mirror of
https://github.com/palera1n/palera1n.git
synced 2026-10-21 09:47:01 +02:00
5 files changed
+1014
No files matched your search
+626
@@ -0,0 +1,626 @@
|
||||
.\"-
|
||||
.\" Copyright (c) 2026 Nick Chan
|
||||
.\" SPDX-License-Identifier: MIT
|
||||
.\"
|
||||
.Dd "23 December 2024"
|
||||
.Dt palera1n 1
|
||||
.Sh NAME
|
||||
.Nm palera1n
|
||||
.Nd arm64 iOS/iPadOS/tvOS 15-26, bridgeOS 5-10 jailbreaking tool
|
||||
.Sh SYNOPSIS
|
||||
.Nm
|
||||
.Op Fl hvlfcBsTVpednq
|
||||
.Op Fl e Ar Boot arguments
|
||||
.Op Fl k Ar Pongo image
|
||||
.Op Fl o Ar overlay file
|
||||
.Op Fl r Ar ramdisk file
|
||||
.Op Fl K Ar KPF file
|
||||
.Op Fl -cli
|
||||
.Op Fl -gui
|
||||
.Op Fl -tui
|
||||
.Op Fl -force-revert
|
||||
.Op Fl -dark-blockchain
|
||||
.Op Fl -force-enable-ssv
|
||||
.Sh DESCRIPTION
|
||||
.Nm
|
||||
jailbreaks an arm64 (arm64e excluded) iOS/iPadOS/tvOS 15-26, bridgeOS 5-10 device,
|
||||
utilizing the
|
||||
.Em checkm8
|
||||
bootROM exploit.
|
||||
.Pp
|
||||
.Nm
|
||||
provides rootful and rootless jailbreak modes.
|
||||
On iOS/iPadOS 15.0 and later,
|
||||
.Nm
|
||||
is able to jailbreak the device in fakefs-rootful mode, where /
|
||||
is writable, as well as rootless mode, where / cannot be written to.
|
||||
On tvOS and bridgeOS,
|
||||
only rootful is supported. On versions where fakefs-rootful is not
|
||||
applicable, palera1n modifies the actual root filesystem instead
|
||||
of making a fakefs.
|
||||
.Pp
|
||||
Due to the nature of the
|
||||
.Em checkm8
|
||||
exploit,
|
||||
.Nm
|
||||
is semi-tethered. That is, you must run the
|
||||
.Nm
|
||||
tool after the device reboot in order to enter the jailbroken state.
|
||||
However, it is not required for the device to boot.
|
||||
.Pp
|
||||
On A11 devices, that is, iPhone 8, iPhone 8 Plus and iPhone X, the passcode cannot
|
||||
be used.
|
||||
.Pp
|
||||
On iOS 15, the passcode must be off while jailbroken.
|
||||
.Pp
|
||||
On iOS 16, the passcode must be off since restore, and
|
||||
.Sy Reset All Contents and Settings
|
||||
from settings app counts as a restore.
|
||||
A backup may be used in this case.
|
||||
.Pp
|
||||
In the remainder of this document, the term "iOS" and "iPadOS" will be used interchangably
|
||||
as the difference is negligible as far as the jailbreak is concerened.
|
||||
.Pp
|
||||
.Sh SUPPORTED DEVICES
|
||||
As described above, arm64 iOS 15.0-26.0 devices are supported, here is an explicit
|
||||
list of supported devicecs:
|
||||
|
||||
.Bl -tag -compact
|
||||
.It iPhone 6s
|
||||
.It iPhone 6s Plus
|
||||
.It iPhone SE (2016)
|
||||
.It iPhone 7
|
||||
.It iPhone 7 Plus
|
||||
.It iPhone 8
|
||||
.It iPhone 8 Plus
|
||||
.It iPhone X
|
||||
.El
|
||||
|
||||
.Bl -tag -compact
|
||||
.It iPad mini 4
|
||||
.It iPad Air 2
|
||||
.It iPad (5th generation)
|
||||
.It iPad (6th generation)
|
||||
.It iPad (7th generation)
|
||||
.It iPad Pro (9.7")
|
||||
.It iPad Pro (12.9") (1st generation)
|
||||
.It iPad Pro (10.5")
|
||||
.It iPad Pro (12.9") (2nd generation)
|
||||
.El
|
||||
|
||||
.Bl -tag -compact
|
||||
.It iPod Touch (7th generation)
|
||||
.El
|
||||
|
||||
.Bl -tag -compact
|
||||
.It Apple TV HD
|
||||
.It Apple TV 4K (1st generation)
|
||||
.El
|
||||
|
||||
.Bl -tag -compact
|
||||
.It Apple T2 iMacPro1,1
|
||||
.It Apple T2 MacBookPro15,1
|
||||
.It Apple T2 MacBookPro15,2
|
||||
.It Apple T2 Macmini8,1
|
||||
.It Apple T2 MacPro7,1
|
||||
.It Apple T2 MacBookPro15,3
|
||||
.It Apple T2 MacBookAir8,1
|
||||
.It Apple T2 MacBookPro15,4
|
||||
.It Apple T2 MacBookAir8,2
|
||||
.It Apple T2 MacBookPro16,1
|
||||
.It Apple T2 MacBookAir9,1
|
||||
.It Apple T2 MacBookPro16,2
|
||||
.It Apple T2 iMac20,1
|
||||
.It Apple T2 iMac20,2
|
||||
.It Apple T2 MacBookPro16,3
|
||||
.It Apple T2 MacBookPro16,4
|
||||
.El
|
||||
|
||||
Support for the A8 HomePod on Darwin 21 and above could be added,
|
||||
but it is currently unsupported.
|
||||
|
||||
arm64e devices will NEVER be supported.
|
||||
|
||||
|
||||
|
||||
.Sh OPTIONS
|
||||
.Bl -tag -width -indent
|
||||
|
||||
|
||||
|
||||
.It Fl h , -help
|
||||
Prints usage information.
|
||||
|
||||
.It Fl v , -version
|
||||
Prints the program version and exit.
|
||||
|
||||
.It Fl -cli
|
||||
Run in command line interface mode.
|
||||
|
||||
.It Fl -gui
|
||||
Run in graphical user interface mode.
|
||||
.Pp
|
||||
This argument is available only in builds compiled with
|
||||
.Cm WITH_GUI
|
||||
support enabled.
|
||||
|
||||
.It Fl -tui
|
||||
Run in text user interface mode.
|
||||
.Pp
|
||||
This argument is available only in builds compiled with
|
||||
.Cm WITH_TUI
|
||||
support enabled.
|
||||
|
||||
.It Fl -dark-blockchain
|
||||
Runs the jailbreak in hacker mode.
|
||||
|
||||
.It Fl -force-revert
|
||||
Remove the jailbreak while keeping user data. Some jailbreak files may remain
|
||||
after running this command. Additionally, jailbreak apps may remain on the
|
||||
home screen on for a while even when the files are deleted as the icon cache
|
||||
still has their icons. When used with
|
||||
|
||||
.It Fl -force-enable-ssv
|
||||
Force the jailbreak to detect Signed System Volume (SSV) as being required on
|
||||
the system. This option provides compatibility with previous version of palera1n
|
||||
that incorrectly detect SSV as being required on tvOS 18.2 and above. When using
|
||||
this option with
|
||||
.Fl f , -fakefs ,
|
||||
the jailbreak will behave as if fakefs is required, which allows the user to boot
|
||||
into fakefs possibly created by previous versions of palera1n, or remove it if
|
||||
the
|
||||
.Fl -force-revert
|
||||
option is specified as well.
|
||||
(It is technically possible to setup fakefs using this option as well, but this
|
||||
is not a supported scenario)
|
||||
|
||||
.Fl f , -rootful ,
|
||||
this will actually boot the device in rootless mode then delete the jailbreak
|
||||
files. As a result, using the loader app to install the jailbreak environment
|
||||
is not supported when this option is used together with
|
||||
.Fl f , -rootful
|
||||
\[char46]
|
||||
|
||||
.It Fl l , -rootless
|
||||
Proceed in rootless mode. This option is only supported on iOS/iPadOS.
|
||||
|
||||
.It Fl f , -rootful
|
||||
Proceed in rootful mode. Despite its name, this applies to both full, partial fakefs, as well as realfs, and it still applies even when trying to force revert.
|
||||
|
||||
.It Fl c , -setup-fakefs
|
||||
When used with
|
||||
.Fl f , -rootful ,
|
||||
creates the new APFS volume required for rootful. Will fail if one already exists.
|
||||
This flag is supported on iOS/iPadOS 15.0 or later and tvOS 18.2 or later, as they
|
||||
require fakefs for rootful.
|
||||
|
||||
.It Fl B , -setup-fakefs-partial
|
||||
Like
|
||||
.Fl c , -setup-fakefs
|
||||
but the size of the created fakefs is smaller at the expense of having unwritable
|
||||
parts in rarely-written paths. When jailbreaking 16 GB devices, this option must be used
|
||||
when setting up fakefs for rootful, as they do not have enough storage for full fakefs.
|
||||
This flag is supported on iOS/iPadOS 15.0 or later and tvOS 18.2 or later, as they
|
||||
require fakefs for rootful.
|
||||
|
||||
.It Fl s , -safe-mode
|
||||
Enter safe mode. An alert will be displayed on iOS/iPadOS/tvOS. Jailbreak daemons nor early boot executable files
|
||||
specified (see
|
||||
.Sy FILES
|
||||
section below) will be executed. The loader app and the built in SSH server can still be used,
|
||||
as well as any jailbreak-specific apps you have installed.
|
||||
|
||||
.It Fl T , -telnetd
|
||||
Enable the TELNET daemon on port 46, all interfaces. Please note that there is no authentication and is therefore insecure.
|
||||
|
||||
.It Fl V , -verbose-boot
|
||||
Boots the device in verbose mode, allowing boot logs to be seen.
|
||||
|
||||
.It Fl p , -early-exit
|
||||
Exit after booting into a clean PongoOS shell.
|
||||
|
||||
.It Fl e , -extra-bootargs Ar boot arguments
|
||||
Specify custom XNU kernel command line. Additionally, the
|
||||
.Em wdt=-1
|
||||
argument is used during fakefs setup.
|
||||
|
||||
.It Fl k , -override-pongo Ar pongo file
|
||||
Override PongoOS image. The raw image, named
|
||||
.Em Pongo.bin
|
||||
when built, should be used. PongoOS 2.6.0 or later is required.
|
||||
|
||||
.It Fl K , -override-kpf Ar KPF file
|
||||
Override the kernel patchfinder PongoOS module. The module is required to support setting
|
||||
root filesystem in paleinfo with
|
||||
.Em rootfs
|
||||
command. If in doubt, use
|
||||
.Sy https://github.com/palera1n/PongoOS
|
||||
iOS15 branch or your own fork of it.
|
||||
|
||||
.It Fl o , -override-overlay Ar overlay file
|
||||
Specify the path to a custom overlay file, which is then mounted onto /cores/binpack
|
||||
during boot, if the default ramdisk is used. The default ramdisk expects the overlay
|
||||
to contain a folder named
|
||||
.Em Applications
|
||||
at the root of it, as well as a dmg named
|
||||
.Em loader.dmg
|
||||
at the root of it. Otherwise, the device will not boot. It is also expected that it
|
||||
contains a shell, a ssh server, and various command line utilities.
|
||||
|
||||
.It Fl r , -override-ramdisk Ar ramdisk file
|
||||
Override the ramdisk. At a very minimum, it should contain
|
||||
.Em /cores/ploosh
|
||||
as well as a fake dyld
|
||||
.Em /usr/lib/dyld
|
||||
where the logic is expected to be in.
|
||||
|
||||
.It Fl d , -debug-logging
|
||||
Enable debug logging. Supports up to 5 levels of verbosity, with 5 being the most verbose.
|
||||
|
||||
.It Fl n , -no-colors
|
||||
Disable colors on the command line.
|
||||
|
||||
.It Fl q , -quick
|
||||
When used with
|
||||
.Fl -tui ,
|
||||
or
|
||||
.Fl -gui ,
|
||||
the interfaces will automate the process of entering DFU mode, without needing to press the interface buttons for every step of the process.
|
||||
.Pp
|
||||
This variable is available only in builds compiled with
|
||||
.Cm WITH_GUI
|
||||
or
|
||||
.Cm WITH_TUI
|
||||
support enabled.
|
||||
|
||||
|
||||
.El
|
||||
.Sh ENVIRONMENTAL VARIABLES
|
||||
.Bl -tag -width -indent
|
||||
|
||||
|
||||
|
||||
.It Ev RA1N_ABORT_TIMEOUT
|
||||
Set a custom timeout value (0 to 999999999) for the exploit abort timer.
|
||||
While the default value is sufficient for standard platforms (Intel or Apple Silicon),
|
||||
this variable allows timing adjustments on specific environments such as Linux (AMD)
|
||||
or Raspberry Pi (ARM64), where the exploit may fail due to platform-specific USB
|
||||
stack behavior.
|
||||
.Pp
|
||||
E.g. Raspberry Pi 5:
|
||||
.Em RA1N_ABORT_TIMEOUT=1000000
|
||||
.Pp
|
||||
This variable is available only in builds compiled with
|
||||
.Cm WITH_CIDERRAIN
|
||||
support enabled.
|
||||
|
||||
.It Ev RA1N_CLI
|
||||
Equivalent to using the
|
||||
.Fl -cli
|
||||
option.
|
||||
|
||||
.It Ev RA1N_GUI
|
||||
Equivalent to using the
|
||||
.Fl -gui
|
||||
option.
|
||||
.Pp
|
||||
This variable is available only in builds compiled with
|
||||
.Cm WITH_GUI
|
||||
support enabled.
|
||||
|
||||
.It Ev RA1N_TUI
|
||||
Equivalent to using the
|
||||
.Fl -tui
|
||||
option.
|
||||
.Pp
|
||||
This variable is available only in builds compiled with
|
||||
.Cm WITH_TUI
|
||||
support enabled.
|
||||
|
||||
.It Ev RA1N_DARK_BLOCKCHAIN
|
||||
Equivalent to using the
|
||||
.Fl -dark-blockchain
|
||||
option.
|
||||
|
||||
.It Ev RA1N_FORCE_REVERT
|
||||
Equivalent to using the
|
||||
.Fl -force-revert
|
||||
option.
|
||||
|
||||
.It Ev RA1N_FORCE_ENABLE_SSV
|
||||
Equivalent to using the
|
||||
.Fl -force-enable-ssv
|
||||
option.
|
||||
|
||||
.It Ev RA1N_ROOTLESS
|
||||
Equivalent to using the
|
||||
.Fl l , -rootless
|
||||
option.
|
||||
|
||||
.It Ev RA1N_ROOTFUL
|
||||
Equivalent to using the
|
||||
.Fl f , -rootful
|
||||
option.
|
||||
|
||||
|
||||
.It Ev RA1N_SETUP_FAKEFS
|
||||
Equivalent to using the
|
||||
.Fl c , -setup-fakefs
|
||||
option.
|
||||
|
||||
.It Ev RA1N_SETUP_FAKEFS_PARTIAL
|
||||
Equivalent to using the
|
||||
.Fl B , -setup-fakefs-partial
|
||||
option.
|
||||
|
||||
.It Ev RA1N_SAFE_MODE
|
||||
Equivalent to using the
|
||||
.Fl s , -safe-mode
|
||||
option.
|
||||
|
||||
.It Ev RA1N_TELNETD
|
||||
Equivalent to using the
|
||||
.Fl T , -telnetd
|
||||
option.
|
||||
|
||||
.It Ev RA1N_VERBOSE_BOOT
|
||||
Equivalent to using the
|
||||
.Fl V , -verbose-boot
|
||||
option.
|
||||
|
||||
.It Ev RA1N_EARLY_EXIT
|
||||
Equivalent to using the
|
||||
.Fl p , -early-exit
|
||||
option.
|
||||
|
||||
.It Ev RA1N_EXTRA_BOOTARGS
|
||||
Equivalent to using the
|
||||
.Fl e , -extra-bootargs
|
||||
option.
|
||||
|
||||
.It Ev RA1N_OVERRIDE_PONGO
|
||||
Equivalent to using the
|
||||
.Fl k , -override-pongo
|
||||
option.
|
||||
|
||||
.It Ev RA1N_OVERRIDE_KPF
|
||||
Equivalent to using the
|
||||
.Fl K , -override-kpf
|
||||
option.
|
||||
|
||||
.It Ev RA1N_OVERRIDE_OVERLAY
|
||||
Equivalent to using the
|
||||
.Fl o , -override-overlay
|
||||
option.
|
||||
|
||||
.It Ev RA1N_OVERRIDE_RAMDISK
|
||||
Equivalent to using the
|
||||
.Fl r , -override-ramdisk
|
||||
option.
|
||||
|
||||
.It Ev RA1N_DEBUG_LOGGING
|
||||
Equivalent to using the
|
||||
.Fl d , -debug-logging
|
||||
option. Supports up to 5 levels of verbosity, with 5 being the most verbose.
|
||||
e.g. to enable level 3 debug logging, use
|
||||
.Em RA1N_DEBUG_LOGGING=3
|
||||
|
||||
.It Ev RA1N_NO_COLORS
|
||||
Equivalent to using the
|
||||
.Fl n , -no-colors
|
||||
option.
|
||||
|
||||
.It Ev RA1N_QUICK
|
||||
Equivalent to using the
|
||||
.Fl q , -quick
|
||||
option.
|
||||
.Pp
|
||||
This variable is available only in builds compiled with
|
||||
.Cm WITH_GUI
|
||||
or
|
||||
.Cm WITH_TUI
|
||||
support enabled.
|
||||
|
||||
|
||||
.El
|
||||
.Sh EXAMPLES
|
||||
|
||||
|
||||
|
||||
To (re-)jailbreak in rootless mode:
|
||||
.Pp
|
||||
.Dl "palera1n -l"
|
||||
.Pp
|
||||
|
||||
To setup fakefs for rootful mode:
|
||||
.Pp
|
||||
.Dl "palera1n -fc"
|
||||
.Pp
|
||||
After the device has rebooted into recovery mode, follow the following example.
|
||||
.Pp
|
||||
|
||||
To re-jailbreak in rootful mode:
|
||||
.Pp
|
||||
.Dl "palera1n -f"
|
||||
.Pp
|
||||
|
||||
To remove the jailbreak in rootful mode:
|
||||
.Pp
|
||||
.Dl "palera1n --force-revert -f"
|
||||
.Pp
|
||||
|
||||
To remove the jailbreak in rootless mode:
|
||||
.Pp
|
||||
.Dl "palera1n --force-revert"
|
||||
.Pp
|
||||
|
||||
To verbose boot in rootful mode:
|
||||
.Pp
|
||||
.Dl "palera1n -Vf"
|
||||
.Pp
|
||||
|
||||
To create a partial fakefs with bind mounts:
|
||||
.Pp
|
||||
.Dl "palera1n -Bf"
|
||||
.Pp
|
||||
|
||||
|
||||
.El
|
||||
.Sh CAVEATS
|
||||
|
||||
|
||||
|
||||
.Pp
|
||||
.Em -v
|
||||
is not a real XNU boot argument. It is interpreted by iBoot. However, since XNU
|
||||
boot arguments are set in PongoOS, which is ran after iBoot has ran, it does nothing.
|
||||
To verbose boot, use the
|
||||
.Fl V , -verbose-boot
|
||||
option when jailbreaking.
|
||||
.Pp
|
||||
Fakefs takes up around 5-10 GB of storage, and takes up to 10 minutes to setup.
|
||||
.Pp
|
||||
iOS 15.0 requires DER entitlements, and iOS 15.1 requires hash agility in code signatures.
|
||||
As a result, binaries with the old code signature format need to be resigned with a recent
|
||||
version of the Procursus fork of
|
||||
.Xr ldid 1
|
||||
before they can be ran on a device jailbroken with
|
||||
.Nm
|
||||
\[char46]
|
||||
.Pp
|
||||
When using rootful mode, the
|
||||
.Fl f , -rootful
|
||||
flag must be specified at all times. It does not matter whether you want to create fakefs,
|
||||
create partial fakefs, rejailbreak or remove jailbreak.
|
||||
.Pp
|
||||
Due to a stock bug, using the
|
||||
.Fl V , -verbose-boot
|
||||
option might cause some versions for tvOS to crash and not boot.
|
||||
.Pp
|
||||
Offical Apple USB-C cables as well as some other USB-C cables cannot be used to enter DFU mode.
|
||||
USB-A cable with male USB-C to female USB-A adapter works fine.
|
||||
.Sh POST INSTALLATION (iOS/iPadOS)
|
||||
The palera1n loader app will take up to 1 minute to appear on the homescreen after the
|
||||
device has booted. If it does not appear, you can try using the shortcut:
|
||||
.Pp
|
||||
.Lk https://www.icloud.com/shortcuts/8cd5f489c8854ee0ab9ee38f2e62f87d
|
||||
.Pp
|
||||
to open it. After opening the loader app, select a package manager to install.
|
||||
This will also bootstrap your device.
|
||||
.Pp
|
||||
A built-in SSH server runs on port 44 on loopback interfaces.
|
||||
.Sh POST INSTALLATION (tvOS)
|
||||
.Pp
|
||||
The palera1n loader app will appear on homescreen. Open the loader and select a package manager to install.
|
||||
This will also bootstrap your device.
|
||||
.Pp
|
||||
A built-in SSH server runs on port 44 on all interfaces.
|
||||
.Sh POST INSTALLATION (bridgeOS)
|
||||
.Pp
|
||||
A built-in SSH server runs on port 44 on all interfaces.
|
||||
.Pp
|
||||
Bootstrapping is currently not supported on this device.
|
||||
.Sh FILES
|
||||
During the jailbreak process, a temporary filesystem is mounted on /cores as a place
|
||||
to stash jailbreak files needed during the boot process. No files are ever written
|
||||
onto the actual disk if you do not use the SSH server to write files or using the
|
||||
loader app to install additional jailbreak files.
|
||||
|
||||
.Bl -tag -width "/var/jb/Library/LaunchDaemons"
|
||||
.It Pa /cores
|
||||
The location of the temporary filesystem where jailbreak files are stashed during boot.
|
||||
.It Pa /Library/LaunchDaemons
|
||||
The directory where jailbreak-specific
|
||||
.Xr launchd.plist 5
|
||||
property list files should be placed on rootful.
|
||||
.It Pa /var/jb/Library/LaunchDaemons
|
||||
The directory where jailbreak-specific
|
||||
.Xr launchd.plist 5
|
||||
property list files should be placed on rootless.
|
||||
.It Pa /etc/rc.d
|
||||
The directory where executable files that needs to be executed during boot, before
|
||||
daemons are launched, are placed on rootful. They are executed after all filesystems
|
||||
has been mounted.
|
||||
.It Pa /var/jb/etc/rc.d
|
||||
The directory where executable files that needs to be executed during boot, before
|
||||
daemons are launched, are placed on rootless. They are executed after all filesystems
|
||||
has been mounted.
|
||||
|
||||
|
||||
|
||||
.El
|
||||
.Sh BUGS
|
||||
|
||||
|
||||
|
||||
.Nm
|
||||
may crash if the machine it is running on has non-compliant USB devices plugged in.
|
||||
.Pp
|
||||
.Nm
|
||||
will fail to initialize on Linux when there are no USB devices plugged in.
|
||||
Usually this is not a problem on PCs since the built-in root hubs are also
|
||||
USB devices. However, on platforms such as Apple Silicon Macs in Linux, since
|
||||
there are no built-in USB hubs, at least one USB device needs to be manually
|
||||
plugged in for palera1n to be initialized.
|
||||
|
||||
.Pp
|
||||
The exploit may also work less reliably on some hosts, like AMD desktops, or some MediaTek devices.
|
||||
|
||||
.Pp
|
||||
The built-in SSH server might be not accessible with password after bootstrapping rootful,
|
||||
since the bootstrap uses a custom crypt() function that is not supported
|
||||
by the built-in SSH server.
|
||||
|
||||
.Pp
|
||||
There are no DFU instructions for iBridge T2 as there are no known ways to connect to the T2's USB
|
||||
interface when macOS has been booted.
|
||||
|
||||
|
||||
|
||||
.Sh DEPRECATED AND REMOVED FUNCTIONALITY
|
||||
|
||||
|
||||
|
||||
There was an option in
|
||||
.Nm
|
||||
to force create the fakefs even when one already exists (which would overwrite
|
||||
the existing fakefs), by setting the palerain_option_setup_rootful_forced flag
|
||||
in palera1n flags. This option was removed because using
|
||||
.Fl -force-revert
|
||||
and
|
||||
.Fl c
|
||||
at the same time has exactly the same effect.
|
||||
|
||||
.Pp
|
||||
The hook that enabled
|
||||
.Sy launchctl runstats
|
||||
has been removed, since it leaks memory in launchd.
|
||||
.Pp
|
||||
|
||||
.Fl f, -fakefs
|
||||
has been renamed to
|
||||
.Fl f, -rootful
|
||||
due to its ambiguity. As it supports both fakefs and realfs on certain platforms.
|
||||
.Sh SEE ALSO
|
||||
.Xr launchd 8
|
||||
.Xr launchd.plist 5
|
||||
.Xr ldid 1
|
||||
.Xr p1ctl 8
|
||||
|
||||
|
||||
|
||||
.Sh HISTORY
|
||||
|
||||
|
||||
|
||||
The
|
||||
.Nm
|
||||
jailbreak was first written by Nebula and Mineek on September 26, 2022, as a shell
|
||||
script. Tweak support with DEVELOPMENT kernels are added on October 2, 2022. RELEASE
|
||||
kernel support is added on November 14, 2022. iOS 16 Support is added on
|
||||
December 13, 2022. Later, the first attempt to rewrite palera1n into C begins on January
|
||||
01 2023. The
|
||||
.Nm
|
||||
utility described here is the second attempt, which first started on January 16, 2023,
|
||||
using checkra1n 1337 and a custom KPF.
|
||||
Something happened on August 15, 2023.
|
||||
Reference in new issue
Block a user