Kavi

self learning iOS security researcher ,17 years boy

[Joseph Ravichandran @0xjprx]

I got the latest iOS and macOS 27 booting in Qemu (with SPTM!)

- Virtual iPhone 17, 16, 15, 14, 13, 12 and every M1-M5 Mac supported
- Debug, patch, or modify everything: kernel, SPTM, TXM, launchd, dyld, user programs all modifiable/ GDB-able
- Boots directly to root shell in seconds
- Run your own programs as root in iOS/ macOS, no jailbreak / kernel patches required
- SPTM, TXM, MTE/MIE, genter/ gexit, GXF/SPRR/GL0-2, AMCC, AIC v1-3, Apple timer, many sysregs
- Automated setup; get running in just a few minutes
- Runs anywhere qemu runs... no ARM CPU required 😉

Try it here: https://t.co/PEydRXL25G

[littlelailo @littlelailo]

Had a lot of fun reversing Coruna over the last couple weeks and decided it would be worth to write it all up before I forget - so enjoy :)

https://t.co/DWld4SWgf6

[Kavi @K6vish6]

@bellis1000 Yea i used h6camin

[matteyeux @matteyeux]

Got kernel R/W on an iPad mini 6th gen running iOS 18.6.2 using the in the wild exploit chain darksword

[Kavi @K6vish6]

@0x41con @xerub For admins of @0x41con can you record the talk of everyone and put it on thr youtube @xerub
Because others also can learn something

[Kavi @K6vish6]

@amfi_d Did you got network working ?

[Kavi @K6vish6]

@matteyeux Are you using normal ios kernel inside ios 26 ipsw or SRD device’s kernel

[Kavi @K6vish6]

IOSurface driver was used to trigger this bug and sending some IOSrifafewidth and height serialised objects to port and do some stuffs

Thanks for files @matteyeux

[James D @0x4A616D657344]

Through much p̶a̶i̶n̶ fun RE'ing plasmaloader and it’s comms mechanism I now have the ‘Coruna’ iOS remote exploit chain(s) served up locally with a custom module 🎵

[Kavi @K6vish6]

@amfi_d are there any modifications needed for inferno project to get iOS 26?

[Kavi @K6vish6]

@Little_34306 can't we run this vm on Intel Macs?

[Kavi @K6vish6]

@naehrdine Thanks for help

[Kavi @K6vish6]

I’m trying to learn how CVE-2019-7287 vulnerability works ,does anyone know how to symbolise iOS kernel . ida pseudo code was messed.

#ios

[Kavi @K6vish6]

@naehrdine I saw it already have symbols in side iometa folder but how does that symbols import to ida pro workspace

[Kavi @K6vish6]

@naehrdine I already watched this video thanks 🙂

[Kavi @K6vish6]

@naehrdine Thanks i have ida pro 9.2 and can’t run ida_kernlcache plugin because of some version error i have iometa but i don’t how to import symbols to ida pro by iometa

[Kavi @K6vish6]

@naehrdine I’m using ios 12.1.4 on iPhone 6s
I tried with iometa but it gives only small amoint of class names not all things . It can’t apply for ida pro .
Some researchers having good output on ida pro but I’m still trying to get it

[Kavi @K6vish6]

@bellis1000 @blacktop__ I tried it but not works I doesn’t give output like this

[Kavi @K6vish6]

A good year of iOS jailbreak .

[Michael @MasterMike88]

Year In Review of Jailbreaking (2025):

Just like the last two years, it's month by month.

January:
January 16th, 2025: Lyncis is released, being the first WebKit-based jailbreak for 32-bit iOS 7.1.x

February:
February 16th, 2025: Dopamine 2.4 is released, largely fixing spinlock panics for arm64e iOS 15 once and for all, and substantially improving the "Hide Jailbreak" function to be near-equivalent to being in a stock state

March:
March 1st, 2025: Trigon is released, being a 100% reliable (cannot fail) kernel exploit for A10(X) devices on 13.0-15.7.6
March 29th, 2025: turdus merula 1.0 is released, being largely the first public tool to do untethered/tethered downgrades on A9(X)/A10(X) devices without any SEP limitations
March 29th, 2025: g1lbertJB 1.0.5 is released, adding Windows support to g1lbertJB

April:
April 2nd, 2025: tns-sockport and MeridianFix (TNS) are updated to have proper support for 64-bit 10.0-10.2.1, partially resolving the mess that has existed with 64-bit iOS 10 for the past few years

May:
literally nothing (pretend to be surprised)

June:
June 6th, 2025: Aquila is released, being a more modern jailbreak for iOS 6
June 8th, 2025: Nick Chan releases a guide on how to use iPadOS 18 on the iPad 6th Generation, which - while complex - is the first time that such a thing has been achieved on a 64-bit iOS/iPadOS device
June 9th, 2025: iOS/iPadOS 26 is announced, dropping support for the iPad 7th Generation, which was the final checkm8 iOS/iPadOS device remaining

July:
July 3rd, 2025 (estimated): Many A5(X)/A6(X) devices with an IMEI starting with "9900" started having issues with activation looping or outright failure to activate, this issue has still not been resolved as of now (to Apple if you're reading this: please fix this)
July 12th, 2025: EverPwnage 1.2 is released, adding support for 32-bit iOS 9.1-9.3.4
July 16th, 2025: Alfie adds A9(X) and A11 support to Trigon (which - as mentioned earlier - is a 100% reliable kernel exploit for 13.0-15.7.6)
July 20th, 2025: TotallyNotSpyware-v2 is released, allowing A10(X) and earlier devices jailbroken with Chimera (12.0-12.5.7) to re-jailbreak without an app

August:
August 3rd, 2025: oob_entry is released, being a 100% reliable (cannot fail) kernel exploit for all armv7 iOS devices on all armv7 firmwares
August 10th, 2025: EverPwnage 1.3 is released, adding semi-untethered support for 32-bit iOS 9.3.5/9.3.6, as well as switching to oob_entry for the kernel exploit

September:
September 23rd, 2025: palera1n 2.2 is released, adding iPadOS 18.4 and later support, as well as tvOS 18.4-26.1b1 support
September 24th, 2025: turdus merula 1.1 is released, adding Linux support, as well as allowing checkra1n/palera1n to be used on tether downgraded devices

October:
literally nothing (pretend to be more surprised)

November:
November 22nd, 2025: SundanceInH2A is released, allowing iPod Touch 3rd Generations to untether restore to iOS 6 (6.0, to be specific) for the first time

December:
December 4th, 2025: nathanlr 2.0 is released, adding 16.7 RC/17.0 support, as well as being the first time that iPhones are able to use most tweaks on iOS 17
December 31st, 2025: Two years pass since the last new kernel exploit (puaf_landa), or any jailbreak-relevant exploit for that matter

Overall:
- Device/Version combinations which already had something (whether a jailbreak or just TrollStore) got meaningful improvements and had a very good year.
- Anything that had nothing previously... still has nothing, and has not changed since 2023/2024.

2026 has a lot of things that are going for it for legacy (and anything that already has anything).

As for anything that doesn't have anything yet, I could pretend to be optimistic... but given that it's been 2 years since the last jailbreak-relevant exploit has pushed anything forward, I'm not sure.

Happy New Year.