palera1n

An iOS 15.0-16.3 work-in-progress, (semi-)tethered checkm8 jailbreak.

Change Log • Discord • Twitter

How does it work?

It boots the device with multiple patches required. On first run, it'll boot a ramdisk which dumps your onboard blob, creates a fakefs (if using semi-tethered), installs the loader app, and patches your kernel.

Requirements

• A checkm8 vulnerable iOS device on iOS 15 or 16 (A8-A11)

  • The device must be on iOS 15.0-16.3
    • palera1n will never work with devices above the iPhone X/A11. Please stop asking in the Discord, and remember: this is mainly a developer jailbreak
  • If you want the device to be semi-tethered, you will need 5-10GB of space for the fakefs. This means that 16GB devices cannot be semi-tethered

  • A10 and A11 devices

    • On A10 and A11, you must disable your passcode while in the jailbroken state.
    • On iOS 16 A10+, if you EVER enabled a passcode on 16, you have to reset through the settings app/restore with a computer
    • On A10, this can be fixed in the future by implementing blackbird.
    • On A11, we don't have a SEP exploit yet.
    • In the meantime, we recommend FakePass if you would like a passcode

• A USB-A to Lightning cable

  • USB-C cables
    • 

• A Linux or macOS computer

  • Python 3 must be installed.
  • This must be a physical computer. Virtual machines do not work.
  • AMD CPUs have an issue [with (likely) their USB controllers] that causes them to have a very low success rate with checkm8. It is unrecommended that you use them with palera1n.
    • If your device does not successfully jailbreak, try a computer with an Intel or other CPU

Warning

• We are NOT responsible for any data loss, or the result of a device being bricked. The user of this program accepts responsibility should something happen to their device. While nothing should happen, jailbreaking has risks in itself.

How to use?

A tutorial can be found here.

Issues

Please first check the common issues document.

Still need help?

If you still need help, please join our Discord. We disabled issues due to the flood of spam, and difficulty to respond in general. We are much more comfortable on Discord.

Please, please, please, provide necessary info:

• iOS version and device (eg. iPhone 6s 15.3.1, iPhone X 16.0)

• Computer's OS and version (eg. Ubuntu 22.04, macOS 13.0)

• The command you ran

• Full log from the logs folder

DO NOT harass tweak devs if tweaks don't work. Refer to here for compatiblity.

You may join here.

Patreons

Thank you so much to our Patrons that make the future development possible! You may sub here, if you'd like to.

Repos

Tweaks mode

All repos work when using tweaks mode because it uses normal Procursus and not rootless.

Rootless

Repos need to be updated for rootless, here are some that work currently:

• Mineek's repo contains rootless Procursus packages
• The official palera1n repo contains miscellaneous packages

If you want to make a rootless repo, use the official palera1n repo for reference. Every deb should use the iphoneos-arm64 architecture, and nothing should be on the rootfs. Everything should be in /var/jb.

Credits

• Nathan
  • The ramdisk that dumps blobs, copies files, and duplicates rootfs is a slimmed down version of SSHRD_Script
  • For modified restored_external
  • Also helped Mineek getting the kernel up and running and with the patches
  • Helping with adding multiple device support
  • Fixing issues relating to camera.. etc by switching to fsboot
  • iBoot64Patcher fork
• Mineek
  • For the patching and booting commands
  • Adding tweak support
  • For patchfinders for RELEASE kernels
  • Kernel15Patcher
  • Kernel64Patcher
  • Work on jbinit, together with Nick Chan
• Amy for the Pogo app
• checkra1n for the base of the kpf
• nyuszika7h for the script to help get into DFU
• the Procursus Team for the amazing bootstrap
• F121 for helping test
• m1sta for pyimg4
• tihmstar for pzb/original iBoot64Patcher/original liboffsetfinder64/img4tool
• Tom for a couple patches and bugfixes
  • For maintaining Kernel64Patcher
• xerub for img4lib and restored_external in the ramdisk
• Cryptic for iBoot64Patcher fork, and liboffsetfinder64 fork
• libimobiledevice for several tools used in this project (irecovery, ideviceenterrecovery etc), and nikias for keeping it up to date
• Nick Chan general help with patches and iBoot payload stuff
• Dora for iBoot payload and iBootpatcher2
• Sam Bingner for Substitute
• Serena for helping with boot ramdisk.