How to boot a SSH ramdisk on 64-bit devices

This tutorial will show you how to boot a SSH ramdisk on 64-bit (A7-A11) iOS devices.

Part 1: Creating the ramdisk

1. Download and unzip the ramdisk tool v0.9
2. Open a terminal and drag the ramdisk folder into it
3. Run bash create.sh [devicetype] [version]
   • Replace [devicetype] with your device type (like iPhone9,2)

• For all devices on iOS 12 and above, replace [version] with the iOS version that is installed on your device
• Use 12.0 for devices on iOS 11 and below
• iOS 15 ramdisk might not boot, if this happens use 14.8
• If you get a "Failed to download firmware keys" error, update to Big Sur or later
• A9 devices have two different chips, the S8000 and S8003. The S8000 version is downloaded by default, if your device has the S8003 chip run create.sh with -t at the end, like this: bash create.sh iPhone8,1 14.8 -t

Part 2: Loading the ramdisk

1. Connect your device and enter DFU mode

2. Run bash pwndfu.sh to enter pwned DFU mode (this might take a few tries)

   • A11 devices might need to use bash pwndfu.sh -a

3. If you have an A10/A11 device, run bash load.sh [devicetype] a10

• For all other devices, run bash load.sh [devicetype]

1. Once the ramdisk has loaded and you see the apple logo with a gray bar, run ./resources/tcprelay.py -t 22:2222 to start the SSH proxy

   • If you get an error, download and open Sliver from appletech752 website and install python when it asks

2. Open a new terminal window and connect to the device by typing ssh root@localhost -p 2222 (password is alpine)

3. Once connected, run bash /usr/bin/mount_root to mount the root filesystem on /mnt1

4. Run bash /usr/bin/mount_data to mount the data partition on /mnt2

• Mounting the data partition will likely fail with iOS 13+ even if passcode is disabled. If it works for you, post a comment

This has been tested on an iPad7,5 on 14.8, an iPhone10,1 on 13.3, and an iPhone9,2 on 12.0 If your device is rebooting after a few minutes, use a version older than 14.5. There is a problem with bootargs on 14.5 and up that causes no verbose boot and automatic reboot