Skip to content

Commit 484fd83

Browse files
committed
Update README for checkm8
1 parent 2d0abd3 commit 484fd83

1 file changed

Lines changed: 28 additions & 0 deletions

File tree

README.md

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,34 @@
55
**Read [disclaimer](#disclaimer) before using this software.*
66

77

8+
## checkm8
9+
10+
* permanent unpatchable bootrom exploit for hundreds of millions of iOS devices
11+
12+
* meant for researchers, this is not a jailbreak with Cydia yet
13+
14+
* allows dumping SecureROM, decrypting keybags for iOS firmware, and demoting device for JTAG
15+
16+
* current SoC support: s5l8947x, s5l8950x, s5l8955x, s5l8960x, t8002, t8004, t8010, t8011, t8015
17+
18+
* future SoC support: s5l8940x, s5l8942x, s5l8945x, s5l8747x, t7000, t7001, s7002, s8000, s8001, s8003, t8012
19+
20+
* full jailbreak with Cydia on latest iOS version is possible, but requires additional work
21+
22+
23+
## Quick start guide for checkm8
24+
25+
1. Use a cable to connect device to your Mac. Hold buttons are required to enter DFU Mode.
26+
27+
2. First run ```./ipwndfu -p``` to exploit the device. Repeat the process if it fails, it is not reliable.
28+
29+
3. Run ```./ipwndfu --dump-rom``` to get a dump of SecureROM.
30+
31+
4. Run ```./ipwndfu --decrypt-gid KEYBAG``` to decrypt a keybag.
32+
33+
5. Run ```./ipwndfu --demote``` to demote device and enable JTAG.
34+
35+
836
## Features
937

1038
* Jailbreak and downgrade iPhone 3GS (new bootrom) with alloc8 untethered bootrom exploit. :-)

0 commit comments

Comments
 (0)