{"id":13387568,"url":"https://github.com/axi0mx/ipwndfu","last_synced_at":"2025-07-23T10:06:11.401Z","repository":{"id":37800396,"uuid":"87743379","full_name":"axi0mX/ipwndfu","owner":"axi0mX","description":"open-source jailbreaking tool for many iOS devices","archived":false,"fork":false,"pushed_at":"2024-02-21T04:10:19.000Z","size":1889,"stargazers_count":7183,"open_issues_count":170,"forks_count":1708,"subscribers_count":378,"default_branch":"master","last_synced_at":"2025-05-21T01:02:50.107Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/axi0mX.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2017-04-09T22:21:26.000Z","updated_at":"2025-05-20T07:19:38.000Z","dependencies_parsed_at":"2024-09-20T23:01:29.344Z","dependency_job_id":"b14eae84-3b4b-48a2-85a9-b157cb29fffe","html_url":"https://github.com/axi0mX/ipwndfu","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/axi0mX/ipwndfu","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/axi0mX%2Fipwndfu","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/axi0mX%2Fipwndfu/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/axi0mX%2Fipwndfu/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/axi0mX%2Fipwndfu/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/axi0mX","download_url":"https://codeload.github.com/axi0mX/ipwndfu/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/axi0mX%2Fipwndfu/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":266657994,"owners_count":23963611,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-07-23T02:00:09.312Z","response_time":66,"last_error":null,"robots_txt_status":null,"robots_txt_updated_at":null,"robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-07-30T12:01:23.865Z","updated_at":"2025-07-23T10:06:11.369Z","avatar_url":"https://github.com/axi0mX.png","language":"Python","funding_links":[],"categories":["\u003ca id=\"06fccfcc4faa7da54d572c10ef29b42e\"\u003e\u003c/a\u003e移动\u0026\u0026Mobile","\u003ca id=\"bba00652bff1672ab1012abd35ac9968\"\u003e\u003c/a\u003e越狱"],"sub_categories":["\u003ca id=\"dbde77352aac39ee710d3150a921bcad\"\u003e\u003c/a\u003eiOS\u0026\u0026MacOS\u0026\u0026iPhone\u0026\u0026iPad\u0026\u0026iWatch","\u003ca id=\"ff19d5d94315d035bbcb3ef0c348c75b\"\u003e\u003c/a\u003e工具"],"readme":"![](repo/ipwndfu.png)\n# Open-source jailbreaking tool for many iOS devices\n\n\n**Read [disclaimer](#disclaimer) before using this software.*\n\n\n## checkm8\n\n* permanent unpatchable bootrom exploit for hundreds of millions of iOS devices\n\n* meant for researchers, this is not a jailbreak with Cydia yet\n\n* allows dumping SecureROM, decrypting keybags for iOS firmware, and demoting device for JTAG\n\n* current SoC support: s5l8947x, s5l8950x, s5l8955x, s5l8960x, t8002, t8004, t8010, t8011, t8015\n\n* future SoC support: s5l8940x, s5l8942x, s5l8945x, s5l8747x, t7000, t7001, s7002, s8000, s8001, s8003, t8012\n\n* full jailbreak with Cydia on latest iOS version is possible, but requires additional work\n\n\n## Quick start guide for checkm8\n\n1. Use a cable to connect device to your Mac. Hold buttons as needed to enter DFU Mode.\n\n2. First run ```./ipwndfu -p``` to exploit the device. Repeat the process if it fails, it is not reliable.\n\n3. Run ```./ipwndfu --dump-rom``` to get a dump of SecureROM.\n\n4. Run ```./ipwndfu --decrypt-gid KEYBAG``` to decrypt a keybag.\n\n5. Run ```./ipwndfu --demote``` to demote device and enable JTAG.\n\n\n## Features\n\n* Jailbreak and downgrade iPhone 3GS (new bootrom) with alloc8 untethered bootrom exploit. :-)\n\n* Pwned DFU Mode with steaks4uce exploit for S5L8720 devices.\n\n* Pwned DFU Mode with limera1n exploit for S5L8920/S5L8922 devices.\n\n* Pwned DFU Mode with SHAtter exploit for S5L8930 devices.\n\n* Dump SecureROM on S5L8920/S5L8922/S5L8930 devices.\n\n* Dump NOR on S5L8920 devices.\n\n* Flash NOR on S5L8920 devices.\n\n* Encrypt or decrypt hex data on a connected device in pwned DFU Mode using its GID or UID key.\n\n\n## Dependencies\n\nThis tool should be compatible with Mac and Linux. It won't work in a virtual machine.\n\n* libusb, `If you are using Linux: install libusb using your package manager.`\n* [iPhone 3GS iOS 4.3.5 iBSS](#ibss)\n\n\n## Tutorial\n\nThis tool can be used to downgrade or jailbreak iPhone 3GS (new bootrom) without SHSH blobs, as documented in [JAILBREAK-GUIDE](https://github.com/axi0mX/ipwndfu/blob/master/JAILBREAK-GUIDE.md).\n\n\n## Exploit write-up\n\nWrite-up for alloc8 exploit can be found here:\n\nhttps://github.com/axi0mX/alloc8\n\n\n## iBSS\n\nDownload iPhone 3GS iOS 4.3.5 IPSW from Apple:\n\nhttp://appldnld.apple.com/iPhone4/041-1965.20110721.gxUB5/iPhone2,1_4.3.5_8L1_Restore.ipsw\n\nIn Terminal, extract iBSS using the following command, then move the file to ipwndfu folder:\n\n```\nunzip -p iPhone2,1_4.3.5_8L1_Restore.ipsw Firmware/dfu/iBSS.n88ap.RELEASE.dfu \u003e n88ap-iBSS-4.3.5.img3\n```\n\n\n## Coming soon!\n\n* Reorganize and refactor code.\n\n* Easier setup: download iBSS automatically using partial zip.\n\n* Dump SecureROM on S5L8720 devices.\n\n* Install custom boot logos on devices jailbroken with 24Kpwn and alloc8.\n\n* Enable verbose boot on devices jailbroken with 24Kpwn and alloc8.\n\n## Disclaimer\n\n**This is BETA software.**\n\nBackup your data.\n\nThis tool is currently in beta and could potentially brick your device. It will attempt to save a copy of data in NOR to nor-backups folder before flashing new data to NOR, and it will attempt to not overwrite critical data in NOR which your device requires to function. If something goes wrong, hopefully you will be able to restore to latest IPSW in iTunes and bring your device back to life, or use nor-backups to restore NOR to the original state, but I cannot provide any guarantees.\n\n**There is NO warranty provided.**\n\nTHERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.\n\n## Toolchain\n\nYou will not need to use `make` or compile anything to use ipwndfu. However, if you wish to make changes to assembly code in `src/*`, you will need to use an ARM toolchain and assemble the source files by running `make`.\n\nIf you are using macOS with Homebrew, you can use binutils and gcc-arm-embedded. You can install them with these commands:\n\n```\nbrew install binutils\nbrew cask install https://raw.githubusercontent.com/Homebrew/homebrew-cask/b88346667547cc85f8f2cacb3dfe7b754c8afc8a/Casks/gcc-arm-embedded.rb\n```\n\n## Credit\n\ngeohot for limera1n exploit\n\nposixninja and pod2g for SHAtter exploit\n\nchronic, CPICH, ius, MuscleNerd, Planetbeing, pod2g, posixninja, et al. for 24Kpwn exploit\n\npod2g for steaks4uce exploit\n\nwalac for pyusb\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Faxi0mx%2Fipwndfu","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Faxi0mx%2Fipwndfu","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Faxi0mx%2Fipwndfu/lists"}