19 ms·

Unc0ver Jailbreak for iOS 11.0 to 13.5

233 points by ValentineC 6y ago

PieUser 6y ago
I remember the JB scene during the early days, iOS 3-6. Those were good times...
- zigzaggy 6y ago
  Yep. I loved rooting droids and jailbreaking iPhones back then. It almost seems like it ain’t worth it these days. I can’t think of much I can get in JB that I can’t have anyway
  - thakoppno 6y ago
    at one point i had the original iphone running android. it was a hot mess usability wise but still kinda marvelous in a way.
    - aspenmayer 6y ago
      Have you tried any of the Project Sandcastle builds? https://projectsandcastle.org https://projectsandcastle.org
      - zigzaggy 6y ago
        Thanks for sharing this! I just decommissioned an iPhone 7 and I think this is the perfect project for it.
        aspenmayer 6y ago
        It’s definitely interesting! I think the iPhone hardware is amazing, and Android is the only alternate OS I would consider running so it’s just a great match. Fun project.
- aspenmayer 6y ago
  When the first web based jailbreak[1] dropped I felt like something important had happened among the mundane. Rooting the HTC G1 and jailbreaking pre-App Store iOS was a PC-assisted complicated revelation; being able to JB straight from the browser doubly so. [1] https://en.wikipedia.org/wiki/JailbreakMe https://en.wikipedia.org/wiki/JailbreakMe
  - Lammy 6y ago
    > Rooting the HTC G1 […] was a PC-assisted complicated revelation Well, aside from the early versions of Android that ran all your keyboard input through a root shell: https://web.archive.org/web/20081206090335/http://blogs.zdnet.com/Burnette/?p=680 https://web.archive.org/web/20081206090335/http://blogs.zdne...
    - aspenmayer 6y ago
      I’m having flashbacks of mistyped commands on a G1 keyboard leading to restoring my nandroid backups. It took a couple tries but was well worth it for the decent overclock I was able to get out of it. With an extended battery it was a pretty decent two or three day charge phone with some battery management. Still love that phone.
aklemm 6y ago
Remind me what I get for jailbreaking these days? Long ago I wanted to tether, but can’t think of what I need today.
- LeoNatan25 6y ago
  You can enable ECG on Apple Watch in non-approved countries.
- boardwaalk 6y ago
  Also curious about this. The only thing I can think of emulators and other forbidden apps - you sign them with Xcode, but it only lasts a limited time (a week?)
  - MaxLeiter 6y ago
    There’s now a clever tool for getting around Apples signing, AltStore, which uses a server application on your computer to periodically sign the app (and has some trick to bypass not requiring a developer account that involves an Apple Mail extension)
    - derefr 6y ago
      As it turns out, this is used as one of the listed bootstrap methods for getting the jailbreak going. It's a very different era for jailbreaking, these days. We don't actually need an ACE exploit as a bootstrap any more; we can just rely on various pseudo-officially-sanctioned methods of running arbitrary code (e.g. an XCode development provisioning profile.) A jailbreak is now just a privilege-escalation exploit. Interesting times.
      - ValentineC 6y ago
        The crazy thing is that it used to be even easier, but Apple broke some of the sideloading mechanisms. AltStore and its mods seem to be one of the few sideloading methods left for people who aren't paying $99/year for the Apple Developer Program.
deleted 6y ago
[deleted]
betaby 6y ago
Can one unlock carrier locked phone with that tool?
- OkGoDoIt 6y ago
  In the past carrier unlocking was always a separate ordeal that jailbreaking didn’t seem to help. But I haven’t tried in many years.
- RL_Quine 6y ago
  No. Different chip.
  - Nextgrid 6y ago
    I believe the carrier lock is now handled in software. The modem itself is never carrier locked and the lock is enforced at the activation step by sending the SIM details to Apple for validation, so I believe once you're jailbroken you should be able to bypass that behavior.
deleted 6y ago
[deleted]
clairity 6y ago
are there any good firewall apps for jailbroken iphones? something that works more holistically than at the dns level (like IP addresses, stateful packet inspection, etc). there used to be "firewall iP" but that seems long abandoned now. that's the one thing i'd love to jailbreak for. and a UI tweak or two can be nice too.
- sneak 6y ago
  I would so eagerly jailbreak for something like Little Snitch for iOS.
  - leoh 6y ago
    You definitely don't need too! Charles Proxy is really impressive on iOS.
    - AnonC 6y ago
      How does it compare to Little Snitch, which on the Mac asks the user to check the connection attempt and allow/disallow each one based on some patterns (domain, port, etc.)? I don’t think such a functionality is possible on non-jailbroken iOS. Charles Proxy seems to be targeted at just examining traffic, and not prompting the user for connection attempts and controlling them.
      - saagarjha 6y ago
        You can’t ask dynamically, but setting up filtering rules is not out of the question.
- Lammy 6y ago
  iOS has PF, just like the base macOS. No UI, but it works if you just create your PF rules and OS fingerprint files, then create the launchd config: https://gist.github.com/pwnsdx/cc82feb97f451f26c24b https://gist.github.com/pwnsdx/cc82feb97f451f26c24b
proverbialbunny 6y ago
Anyone know what the best ad blockers are for iOS?
- jmull3n 6y ago
  I use NextDNS, works pretty well.
  - awinder 6y ago
    Any recommendations on the block list(s) to use? I just realized I totally missed this config in NextDNS so cheers for clueing me in
    - AnonC 6y ago
      To start with: someonewhocares Dan Pollock’s list All the Fanboy blocking lists Any “annoyances” list you’re interested in
  - proverbialbunny 6y ago
    Does this block ads in apps? It looks like I may have not had to jailbreak after all. I assumed it was a necessary prerequisite.
    - AnonC 6y ago
      Yes, it’s great and works across all apps. You have to setup an account on the website, then choose filters just like you would with uBlock Origin. Then you enter your configuration code in the app (to connect to the right settings). The filters get applied to every DNS request.
    - ornornor 6y ago
      Yes. I only still see ads in the YouTube app (stopped using YT on my phone for that reason), and some websites that do some clever ads reinjection after the page ha aliases still have ads too (but that’s really a minority of websites and they’re not very good anyway son or using them much) Otherwise it blocks all ads in every other app (especially free to play games that are unusable with ads) Nextdns will also work on your tv and block all ads (hello Samsung) and telemetry too (there is a smarttv block list you can select at the end of the choices on nextdns)
WantonQuantum 6y ago
I absolutely support people's right to jailbreak devices they own and over the years I've jailbroken my phone or ipad for one reason or another. Having said that, unless there's something specific you're looking for, it's not really worth the effort these days and has potential downsides. The biggest downside is that you might find some existing apps on your phone can detect that the phone is jailbroken and refuse to start. There are obvious security reasons for apps like banking apps to do this but also many online gaming apps won't run if they detect that the device is jailbroken in order to deter cheating. There's an ongoing arms-race between app developers and jailbreakers where jailbreakers try to avoid detection and app developers find new ways to detect jailbreaks. So a new jailbreak will probably not be detected until a few weeks or months later when the app is updated. Source: I used to work for a company that makes phone software that needs to be secure and so would attempt to detect jailbreaks.
- unityByFreedom 6y ago
  Is there a way to temporarily disable the jailbreak, then open/use the banking app, then re-enable jailbreak? Even if it required a reboot I'd be okay with it.
  - WantonQuantum 6y ago
    The short answer is sometimes yes sometimes no. Some jailbreaking detection works by attempting things that wouldn't succeed on a non-jailbroken device and some detection works by looking for signs of specific jailbreaks. It's a real cat-and-mouse game.
  - Lammy 6y ago
    unc0ver isn't one, but a "rootless" jailbreak is usually undetectable. This one hasn't been updated with iOS 13 support but was popular for iOS 12: https://pangu8.com/jailbreak/rootless-jb/ https://pangu8.com/jailbreak/rootless-jb/ I haven't used it myself, but two very similar kernel-level jailbreak detection bypasses were just released for unc0ver 13.x, FlyJB and KernBypass: https://github.com/akusio/KernBypass-Public https://github.com/akusio/KernBypass-Public A couple of my banking apps detect my jailbreak but allow me to continue after hitting "Okay". The only app I ever wanted to use that refused to let me in was the Nintendo Switch Online app. Steam works fine. If you don't play games on your phone it isn't really a big deal imo.
_eht 6y ago
I’ve had an iPad that’s been locked for at least a year (forgot pin) and I don’t have a computer that runs iTunes to plug it in to and unlock it. Would this get past that?
- ValentineC 6y ago
  > I’ve had an iPad that’s been locked for at least a year (forgot pin) and I don’t have a computer that runs iTunes to plug it in to and unlock it. If you have the proof of purchase, an Apple Store should be able to unlock it for you.
  - _eht 6y ago
    I’m 7hrs away from a apple store... pretty remote, but do have proof of purchase. I’ll take that as a no? Someday I’ll have a usable iPad again.
    - MaxLeiter 6y ago
      I had to get a laptop fixed and Apple shipped me a box. 10 days later (and this was a few weeks ago during height of Covid lockdown in US) I got it back. I recommend looking into something like that.
  - choward 6y ago
    Are you serious? People are okay with this? What's the point of encryption if Apple can unlock it? If the same thing happens on an encrypted computer you won't be able to access the data, but at least the device isn't bricked.
    - ggreer 6y ago
      You misunderstand. Apple can erase the device and let a new user set it up from scratch, but they can't read the data off it. The feature is called Activation Lock and it exists to discourage theft.
      - 6y ago
leoh 6y ago
Isn't a theoretical large reason for jailbreaking (not your main phone) to be able to read the contents of all installed apps, say, via SSH? I don't know of another way to do this.
- enricozb 6y ago
  It doesn't install OpenSSH by default, but it does set up a root user with a default password "alpine". It's recommended that you change this.
  - saagarjha 6y ago
    I believe that the root user already exists with that password.
    - enricozb 6y ago
      It looks like you're right. I guess I don't really understand then why we can't just log in as root in vanilla iOS
- judge2020 6y ago
  It technically is, but iOS apps are compiled ARM64 so decompiling them isn't trivial. It's often easier to find the app's config files and mess around, or to use an app like Flex that allows you to override return values for an app's methods. https://twitter.com/flextweak https://twitter.com/flextweak
  - leoh 6y ago
    Super interesting. I suspect Ghidra might support reasonably well.
    - _kbh_ 6y ago
      Ghidra doesn't do a great job of decompiling Swift and ObjC which most most iOS apps would be written in now days. You are better off with something like Hopper. Hopper does a better job of decompiling Swift and ObjC but its decompiler output is no where near as good unfortunately.
leoh 6y ago
Went to do this for extra iPhone X I have. Made me download an app, supply Apple ID credentials, and provide my system login/password to a dialog. I want to use it, but I won't touch it without a VM and a six foot stick.
- kccqzy 6y ago
  Asking for your Apple ID credentials appears to be trying to automatically set up your Apple ID for sideloading, i.e. obtaining certificates etc. You should be able to do this step manually.
  - ValentineC 6y ago
    Adding on: you can also create a new Apple ID, and provide those credentials just for sideloading.
- Lammy 6y ago
  You don't need unc0ver at all to jailbreak your phone! Everything older than and including the iPhone X has a hardware-level bootloader exploit known as "checkm8". You can use a jailbreak called "checkra1n" via that hardware-level exploit with just a USB/Lightning cable and any computer running macOS or Linux (Windows support Real Soon Now™): https://checkra.in/ https://checkra.in/ unc0ver is necessary for newer phones that need a software entry point to jailbreak. It should work just the same on your phone too, but the hardware exploit is way way easier and should automatically* work with any new iOS updates as they are released. [*] Any tweaks you have installed may of course be incompatible with a major OS update
  - sp332 6y ago
    Doesn't checkm8 require re-jailbreaking on every boot?
    - Lammy 6y ago
      To stay jailbroken, yes. The phone will still boot fine by itself, however, just in the normal unjailbroken state. Same limitation as unc0ver except without the conveniently-portable app entry point. I prefer using the hardware entry point that doesn't depend on Apple's goodwill to let me sideload since I usually get at least a month or two of uptime anyway. My recent record has been 66 days, then I rebooted intentionally for something: https://i.imgur.com/l9tL9dw.png https://i.imgur.com/l9tL9dw.png
Wowfunhappy 6y ago
There's a Jailbreak app called PermaFlex that I worked with a developer to get made about a year ago. It hasn't gotten a lot of attention, I suspect because it's not especially easy to wrap your head around. But it allows you to do something magical—permanently hide just about any icon, button, or other UI element in just about any iOS app, all on your phone and without writing code. There are some caveats you should read about at the link below, but overall it works well! I'm an interface minimalist. Mobile apps are so cluttered these days, and it feels so good to hide all the random crap I don't need. https://www.reddit.com/r/jailbreak/comments/bfpso0/release_permaflex_permanently_hide_elements_with/elfgay6/ https://www.reddit.com/r/jailbreak/comments/bfpso0/release_p...
- kiddico 6y ago
  That's ~95% of what I jailbreak for. Just getting rid of (or hiding) junk I don't want to see/be able to get to. I'll look into this. Thanks!
- chipperyman573 6y ago
  Does anyone know if there's an android version of this?
  - jeroenhd 6y ago
    This looks like it shouldn't be too hard to do on Android (in native apps, you'd have problems with Unity3D and Flutter apps) with Xposed, but I don't think there's an Xposed module that does specifically this. It's a nice idea though and I hope someone with experience in it will take an interest in writing this.
jmull3n 6y ago
This doesn't work without a $99 developer certificate when you get to the Cydia Impactor step
- fastball 6y ago
  Cydia Impactor is a method, not a step. You can jailbreak with unc0ver in 3 different ways, one of which requires an Apple Developer account, yes.
- Lammy 6y ago
  You can use AltStore to sideload it for free: https://altstore.io/ https://altstore.io/ And if you have an iPhone X or older (iPhone 8, 7, etc) you have a hardware exploit and can jailbreak using checkra1n with just a computer and a USB Lightning cable: https://checkra.in/ https://checkra.in/
  - birdiesanders 6y ago
    I tried this, it doesn't seem to work, unless I am missing the obvious somewhere along the line.
    - Lammy 6y ago
      Tried which one, sorry? I haven't used AltStore much myself since I have an older model with the hardware exploit, but it did work the one time I tried it. It's just a heck of a lot jankier than the old method of using Cydia Impactor (Computer-based) or ReProvision (iOS-based) to sign the app for seven days with your personal free dev account. Apple changed something on their end and broke those apps. Here's a video demo (not mine) of how the AltServer method should work for you: https://twitter.com/InvoxiPlayGames/status/1212968106609565697 https://twitter.com/InvoxiPlayGames/status/12129681066095656...
Qahlel 6y ago
It's 2020 and ppl are still forced to jb their own phones.
- varenc 6y ago
  You're going to hate 2030... I think by then macOS will need a jailbreak if you want to disable SIP and have genuine root access.
fastball 6y ago
Remember when Comex released JailbreakMe 2.0, when jailbreaking was only a webpage + "slide to jailbreak" away? Those were the days.
sys_64738 6y ago
Can you downgrade iOS if you jailbreak?
- Lammy 6y ago
  Downgrades are possible on certain older models, but as far as I know it requires a bootloader exploit and the boot may be tethered i.e. requires a PC to poke it before it will boot. 32 bit devices can use coolbooter: https://coolbooter.com/ https://coolbooter.com/ And I've not used this tool but am aware of it: https://github.com/MatthewPierson/Vieux https://github.com/MatthewPierson/Vieux
- joshspankit 6y ago
  Yes, If you were jailbroken on the older version, and took steps to roll it back. To be honest, I still have the ability to roll back to anything from 11.4+, but I have not even used it once. Apple is putting a lot of effort in to pulling people forward. (Some compelling apps just don’t launch on older versions, for example)
AnonC 6y ago
> Utilizing native system sandbox exceptions, security remains intact while enabling access to jailbreak files. This is not very clear to me. Does this only mean that other security protections remain for apps that respect the restrictions? After jailbreaking, any malicious apps (even the ones that get through App Store reviews, not just the apps from Cydia) can get wider access to resources, right?
hdhdgdh 6y ago
Fff
Thorrez 6y ago
So it sounds like sometimes jailbreaks use known vulnerabilities, but this one uses a 0day https://twitter.com/Pwn20wnd/status/1264258454610259968 https://twitter.com/Pwn20wnd/status/1264258454610259968
0x0 6y ago
Does anyone have any technical information about the (0day?) exploits used by this new jailbreak? The source code on github seems to be very out of date. Will Apple delay the release of macOS 10.15.5, which is expected this week? (Curious to know if the same exploit applies to macOS).
rektide 6y ago
I wish Android had such a hope for it. Getting root to do basic kernel level tasks like working with networking or uhid is some extreme bizarre exploit special to most every device. It's so detestable. This device is my device. It needs to be trusted & manipulable by me. But these manufacturers, they look on users & what they would do as the enemy, as power they grant only to themselves. It's sad being in this post-general-purpose computing age, maligned by my own machines.

233 points by ValentineC 6y ago

PieUser 6y ago

I remember the JB scene during the early days, iOS 3-6. Those were good times...

zigzaggy 6y ago
Yep. I loved rooting droids and jailbreaking iPhones back then. It almost seems like it ain’t worth it these days. I can’t think of much I can get in JB that I can’t have anyway
- thakoppno 6y ago
  at one point i had the original iphone running android. it was a hot mess usability wise but still kinda marvelous in a way.
  - aspenmayer 6y ago
    Have you tried any of the Project Sandcastle builds? https://projectsandcastle.org https://projectsandcastle.org
    - zigzaggy 6y ago
      Thanks for sharing this! I just decommissioned an iPhone 7 and I think this is the perfect project for it.
      - aspenmayer 6y ago
        It’s definitely interesting! I think the iPhone hardware is amazing, and Android is the only alternate OS I would consider running so it’s just a great match. Fun project.
aspenmayer 6y ago
When the first web based jailbreak[1] dropped I felt like something important had happened among the mundane. Rooting the HTC G1 and jailbreaking pre-App Store iOS was a PC-assisted complicated revelation; being able to JB straight from the browser doubly so. [1] https://en.wikipedia.org/wiki/JailbreakMe https://en.wikipedia.org/wiki/JailbreakMe
- Lammy 6y ago
  > Rooting the HTC G1 […] was a PC-assisted complicated revelation Well, aside from the early versions of Android that ran all your keyboard input through a root shell: https://web.archive.org/web/20081206090335/http://blogs.zdnet.com/Burnette/?p=680 https://web.archive.org/web/20081206090335/http://blogs.zdne...
  - aspenmayer 6y ago
    I’m having flashbacks of mistyped commands on a G1 keyboard leading to restoring my nandroid backups. It took a couple tries but was well worth it for the decent overclock I was able to get out of it. With an extended battery it was a pretty decent two or three day charge phone with some battery management. Still love that phone.

aklemm 6y ago

Remind me what I get for jailbreaking these days? Long ago I wanted to tether, but can’t think of what I need today.

LeoNatan25 6y ago
You can enable ECG on Apple Watch in non-approved countries.
boardwaalk 6y ago
Also curious about this. The only thing I can think of emulators and other forbidden apps - you sign them with Xcode, but it only lasts a limited time (a week?)
- MaxLeiter 6y ago
  There’s now a clever tool for getting around Apples signing, AltStore, which uses a server application on your computer to periodically sign the app (and has some trick to bypass not requiring a developer account that involves an Apple Mail extension)
  - derefr 6y ago
    As it turns out, this is used as one of the listed bootstrap methods for getting the jailbreak going. It's a very different era for jailbreaking, these days. We don't actually need an ACE exploit as a bootstrap any more; we can just rely on various pseudo-officially-sanctioned methods of running arbitrary code (e.g. an XCode development provisioning profile.) A jailbreak is now just a privilege-escalation exploit. Interesting times.
    - ValentineC 6y ago
      The crazy thing is that it used to be even easier, but Apple broke some of the sideloading mechanisms. AltStore and its mods seem to be one of the few sideloading methods left for people who aren't paying $99/year for the Apple Developer Program.

deleted 6y ago

[deleted]

betaby 6y ago

Can one unlock carrier locked phone with that tool?

OkGoDoIt 6y ago
In the past carrier unlocking was always a separate ordeal that jailbreaking didn’t seem to help. But I haven’t tried in many years.
RL_Quine 6y ago
No. Different chip.
- Nextgrid 6y ago
  I believe the carrier lock is now handled in software. The modem itself is never carrier locked and the lock is enforced at the activation step by sending the SIM details to Apple for validation, so I believe once you're jailbroken you should be able to bypass that behavior.

deleted 6y ago

[deleted]

clairity 6y ago

are there any good firewall apps for jailbroken iphones? something that works more holistically than at the dns level (like IP addresses, stateful packet inspection, etc). there used to be "firewall iP" but that seems long abandoned now. that's the one thing i'd love to jailbreak for. and a UI tweak or two can be nice too.

sneak 6y ago
I would so eagerly jailbreak for something like Little Snitch for iOS.
- leoh 6y ago
  You definitely don't need too! Charles Proxy is really impressive on iOS.
  - AnonC 6y ago
    How does it compare to Little Snitch, which on the Mac asks the user to check the connection attempt and allow/disallow each one based on some patterns (domain, port, etc.)? I don’t think such a functionality is possible on non-jailbroken iOS. Charles Proxy seems to be targeted at just examining traffic, and not prompting the user for connection attempts and controlling them.
    - saagarjha 6y ago
      You can’t ask dynamically, but setting up filtering rules is not out of the question.
Lammy 6y ago
iOS has PF, just like the base macOS. No UI, but it works if you just create your PF rules and OS fingerprint files, then create the launchd config: https://gist.github.com/pwnsdx/cc82feb97f451f26c24b https://gist.github.com/pwnsdx/cc82feb97f451f26c24b

proverbialbunny 6y ago

Anyone know what the best ad blockers are for iOS?

jmull3n 6y ago
I use NextDNS, works pretty well.
- awinder 6y ago
  Any recommendations on the block list(s) to use? I just realized I totally missed this config in NextDNS so cheers for clueing me in
  - AnonC 6y ago
    To start with: someonewhocares Dan Pollock’s list All the Fanboy blocking lists Any “annoyances” list you’re interested in
- proverbialbunny 6y ago
  Does this block ads in apps? It looks like I may have not had to jailbreak after all. I assumed it was a necessary prerequisite.
  - AnonC 6y ago
    Yes, it’s great and works across all apps. You have to setup an account on the website, then choose filters just like you would with uBlock Origin. Then you enter your configuration code in the app (to connect to the right settings). The filters get applied to every DNS request.
  - ornornor 6y ago
    Yes. I only still see ads in the YouTube app (stopped using YT on my phone for that reason), and some websites that do some clever ads reinjection after the page ha aliases still have ads too (but that’s really a minority of websites and they’re not very good anyway son or using them much) Otherwise it blocks all ads in every other app (especially free to play games that are unusable with ads) Nextdns will also work on your tv and block all ads (hello Samsung) and telemetry too (there is a smarttv block list you can select at the end of the choices on nextdns)

WantonQuantum 6y ago

I absolutely support people's right to jailbreak devices they own and over the years I've jailbroken my phone or ipad for one reason or another. Having said that, unless there's something specific you're looking for, it's not really worth the effort these days and has potential downsides. The biggest downside is that you might find some existing apps on your phone can detect that the phone is jailbroken and refuse to start. There are obvious security reasons for apps like banking apps to do this but also many online gaming apps won't run if they detect that the device is jailbroken in order to deter cheating. There's an ongoing arms-race between app developers and jailbreakers where jailbreakers try to avoid detection and app developers find new ways to detect jailbreaks. So a new jailbreak will probably not be detected until a few weeks or months later when the app is updated. Source: I used to work for a company that makes phone software that needs to be secure and so would attempt to detect jailbreaks.

unityByFreedom 6y ago
Is there a way to temporarily disable the jailbreak, then open/use the banking app, then re-enable jailbreak? Even if it required a reboot I'd be okay with it.
- WantonQuantum 6y ago
  The short answer is sometimes yes sometimes no. Some jailbreaking detection works by attempting things that wouldn't succeed on a non-jailbroken device and some detection works by looking for signs of specific jailbreaks. It's a real cat-and-mouse game.
- Lammy 6y ago
  unc0ver isn't one, but a "rootless" jailbreak is usually undetectable. This one hasn't been updated with iOS 13 support but was popular for iOS 12: https://pangu8.com/jailbreak/rootless-jb/ https://pangu8.com/jailbreak/rootless-jb/ I haven't used it myself, but two very similar kernel-level jailbreak detection bypasses were just released for unc0ver 13.x, FlyJB and KernBypass: https://github.com/akusio/KernBypass-Public https://github.com/akusio/KernBypass-Public A couple of my banking apps detect my jailbreak but allow me to continue after hitting "Okay". The only app I ever wanted to use that refused to let me in was the Nintendo Switch Online app. Steam works fine. If you don't play games on your phone it isn't really a big deal imo.

_eht 6y ago

I’ve had an iPad that’s been locked for at least a year (forgot pin) and I don’t have a computer that runs iTunes to plug it in to and unlock it. Would this get past that?

ValentineC 6y ago
> I’ve had an iPad that’s been locked for at least a year (forgot pin) and I don’t have a computer that runs iTunes to plug it in to and unlock it. If you have the proof of purchase, an Apple Store should be able to unlock it for you.
- _eht 6y ago
  I’m 7hrs away from a apple store... pretty remote, but do have proof of purchase. I’ll take that as a no? Someday I’ll have a usable iPad again.
  - MaxLeiter 6y ago
    I had to get a laptop fixed and Apple shipped me a box. 10 days later (and this was a few weeks ago during height of Covid lockdown in US) I got it back. I recommend looking into something like that.
- choward 6y ago
  Are you serious? People are okay with this? What's the point of encryption if Apple can unlock it? If the same thing happens on an encrypted computer you won't be able to access the data, but at least the device isn't bricked.
  - ggreer 6y ago
    You misunderstand. Apple can erase the device and let a new user set it up from scratch, but they can't read the data off it. The feature is called Activation Lock and it exists to discourage theft.
    - 6y ago

leoh 6y ago

Isn't a theoretical large reason for jailbreaking (not your main phone) to be able to read the contents of all installed apps, say, via SSH? I don't know of another way to do this.

enricozb 6y ago
It doesn't install OpenSSH by default, but it does set up a root user with a default password "alpine". It's recommended that you change this.
- saagarjha 6y ago
  I believe that the root user already exists with that password.
  - enricozb 6y ago
    It looks like you're right. I guess I don't really understand then why we can't just log in as root in vanilla iOS
judge2020 6y ago
It technically is, but iOS apps are compiled ARM64 so decompiling them isn't trivial. It's often easier to find the app's config files and mess around, or to use an app like Flex that allows you to override return values for an app's methods. https://twitter.com/flextweak https://twitter.com/flextweak
- leoh 6y ago
  Super interesting. I suspect Ghidra might support reasonably well.
  - _kbh_ 6y ago
    Ghidra doesn't do a great job of decompiling Swift and ObjC which most most iOS apps would be written in now days. You are better off with something like Hopper. Hopper does a better job of decompiling Swift and ObjC but its decompiler output is no where near as good unfortunately.

leoh 6y ago

Went to do this for extra iPhone X I have. Made me download an app, supply Apple ID credentials, and provide my system login/password to a dialog. I want to use it, but I won't touch it without a VM and a six foot stick.

kccqzy 6y ago
Asking for your Apple ID credentials appears to be trying to automatically set up your Apple ID for sideloading, i.e. obtaining certificates etc. You should be able to do this step manually.
- ValentineC 6y ago
  Adding on: you can also create a new Apple ID, and provide those credentials just for sideloading.
Lammy 6y ago
You don't need unc0ver at all to jailbreak your phone! Everything older than and including the iPhone X has a hardware-level bootloader exploit known as "checkm8". You can use a jailbreak called "checkra1n" via that hardware-level exploit with just a USB/Lightning cable and any computer running macOS or Linux (Windows support Real Soon Now™): https://checkra.in/ https://checkra.in/ unc0ver is necessary for newer phones that need a software entry point to jailbreak. It should work just the same on your phone too, but the hardware exploit is way way easier and should automatically* work with any new iOS updates as they are released. [*] Any tweaks you have installed may of course be incompatible with a major OS update
- sp332 6y ago
  Doesn't checkm8 require re-jailbreaking on every boot?
  - Lammy 6y ago
    To stay jailbroken, yes. The phone will still boot fine by itself, however, just in the normal unjailbroken state. Same limitation as unc0ver except without the conveniently-portable app entry point. I prefer using the hardware entry point that doesn't depend on Apple's goodwill to let me sideload since I usually get at least a month or two of uptime anyway. My recent record has been 66 days, then I rebooted intentionally for something: https://i.imgur.com/l9tL9dw.png https://i.imgur.com/l9tL9dw.png

Wowfunhappy 6y ago

There's a Jailbreak app called PermaFlex that I worked with a developer to get made about a year ago. It hasn't gotten a lot of attention, I suspect because it's not especially easy to wrap your head around. But it allows you to do something magical—permanently hide just about any icon, button, or other UI element in just about any iOS app, all on your phone and without writing code. There are some caveats you should read about at the link below, but overall it works well! I'm an interface minimalist. Mobile apps are so cluttered these days, and it feels so good to hide all the random crap I don't need. https://www.reddit.com/r/jailbreak/comments/bfpso0/release_permaflex_permanently_hide_elements_with/elfgay6/ https://www.reddit.com/r/jailbreak/comments/bfpso0/release_p...

kiddico 6y ago
That's ~95% of what I jailbreak for. Just getting rid of (or hiding) junk I don't want to see/be able to get to. I'll look into this. Thanks!
chipperyman573 6y ago
Does anyone know if there's an android version of this?
- jeroenhd 6y ago
  This looks like it shouldn't be too hard to do on Android (in native apps, you'd have problems with Unity3D and Flutter apps) with Xposed, but I don't think there's an Xposed module that does specifically this. It's a nice idea though and I hope someone with experience in it will take an interest in writing this.

jmull3n 6y ago

This doesn't work without a $99 developer certificate when you get to the Cydia Impactor step

fastball 6y ago
Cydia Impactor is a method, not a step. You can jailbreak with unc0ver in 3 different ways, one of which requires an Apple Developer account, yes.
Lammy 6y ago
You can use AltStore to sideload it for free: https://altstore.io/ https://altstore.io/ And if you have an iPhone X or older (iPhone 8, 7, etc) you have a hardware exploit and can jailbreak using checkra1n with just a computer and a USB Lightning cable: https://checkra.in/ https://checkra.in/
- birdiesanders 6y ago
  I tried this, it doesn't seem to work, unless I am missing the obvious somewhere along the line.
  - Lammy 6y ago
    Tried which one, sorry? I haven't used AltStore much myself since I have an older model with the hardware exploit, but it did work the one time I tried it. It's just a heck of a lot jankier than the old method of using Cydia Impactor (Computer-based) or ReProvision (iOS-based) to sign the app for seven days with your personal free dev account. Apple changed something on their end and broke those apps. Here's a video demo (not mine) of how the AltServer method should work for you: https://twitter.com/InvoxiPlayGames/status/1212968106609565697 https://twitter.com/InvoxiPlayGames/status/12129681066095656...

Qahlel 6y ago

It's 2020 and ppl are still forced to jb their own phones.

varenc 6y ago
You're going to hate 2030... I think by then macOS will need a jailbreak if you want to disable SIP and have genuine root access.

fastball 6y ago

Remember when Comex released JailbreakMe 2.0, when jailbreaking was only a webpage + "slide to jailbreak" away? Those were the days.

sys_64738 6y ago

Can you downgrade iOS if you jailbreak?

Lammy 6y ago
Downgrades are possible on certain older models, but as far as I know it requires a bootloader exploit and the boot may be tethered i.e. requires a PC to poke it before it will boot. 32 bit devices can use coolbooter: https://coolbooter.com/ https://coolbooter.com/ And I've not used this tool but am aware of it: https://github.com/MatthewPierson/Vieux https://github.com/MatthewPierson/Vieux
joshspankit 6y ago
Yes, If you were jailbroken on the older version, and took steps to roll it back. To be honest, I still have the ability to roll back to anything from 11.4+, but I have not even used it once. Apple is putting a lot of effort in to pulling people forward. (Some compelling apps just don’t launch on older versions, for example)

AnonC 6y ago

> Utilizing native system sandbox exceptions, security remains intact while enabling access to jailbreak files. This is not very clear to me. Does this only mean that other security protections remain for apps that respect the restrictions? After jailbreaking, any malicious apps (even the ones that get through App Store reviews, not just the apps from Cydia) can get wider access to resources, right?

hdhdgdh 6y ago

Fff

Thorrez 6y ago

So it sounds like sometimes jailbreaks use known vulnerabilities, but this one uses a 0day https://twitter.com/Pwn20wnd/status/1264258454610259968 https://twitter.com/Pwn20wnd/status/1264258454610259968

0x0 6y ago

Does anyone have any technical information about the (0day?) exploits used by this new jailbreak? The source code on github seems to be very out of date. Will Apple delay the release of macOS 10.15.5, which is expected this week? (Curious to know if the same exploit applies to macOS).

rektide 6y ago

I wish Android had such a hope for it. Getting root to do basic kernel level tasks like working with networking or uhid is some extreme bizarre exploit special to most every device. It's so detestable. This device is my device. It needs to be trusted & manipulable by me. But these manufacturers, they look on users & what they would do as the enemy, as power they grant only to themselves. It's sad being in this post-general-purpose computing age, maligned by my own machines.