palera1n

An iOS 15.0-15.7.1 work-in-progress, (semi-)tethered checkm8 jailbreak.

本版修复iPhone8 - iPhone x 15.7和15.7.1 越狱出现的init pzb 错误

Change Log • Discord • Twitter

How does it work?

It boots the device with multiple patches required. On first run, it'll boot a ramdisk which dumps your onboard blob, creates a fakefs (if using semi tethered), installs the loader app, and patches your kernel.

Issues

Need help?

If you need help, please join our Discord. We disabled issues due to the flood of spam, and difficulty to respond in general. We are much more comfortable on Discord.

Please, please, please, provide necessary info:

• iOS version and device (eg. iPhone 7+ 15.1, iPhone 6s 15.3.1)
• Computer's OS and version (eg. Ubuntu 22.04, macOS 13.0)
• The command you ran
• Full log from the logs folder

DO NOT harass tweak devs if tweaks don't work. Refer to here for compatiblity.

You may join here.

Linux

• Linux has some weird usbmuxd issues. We have tried our best to fix them, but there still are issues. We highly recommend to compile and install usbmuxd2.
• Stop making issues about Linux not being able to connect, we are aware. This includes being stuck on waiting for ramdisk to finish booting.

Warning

• We are NOT responsible for any data loss. The user of this program accepts responsibility should something happen to their device. While nothing should happen, jailbreaking has risks in itself. If your device is stuck in recovery, please run one of the following:
  • futurerestore --exit-recovery
  • irecovery -n

A10 and A11 devices

• On A10 and A11, you must disable your passcode while in the jailbroken state.
  • On A10, this can be fixed in the future by implementing blackbird.
  • On A11, we don't have a SEP exploit yet.

Prerequisites

Warning: You must install the Tips app from the App Store before running palera1n.

• A checkm8 vulnerable iOS device on iOS 15 (A8-A11)
  • The device must be on iOS 15.0-15.7.1
• Linux or macOS computer
  • Python 3 must be installed.

如何使用?

A better tutorial can be found here.

手机必须安装 提示 App 出现错误还原设备后安装 提示 APP后再试

1. 终端 git clone --recursive https://github.com/wxhbts/palera1n && cd palera1n
2. 运行 ./palera1n.sh --tweaks <手机系统版本> (run with sudo if you're on linux)
   • A10/A11设备必须禁用密码
   • Put your device in DFU mode before running.
3. Follow the steps on your screen.
4. 越狱成功 打开 提示 app 选择install 重启激活选择tool - Activate Tweaks
5. 卸载越狱./palera1n.sh --restorerootfs
6. 欢迎添加软件源：https://apt.wxhbts.vip

Repos

Tweaks mode

All repos work when using tweaks mode because it uses normal Procursus and not rootless.

Rootless

Repos need to be updated for rootless, here are some that work currently:

• Mineek's repo contains rootless Procursus packages
• The official palera1n repo contains miscellaneous packages

If you want to make a rootless repo, use the official palera1n repo for reference. Every deb should use the iphoneos-arm64 architecture, and nothing should be on the rootfs. Everything should be in /var/jb.

Credits

• Nathan
  • The ramdisk that dumps blobs is a slimmed down version of SSHRD_Script
  • Also helped Mineek getting the kernel up and running and with the patches
  • Helping with adding multiple device support
• Mineek
  • For the patching and booting commands
  • Adding tweak support
• Amy for the Pogo app
• checkra1n for the base of the kpf
• nyuszika7h for the script to help get into DFU
• the Procursus Team for the amazing bootstrap
• F121 for helping test
• m1sta for pyimg4
• tihmstar for pzb/original iBoot64Patcher/img4tool
• xerub for img4lib and restored_external in the ramdisk
• Cryptic for iBoot64Patcher fork
• libimobiledevice for several tools used in this project (irecovery, ideviceenterrecovery etc), and nikias for keeping it up to date