That was indeed enjoyable to read! Especially as someone who is still terrible at reverse engineering native code. Now, this is a tethered jailbreak since it u

That was indeed enjoyable to read! Especially as someone who is still terrible at reverse engineering native code. Now, this is a tethered jailbreak since it uses the system recovery mechanism to breach the chain of trust and ultimately boot a modified version iOS. I have to wonder how untethered jailbreaks work. Am I right that they don't go through the secure boot chain at all, leaving it intact, instead exploiting one of the privileged processes in a running system (or a non-privileged one, and then doing a separate privilege escalation exploit)? How do they gain persistence then? How do they patch the signature checks out of the kernel without tripping any signature checks in the bootloader and the kernel itself?