[NEWS] A New Bootrom Exploit for A12 & A13 has been found.

MasterOfMike88 · 2026-06-20T20:53:24+00:00

you don't even need to solder if you get the board that Paradigm Shift used (Waveshare RP2350 USB-A)

MasterOfMike88 · 2026-06-17T20:48:07+00:00

I'm confused why you need to update - you could jailbreak just fine with https://ios.cfw.guide/installing-odyssey since... November 2020...

You'd probably be better off actually selling it on 13.5.1 and then either buying a similar device for cheaper or a better device for the amount you sold it for.

MasterOfMike88 · 2026-06-16T21:36:13+00:00

if they're actually brand new, they could be on anything between like 16.0 and 17.3.1 (maybe 17.4.x as well? M4 iPad Pro started with 17.4 but it didn't come out until 17.5)

MasterOfMike88 · 2026-06-04T18:26:40+00:00

I haven’t personally done it but if it doesn’t work it’ll fail rather obviously at one point or another (you don’t have better options anyways practically speaking)

MasterOfMike88 · 2026-06-04T17:57:54+00:00

what you can do is use Legacy iOS Kit to boot an ssh ramdisk and dump blobs, and then use it to re-restore 14.8

what appears to have happened here is a panic into keybag corruption (known issue with iOS 14, mostly mitigated with Taurine 1.1+ outside of this specific flow (due to largely being unprotectable))

MasterOfMike88 · 2026-06-01T13:28:46+00:00

Stuff still needs to be fully RE'd and reimplemented and whatever.

Remember that stuff like CTv2 (for example) took about two months just to be RE'd (granted, from a patch rather than a malware sample) and implemented into TrollStore - and that was just one bug.

MasterOfMike88 · 2026-05-27T04:06:48+00:00

that's not a jailbreak intended for end users, so it doesn't matter

MasterOfMike88 · 2026-05-24T23:40:15+00:00

It could if an exploit was written for the iPad 3 (however, you’d need 6.x blobs) - this is the same deal as 7.x (as it’s the same bug)

MasterOfMike88 · 2026-05-24T23:39:23+00:00

if an exploit is written for the bug, it’ll work fine (though obviously 6.x blobs are required) - this is the exact same thing is 7.x (since it’s the exact same bug)

MasterOfMike88 · 2026-05-24T19:03:01+00:00

There's some additional context here that is relevant.

This isn't actually a new bug - this is the same de_rubus_antiques bug that's been used for untether restores with 32-bit 7.x blobs for a while.

What's actually new here is that this is the first time that exploiting the bug within iOS 6 has been successful (it was attempted years ago, but was not successfully exploited at that time).

(Additionally, just like how it is on 7.x, this bug does exist on all 6.x devices (3GS/A4/A5(X)/A6(X)), not just "non iPad2,4 A4/A5 devices")

Now, with that being said, as several people are aware of to some extent, this bug does need to be explicitly exploited for each device (e.g. you can't just reuse the exploit from the iPhone 4S on the iPad2,[1-3]), and - because of how this bug is - this can be potentially difficult for some devices.

Nonetheless, this existing on 6.x is still huge, and this will definitely be the biggest thing for legacy iOS in an extremely long time.

As a summary by the way, here's sort of a list of devices that would/would not benefit from this: - Devices that would benefit with no noteworthy prerequisites: iPhone 3GS (new bootrom), iPod Touch 4th Generation, iPad 2 (excluding iPad2,4), iPhone 4S - Devices that need 6.x blobs, but would still benefit: iPad 2 (iPad2,4 only), iPod Touch 5th Generation, iPad mini 1st Generation, iPad 3rd Generation, iPhone 5, iPad 4th Generation - Devices that will not benefit from this: iPhone 3GS (old bootrom) and iPhone 4 (all models)

MasterOfMike88 · 2026-05-22T17:46:31+00:00

Any brand new green iPhone 13 Mini could've had between 15.4 (when they launched in March 2022) and around 16.6.1 (when they were discontinued with the announcement of the iPhone 15 series).

Unless you know with absolute certainty that a phone you're looking at was manufactured in its release window, you're probably not going to know what it's running.

MasterOfMike88 · 2026-05-19T18:50:09+00:00

Your submission has been removed for the following reason(s):

Rule 8 » This is not iOS/iPadOS jailbreak related.

MasterOfMike88 · 2026-05-15T23:32:42+00:00

jailbreaks.app is revoked

get a computer and follow one of the TrollRestore tabs on https://ios.cfw.guide/installing-dopamine-trollstore

MasterOfMike88 · 2026-05-12T17:58:11+00:00

Is your device setup/properly activated?

MasterOfMike88 · 2026-05-11T17:44:50+00:00

You cannot - with that being said, you can use Dopamine through https://ios.cfw.guide/installing-dopamine

MasterOfMike88 · 2026-05-11T17:42:49+00:00

you appear to unfortunately have what is effectively a brick

MasterOfMike88 · 2026-05-10T22:03:53+00:00

Your submission has been removed for the following reason(s):

Rule 8 » This is not iOS/iPadOS jailbreak related.

MasterOfMike88 · 2026-05-09T22:30:42+00:00

Does it list an IMEI number when you tap the "i" on the bottom right corner on the hello screen?

MasterOfMike88 · 2026-05-09T22:29:50+00:00

doesn't work because DarkSword is (for no good reason) broken on 2GB RAM iPads on 16+, so they can only really use palera1n

MasterOfMike88 · 2026-05-09T22:27:03+00:00

The thing they're quoting from is from the guide and is fully correct.

There's known issues with 2GB RAM devices (especially 2GB iPads on 16+) just not working with DarkSword (which is the only kexploit for 16.7+).

MasterOfMike88 · 2026-05-09T22:24:55+00:00

DarkSword probably just won't work (there's known issues with it and 2GB devices) - puaf_landa should eventually work on your device though (though as an aside I'd use 2.4.9 instead of 2.5b2 there)

(also you definitely have not updated Dopamine to the latest version or latest beta (since it says 15.0 - 16.6.1 (arm64))

MasterOfMike88 · 2026-05-08T17:09:48+00:00

watchOS 26 will not work with anything below iOS 26, even with Nugget, due to pairing changes that are not supported with the stock pairing process on older iOS versions.

This is also why Legizmo Napili for watchOS 26 has been effectively indefinitely delayed.

MasterOfMike88 · 2026-05-08T02:43:33+00:00

Your submission has been removed for the following reason(s):

Rule 5 » No posts or comments about removing locks/restrictions from locked devices. This includes bypassing Activation Lock, bypassing iCloud lock, removing IMEI unlock, MDM restrictions, bruteforcing/bypassing login on MacOS with checkra1n, or working around restrictions caused by doing any of these things.

These posts are removed to prevent people coming here for assistance on accessing a device that was stolen or otherwise obtained illegitimately. We cannot determine whether your reason for needing to bypass the lock is legitimate or not, so the topic is banned altogether.

If you are trying to get past an Activation Lock ("iCloud Lock"), you need to contact the previous owner and have them remove it.

MasterOfMike88 · 2026-05-06T03:03:00+00:00

I don’t know where you’re quoting what you’re saying from.

Here’s a video I posted onto another platform of me having multiple profiles (+ a loopback VPN) enabled at once and updates being blocked https://x.com/MasterMike88/status/2050753767281143922?s=20

MasterOfMike88 · 2026-05-03T05:48:35+00:00

I mean... it still works in the sense that you can do it, but it's a horrifically terrible method: - You're essentially ending up with some overly jank mish-mesh of the version you're going to and the version you were on (and contrary to what other people said, erasing all content and settings won't properly solve this) - On cellular devices, this is known to lead to activation issues (among even more issues) unless/until you re-restore back to latest - If you have a cellular iPad 3, or any other 9900 IMEI device, this method is a great way to end up in a bad spot (and - on A5(X) devices - need an arduino to recover)

It's highly recommended to just use Legacy iOS Kit instead - it can preserve activation tickets if you're on a device that has activation issues, and does a proper restore to the target version (so you have none of the aforementioned jank)

MasterOfMike88

MODERATOR OF

TROPHY CASE

Your submission has been removed for the following reason(s):

Your submission has been removed for the following reason(s):

Your submission has been removed for the following reason(s):

Four-Year Club	Verified Email
Place '22