
* MobileStorageMounter allowed older DeveloperDiskImages to be mounted, resulting in unsandboxed unsigned code execution due to known weaknesses in entitled executables. ({{cve|2015-7051}})
* IOHIDFamily Use-After-Free for kernel information leak / code execution as mobile. ({{cve|2015-6974}})
* dyld exploit in dyld shared cache handling to override MISValidateSignature in libmis.dylib for persistency ({{cve|2015-7079}})
* Racing KPP for some of the patches.
* AMFI MAC Hooks were in non-__const __DATA section, so wouldn't be integrity checked by KPP, allowing to replace MAC hooks required for code-signing. ({{cve|2015-7055}})

=== [[Pangu9]] (9.2 / 9.2.1 / 9.3 / 9.3.1 / 9.3.2 / 9.3.3) ===
* IOMobileFrameBuffer exploit to execute arbitrary code with kernel privileges. ({{cve|2016-4654}})

=== [[jbme]] (9.2 / 9.2.1 / 9.3 / 9.3.1 / 9.3.2 / 9.3.3) ===
* Webkit exploit ({{cve|2016-4657}})

=== [[Home Depot]] (9.1-9.3.4) ===
* OSUnserialize Information leak ({{cve|2016-4655}})
* Kernel exploit ({{cve|2016-4656}})

=== [[JailbreakMe 4.0]] (9.1-9.3.4) ===
* OSUnserialize Information leak ({{cve|2016-4655}})
* Kernel exploit ({{cve|2016-4656}})
* Webkit exploit ({{cve|2016-4657}})

=== [[Phœnix]] (9.3.5 / 9.3.6) ===
* OSUnserialize Information leak ({{cve|2016-4655}})
* mach_port_register Kernel exploit ({{cve|2016-4669}})

== Programs used to jailbreak 10.x ==

=== [[extra_recipe+yaluX]] (10.0-10.1.1) ===

* set_dp_control_port exploit to execute arbitrary code with kernel privileges. ({{cve|2016-7644}})

=== [[yalu102]] (10.0.1-10.2) ===

* mach_voucher_extract_attr_recipe_trap memory corruption. ({{cve|2017-2370}})

=== [[doubleH3lix]] (10.0.1 - 10.3.3) ===

* IOSurface Kernel Exploit ({{cve|2017-13861}})

=== [[Meridian]] (10.0 - 10.3.3) ===

* IOSurface Kernel Exploit ({{cve|2017-13861}})

=== [[TotallyNotSpyware]] (10.0 - 10.3.3) ===

* IOSurface Kernel Exploit ({{cve|2017-13861}})
* WebKit JIT optimization bug exploit ({{cve|2018-4233}})

=== [[H3lix]] (10.0.1 - 10.3.4) ===

* IOSurface Kernel Exploit ({{cve|2017-13861}})

== Programs used to jailbreak 11.x ==

===[[Unc0ver]] (11.0-11.4.1)===

11.0 - 11.1.2

* IOSurface Kernel Exploit ({{cve|2017-13861}})

11.0 - 11.3.1

* mptcp_usr_connectx (multi_path) ({{cve|2018-4241}})
* getvolattrlist (empty_list) ({{cve|2018-4243}})

11.0 - 11.4.1

* voucher_swap ({{cve|2019-6225}})

===[[Electra]] (11.0-11.4.1)===

11.0 - 11.1.2

* IOSurface Kernel Exploit ({{cve|2017-13861}})

11.2 - 11.3.1

* mptcp_usr_connectx (multi_path) ({{cve|2018-4241}})
* getvolattrlist (empty_list) ({{cve|2018-4243}})

11.2 - 11.4.1

* v1ntex ({{cve|2019-6225}})

== Programs used to jailbreak 12.x ==

===[[Chimera]] (12.0 - 12.2 / 12.4)===

12.0 - 12.1.2

* voucher_swap ({{cve|2019-6225}})

12.0 - 12.2/12.4

* sockpuppet ({{cve|2019-8527}})

===[[Unc0ver]] (12.0 - 12.2 / 12.4 / 12.4.1)===

12.0 - 12.1.2

* voucher_swap ({{cve|2019-6225}})

12.0 - 12.2/12.4

* sockpuppet ({{cve|2019-8527}})

12.4.1

* ZecOps Kernel Exploit ({{cve|2019-8794}})

== Programs used to jailbreak 13.x ==

===[[Unc0ver]] (13.0 - 13.3)===

* oob_timestamp ({{cve|2020-3837}})

===[[checkra1n]] (12.3 - 13.3.1)===

* [[Checkm8_Exploit | checkm8]]

PeaceC 16C101 (iPhone7,2)

2020-03-03T01:26:09Z

Kiddepants: Thanks @a1exdandy

{{keys
| Version = 12.1.2
| Build = 16C101
| Device = iPhone7,2
| Codename = PeaceC
| Baseband = 7.32.00
| DownloadURL = https://updates.cdn-apple.com/2018FallFCS/fullrestores/041-27254/5EB0EB28-FF0C-11E8-8653-E1D4C465C0D3/iPhone_4.7_12.1.2_16C101_Restore.ipsw

| RootFS = 048-40109-059
| RootFSKey = Not Encrypted

| UpdateRamdisk = 048-40327-059
| UpdateRamdiskIV = Not Encrypted

| RestoreRamdisk = 048-40310-059
| RestoreRamdiskIV = Not Encrypted

| AppleLogo = applelogo@2x~iphone.im4p
| AppleLogoIV = Not Encrypted

| BatteryCharging0 = batterycharging0@2x~iphone.im4p
| BatteryCharging0IV = Not Encrypted

| BatteryCharging1 = batterycharging1@2x~iphone.im4p
| BatteryCharging1IV = Not Encrypted

| BatteryFull = batteryfull@2x~iphone.im4p
| BatteryFullIV = Not Encrypted

| BatteryLow0 = batterylow0@2x~iphone.im4p
| BatteryLow0IV = Not Encrypted

| BatteryLow1 = batterylow1@2x~iphone.im4p
| BatteryLow1IV = Not Encrypted

| DeviceTree = DeviceTree.n61ap.im4p
| DeviceTreeIV = Not Encrypted

| GlyphPlugin = glyphplugin@1334~iphone-lightning.im4p
| GlyphPluginIV = Not Encrypted

| iBEC = iBEC.n61.RELEASE.im4p
| iBECIV = 5c25d829f655c84855b6af7ed19cc1cd
| iBECKey = 69d5a66ec345d8af73b371be12c24c3b26e63175e429e0b8c540412d70a0e7d6

| iBoot = iBoot.n61.RELEASE.im4p
| iBootIV = 39dc92f448a59f373424708828c8a647
| iBootKey = d40d63135cbe1f9e06b4c5329701a3240152954845d767890484ee664091a938

| iBSS = iBSS.n61.RELEASE.im4p
| iBSSIV = 1cc13c9a933243144d6d3a7734516e96
| iBSSKey = fca58946c870992687de93cec6d72612d878a05b0fb8e35e2f12277a6184a1e5

| Kernelcache = kernelcache.release.iphone7
| KernelcacheIV = Not Encrypted

| LLB = LLB.n61.RELEASE.im4p
| LLBIV = 44c866c60125745c073be051c858f7d8
| LLBKey = fa31cee285a58e6aab66af992d3d7b502b1270194d6d1795b3c3a3a97d0f4f69

| RecoveryMode = recoverymode@1334~iphone-lightning.im4p
| RecoveryModeIV = Not Encrypted

| SEPFirmware = sep-firmware.n61.RELEASE.im4p
| SEPFirmwareIV = Unknown
| SEPFirmwareKey = Unknown
| SEPFirmwareKBAG = 06a1b077c36f4e244acd927c5ff534cf034573cdf2d4925d05a947af34eceb22791d68013ddbd942daf29bc6a8d89da4

}}

PeaceSecYukonD 16G161 (iPhone7,2)

2020-02-24T08:27:22Z

Kiddepants: Thanks @a1exdandy

{{keys
| Version = 12.4.5
| Build = 16G161
| Device = iPhone7,2
| Codename = PeaceSecYukonD
| Baseband = 7.80.04
| DownloadURL = https://updates.cdn-apple.com/2020WinterFCS/fullrestores/061-62313/32754B5C-6393-4835-9578-47490E2748BF/iPhone_4.7_12.4.5_16G161_Restore.ipsw

| RootFS = 038-27324-003
| RootFSKey = Not Encrypted

| UpdateRamdisk = 038-27252-003
| UpdateRamdiskIV = Not Encrypted

| RestoreRamdisk = 038-27407-003
| RestoreRamdiskIV = Not Encrypted

| AppleLogo = applelogo@2x~iphone.im4p
| AppleLogoIV = Not Encrypted

| BatteryCharging0 = batterycharging0@2x~iphone.im4p
| BatteryCharging0IV = Not Encrypted

| BatteryCharging1 = batterycharging1@2x~iphone.im4p
| BatteryCharging1IV = Not Encrypted

| BatteryFull = batteryfull@2x~iphone.im4p
| BatteryFullIV = Not Encrypted

| BatteryLow0 = batterylow0@2x~iphone.im4p
| BatteryLow0IV = Not Encrypted

| BatteryLow1 = batterylow1@2x~iphone.im4p
| BatteryLow1IV = Not Encrypted

| DeviceTree = DeviceTree.n61ap.im4p
| DeviceTreeIV = Not Encrypted

| GlyphPlugin = glyphplugin@1334~iphone-lightning.im4p
| GlyphPluginIV = Not Encrypted

| iBEC = iBEC.n61.RELEASE.im4p
| iBECIV = cd4ce0e1edc721258f37556f4767d6c7
| iBECKey = 62d2f3d8a9a7161320d43d88476905fb5132b34cd97ccf9d14d9860d0ec2cf41

| iBoot = iBoot.n61.RELEASE.im4p
| iBootIV = fc844a8fd16692bcfbcc09a8d61a8baa
| iBootKey = b4947988635695173efed8cdfa5c282266da7baa06aff733248d2453fda31a6d

| iBSS = iBSS.n61.RELEASE.im4p
| iBSSIV = 2237e1a3f637055a1ad11eef485f036e
| iBSSKey = 97f4cda4d59e4aeae12bcd8afa9beff39173e9d568b0470c9c7a5076353f6e9f

| Kernelcache = kernelcache.release.iphone7
| KernelcacheIV = Not Encrypted

| LLB = LLB.n61.RELEASE.im4p
| LLBIV = 9f2093d67f5482f415007a4c85797fe6
| LLBKey = c51ae27c4e0e34b02450505451a347dda13c35f2f68b9f304160adc34bfd88ee

| RecoveryMode = recoverymode@1334~iphone-lightning.im4p
| RecoveryModeIV = Not Encrypted

| SEPFirmware = sep-firmware.n61.RELEASE.im4p
| SEPFirmwareIV = Unknown
| SEPFirmwareKey = Unknown
| SEPFirmwareKBAG = f9a26de33ff3b6a9787d716e0773c0cba0c63198129af72c6aa8f5a8339e694d937354a03a2bda37e2a063fb72705ad0

}}

PeaceSecYukonC 16G140 (iPhone7,2)

2020-02-24T08:26:21Z

Kiddepants: Thanks @a1exdandy

{{keys
| Version = 12.4.4
| Build = 16G140
| Device = iPhone7,2
| Codename = PeaceSecYukonC
| Baseband = 7.80.04
| DownloadURL = https://updates.cdn-apple.com/2019FallFCS/fullrestores/061-37750/DEB56BCA-0BFC-11EA-AA76-70FE7531BBAA/iPhone_4.7_12.4.4_16G140_Restore.ipsw

| RootFS = 038-11934-004
| RootFSKey = Not Encrypted

| UpdateRamdisk = 038-12536-004
| UpdateRamdiskIV = Not Encrypted

| RestoreRamdisk = 038-13022-004
| RestoreRamdiskIV = Not Encrypted

| AppleLogo = applelogo@2x~iphone.im4p
| AppleLogoIV = Not Encrypted

| BatteryCharging0 = batterycharging0@2x~iphone.im4p
| BatteryCharging0IV = Not Encrypted

| BatteryCharging1 = batterycharging1@2x~iphone.im4p
| BatteryCharging1IV = Not Encrypted

| BatteryFull = batteryfull@2x~iphone.im4p
| BatteryFullIV = Not Encrypted

| BatteryLow0 = batterylow0@2x~iphone.im4p
| BatteryLow0IV = Not Encrypted

| BatteryLow1 = batterylow1@2x~iphone.im4p
| BatteryLow1IV = Not Encrypted

| DeviceTree = DeviceTree.n61ap.im4p
| DeviceTreeIV = Not Encrypted

| GlyphPlugin = glyphplugin@1334~iphone-lightning.im4p
| GlyphPluginIV = Not Encrypted

| iBEC = iBEC.n61.RELEASE.im4p
| iBECIV = cd4ce0e1edc721258f37556f4767d6c7
| iBECKey = 62d2f3d8a9a7161320d43d88476905fb5132b34cd97ccf9d14d9860d0ec2cf41

| iBoot = iBoot.n61.RELEASE.im4p
| iBootIV = fc844a8fd16692bcfbcc09a8d61a8baa
| iBootKey = b4947988635695173efed8cdfa5c282266da7baa06aff733248d2453fda31a6d

| iBSS = iBSS.n61.RELEASE.im4p
| iBSSIV = 2237e1a3f637055a1ad11eef485f036e
| iBSSKey = 97f4cda4d59e4aeae12bcd8afa9beff39173e9d568b0470c9c7a5076353f6e9f

| Kernelcache = kernelcache.release.iphone7
| KernelcacheIV = Not Encrypted

| LLB = LLB.n61.RELEASE.im4p
| LLBIV = 9f2093d67f5482f415007a4c85797fe6
| LLBKey = c51ae27c4e0e34b02450505451a347dda13c35f2f68b9f304160adc34bfd88ee

| RecoveryMode = recoverymode@1334~iphone-lightning.im4p
| RecoveryModeIV = Not Encrypted

| SEPFirmware = sep-firmware.n61.RELEASE.im4p
| SEPFirmwareIV = Unknown
| SEPFirmwareKey = Unknown
| SEPFirmwareKBAG = f9a26de33ff3b6a9787d716e0773c0cba0c63198129af72c6aa8f5a8339e694d937354a03a2bda37e2a063fb72705ad0

}}

PeaceG 16G130 (iPhone7,2)

2020-02-24T08:25:03Z

Kiddepants: Thanks @a1exdandy

{{keys
| Version = 12.4.3
| Build = 16G130
| Device = iPhone7,2
| Codename = PeaceG
| Baseband = 7.80.04
| DownloadURL = https://updates.cdn-apple.com/2019FallFCS/fullrestores/061-32402/20A23F00-F0CC-11E9-A9B1-77BD38B10759/iPhone_4.7_12.4.3_16G130_Restore.ipsw

| RootFS = 048-76490-103
| RootFSKey = Not Encrypted

| UpdateRamdisk = 048-76167-104
| UpdateRamdiskIV = Not Encrypted

| RestoreRamdisk = 048-78047-104
| RestoreRamdiskIV = Not Encrypted

| AppleLogo = applelogo@2x~iphone.im4p
| AppleLogoIV = Not Encrypted

| BatteryCharging0 = batterycharging0@2x~iphone.im4p
| BatteryCharging0IV = Not Encrypted

| BatteryCharging1 = batterycharging1@2x~iphone.im4p
| BatteryCharging1IV = Not Encrypted

| BatteryFull = batteryfull@2x~iphone.im4p
| BatteryFullIV = Not Encrypted

| BatteryLow0 = batterylow0@2x~iphone.im4p
| BatteryLow0IV = Not Encrypted

| BatteryLow1 = batterylow1@2x~iphone.im4p
| BatteryLow1IV = Not Encrypted

| DeviceTree = DeviceTree.n61ap.im4p
| DeviceTreeIV = Not Encrypted

| GlyphPlugin = glyphplugin@1334~iphone-lightning.im4p
| GlyphPluginIV = Not Encrypted

| iBEC = iBEC.n61.RELEASE.im4p
| iBECIV = cd4ce0e1edc721258f37556f4767d6c7
| iBECKey = 62d2f3d8a9a7161320d43d88476905fb5132b34cd97ccf9d14d9860d0ec2cf41

| iBoot = iBoot.n61.RELEASE.im4p
| iBootIV = fc844a8fd16692bcfbcc09a8d61a8baa
| iBootKey = b4947988635695173efed8cdfa5c282266da7baa06aff733248d2453fda31a6d

| iBSS = iBSS.n61.RELEASE.im4p
| iBSSIV = 2237e1a3f637055a1ad11eef485f036e
| iBSSKey = 97f4cda4d59e4aeae12bcd8afa9beff39173e9d568b0470c9c7a5076353f6e9f

| Kernelcache = kernelcache.release.iphone7
| KernelcacheIV = Not Encrypted

| LLB = LLB.n61.RELEASE.im4p
| LLBIV = 9f2093d67f5482f415007a4c85797fe6
| LLBKey = c51ae27c4e0e34b02450505451a347dda13c35f2f68b9f304160adc34bfd88ee

| RecoveryMode = recoverymode@1334~iphone-lightning.im4p
| RecoveryModeIV = Not Encrypted

| SEPFirmware = sep-firmware.n61.RELEASE.im4p
| SEPFirmwareIV = Unknown
| SEPFirmwareKey = Unknown
| SEPFirmwareKBAG = f9a26de33ff3b6a9787d716e0773c0cba0c63198129af72c6aa8f5a8339e694d937354a03a2bda37e2a063fb72705ad0

}}

PeaceG 16G114 (iPhone7,2)

2020-02-24T08:23:45Z

Kiddepants: Thanks @a1exdandy

{{keys
| Version = 12.4.2
| Build = 16G114
| Device = iPhone7,2
| Codename = PeaceG
| Baseband = 7.80.04
| DownloadURL = https://updates.cdn-apple.com/2019SummerFCS/fullrestores/061-20436/FD3DCFA0-DC8C-11E9-ABB0-288C66A83945/iPhone_4.7_12.4.2_16G114_Restore.ipsw

| RootFS = 048-76490-100
| RootFSKey = Not Encrypted

| UpdateRamdisk = 048-76167-101
| UpdateRamdiskIV = Not Encrypted

| RestoreRamdisk = 048-78047-101
| RestoreRamdiskIV = Not Encrypted

| AppleLogo = applelogo@2x~iphone.im4p
| AppleLogoIV = Not Encrypted

| BatteryCharging0 = batterycharging0@2x~iphone.im4p
| BatteryCharging0IV = Not Encrypted

| BatteryCharging1 = batterycharging1@2x~iphone.im4p
| BatteryCharging1IV = Not Encrypted

| BatteryFull = batteryfull@2x~iphone.im4p
| BatteryFullIV = Not Encrypted

| BatteryLow0 = batterylow0@2x~iphone.im4p
| BatteryLow0IV = Not Encrypted

| BatteryLow1 = batterylow1@2x~iphone.im4p
| BatteryLow1IV = Not Encrypted

| DeviceTree = DeviceTree.n61ap.im4p
| DeviceTreeIV = Not Encrypted

| GlyphPlugin = glyphplugin@1334~iphone-lightning.im4p
| GlyphPluginIV = Not Encrypted

| iBEC = iBEC.n61.RELEASE.im4p
| iBECIV = cd4ce0e1edc721258f37556f4767d6c7
| iBECKey = 62d2f3d8a9a7161320d43d88476905fb5132b34cd97ccf9d14d9860d0ec2cf41

| iBoot = iBoot.n61.RELEASE.im4p
| iBootIV = fc844a8fd16692bcfbcc09a8d61a8baa
| iBootKey = b4947988635695173efed8cdfa5c282266da7baa06aff733248d2453fda31a6d

| iBSS = iBSS.n61.RELEASE.im4p
| iBSSIV = 2237e1a3f637055a1ad11eef485f036e
| iBSSKey = 97f4cda4d59e4aeae12bcd8afa9beff39173e9d568b0470c9c7a5076353f6e9f

| Kernelcache = kernelcache.release.iphone7
| KernelcacheIV = Not Encrypted

| LLB = LLB.n61.RELEASE.im4p
| LLBIV = 9f2093d67f5482f415007a4c85797fe6
| LLBKey = c51ae27c4e0e34b02450505451a347dda13c35f2f68b9f304160adc34bfd88ee

| RecoveryMode = recoverymode@1334~iphone-lightning.im4p
| RecoveryModeIV = Not Encrypted

| SEPFirmware = sep-firmware.n61.RELEASE.im4p
| SEPFirmwareIV = Unknown
| SEPFirmwareKey = Unknown
| SEPFirmwareKBAG = f9a26de33ff3b6a9787d716e0773c0cba0c63198129af72c6aa8f5a8339e694d937354a03a2bda37e2a063fb72705ad0

}}

PeaceG 16G77 (iPhone7,2)

2020-02-24T08:22:18Z

Kiddepants: Thanks @a1exdandy

{{keys
| Version = 12.4
| Build = 16G77
| Device = iPhone7,2
| Codename = PeaceG
| Baseband = 7.80.04
| DownloadURL = https://updates.cdn-apple.com/2019SummerFCS/fullrestores/041-86577/9E2ACCF8-A743-11E9-A35C-D2077EC3910A/iPhone_4.7_12.4_16G77_Restore.ipsw

| RootFS = 048-76490-092
| RootFSKey = Not Encrypted

| UpdateRamdisk = 048-76167-092
| UpdateRamdiskIV = Not Encrypted

| RestoreRamdisk = 048-78047-092
| RestoreRamdiskIV = Not Encrypted

| AppleLogo = applelogo@2x~iphone.im4p
| AppleLogoIV = Not Encrypted

| BatteryCharging0 = batterycharging0@2x~iphone.im4p
| BatteryCharging0IV = Not Encrypted

| BatteryCharging1 = batterycharging1@2x~iphone.im4p
| BatteryCharging1IV = Not Encrypted

| BatteryFull = batteryfull@2x~iphone.im4p
| BatteryFullIV = Not Encrypted

| BatteryLow0 = batterylow0@2x~iphone.im4p
| BatteryLow0IV = Not Encrypted

| BatteryLow1 = batterylow1@2x~iphone.im4p
| BatteryLow1IV = Not Encrypted

| DeviceTree = DeviceTree.n61ap.im4p
| DeviceTreeIV = Not Encrypted

| GlyphPlugin = glyphplugin@1334~iphone-lightning.im4p
| GlyphPluginIV = Not Encrypted

| iBEC = iBEC.n61.RELEASE.im4p
| iBECIV = 5206c41313da7476a9660a01e6b04090
| iBECKey = d29a487501ae6eb0056ef20f6d43b99dd67914ce324150c186e8792d527be459

| iBoot = iBoot.n61.RELEASE.im4p
| iBootIV = 0820d9bee7da6c1b012607050cfbab73
| iBootKey = b875c2c20f5f925ae6238ae451e8ff5707e6e78ab21c6623ba1b8fdc8bd19575

| iBSS = iBSS.n61.RELEASE.im4p
| iBSSIV = c108cb291b1b9edb4efbf37ca2b14652
| iBSSKey = 824f8e679b5ca27a8e7d1dae67258270e35a44e733ec99096a222c9f65d6e1c2

| Kernelcache = kernelcache.release.iphone7
| KernelcacheIV = Not Encrypted

| LLB = LLB.n61.RELEASE.im4p
| LLBIV = 111494e69c7667bdb957fe6bc5737b41
| LLBKey = 9d281a3a5b9757d0b635c70d6a69f6eccb7893a1efc339b667f3f8890c657671

| RecoveryMode = recoverymode@1334~iphone-lightning.im4p
| RecoveryModeIV = Not Encrypted

| SEPFirmware = sep-firmware.n61.RELEASE.im4p
| SEPFirmwareIV = Unknown
| SEPFirmwareKey = Unknown
| SEPFirmwareKBAG = 4af1f47e99281427ac950aaae87faf5eca7d41dcde276e6abd88f08f1eb20eaf4a10e47dceef1bb867619a475fa45849

}}

PeaceF 16F203 (iPhone7,2)

2020-02-24T08:19:53Z

Kiddepants: Thanks @a1exdandy

{{keys
| Version = 12.3.1
| Build = 16F203
| Device = iPhone7,2
| Codename = PeaceF
| Baseband = 7.70.01
| DownloadURL = https://updates.cdn-apple.com/2019SpringFCS/fullrestores/041-68903/CC343F30-7C96-11E9-B886-4FF06256CCDB/iPhone_4.7_12.3.1_16F203_Restore.ipsw

| RootFS = 048-42931-182
| RootFSKey = Not Encrypted

| UpdateRamdisk = 048-42908-184
| UpdateRamdiskIV = Not Encrypted

| RestoreRamdisk = 048-43177-185
| RestoreRamdiskIV = Not Encrypted

| AppleLogo = applelogo@2x~iphone.im4p
| AppleLogoIV = Not Encrypted

| BatteryCharging0 = batterycharging0@2x~iphone.im4p
| BatteryCharging0IV = Not Encrypted

| BatteryCharging1 = batterycharging1@2x~iphone.im4p
| BatteryCharging1IV = Not Encrypted

| BatteryFull = batteryfull@2x~iphone.im4p
| BatteryFullIV = Not Encrypted

| BatteryLow0 = batterylow0@2x~iphone.im4p
| BatteryLow0IV = Not Encrypted

| BatteryLow1 = batterylow1@2x~iphone.im4p
| BatteryLow1IV = Not Encrypted

| DeviceTree = DeviceTree.n61ap.im4p
| DeviceTreeIV = Not Encrypted

| GlyphPlugin = glyphplugin@1334~iphone-lightning.im4p
| GlyphPluginIV = Not Encrypted

| iBEC = iBEC.n61.RELEASE.im4p
| iBECIV = 8e55ecfa2544c3a6f120476e8eb47505
| iBECKey = d7d3b285fcd33f230e2e9fceb6b4e21730db2ebd026a0844a52a63da9433a82b

| iBoot = iBoot.n61.RELEASE.im4p
| iBootIV = db1b5419e3525960820e39b2ea784636
| iBootKey = 0acd488f166ca20d306af254bba8a167c5f81dbc634db8b8759e94a4aecd77d1

| iBSS = iBSS.n61.RELEASE.im4p
| iBSSIV = 5fbd44bde97fcb9aacb4f7aa1acd888b
| iBSSKey = 94e4c3a3e6f81c49c928f8b631e692cc906bdad8b559c26868966454774d18f4

| Kernelcache = kernelcache.release.iphone7
| KernelcacheIV = Not Encrypted

| LLB = LLB.n61.RELEASE.im4p
| LLBIV = 986f30a91647a75ff9ecc46383207fe3
| LLBKey = 5d6b0e89f0e1431107d289030498f188db073c9c5f14a5148bfb05655c58c78e

| RecoveryMode = recoverymode@1334~iphone-lightning.im4p
| RecoveryModeIV = Not Encrypted

| SEPFirmware = sep-firmware.n61.RELEASE.im4p
| SEPFirmwareIV = Unknown
| SEPFirmwareKey = Unknown
| SEPFirmwareKBAG = 22773d20a9fd545c3f92a8a76f296029c26e7d57b9a60d396f2f50a1ea406ad5a8ce820887e53233e844d4941984dee7

}}

PeaceF 16F156 (iPhone7,2)

2020-02-24T08:18:39Z

Kiddepants: Thanks @a1exdandy

{{keys
| Version = 12.3
| Build = 16F156
| Device = iPhone7,2
| Codename = PeaceF
| Baseband = 7.70.01
| DownloadURL = https://updates.cdn-apple.com/2019SpringFCS/fullrestores/041-61795/B8E4BB08-71E2-11E9-AF43-0B84412A1E9F/iPhone_4.7_12.3_16F156_Restore.ipsw

| RootFS = 048-42931-178
| RootFSKey = Not Encrypted

| UpdateRamdisk = 048-42908-180
| UpdateRamdiskIV = Not Encrypted

| RestoreRamdisk = 048-43177-181
| RestoreRamdiskIV = Not Encrypted

| AppleLogo = applelogo@2x~iphone.im4p
| AppleLogoIV = Not Encrypted

| BatteryCharging0 = batterycharging0@2x~iphone.im4p
| BatteryCharging0IV = Not Encrypted

| BatteryCharging1 = batterycharging1@2x~iphone.im4p
| BatteryCharging1IV = Not Encrypted

| BatteryFull = batteryfull@2x~iphone.im4p
| BatteryFullIV = Not Encrypted

| BatteryLow0 = batterylow0@2x~iphone.im4p
| BatteryLow0IV = Not Encrypted

| BatteryLow1 = batterylow1@2x~iphone.im4p
| BatteryLow1IV = Not Encrypted

| DeviceTree = DeviceTree.n61ap.im4p
| DeviceTreeIV = Not Encrypted

| GlyphPlugin = glyphplugin@1334~iphone-lightning.im4p
| GlyphPluginIV = Not Encrypted

| iBEC = iBEC.n61.RELEASE.im4p
| iBECIV = fa83dd075a2a75d092f94c9e560e9ca0
| iBECKey = ba8bfa7201af457d21793351030bc80b3f170c780fb24d38487bc1887b5bcc0d

| iBoot = iBoot.n61.RELEASE.im4p
| iBootIV = be8dd8a7516271037b068d21bba06fbe
| iBootKey = 01838363198711640573170a186e1ae712b15140455603d74ac691dea0dd0c02

| iBSS = iBSS.n61.RELEASE.im4p
| iBSSIV = 41dca3e3458f03875f845cc99e2cbe38
| iBSSKey = 48eee34433e666b96894470091fb9d348efe1e2e2be13207a9086ecfc40090f0

| Kernelcache = kernelcache.release.iphone7
| KernelcacheIV = Not Encrypted

| LLB = LLB.n61.RELEASE.im4p
| LLBIV = f13eed84f2a091c5abba272042bd8739
| LLBKey = 8f4f1cce15a11832776aa3f83b5f7bb45481c85fc95438ecfec031a776a6b3b2

| RecoveryMode = recoverymode@1334~iphone-lightning.im4p
| RecoveryModeIV = Not Encrypted

| SEPFirmware = sep-firmware.n61.RELEASE.im4p
| SEPFirmwareIV = Unknown
| SEPFirmwareKey = Unknown
| SEPFirmwareKBAG = e3306314f39ff4ae5dff35b1f97e0ab63078f0ff640e23829c4d4e8d9f2d0383365f7519539229fe01716e50c6009246

}}

PeaceE 16E227 (iPhone7,2)

2020-02-24T08:16:01Z

Kiddepants: Thanks @a1exdandy

{{keys
| Version = 12.2
| Build = 16E227
| Device = iPhone7,2
| Codename = PeaceE
| Baseband = 7.55.01
| DownloadURL = https://updates.cdn-apple.com/2019SpringFCS/fullrestores/041-06917/ECD402F4-499F-11E9-85D3-E64576CE070F/iPhone_4.7_12.2_16E227_Restore.ipsw

| RootFS = 048-41588-148
| RootFSKey = Not Encrypted

| UpdateRamdisk = 048-23611-271
| UpdateRamdiskIV = Not Encrypted

| RestoreRamdisk = 048-23877-271
| RestoreRamdiskIV = Not Encrypted

| AppleLogo = applelogo@2x~iphone.im4p
| AppleLogoIV = Not Encrypted

| BatteryCharging0 = batterycharging0@2x~iphone.im4p
| BatteryCharging0IV = Not Encrypted

| BatteryCharging1 = batterycharging1@2x~iphone.im4p
| BatteryCharging1IV = Not Encrypted

| BatteryFull = batteryfull@2x~iphone.im4p
| BatteryFullIV = Not Encrypted

| BatteryLow0 = batterylow0@2x~iphone.im4p
| BatteryLow0IV = Not Encrypted

| BatteryLow1 = batterylow1@2x~iphone.im4p
| BatteryLow1IV = Not Encrypted

| DeviceTree = DeviceTree.n61ap.im4p
| DeviceTreeIV = Not Encrypted

| GlyphPlugin = glyphplugin@1334~iphone-lightning.im4p
| GlyphPluginIV = Not Encrypted

| iBEC = iBEC.n61.RELEASE.im4p
| iBECIV = fe80c2e8c05308131171bc2f362a48e6
| iBECKey = 7568dbad963f3c813ca14941152620cfc12a842f7b4cf0a1ed6edc6ce1ba0eb4

| iBoot = iBoot.n61.RELEASE.im4p
| iBootIV = d47d7e138f5cd533b55c4a135d73108c
| iBootKey = ba0f86db8b9dcdbd8f62ed102ab7bcf54e293ab22bb670dc60b8347889491f2b

| iBSS = iBSS.n61.RELEASE.im4p
| iBSSIV = a8260d49fb704612a89807ed55184be1
| iBSSKey = b0c6c606faa50c50b36f16e5406acf362fab508df2ce8f82fd1845796d9d32a6

| Kernelcache = kernelcache.release.iphone7
| KernelcacheIV = Not Encrypted

| LLB = LLB.n61.RELEASE.im4p
| LLBIV = 93b824a4cc70f170d6c133d3e450ff80
| LLBKey = 702268e6453705ca013ceab226299a8ca45993061536044acab357ee2266f962

| RecoveryMode = recoverymode@1334~iphone-lightning.im4p
| RecoveryModeIV = Not Encrypted

| SEPFirmware = sep-firmware.n61.RELEASE.im4p
| SEPFirmwareIV = Unknown
| SEPFirmwareKey = Unknown
| SEPFirmwareKBAG = e6d79c6047e8b6bc1966a689642b782d5c67f64a8acc5bb9d9386774369d5b8912fdf9ff2b718d8fe022867471262d45

}}

PeaceD 16D57 (iPhone7,2)

2020-02-24T08:14:13Z

Kiddepants: Thanks @a1exdandy

{{keys
| Version = 12.1.4
| Build = 16D57
| Device = iPhone7,2
| Codename = PeaceD
| Baseband = 7.32.00
| DownloadURL = https://updates.cdn-apple.com/2019WinterFCS/fullrestores/041-39257/32129B6C-292C-11E9-9E72-4511412B0A59/iPhone_4.7_12.1.4_16D57_Restore.ipsw

| RootFS = 048-48527-047
| RootFSKey = Not Encrypted

| UpdateRamdisk = 048-47614-048
| UpdateRamdiskIV = Not Encrypted

| RestoreRamdisk = 048-48002-048
| RestoreRamdiskIV = Not Encrypted

| AppleLogo = applelogo@2x~iphone.im4p
| AppleLogoIV = Not Encrypted

| BatteryCharging0 = batterycharging0@2x~iphone.im4p
| BatteryCharging0IV = Not Encrypted

| BatteryCharging1 = batterycharging1@2x~iphone.im4p
| BatteryCharging1IV = Not Encrypted

| BatteryFull = batteryfull@2x~iphone.im4p
| BatteryFullIV = Not Encrypted

| BatteryLow0 = batterylow0@2x~iphone.im4p
| BatteryLow0IV = Not Encrypted

| BatteryLow1 = batterylow1@2x~iphone.im4p
| BatteryLow1IV = Not Encrypted

| DeviceTree = DeviceTree.n61ap.im4p
| DeviceTreeIV = Not Encrypted

| GlyphPlugin = glyphplugin@1334~iphone-lightning.im4p
| GlyphPluginIV = Not Encrypted

| iBEC = iBEC.n61.RELEASE.im4p
| iBECIV = ee091c44f1d30dfc2f4244f4709cb266
| iBECKey = ce2badff96592d721d73cfd80f2426dccd8dcc445533a587b3fe8961f85279ee

| iBoot = iBoot.n61.RELEASE.im4p
| iBootIV = e4e855b2405c39bd1477f366df8cf3fb
| iBootKey = 4c2b4a056cc2f3047aba6e2de49e22b72fc130725537dcde1d17eaec5a8c4287

| iBSS = iBSS.n61.RELEASE.im4p
| iBSSIV = bbd367692212ae3512d98d7c326a0065
| iBSSKey = 958c34f549e176d411f6e420b449d4acfe85c3f996ea6cba45d196154297a96b

| Kernelcache = kernelcache.release.iphone7
| KernelcacheIV = Not Encrypted

| LLB = LLB.n61.RELEASE.im4p
| LLBIV = 4ce2a732d752cf59f7a5ec06593ac48f
| LLBKey = b74d21a4b4e3ca476d219c7bcd4696d72f2fca5dcb0ad8fe2f2fb3c21dbd083b

| RecoveryMode = recoverymode@1334~iphone-lightning.im4p
| RecoveryModeIV = Not Encrypted

| SEPFirmware = sep-firmware.n61.RELEASE.im4p
| SEPFirmwareIV = Unknown
| SEPFirmwareKey = Unknown
| SEPFirmwareKBAG = 7b7488009742aa3006fe0508742bae60716319493119d56fa9c400e0025dd1c4c43f4b5999a61b6ea84ac6cda45f6f11

}}