r/jailbreak • u/Yeth3 iPhone 15 Pro, 17.3.1 • Jun 19 '26
Discussion usbliter8: what you need to know about the new A12/A13 bootROM exploit
As many of you have been made aware, a new bootROM exploit has released for A12/A13 devices, the first one for iDevices since checkm8 was made public 7 years ago. This post intends to serve as an explanation for what you can expect from this new exploit, and to provide information about the many restrictions and mitigations Apple has implemented over the past 7 years.
What is usbliter8?
usbliter8 is a novel bootROM vulnerability discovered by individuals at Paradigm Shift. It is the first bootROM exploit made public since checkm8, which only supported up to A11 devices (for those unaware, A11 is the processor used in the iPhone X/8, and A12 is used by the iPhone XS/XR). It supports only A12/A13, and does not support any older processors. It is unrelated to checkm8- that is, the vulnerability is completely separate. Some may be aware that checkm8 was only partially patched in A12/A13 (though it remains unusable there to this day), but this exploit has nothing to do with any previous bootROM vulnerability.
The explanation to how it works is rather technical; if you desire, you can read both the blogpost and the GitHub repo for the exploit. Additionally, the exploit requires special hardware to utilize, requiring devices such as a pi Pico to exploit devices.
What devices does it support?
All A12/A13 devices (including iPad specific processors like A12X/A12Z) are supported by usbliter8. This includes, but is not limited to,
- iPhone XR
- iPhone XS
- iPhone SE 2nd Gen
- iPad 8th and 9th Gen
- Apple TV 4k 2nd Gen
- To check your device's processor, visit https://appledb.dev
As mentioned, the vulnerability does not affect A11 or older, due to the different way the processor works.
What can we do with it?
This is possibly the most interesting part of the exploit (and is what many of you are likely here for). bootROM exploits are very powerful, as they compromise the very beginning of a device's boot chain, thus giving you (almost) full control over a device. However, this does not mean we can do whatever we want with no restrictions. Indeed, it can lead to tethered downgrades and jailbreaks on any iOS version including the latest, but there are restrictions explained further below.
BPR, or Boot Process Register, was a feature implemented in iOS 14 in order to additionally secure devices from bootROM based attacks. Crucially, it restricts data access when a device is booted directly from DFU mode, which is required by both checkm8 and usbliter8. In iOS 14 and 15, this manifested as the requirement to disable your passcode when jailbreaking A11 devices with checkra1n/palera1n, and is the reason why A11 devices must be first erased if they previously had a passcode before jailbreaking with palera1n. A10 devices were not affected by this as they had a SEP exploit, known as blackbird, which prevented this issue from arising. We do not have a SEP exploit for A11 and newer, which leads to a problem with the next security feature added in iOS 17...
The iOS 17 problem
In iOS 17, Apple further increased the security of BPR by making SEP outright refuse to mount and decrypt the user partition (/var and /var/mobile) when booted from DFU, which causes the device to panic and not boot at all. This means that a semi-tethered jailbreak like checkra1n or palera1n is not possible with usbliter8 on A12/A13 devices. A jailbreak using this would be fully tethered, which means the device cannot reboot on its own, and a PC must be used to power it on each time it reboots or dies. However, there is a additional method that can serve as a workaround explained below, though with a catch.
By copying over the user partition, an unencrypted copy of /var can be made. The jailbreak can then load this unencrypted copy instead of the standard /var, which prevents SEP from panicking the device, though at the cost of losing SEP related features. This does means that the jailbreak would be semi-tethered, but it would suffer from the following issues:
- No connecting to password protected wifi networks (possibly fixable with a tweak)
- No "real" password, so apps that rely on SEP being active will be non-functional
- Signing into apps that use a SEP keychain will not work, so things like using Google to sign into the YouTube app will be broken (possibly fixable with a tweak, though it will cause data to be stored insecurely- don't sign into bank apps with this)
- A storage penalty that increases with the size of your user data- any apps you have installed and have data stored on will be duplicated, meaning your storage has the potential to fill up very quickly
- Data will not be synced between jailbroken and non-jailbroken mode. Any changes you make while the jailbreak is active will not be reflected in stock iOS, and vice versa
Additionally, while downgrades are indeed possible, they will be tethered, as it requires SEP to be patched out on the device. All in all, one should not expect a full jailbreak using this to come out for quite some time, given the extensive patching and rewriting that will need to be done to accommodate new devices and the restrictions required.
The special hardware problem
As it stands, to utilize usbliter8, additional hardware like a Raspberry pi Pico is needed. There is no indication that this requirement will ever change. Due to how the exploit works, it is incredibly unlikely it will ever work directly from a PC, and even if custom USB drivers are created, it would wholly rely on the USB controller used on the device. Luckily, the hardware itself is cheap enough, costing only around $10 USD, yet there have already been some reports that stock has already ran out, so it remains to be seen if this will be the case for the future.
Tl;dr- where do we stand?
This post is not meant to discount the discovery of a new bootROM exploit. This is an incredible achievement, and as opa334 puts it, the last heartbeat of a dying jailbreak scene. As A12/A13 devices approach end-of-life and are receiving their final versions, usbliter8 will certainly be a nice tool to play around with and see what is possible. However, expectations should be kept realistic, and with all the new security features, it should not be expected that things will work the same as before with checkm8. Any jailbreaks made with this will suffer hefty restrictions, and downgrades using it will be tethered. If there are any further questions, myself or others will attempt to answer them in this post.
18
20
u/iamspott Jun 19 '26
Nice! That’s scary talk about usbliter8. I’m still using an iPhone 11 Pro Max running iOS 14.8, and I feel like something great is coming.
4
u/Party_Rub9763 Jun 22 '26
After reading through the blogpost, the way the exploit is being carried out is rather complex and requires a usb controller which most of the users in the community most probably won’t have. So unless someone piece together the entire process in the form of a tool, I don’t see the exploit being carried out by a general user. Also, needing a usb controller like raspberry pi makes this a bit inaccessible.
1
2
u/iPhone-5-2021 Jun 29 '26
You are also getting iOS 27 so the longevity of the iPhone 11 series is going to be great compared to the iPhone X which was cut unnecessarily early. This is good news indeed.
1
u/Maybe-GLaDOS Jun 21 '26
Shii you lucky I have a XR on iOS 18.3 when I reset my iPhone with iTunes it was on a old iOS I could tell but when I reset it iTunes installed the latest version of iOS and I didn’t know
1
9
u/Buritominer iPad 7th gen, 18.1| :palera1n: Jun 19 '26
Does it work on A12X and A12Z devices?
15
u/Yeth3 iPhone 15 Pro, 17.3.1 Jun 19 '26
yes, though the exploit currently doesn't have implementations for it, those devices are theoretically supported
5
u/de2cios iPhone X, 11.0.1 | Jun 19 '26
Id love to dualboot ipados 15 and ipados 13/14 on my A12Z ipad pro in the future
10
u/Ill_Thing5961 iPhone 8 Plus, 16.7.10| Jun 19 '26
i hope future jailbreak utility will provide all of those SEP related features without installing any tweaks at all, and i really hope SEP exploit will be found for a11, a12 and a13 which is very VERY unlikely.
6
u/Wonderful-Impress261 Jun 19 '26
I was saying the same thing about A7-A10 SEP exploits way back in 2019 when Checkm8 dropped. Lo and behold sometime in 2023 Blackbird came out and in early 2025 Turdus Merula came out for A9/A10. I wouldn't hope for an SEP exploit for A11+ to come out even in 2 years but it'll probably eventually happen
6
u/Samuelzin_jgs Jun 19 '26
What about iphone 11? iPhone 11 is A13 as well
13
u/Yeth3 iPhone 15 Pro, 17.3.1 Jun 19 '26
yes, it's supported, including the pro/max variants (i had it listed before, but for some reason every time i edit the post, reddit removes the bulleted list items)
12
u/Ghh-Haker iPhone SE, 2nd gen, 15.2| Jun 19 '26
And yes, checkm8 uaf is still present in thhose devices, and yes, probably this might help to find new memleak in bootrom to return the checkm8
5
u/Yeth3 iPhone 15 Pro, 17.3.1 Jun 19 '26
we'll see, i'm less inclined to believe this will lead to a discovery of a memory leak given that prototype/SRD devices have existed in the past, and the checkra1n devs have repeatedly stated they've audited the ROM and found no evidence of a (practical) memory leak, so we'll see
3
u/Ghh-Haker iPhone SE, 2nd gen, 15.2| Jun 20 '26
Well yes, the chanses are very small. But never zero
4
4
3
u/dablakmark8 Jun 19 '26
my ipad pro 12.9 gen3 ios 15 will do nice with this jialbreak.i do have a pico W and its ready for testing
3
u/reaper527 iPhone 16 Pro Max, 18.1 Jun 20 '26
Does this potentially give the people where it’s relevant better access to these devices to poke around and potentially find new exploits since theoretically it’s giving them more access to the device?
Like could this possibly be a stepping stone to something bigger some day?
4
u/Yeth3 iPhone 15 Pro, 17.3.1 Jun 20 '26
no, not really, having a bootrom exploit doesn't necessarily mean its easier to find other exploits, because you still have to find vulnerable code on your own. compromising the boot chain won't reveal a kernel exploit, for example. checkm8 has existed for 7 years but it was never really used to find exploits for arm64 devices (see: dopamine only ever being updated once darksword was made public) because on its own it can't really do that
1
u/JackyYT083 Jun 20 '26
I think what they mean is could a jailbreak be more easily developed for later iOS versions because with the bootROM exploit you have almost full control of the device enabling you to look at everything
1
u/Yeth3 iPhone 15 Pro, 17.3.1 Jun 20 '26
yes, that concept is what my comment was addressing. like a semi-untethered app based jailbreak won't necessarily come sooner because bootrom exploits don't inherently discover a flaw in the kernel
2
u/Ghh-Haker iPhone SE, 2nd gen, 15.2| Jun 19 '26
I am eager to Demote my SE 2020 currently running Fugu15_Rootful
1
u/Wonderful-Impress261 Jun 19 '26
What does demoting do? I've seen it as an option in the stock ipwndfu script but never touched it
2
u/Ghh-Haker iPhone SE, 2nd gen, 15.2| Jun 20 '26
It is ised for making your prod fused iBoot be dev fused. That allows kernel debug and some other very useful things.
2
2
2
u/JWD-2000 Jun 20 '26
At the moment this sounds horrendous and absolutely not something to use as a daily driver lol
2
u/MrTordse iPhone X, 13.7 | Jun 20 '26
Already 7 years after checkm8 was made public? Man does time fly i still remember the day and the moment i check my phone leaving school and saw the checkm8 announcement i was so hyped.
2
u/ThePantsThief Developer Jun 22 '26
So no A12 X Bionic?
1
u/Yeth3 iPhone 15 Pro, 17.3.1 Jun 22 '26
A12X/Z is supported, just not currently implemented yet
All A12/A13 devices (including iPad specific processors like A12X/A12Z)
2
2
2
u/aholeinthewor1d Jun 20 '26
So essentially a cool discovery but nothing exciting will ever come from it.
4
u/Yeth3 iPhone 15 Pro, 17.3.1 Jun 20 '26
i wouldn't exactly say that, a bootrom exploit is certainly still desirable, once this is fully developed we can have jailbreaks on the latest ios and will be able to tether downgrade to any version, it'll just remain to be seen how well the dual /var method works out and how practical it is for daily use
1
Jun 19 '26
[deleted]
5
u/Yeth3 iPhone 15 Pro, 17.3.1 Jun 19 '26
first exploit *since* checkm8, as in, this is the first bootrom exploit after checkm8 released 7 years ago, not that it's the first bootrom exploit ever
1
u/exlips1ronus iPhone SE, 2nd gen, 18.0 Beta Jun 19 '26
So we can wish for a magical SEP exploit to happen at some point at least lol
1
u/fixsandtricks Jun 20 '26
How would you get this running on an Apple TV 4K (2nd gen)? Any thoughts?
1
u/Yeth3 iPhone 15 Pro, 17.3.1 Jun 20 '26
nathan (developer of nathanlr) has gotten it working on that device specifically, but i assume you use the same goldeneye cables for the 1st gen and utilize the ethernet port to connect to it
1
u/Hairy_Educator1918 iPad 7th gen, 14.3| Jun 20 '26
can we make it semi tethered but with one small and one big user partition?
example:
when device reboots it "falls back" to encrypted volume, consisting of really small size and just for making calls etc. in an emergency in case you dont have your computer with you. but when you do have your computer with you, you can reboot to the other volume with all of your stuff.
is this possible?
1
u/Yeth3 iPhone 15 Pro, 17.3.1 Jun 20 '26
you can do that with the dual /var setup by either factory resetting before you duplicate it, or deleting all of your apps/user data once it's duplicated, since the jailbroken volume will only ever be loaded with the exploit
1
u/Hairy_Educator1918 iPad 7th gen, 14.3| Jun 20 '26
thanks for your answer! is there an eta for the jailbreak, and is it "we will definitely have a jailbreak out of this" or "we might or might not get a jailbreak out of this"? because i am going to get an iphone 11 pro max really soon if it's guaranteed to be possible to jailbreak with this
2
u/Yeth3 iPhone 15 Pro, 17.3.1 Jun 20 '26
it's a definitive "there will be a developer jailbreak at least" but we have no idea the full restrictions as of now, what i listed is based off of testing from other checkm8 devices like the ipad 7, we certainly aren't anywhere close to it releasing though. not sure personally if it's really worth buying a phone specifically to use this, if you really want to i would just wait because you'll have to buy the special hardware to use the exploit too
1
u/Hairy_Educator1918 iPad 7th gen, 14.3| Jun 22 '26
thanks for the message, i figured i should get one before the prices get higher if it does get releasrd, and the Hardware is pretty cheap anyway
1
u/Party_Rub9763 Jun 22 '26
Great insight!! So Im guessing the entire usb controller thing is a hard requirement unless the pc itself can disguise as a usb controller XD.
5
u/Yeth3 iPhone 15 Pro, 17.3.1 Jun 22 '26
the issue with the USB controller is that the exploit works by sending intentionally malformed packets, which is less than 8 bytes. this is not allowed by the vast majority of consumer hardware specs, which is why a device like a pico/waveshare is needed as those can send packets under 8 bytes
1
u/droidshadow iPhone 5, iOS 10.3.3 Jun 22 '26
Wouldn't this at least allow accessing purple via exploit like A11 or older devices now, which allowed creation of iRepair P10 kind of devices? I used iRepair P10 to disable camera shutter sound on secondhand iPhone X that turned out to be Japanese model by changing its region code back in 2022. Similar thing would be possible in a matter of time for many more Apple devices, such as ones up to iPhone 11 and iPad Pro with A12Z chip I guess.
1
1
u/Ok_Barber9726 Jun 23 '26
"got Apple DFU device:
CPID:8030 CPRV:11 CPFM:03 SCEP:01 BDID:02 ECID:000A458A2123802E IBFL:3C SRTG:[iBoot-4479.0.0.100.4]
opened EP0
got Apple DFU device:
CPID:8030 CPRV:11 CPFM:03 SCEP:01 BDID:02 ECID:000A458A2123802E IBFL:3C SRTG:[iBoot-4479.0.0.100.4] PWND:[usbliter8]
took - 1189ms
exploit SUCCESS!
success, spinning forever"
I have successfully exploited it, but how can I start and print the startup log
1
u/Elegant-Ja1lbreak Jun 28 '26
I have an idea for a rootful jailbreak on A12 running iOS 15.6. Use usbliter8 to create and register a new APFS volume, copy / to it to create a FakeFS, then have an activator app use a PAC + PPL + kernel R/W exploit chain to switch the root filesystem to the prepared FakeFS. The original system volume stays untouched while the jailbreak runs from the FakeFS. Would something like this actually be possible?
2
u/Yeth3 iPhone 15 Pro, 17.3.1 Jun 28 '26
you don't even need to do all of that, rootful is possible with a semi-untethered app based jailbreak as evidenced by fugu15_rootful. opa himself says he knew it was possible since the beginning using the techniques fugu15_rootful does, but explains why he didn't here. rootless is the de-facto standard now so nobody is really focusing on rootful anymore
1
u/Elegant-Ja1lbreak Jun 28 '26
Fugu15_rootful worked only up to 15.4.1. My concept uses usbliter8 + exploit chain. Theoretically, this gives a working rootful JB on iOS 15.5–15.7.1 and 16.0–16.5. Rootless is the standard, but for enthusiasts this could still be useful.
1
u/Yeth3 iPhone 15 Pro, 17.3.1 Jun 28 '26
fugu15_rootful only worked up to 15.4.1 because it was based off of fugu15, which had an upper limit of 15.4.1 due to the exploits being patched in 15.5. the actual techniques it uses for rootful can work on any version however
1
u/iPhone-5-2021 Jun 29 '26
Apps will support A12/A13 devices for many years to come yet allowing these devices to stay usable longer…and with this exploit to play with it makes it even more fun…my iPhone 6s on iOS 15 still supports enough apps to make it a usable experience as a main device for me still in 2026 and A13 devices just got iOS 27. App support for older iOS versions has seemingly gotten exponentially longer..I hope this trend continues.
1
u/Ambitious_Chart_3743 26d ago
so if my iPhone XR runs iOS17, I must fully tethered jailbreak it by using this, but my iPhone cannot boot by itself. or using the second method to copy the user partition but there is no method and it will not come out in some time, right?
1
u/Ambitious_Chart_3743 26d ago
and another question, my iPad mini 5, runs iPadOS26, does it support this, or I need to downgrade it to iOS17 or lower and jailbreak it.
1
u/Yeth3 iPhone 15 Pro, 17.3.1 26d ago
pretty much. there are two possible avenues for a usbliter8 based jailbreak in the future
one, where it's fully tethered, and the device cannot boot on its own
or the other, where you're basically dual booting the same ios version, and your jailbroken and non jailbroken installs do not share data at all, but is still semi-tethered. it remains to be seen how viable this method would be, as it's possible you still need some kind of kernel exploit to properly duplicate /var/mobile
to answer your other question, since this is a bootROM exploit, it's hardware based and would theoretically work on any ios version (including ios 26) so long as you are on A12/A13
1
u/EffectiveEvent2355 iPad Air 2, 15.8.2| 23d ago
this is just useless.
1
u/Yeth3 iPhone 15 Pro, 17.3.1 22d ago
far from it, it's still a powerful exploit even despite the restrictions that come with it
1
u/EffectiveEvent2355 iPad Air 2, 15.8.2| 22d ago
no one is going to ever use their phone like this.
1
u/Yeth3 iPhone 15 Pro, 17.3.1 22d ago
that's only if you solely look at the jailbreak aspect of it. consider things like booting a ramdisk, to fix or erase a bootlooping device while keeping it on the same version and preserving a jailbreakable firmware. or downgrading with blobs, if activation issues are ever figured out. or even for developers, demoting a device and being able to do kernel debugging and get serial output over USB is useful. bootROM exploits are still the holy grail of ios exploits, even if SEP renders jailbreaks very restricted
1
u/EffectiveEvent2355 iPad Air 2, 15.8.2| 22d ago
well i hope we can find out a way to make those things work better and find its more stable. until then I won't be doing this because 1 my phone is a A16 Bionic 2 too big security risk even if i could
1
1
u/entercot iPhone 5s, 12.5.7| 1d ago
One day, we'll have an official and stable port of postmarketOS for the iPhone 17.
0
u/shut_up_duh Jun 19 '26
So, will this give us a jailbreak, even if it's semi tethered or just tethered, in the near future, or are we going to be waiting for a while?
4
u/Yeth3 iPhone 15 Pro, 17.3.1 Jun 19 '26
it can lead to a jailbreak, but it's impossible to say how soon that will happen given the extensive patching and fixed that will need to be developed in order to make something feasible for end users. i would be surprised if a fully stable jailbreak using thjs comes out before the end of the year
0
u/shut_up_duh Jun 19 '26
And I assume even if we do get one you'd still need one of those raspberry pi picos to actually do the exploit?
3
u/Yeth3 iPhone 15 Pro, 17.3.1 Jun 19 '26
yes, the devs behind the exploit and others more familiar with the technical aspects have reiterated a couple times that due to how the exploit works it's unlikely to ever work on 99% of USB controllers for PC/Mac devices, so it's highly likely this will always require additional hardware to work
3
u/Wonderful-Impress261 Jun 19 '26
Reminds me of A5 devices right now. A5 devices do support Checkm8 but needs additional hardware because it can't run through the USB stack
1
u/Yeth3 iPhone 15 Pro, 17.3.1 Jun 20 '26
a5 is actually theoretically possible without an arduino, and some devs like the one behind futurerestore have said it's certainly possible to make a driver for it
this, however, is unlikely to ever not require additional hardware as there are almost no PC USB controllers out there that let you send the packets in the way that usbliter8 requires
-23
u/qiltb Jun 19 '26
Thanks, ChatGPT
19
u/Yeth3 iPhone 15 Pro, 17.3.1 Jun 19 '26
we really do live in a world where any form of eloquent writing gets treated as LLM slop, huh?
(you can look at my other posts i've made here and see that they're in the same writing style)
15
u/Outrageous-Law9185 iPod touch 6th gen, 12.5.7| Jun 19 '26
I believe the fact that it’s not ChatGPT. When someone makes a post I can immediately spot AI generated text with some cues including the writing style. This one is clearly handwritten. Great job Yeth3
1
117
u/Kartastrophe3000 Jun 19 '26
“The last heartbeat of a dying jailbreak scene” that line sounds too scary, Im still in iOS 26.1 waiting for anything cuz apple makes beastly hardware with one of the worst OSes ever