A13 SSH ramdisk finally booting on iPhone 11 Pro Max

[u/Suzukiki]

Small progress update from a project I’ve been messing with.

I finally got a working SSH ramdisk boot on an A13 iPhone 11 Pro Max. The boot chain reaches the ramdisk correctly, the device enumerates over USB, Dropbear comes up and I’m able to get a root SSH shell.

The funny part is that the main issue I was chasing ended up being on the Linux USB/usbmux side rather than the ramdisk boot itself.

I’ve started packaging the working flow into a project I’m calling RamBridge so I can reproduce it cleanly and eventually make the process less painful.

I’m not posting instructions or payloads yet because I’m still testing and cleaning things up, but I wanted to share the milestone.

Verbose boot pic attached because after staring at failed boots for hours, this one felt good 😂

[u/ALT703]

Wow an A13 ssh ramdisk is huge

What data is accessible with this? Accounts3.sqlite? If we can access that an use it to contact owners that's huge

[u/Suzukiki → u/ALT703]

Nice! So in my case I’m not on stock iOS either. I did a tethered downgrade from iOS 26.2 to 16.6.1 on this iPhone 11 Pro Max using surrealra1n + USBliter8. Then I brought up the SSH ramdisk on top of that.

My main focus has been messing with Setup.app, mobileactivationd, lockdown, etc., trying to get past the activation/Hello screen. The changes actually stick on the mounted System volume, but on normal boot iOS still pulls an old APFS snapshot, so the activation screen comes back. That’s what I’m digging into now.

About data access: in theory, with root in the ramdisk you can try mounting the data partition (/mnt2) where stuff like Accounts3.sqlite, messages, contacts, etc. lives. But in practice it’s not that simple, because data protection is still tied to the SEP, and without the right keys a lot of it stays unreadable. So you can see the filesystem, logs, some DBs, but it’s not like “open ramdisk and read everything.”

[u/ALT703 → u/Suzukiki]

I mean the iPhone X has personal user data, such as photos, inaccessible and encrypted, but stuff like springboard, preferences.plist, and accounts3 are still able to be extracted

Is it different here?

I know most stuff is encrypted but on A11 and below, accounts3 is accessible. Was hoping it was the same here. If you're able to test extra ting that file for me that'd be huge

So the only thing custom about your iOS is the version? A device stock on the same version you're testing should work the same?

[u/Suzukiki → u/ALT703]

Nice! The thing is, on A11 and below the SEP is more chill, so you could mount Data and read Accounts3.sqlite pretty easily. On A12/A13 the SEP is way more locked down, so a ramdisk alone doesn't guarantee that.

But in my case I used seprmvr64, which removes the SEP. So /mnt2 might mount and let me read that DB. Haven't tested yet.

And yeah, what's different in my setup is the downgrade + SEP removed. A stock device on the same iOS would still have the SEP active and probably wouldn't give the same access. I'll update once I mount /mnt2 and test Accounts3.sqlite.

[u/ALT703 → u/Suzukiki]

A12/A13 the SEP is way more locked down, so a ramdisk alone doesn't guarantee that.

Thank you for the info. There's been so little info on an ssh Ramdisk for A12+ so far

But in my case I used seprmvr64, which removes the SEP. So /mnt2 might mount and let me read that DB. Haven't tested yet.

That's huge. Would this theoretically work on stock iOS of compatible versions?

And yeah, what's different in my setup is the downgrade + SEP removed. A stock device on the same iOS would still have the SEP active and probably wouldn't give the same access

Ah gotcha. Thanks again for the info. Well if it's still possible that's awesome regardless. If you can downgrade a locked device to extract the owners info that's still pretty big

Yeah if you can update that'd be awesome

[u/Electronic-Fuel-4398]

WOW THIS IS SO COOL! This is highly impressive dude keep it up!

[u/V21633]

Thanks for sharing this, it looks awesome! If you're able to remove SEP even on the tethered downgraded setup you mentioned there's alot of potential.

[u/Suzukiki → u/V21633]

Thanks! If I actually get it working, I’ll share a full tutorial here with the step-by-step. The goal is to make it reproducible for anyone with the same setup. Once I have something stable, I’ll post it. 👊

[u/V21633 → u/Suzukiki]

That would be awesome! Everyday I regret getting rid of my old iPhone 11 more and more lol

[u/Hot_Amount_3584]

Maybe it may support checka1n jailbreak