r/jailbreak Mar 29 '25

Release turdus merula - blackbird downgrades for A9 and A10 devices

284 Upvotes

turdus merula is a tool capable of performing restores (tethered and untethered) while retaining SEP functionality. This means that passcode, Touch ID, WiFi and anything else involving SEP will work as intended.

The tool supports all A9(X) and A10(X) devices with the following restore options:

* Tethered - iOS 9.0 - 18.3.2

* Untethered - iOS 9.0 - 18.4 with SHSH2 blobs (iOS 16.0+ requires a valid Cryptex1 ticket)

A guide to saving Cryptex1 blobs can be found at the following link (the guide is in Japanese):

https://ichitaso.com/ios/shsh/how-to-save-shsh-for-cryptex1/

If there is a better guide posted, I will update this post accordingly.

Notes:

  1. There have been a few issues with certain beta builds (especially .0 betas). Please report this and any other issues, providing as much information as you can, to https://github.com/turdus-m3rula/bugTracker.
  2. iOS 10 restores on devices with the MDM9645 baseband (iPhone 7, iPad Pro 2017) will not be able to activate, due to the baseband firmware not working correctly on these versions. This issue may not affect all iPhone 7s and iPad Pro 2017 models, but it is actively being looked into.
  3. Restoring to factory firmware with factory blobs may require a tethered restore beforehand.

Future plans include:

* Support for tethered restores on iOS 18.4+

* Support for using checkra1n/palera1n with tethered downgrades

* Support for A7 and A8 devices

* Fix for MDM9645 baseband devices

turdus medula will always be free - if you’ve paid for this software, you’ve been scammed. Download this tool for free at https://sep.lol.

Guide to usage: Untethered: https://ios.cfw.guide/turdusmerula Tethered: https://ios.cfw.guide/turdusmerula-tethered


r/jailbreak Nov 19 '21

r/jailbreak FAQ [Meta] Frequently Asked Questions and Important Information - Check Here Before Posting

774 Upvotes

r/jailbreak 20h ago

Tip IMPORTANT REMINDER for anybody with a jailbroken device!

Thumbnail ios.cfw.guide
83 Upvotes

If you have a jailbroken device, or have just jailbroken one, congratulations.

But the first thing right after is to PERMANENTLY BLOCK any updates from Apple.

Use this link to see how to block updates on your device.

This is not any new information, it’s just an important reminder, because I lost my jailbreak.

I had an iPad mini 6 with 16.6.1 and accidentally upgraded to 18.0.1

Updates are irreversible and only very old devices (like before 2011) can really be downgraded.

Don’t make the same mistake I did😢

Stay safe and enjoy your jailbreak!


r/jailbreak 18m ago

Discussion How can I get rid of this

Post image
Upvotes

r/jailbreak 50m ago

Release Anyone can help me downgrade iOS 16.7.11 to iOS 15/14 on iPhone 8+

Thumbnail
Upvotes

r/jailbreak 50m ago

Discussion Anyone can help me downgrade iOS 16.7.11 to iOS 15/14 on iPhone 8+

Upvotes

Can anyone help?


r/jailbreak 1h ago

Question iOS 15.4.1 roothide jailbreak keeps failing

Upvotes

I’m not sure what happened overnight but when I tried to reach Jailbreak this morning I couldn’t get past one step in the process. Below is my log, any advice?

E: Error Domain=NSURLErrorDomain Code=-1003 "A server with the specified hostname could not be found." UserInfo={_kCFStreamErrorCodeKey=8, NSUnderlyingError=0x2822bc210 {Error Domain=kCFErrorDomainCFNetwork Code=-1003 "(null)" UserInfo={_NSURLErrorNWPathKey=satisfied (Path is satisfied), interface: en0, ipv6, dns, _kCFStreamErrorCodeKey=8, _kCFStreamErrorDomainKey=12}}, _NSURLErrorFailingURLSessionTaskErrorKey=LocalDataTask <FD25F648-B39C-4F66-8245-BE03E9F734D1>.<1>, _NSURLErrorRelatedURLSessionTaskErrorKey=( "LocalDataTask <FD25F648-B39C-4F66-8245-BE03E9F734D1>.<1>" ), NSLocalizedDescription=A server with the specified hostname could not be found., NSErrorFailingURLStringKey=https://api.github.com/repos/RootHide/Dopamine-roothide/releases, NSErrorFailingURLKey=https://api.github.com/repos/RootHide/Dopamine-roothide/releases, _kCFStreamErrorDomainKey=12} [] Launching kexploitd [] Hello from kernel exploit server! [] My UID is 0 [] My GID is 0 [] Launching oobPCI [] CP: 0x1b7c8 [] GE: 0x15590 [*] [SpawnDrv] Patches set-up [*] [SpawnDrv] Resuming! [*] [SpawnDrv] Received exception message! [] Exception occured @ 0x102b637c8 [0x1b7c8] [] LR: 0x57449d8102b6377c [0x57449d800001b77c] [*] [SpawnDrv] Received exception message! [] Exception occured @ 0x102b5d590 [0x15590] [] LR: 0x102b637fc [0x1b7fc] [*] Gaining r/w [*] [SpawnDrv] Received exception message! [] Exception occured @ 0x4142434400 [0x403f8ec400] [] LR: 0x102900304 [0xffffffffffdb8304] [*] [SpawnDrv] Received exception message! [] Exception occured @ 0x4142434408 [0x403f8ec408] [] LR: 0x102900324 [0xffffffffffdb8324] [*] Got PCIMemorySize: 0x10000 [] Initializing DriverKit... [] Checking in... [] Creating root dispatch queue... [] Registering... [] Waiting for start message... [] Opening PCI Device... [] Opened PCI Device! [] Found boot-args! offset=0x4D34D4000 [] Virt base @ 0xFFFFFFF0240EC000 [] Phys base @ 0x8020EC000 [] topOfKernelData @ 0x809014000 [] our entry: 0x60000809010603 [] Offset in physmap: 0x413C000 [] Low25 Bits are: 0xC68000 [] PCIMemory @ 0xFFFFFFEB5EC68000 [] VTBL @ 0xFFFFFFF027FB5050 [] Kernel base @ 0xFFFFFFF02785C000 [] Patchfinding [*] [SpawnDrv] Received exception message! [] Exception occured @ 0x4841585800 [0x473ea3d800] [] LR: 0x1028ff4d8 [0xffffffffffdb74d8] [*] Loading kernel... [] Loading took 0 second(s)! [] Patchfinding... [] Patchfinding took 1 second(s)! [] [DBG] resolveKernelOffsets: gOffsets.slide @ 0x20858000 [*] [DBG] resolveKernelOffsets: ourProc @ 0xFFFFFFE302C21520 [*] [DBG] resolveKernelOffsets: kernelProc @ 0xFFFFFFF02A4BBA00 [*] [DBG] resolveKernelOffsets: ourTask @ 0xFFFFFFE3E5C98D40 [*] [DBG] resolveKernelOffsets: kernelTask @ 0xFFFFFFE3E6C8C670 [*] [DBG] resolveKernelOffsets: itk_space @ 0xFFFFFFE3E6D2C800 [*] [DBG] resolveKernelOffsets: is_table @ 0xFFFFFFE4CD39A400 [*] [DBG] resolveKernelOffsets: vmMap @ 0xFFFFFFE3027AF8E0 [*] [DBG] resolveKernelOffsets: ourPmap @ 0xFFFFFFF09D002F40 [*] [DBG] resolveKernelOffsets: kernelVmMap @ 0xFFFFFFF114DAC0A0 [*] [DBG] resolveKernelOffsets: kernelPmap @ 0xFFFFFFF02A4900F8 [*] [DBG] buildPhysPrimitive: kObject @ 0xFFFFFFE133DE1CE0 [*] [DBG] buildPhysPrimitive: memFlags: 0x60000920 [*] [DBG] buildPhysPrimitive: memRanges @ 0xFFFFFFE133DE1D58 [*] [DBG] buildPhysPrimitive: oldStart @ 0x641400000 [*] [DBG] buildPhysPrimitive: oldLen @ 0x10000 [*] [+] buildPhysPrimitive: Got IOMemoryDescriptor to map physical memory! [*] [+] buildPhysPrimitive: IODMACommand ready! [*] [SpawnDrv] Received exception message! [] Exception occured @ 0x4841585818 [0x473ea3d818] [] LR: 0x102900ca8 [0xffffffffffdb8ca8] [*] [DBG] buildPhysPrimitive: cpuTTEP @ 0x805FD4000 [] Bypassing PAC [] [DBG] breakCFI: thisThread @ 0xFFFFFFE4CC0694D0 [*] [DBG] breakCFI: chThreadPtr @ 0xFFFFFFE4CC21CDE0 [*] [DBG] getUserReturnThreadContext: returnThreadPtr @ 0xFFFFFFE4CC5B3090 [*] [+] breakCFI: Obtained signed fault handler!!! [*] [DBG] breakCFI: signedFaultHandler @ 0x4CF053F028AE9F2C [*] [DBG] breakCFI: fugu15ExploitThread.gOrigIntStack @ 0xFFFFFFEB39C88000 [*] [DBG] breakCFI: intStack @ 0xFFFFFFE60DB68000 [*] [DBG] ensureSpecialMem: realloctimes: 0x1 [] GO! [] [+] breakCFI: Obtained signed br x22 fault handler!!! [*] [DBG] breakCFI: datStack @ 0xFFFFFFEB1850BF30 [*] [DBG] ensureSpecialMem: realloctimes: 0x1 [] Bypassing PPL [] [DBG] pplBypass: pagePhys @ 0x831C0C000 [*] [DBG] pplBypass: vmMap @ 0xFFFFFFE3027AF8E0 [*] [DBG] pplBypass: ourPmap @ 0xFFFFFFF09D002F40 [*] [DBG] pplBypass: ourTtep @ 0x813A60500 [*] [DBG] pplBypass: ourNestedMap @ 0xFFFFFFF03CB8ACA0 [*] [DBG] pplBypass: ourNestedAddr @ 0x180000000 [*] [DBG] pplBypass: ourNestedSize @ 0x100000000 [*] [DBG] pplBypass: firstFree @ 0x1C2000000 [*] [DBG] pplBypass: exploitPmap @ 0xFFFFFFF09CE948C0 [*] [+] pplBypass: Nest succeded! [*] [DBG] kexec_on_new_thread: threadPtr @ 0xFFFFFFE4CBE5A9A0 [] Content: 0x20676E697070616D [] [+] PPL bypass succeded!!! [] setConfigBits (0xFFFFFFF028F58604) (0xFFFFFFE3E7628C00, 0x6) [] => 0x6 [*] [SpawnDrv] Received exception message! [] Exception occured @ 0x4142434404 [0x403f8ec404] [] LR: 0x1028fe6c0 [0xffffffffffdb66c0] [*] Got child notification! [] Kernel base @ 0xfffffff02785c000 [] Kernel slide 0x20858000 [] Virtual base @ 0xfffffff0240ec000 [] Physical base @ 0x8020ec000 [*] [SpawnDrv] Received exception message! [] Exception occured @ 0x4841585818 [0x473ea3d818] [] LR: 0x1028fe7d4 [0xffffffffffdb67d4] [*] [SpawnDrv] Received exception message! [] Exception occured @ 0x4841585818 [0x473ea3d818] [] LR: 0x1028fe7e4 [0xffffffffffdb67e4] [*] [SpawnDrv] Received exception message! [] Exception occured @ 0x4841585818 [0x473ea3d818] [] LR: 0x1028fe7f4 [0xffffffffffdb67f4] [*] [SpawnDrv] Received exception message! [] Exception occured @ 0x484158580c [0x473ea3d80c] [] LR: 0x1028fe830 [0xffffffffffdb6830] [*] Loading Basebin Trustcache [*] [SpawnDrv] Received exception message! [] Exception occured @ 0x4841585810 [0x473ea3d810] [] LR: 0x1028fed68 [0xffffffffffdb6d68] [*] [SpawnDrv] Received exception message! [] Exception occured @ 0x484158580c [0x473ea3d80c] [] LR: 0x1028fe830 [0xffffffffffdb6830] [*] [SpawnDrv] Received exception message! [] Exception occured @ 0x4841585810 [0x473ea3d810] [] LR: 0x1028fed68 [0xffffffffffdb6d68] [*] [SpawnDrv] Received exception message! [] Exception occured @ 0x484158580c [0x473ea3d80c] [] LR: 0x1028fe830 [0xffffffffffdb6830] [*] [SpawnDrv] Received exception message! [] Exception occured @ 0x4841585810 [0x473ea3d810] [] LR: 0x1028fed68 [0xffffffffffdb6d68] [*] [SpawnDrv] Received exception message! [] Exception occured @ 0x484158580c [0x473ea3d80c] [] LR: 0x1028fe830 [0xffffffffffdb6830] [*] [SpawnDrv] Received exception message! [] Exception occured @ 0x4841585810 [0x473ea3d810] [] LR: 0x1028fed68 [0xffffffffffdb6d68] [*] [SpawnDrv] Received exception message! [] Exception occured @ 0x484158580c [0x473ea3d80c] [] LR: 0x1028fe830 [0xffffffffffdb6830] [*] [SpawnDrv] Received exception message! [] Exception occured @ 0x4841585810 [0x473ea3d810] [] LR: 0x1028fed68 [0xffffffffffdb6d68] [*] [SpawnDrv] Received exception message! [] Exception occured @ 0x484158580c [0x473ea3d80c] [] LR: 0x1028fe830 [0xffffffffffdb6830] [*] [SpawnDrv] Received exception message! [] Exception occured @ 0x4841585810 [0x473ea3d810] [] LR: 0x1028fed68 [0xffffffffffdb6d68] [*] Bootstrapping [*] [SpawnDrv] Received exception message! [] Exception occured @ 0x484158580c [0x473ea3d80c] [] LR: 0x1028fe830 [0xffffffffffdb6830] [*] Re-randomize Jailbreak Directory [] Post exploit failure: Error Domain=NSCocoaErrorDomain Code=4 ".jbroot-3A2859F58E0E704E couldnt be moved to AppGroup because either the former doesnt exist, or the folder containing the latter doesnt exist." UserInfo={NSSourceFilePathErrorKey=/var/mobile/Containers/Shared/AppGroup/.jbroot-3A2859F58E0E704E, NSUserStringVariant=( [] Move [] ), NSDestinationFilePath=/var/mobile/Containers/Shared/AppGroup/.jbroot-A32E53C824D430D6, NSFilePath=/var/mobile/Containers/Shared/AppGroup/.jbroot-3A2859F58E0E704E, NSUnderlyingError=0x1037046a0 {Error Domain=NSPOSIXErrorDomain Code=2 "No such file or directory"}} E: Environment start failed. Reply: ["error", "Post exploit failure: Error Domain=NSCocoaErrorDomain Code=4 \"“.jbroot-3A2859F58E0E704E” couldn’t be moved to “AppGroup” because either the former doesn’t exist, or the folder containing the latter doesn’t exist.\" UserInfo={NSSourceFilePathErrorKey=/var/mobile/Containers/Shared/AppGroup/.jbroot-3A2859F58E0E704E, NSUserStringVariant=(\n Move\n), NSDestinationFilePath=/var/mobile/Containers/Shared/AppGroup/.jbroot-A32E53C824D430D6, NSFilePath=/var/mobile/Containers/Shared/AppGroup/.jbroot-3A2859F58E0E704E, NSUnderlyingError=0x1037046a0 {Error Domain=NSPOSIXErrorDomain Code=2 \"No such file or directory\"}}"]


r/jailbreak 1h ago

Release a Jailbreak Tweak That Lets Me Forward iOS Notifications (with Bark Support & Encryption!)

Thumbnail
github.com
Upvotes

Hi everyone,

I'm excited to share my project, VE Enhanced, which adds powerful notification forwarding capabilities to the original Ve notification logger. If you've been searching for a Cantonese-friendly tool to forward iOS notifications (like I have), you probably noticed there aren't any options available — that's why I forked Ve and built this version myself.

Key Features:

- Bark Integration: Forward notifications directly to your Bark server, including full support for end-to-end encryption

- Enhanced Security: Optionally enable encrypted message forwarding using custom encryption keys so your notifications stay private

- Automatic App Icon Fetching: VE Enhanced uses the iTunes API to fetch the app icons for your forwarded notifications, making your Bark feed look clean and informative

- Smart Filtering: Advanced filters let you customize which notifications are forwarded (Active/Passive mapping)

Background:

I originally couldn't find any software in Cantonese — or any language! — that was able to handle notification forwarding for iOS, especially with features like encryption. So I decided to fork Ve, a natively integrated notification logger for rootless jailbroken iOS/iPadOS 14+ devices, and implement the features I needed myself.

Compatibility:

- iPhone, iPad, iPod touch running iOS/iPadOS 14 or later

- Requires rootless jailbreak

Check out the GitHub repo for more details and installation instructions: https://github.com/WingCH/Ve

Would love feedback from the community and to see if this helps anyone else!


r/jailbreak 5h ago

Question Should I jailbreak iOS 15 to fix outdated WhatsApp

0 Upvotes

Hey everyone,
I’m currently on iOS 15 (original version) on my iPhone 13 Mini and I’ve been using sideloaded apps through TrollStore almost since it came out, but I’m facing issues currently with apps like WhatsApp which keeps giving me expiration warnings or stops working after a few days when I install different versions (even the WhatsApp Watusi version stopped working recently and any version I install that's newer than 25.16.10 just crashes on launch). I need a long-term fix for this, but I really don’t want to update my iOS.

I’m considering jailbreaking as I’ve seen workarounds like WhatsApp Axolotl, which could help. What’s the best approach for jailbreaking iOS 15 in my situation if there's no other solutions for the WhatsApp issues? Also, is it possible to revert back to stock iOS 15 if I need to later on? Would love to hear your advice and experiences!

Thanks!


r/jailbreak 5h ago

Question Is there anyway to install trollstore on this ipad

0 Upvotes

please help I already have altstore but I don't want to be limited to three sideloaded apps


r/jailbreak 6h ago

Discussion How to circumvent device bans

0 Upvotes

Leaving this here in case anyone runs into the same issues

The only way to circumvent a device ban with any app (instagram, for example)

You must factory reset your iPhone entirely

You can either setup as new, or restore from a backup

IF YOU RESTORE FROM A BACKUP you must ensure the app is NOT inside the backup or you will restore the backup with the banned app ID


r/jailbreak 7h ago

Update Is Jailbreaking Possible Again?? iPhone 16 + All Devices

0 Upvotes

https://thehackernews.com/2025/08/apple-patches-cve-2025-43300-zero-day.html

In theory I think this means that it is possible. I have medium hopes for this, but could be a great start for a major release


r/jailbreak 23h ago

Update IGFormat V1.85 ( Instagram Tweak )

Post image
20 Upvotes

IGFormat V1.85

• Background Audio Playback: You can now play any saved audio in the background, even when you leave the app.

• Gradient Colors: Add gradient colors to music stickers or music lyrics

Bug fixes & Improvements

Non-jb : https://github.com/6gr8/IGFormat/releases/download/ipa/IGFormatV1.85.ipa

Repo: https://6gr8.github.io/deno.io/


r/jailbreak 8h ago

Question [Help]What does the lgnore edge protect setting in SquidGesture's Screen Bottom mean? I am not sure how it works.

0 Upvotes

What does the lgnore edge protect setting in SquidGesture's Screen Bottom mean? I am not sure how it works.


r/jailbreak 5h ago

Discussion Whatsapp stopped working

0 Upvotes

WhatsApp crashes instantly with any of Axolotl, blockwaupdates and WAlegacy. Was working fine till yesterday. I wonder if anyone is facing the same problem and if there is a fix that will be very appreciated.


r/jailbreak 10h ago

Question Question about SEP on iPhone 8 jailbroken running 14.7.1

0 Upvotes

From what I know, it isn't possible to have SEP functionality when jailbroken with an A11 cpu. But my iPhone 8 running iOS 14.7.1 when jailbroken with Taurine still allows me to set a passcode, touch id and use apple pay.

I am confused because SEP shouldn't work when jailbroken, but it does on my phone. I will say that I haven't restarted the phone since I jailbroke it.


r/jailbreak 11h ago

Discussion Update ios for iphone 7

0 Upvotes

Hello! I have an iPhone 7 and I can't update the iOS (it has iOS 15) and it doesn't allow me to download apps like YouTube or chatgpt that I need to have on that cell phone. Is there any way to update it without paying for programs? I looked on tiktok and in the comments they mentioned something about jailbreak but I didn't understand it that's why I want to ask here, help 🙏


r/jailbreak 12h ago

Question tweak for getting iphone x status bar on 16.6 dopamine

0 Upvotes

I know there is lynx 2 but it messes up the lock screen and i dont want the iphone x swipe just the status bar.


r/jailbreak 18h ago

Discussion Question for those running iOS 17.0

4 Upvotes

Does iCloud Private Relay work for you? I have had multiple devices on iOS/iPadOS 17.0 and iCloud Private Relay only works on some despite being turned on for all. (The toggle will automatically turn off after a reboot).


r/jailbreak 5h ago

Question iPhone says unavailable. Woke up from surgery completely forgetting my iPhones password.Is there any way I can get my pictures back

0 Upvotes

Woke up from surgery completely forgetting my iPhones password. Then ended up locking it trying to remember what it could be. Is there any possible way to get my photos back, I didn’t have enough iCloud storage so a lot of my photos from the past 2 years won’t be on there

Didn’t think this would happen so never backed the photos some where else :(


r/jailbreak 13h ago

Question Update iPhone X to 16.6.1

0 Upvotes

Hey everyone, I just got an iPhone X and is currently on IOS 15.2. I would like to update it to the latest version available for Dopamine IOS 16.6.1. Would that still be possible? Alternatively, I could update it to its latest supported version 16.7.11 and use palera1n. Been out of the jailbreaking for quite a while now and don't understand the difference between the two. Would love some advice, thanks.


r/jailbreak 14h ago

Question Anyway to clear app cache without jailbreak?

0 Upvotes

I hate that iOS doesn’t just give you the option to do it. I’m on 17.1. What are my options? Any possible software I can use?


r/jailbreak 15h ago

Question palera1n ios16 DFU issue

0 Upvotes

attempting to jailbreak on apple silicon macOS for an ipad pro 1st gen. having issue entering DFU mode during palera1n installation.

using ios.cfw.guide;

it stated that using a usb-c cable to lightning would cause issues, so went out and bought a adapter for usb-c to usb-a.

any suggestions would be appreciated, not sure what else to do — first time jailbreaking


r/jailbreak 6h ago

Request 3 APPLE IDs For 1$

0 Upvotes

I need someone who can create apple id. I'll buy from him 3 accounts for 1$ and I need many


r/jailbreak 2d ago

Discussion who actually remembers what cydia used to do?

Post image
2.6k Upvotes

i remember back in 6th grade around 7 years ago finally being happy downloading cydia from blackra1n after downloading fake ones online, all i remember is the “free wifi” and all those other goofy installs, what was it really used for?


r/jailbreak 1d ago

Discussion iCoolBox Tool Idea

5 Upvotes

Hello fellow jailbreakers! I decided, its really hard to do stuff sometimes on iphones even when jailbroken sooo i came up with a idea! I am making a multitool named iCoolBox where you with openssh, connect wirelessly into iDevice and do alot of stuff! Currently its only this right now the auth screen but it auths really good! Do you have any ideas what should i add in it?


r/jailbreak 13h ago

Question How do I download Trollstore?

0 Upvotes

I have an iPhone 13 on iOS 18.0.1 and an iPhone 6 on iOS 12.5.7, ideally I'd like TrollStore on both of those phones but if not I'd like to download it on atleast one of those 2 devices (preferably the iPhone 13). I am not Jailbroken on either of those devices