MDX Tom MDX-Tom

Bruteforce 4-digit passcode on iPhone 5 iOS 9~10 via SSH Ramdisk

Here is a guide for automatically bruteforcing 4-digit passcodes on iPhone 5 using only a computer and a USB cable (without an MFC Dongle). My device is iPhone5,2 (iPhone 5 Global) iOS 9.2 (FMI OFF), the steps below may work on other 32-bit devices or other iOS versions (see below for tested working devices and iOS versions), but shall not work on any 64-bit devices.

See https://www.reddit.com/r/setupapp/comments/1ha2arg/bruteforce_4digit_passcode_on_iphone_5_ios_9_via/ for discussions.

Updated 10 Jan. 2025:

A more powerful guide for bruteforcing 32-bit devices was released by a reddit user: https://www.reddit.com/r/setupapp/comments/1hw5bfa/bruteforcing_32bit_iphones_ondevice_4_digit_pin/

tl;dr

The iphone-dataprotection project (GiHub mirror) includes a tool to determine an iOS device's 4-digit passcode using a brute force technique. That project only claims support for devices <= iOS 8 and < A5. It turns out the code also supports A5 devices on iOS 9.

However the brute force utility also requires a companion kernel patch to enable access to keys such as 0x835 in calls to the AES accelerator from userland. This doc confirms the value of said patches for 32-bit iOS 9.

This writeup also describes the various st

Downgrade and dualboot status of almost all iOS devices

UPDATED: 2025-09-25

Reddit mirror: https://www.reddit.com/r/iOSDowngrade/comments/j1x7iv/downgrade_and_dualboot_status_of_almost_all_ios/
GitHub Gist mirror: https://gist.github.com/LukeZGD/9d781f1b03a69fa46869384a9407a41a
As of updating this post, there is now a free downgrade tool that utilizes a SEP exploit released for A9-A10X devices, turdus merula: https://sep.lol/
- Untethered with blobs guide: https://ios.cfw.guide/turdusmerula/
- Tethered guide: https://ios.cfw.guide/turdusmerula-tethered/
Save SHSH blobs for signed iOS versions using TSS Saver or blobsaver

Note

For every body who using Win10/11 with new Office that you need to know:

to active Office without crack, just follow https://github.com/WindowsAddict/IDM-Activation-Script,

you wiil only need to run

irm https://massgrave.dev/ias | iex

	@import Darwin;
	@import Foundation;
	@import MachO;

	#import <mach-o/fixup-chains.h>
	// you'll need helpers.m from Ian Beer's write_no_write and vm_unaligned_copy_switch_race.m from
	// WDBFontOverwrite
	// Also, set an NSAppleMusicUsageDescription in Info.plist (can be anything)
	// Please don't call this code on iOS 14 or below
	// (This temporarily overwrites tccd, and on iOS 14 and above changes do not revert on reboot)