An iOS 15.0-16.3 work-in-progress,
(semi-)tethered checkm8 jailbreak

Guide • Common Issues • Changelog • Discord • Twitter

How does it work?

It boots the device with multiple patches required. On first run, it'll boot a ramdisk which dumps your onboard blob, creates a fakefs (if using semi-tethered), installs the loader app, and patches your kernel.

Warnings

• We are NOT responsible for any data loss, or the result of a device being bricked. The user of this program accepts responsibility should something happen to their device. While nothing should happen, jailbreaking has risks in itself. If your device refuses to boot after using palera1n please use iTunes or Finder to restore iOS (or if you used tethered, use --restorerootfs at the end of your palera1n command).

• palera1n will never work in VirtualBox, VMware or any virtual machine that doesn't support a PCI passthrough.

Requirements

• Needs a checkm8 vulnerable iOS device on iOS 15.x or 16.x (A8 - A11)

  • If you want the device to be semi-tethered, you will need 5-10GB of space for the fakefs. This means that 16GB devices cannot be semi-tethered
  • If you are on A10(X), use checkp4le instead for full SEP functionality (Passcode, TouchID, Apple Pay)
  • On A11, you must disable your passcode while in the jailbroken state (on iOS 16, you need to reset your device before proceeding with palera1n A11).

• USB-A cables are recommended to use, USB-C may have issues with palera1n and getting into DFU mode.

• A Linux or macOS computer

  • Python 3 must be installed.
  • AMD CPUs have an issue [with (likely) their USB controllers] that causes them to have a very low success rate with checkm8. It is not recommended that you use them with palera1n.
    • If your device does not successfully jailbreak, try a computer with an Intel or other CPU

Still need help?

Join the Support Discord if you need help with palera1n :)

Credits

palera1n Contributors

• Nathan for part of palera1n's development.
  • The ramdisk that dumps blobs, copies files, and duplicates rootfs is a slimmed down version of SSHRD_Script
  • For modified restored_external
  • Also helped Mineek getting the kernel up and running and with the patches
  • Helping with adding multiple device support
  • Fixing issues relating to camera.. etc by switching to fsboot
  • iBoot64Patcher fork
• Mineek for more part of palera1n's development.
  • For the patching and booting commands
  • Adding tweak support
  • For patchfinders for RELEASE kernels
  • Kernel15Patcher
  • Kernel64Patcher
  • Work on jbinit, together with Nick Chan
• Tom for a couple patches and bugfixes
  • For maintaining Kernel64Patcher
• Serena for helping with boot ramdisk.
• Nick Chan general help with patches and iBoot payload stuff
• Dora for iBoot payload and iBootpatcher2
• alexia for the script to help get into DFU

Other credits for tools used in palera1n

• Amy for the Pogo app
• checkra1n for the base of the kpf
• the Procursus Team for the amazing bootstrap
• m1sta for pyimg4
• tihmstar for pzb/original iBoot64Patcher/original liboffsetfinder64/img4tool
• xerub for img4lib and restored_external in the ramdisk
• Cryptic for iBoot64Patcher fork, and liboffsetfinder64 fork
• libimobiledevice for several tools used in this project (irecovery, ideviceenterrecovery etc), and nikias for keeping it up to date
• Sam Bingner for Substitute

Thank you so much to our Patreons that make the future development possible! You may sub here, if you'd like to.