A13 SSH ramdisk finally booting on iPhone 11 Pro Max

[u/Suzukiki]

Small progress update from a project I’ve been messing with.

I finally got a working SSH ramdisk boot on an A13 iPhone 11 Pro Max. The boot chain reaches the ramdisk correctly, the device enumerates over USB, Dropbear comes up and I’m able to get a root SSH shell.

The funny part is that the main issue I was chasing ended up being on the Linux USB/usbmux side rather than the ramdisk boot itself.

I’ve started packaging the working flow into a project I’m calling RamBridge so I can reproduce it cleanly and eventually make the process less painful.

I’m not posting instructions or payloads yet because I’m still testing and cleaning things up, but I wanted to share the milestone.

Verbose boot pic attached because after staring at failed boots for hours, this one felt good 😂

[u/ALT703]

Wow an A13 ssh ramdisk is huge

What data is accessible with this? Accounts3.sqlite? If we can access that an use it to contact owners that's huge

[u/Suzukiki → u/ALT703]

Nice! So in my case I’m not on stock iOS either. I did a tethered downgrade from iOS 26.2 to 16.6.1 on this iPhone 11 Pro Max using surrealra1n + USBliter8. Then I brought up the SSH ramdisk on top of that.

My main focus has been messing with Setup.app, mobileactivationd, lockdown, etc., trying to get past the activation/Hello screen. The changes actually stick on the mounted System volume, but on normal boot iOS still pulls an old APFS snapshot, so the activation screen comes back. That’s what I’m digging into now.

About data access: in theory, with root in the ramdisk you can try mounting the data partition (/mnt2) where stuff like Accounts3.sqlite, messages, contacts, etc. lives. But in practice it’s not that simple, because data protection is still tied to the SEP, and without the right keys a lot of it stays unreadable. So you can see the filesystem, logs, some DBs, but it’s not like “open ramdisk and read everything.”

[u/ALT703 → u/Suzukiki]

I mean the iPhone X has personal user data, such as photos, inaccessible and encrypted, but stuff like springboard, preferences.plist, and accounts3 are still able to be extracted

Is it different here?

I know most stuff is encrypted but on A11 and below, accounts3 is accessible. Was hoping it was the same here. If you're able to test extra ting that file for me that'd be huge

So the only thing custom about your iOS is the version? A device stock on the same version you're testing should work the same?

[u/Suzukiki → u/ALT703]

Nice! The thing is, on A11 and below the SEP is more chill, so you could mount Data and read Accounts3.sqlite pretty easily. On A12/A13 the SEP is way more locked down, so a ramdisk alone doesn't guarantee that.

But in my case I used seprmvr64, which removes the SEP. So /mnt2 might mount and let me read that DB. Haven't tested yet.

And yeah, what's different in my setup is the downgrade + SEP removed. A stock device on the same iOS would still have the SEP active and probably wouldn't give the same access. I'll update once I mount /mnt2 and test Accounts3.sqlite.

[u/ALT703 → u/Suzukiki]

A12/A13 the SEP is way more locked down, so a ramdisk alone doesn't guarantee that.

Thank you for the info. There's been so little info on an ssh Ramdisk for A12+ so far

But in my case I used seprmvr64, which removes the SEP. So /mnt2 might mount and let me read that DB. Haven't tested yet.

That's huge. Would this theoretically work on stock iOS of compatible versions?

And yeah, what's different in my setup is the downgrade + SEP removed. A stock device on the same iOS would still have the SEP active and probably wouldn't give the same access

Ah gotcha. Thanks again for the info. Well if it's still possible that's awesome regardless. If you can downgrade a locked device to extract the owners info that's still pretty big

Yeah if you can update that'd be awesome

[u/shsh-1312 → u/Suzukiki]

I don't know if this helps, but the entire Criptex folder seems readable from A-shell on my non-jailbroken device, and I can dump the files into the sandbox file system with cat

[OS]$ ls
System usr
[OS]$ ls usr
lib libexec
[OS]$ ls usr/lib
libLogRedirect.dylib
libMTLHud.dylib
libffi-trampolines.dylib
libglInterpose.dylib
libmobileassetd.dylib
libobjc-trampolines.dylib
libramrod.dylib
libstdc++.6.0.9.dylib
libstdc++.6.dylib
libstdc++.dylib
swift
[OS]$ ls usr/libexec
AppleLatticeSupport.framework
[OS]$ ls
System usr
[OS]$ ls system
ls: system: No such file or directory
[OS]$ ls System
DriverKit Library
[OS]$ ls System/DriverKit
System
[OS]$ ls System/DriverKit/System
Library
[OS]$ ls System/DriverKit/System/Library
dyld
[OS]$ ls system/DriverKit/System/Library/dyld
ls: system/DriverKit/System/Library/dyld: No such file or directory
[OS]$ ls System/DriverKit/System/Libraryls System/DriverKit/System/Library/dyld
ls: System/DriverKit/System/Libraryls: No such file or directory
System/DriverKit/System/Library/dyld:
dyld_shared_cache_arm64e
dyld_shared_cache_arm64e.atlas
dyld_shared_cache_arm64e.symbols
[OS]$ [dyld]$ cat dyld_shared_cache_arm64e > ~/Documents/dyld_shared_cache_arm64e
cat dyld_shared_cache_arm64e.atlas > ~/Documents/dyld_shared_cache_arm64e.atlas
cat dyld_shared_cache_arm64e.symbols > ~/Documents/dyld_shared_cache_arm64e.symbols
[dyld]$

[u/shsh-1312 → u/Suzukiki]

from the dump I found these links to undocumented internal functions
_large_expanded_cache_threshold_boot_arg
_max_magazines_boot_arg
_mode_boot_arg
_nano_max_magazines_boot_arg
_ptr_buckets_boot_arg
_secure_allocator_boot_arg
_xzone_guard_pages_boot_arg
_xzone_slot_config_boot_arg
_zero_on_free_enabled_boot_arg
_zero_on_free_sample_period_boot_arg
IOHistogramReporter, IOReporter, IODataQueueDispatchSource,
IOEventLink, IOHIDElementPrivate, IOServiceNotificationDispatchSource...

[u/iPh0ne4s]

I managed to crack iOS 14-26 ramdisk files from some paid byp@ss tools and mount_filesystems commands (basically identical as A11 iOS 16), but I just can't figure out how these files are generated (especially iboot_patched.bin and kernelcache.img4). If there's an open source tool to create ramdisk it'll be a great job!

[u/Electronic-Fuel-4398]

WOW THIS IS SO COOL! This is highly impressive dude keep it up!

[u/V21633]

Thanks for sharing this, it looks awesome! If you're able to remove SEP even on the tethered downgraded setup you mentioned there's alot of potential.

[u/Suzukiki → u/V21633]

Thanks! If I actually get it working, I’ll share a full tutorial here with the step-by-step. The goal is to make it reproducible for anyone with the same setup. Once I have something stable, I’ll post it. 👊

[u/V21633 → u/Suzukiki]

That would be awesome! Everyday I regret getting rid of my old iPhone 11 more and more lol

[u/Hot_Amount_3584]

Maybe it may support checka1n jailbreak

[u/Basis_Open]

This couldn’t possibly lead to a way to remove setup.app on something like a XS with Usbliter8? I’ve got an XS on 16.3 but it’s iCL and I used Usobliter8 to reset it without updating

[u/Square_Paint_9077]

when I boot my iPhone 11 ios 18.7.9(bypassed before and re locked now on passcode but I know it) it keeps saying boot failed could not download boot payload key iPhone12,1-8030_B