SSH Ramdisk Script

Create and boot a SSH ramdisk on checkm8 devices

---

Prerequsites

1. A computer running macOS/linux
2. A checkm8 device (A7-A11)
3. iOS 12-16 IPSW link
4. libimobiledevice installed on your Mac/Linux
   • brew or Procursus is required.
   • brew: brew install libimobiledevice libirecovery
   • Procursus: sudo apt install libimobiledevice-utils libirecovery-utils libusbmuxd-tools
   • Linux: sudo apt install libimobiledevice-utils irecovery libusbmuxd-tools

Usage

1. Clone and cd into this repository: git clone https://github.com/verygenericname/SSHRD_Script --recursive && cd SSHRD_Script
   • If you have cloned this before, run cd SSHRD_Script && git pull to pull new changes
2. Run ./sshrd.sh <link to your ipsw>, without the <>.
   • you can put your own shsh for the second argument, although optional
3. Place your device into DFU mode
   • A11 users, go to recovery first, then DFU.
4. Run ./sshrd.sh boot to boot the ramdisk
5. To ssh into the device, open up another terminal window and run iproxy 2222 22.
6. In the first terminal window, run ssh -p2222 root@localhost
7. Finally, to mount the filesystems, run mount_filesystems

• /var is mounted to /mnt2 in the ssh session.

8. Have fun!

Other Stuff

• Reddit Post

You can also set your nonce/reset a iphone on ios 9+ with this

set nonce: ./sshrd.sh set-nonce <generatorhere>

reset: ./sshrd.sh reset