|palera1n(1)||General Commands Manual||palera1n(1)|
palera1n — iOS 15+
arm64 iOS/iPadOS jailbreaking tool
palera1n jailbreaks any iOS/iPadOS device
with an arm64 (arm64e excluded) on iOS 15+, utilizing the
checkm8 bootROM exploit.
palera1n is able to jailbreak the device
in fakefs-rootful mode, where / is writable, as well as rootless mode, where
/ cannot be written to.
Due to the nature of the checkm8 exploit,
palera1n is semi-tethered. That is, you must run the
palera1n tool after the device reboot in order to
enter the jailbroken state. However, it is not required for the device to
On A11 devices, that is, iPhone 8, iPhone 8 Plus and iPhone X, the passcode cannot be used.
On iOS 15, the passcode must be off while jailbroken.
On iOS 16, the passcode must be off since restore, and Reset All Contents and Settings from settings app counts as a restore. A backup may be used in this case.
As described above, arm64 iOS/iPadOS 15+ devices are supported, here is an explicit list of supported devicecs:
Support for other arm64 Darwin devices, including Apple TV, HomePod and iBridge on Darwin 21 and above could be added, but they are currently unsupported.
arm64e devices will NEVER be supported.
--fakefs, this will actually boot the device in rootless mode then delete the jailbreak files. As a result, using the loader app to install the jailbreak environment is not supported when this option is used together with
--setup-fakefsbut the size of the created fakefs is smaller at the expense of having unwritable parts in rarely-written paths. (good for 16 GB devices)
--fakefs, Create the new APFS volume required for rootful. Will fail if one already exists.
palera1nand cannot be overriden. Additionally, the wdt=-1 argument is used during fakefs setup.
--jbinit-log-to-fileMakes jbinit log to /cores/jbinit.log This file may be viewed from sandboxed applications while jailbroken.
--pongo-shellbut default images and options have been uploaded and applied respectively.
--override-checkra1noption, files must be executable from it as the built-in checkra1n file is extracted and executed here. When not set, /tmp is used.
To (re-)jailbreak in rootless mode:
To setup fakefs for rootful mode:
To re-jailbreak in rootful mode:
To remove the jailbreak in rootful mode:
palera1n --force-revert -f
To remove the jailbreak in rootless mode:
To verbose boot in rootful mode:
To create a partial fakefs with bind mounts:
To exit recovery mode:
-v is not a real XNU boot argument. It is
intercepted by iBoot. However, since XNU boot arguments are set in PongoOS,
which is ran after iBoot has ran, it does nothing. To verbose boot, use the
Fakefs takes up around 5-10 GB of storage, and take up to 10 minutes to setup.
iOS 15.0 requires DER entitlements, and iOS 15.1 requires hash
agility in code signatures. As a result, binaries with the old code
signature format need to be resigned with a recent version of the Procursus
fork of ldid(1) before they can be ran on a device
The palera1n loader app will take up to 30 seconds to appear on the homescreen after the device has booted. If it does not appear, you can try using the shortcut:
to open it. After opening the loader app, press install to install a bootstrap as well as the Sileo package manager. You can install other package managers from settings of the loader app.
During the jailbreak process, a temporary filesystem is mounted on /cores as a place to stash jailbreak files needed during the boot process. No files are ever written onto the actual disk if you do not use the SSH server to write files or using the loader app to install additional jailbreak files.
-Lis used, the log file of jbinit.
palera1n may crash if the machine it is
- Has no USB ports
- Has non-compliant USB devices plugged in
palera1n injects a dylib into launchd to
runstats command to be used on the device.
palera1n jailbreak was first written
by Nebula and Mineek on September 26, 2022, as a shell script. Tweak support
with DEVELOPMENT kernels are added on October 2, 2022. RELEASE kernel
support is added on November 14, 2022. iOS 16 Support is added on December
13, 2022. Later, the first attempt to rewrite palera1n into C begins on
January 01 2023. The
palera1n utility described here
is the second attempt, which first started on January 16, 2023, using
checkra1n 1337 and the plush KPF.
|06 February 2023||Debian|