Palera1n Jailbreak for iOS 15 – iOS 16

Kuba Pawlakqbap | Jailbreak
Palera1n Jailbreak

Palera1n is the first public iOS 15 – iOS 16 semi-tethered checkm8 “jailbreak”. This is an early release, and using it on your main iPhone is not recommended. As for now, Palera1n Jailbreak offers the tweak injection feature, installing Substituteon iOS.

What is Palera1n?

Palera1n Jailbreak is a script for macOS and Linux, allowing you to execute iOS 15.0 – iOS 16 checkm8 exploit on compatible iDevices. It boots the device with AMFI patches and requires you to install Pogo by Amy through the TrollStore app to access the Sileo package manager.

It is brought to you by Nebula, the developer behind the appreciated IPA Permasigner terminal app, the first open-source solution to install IPA files without revokes on iOS 14.0 up to iOS 14.8.1, and iOS 15.0 up to iOS 15.4.1 using the CoreTrust bypass discovered by Linus Henze.

Palera1n Jailbreak is a work in progress, and the installation process isn't as user-friendly as other jailbreaks. To install the semi-tethered iOS 15 jailbreak, it's required to make some preparation first and use a computer. Using this tool is recommended only for advanced users!

Two iPhone screens showing a terminal with a proof of iOS 15 jailbreak and the Pogo app interface.

Palera1n should work for most devices supported by checkra1n, but it's unstable and can get you into some kind of issues on the way. Use it at your own risk and when necessary run futurerestore --exit-recovery, or use irecovery to exit recovery mode.

checkm8 exploit developed by axi0mX is the main engine behind checkra1n jailbreak. The exciting part about this permanent unpatchable bootrom exploit is potentially ensured lifetime jailbreak ability for A5-A11 devices. It means every future iOS release should be vulnerable.

Palera1n Jailbreak executes all necessary scripts to jailbreak, and the Pogo app is used to install Procursus Bootstrap and Sileo. The package manager allows you to manage repositories, view packages, and install “jailbreak” apps on iOS 15.0 up to iOS 15.7.1, and iOS 16.

Sileo is a modern APT Package Manager for iOS 12 and up with a focus on speed and usability. It was designed to provide a real Cydia alternative for jailbroken devices. Sileo officially supports all jailbreaks and can share its sources with Cydia if you're on unc0ver or checkra1n.

It was developed in Swift a modern programming language created by Apple to deliver lightning-fast iOS apps. Therefore, Sileo Package Manager works fast on all jailbroken devices.

Amy, the developer behind Pogo, is working on implementing a tweak injection method for Palera1n jailbreak. At present, you can install Cydia tweaks on jailbroken iOS 15 and iOS 16, but not all will work. Instead, you can install apps like Filza, OpenSSH, AppStore++, NewTerm 2, etc.

Two iPhone screens showing Sileo app running on iOS 15.4.1 and installing various packages.

Pogo is packed with a CoolStar's Sileo 2.4, but Amy is pushing through a private repo also beta releases. The build of Sileo bundled in this is considered beta. If you want more regular updates, add the https://beta.anamy.gay repo to access the latest releases of Sileo APT.

Note: Palera1n Jailbreak for iOS 15 is recommended for advanced users. If you looking forward to Cydia tweaks thoes are supported now on iOS 15.0 up to iOS 15.7.1.

Palera1n Jailbreak was released as an open-source project under GPL-3.0 license through GitHub Repository. The latest Palera1n release works also on iOS 15.5 up to iOS 15.7 (and also iOS 16). The Pogo app can be used with patched AMFI as long as it’s installed with a ramdisk.

Since version 1.2, the devs added semi-tethered support with tweaks to Palera1n. The jailbreak creates a fake rootfs partition that could be modified, then copies the file system over. Only downside is that it can use 5-10 extra GB of your storage. This will not work on 16 GB devices.

Palera1n for iOS 15.0 up to iOS 15.7.1 with tweaks support

Recently, @mineekdev started working on a new branch of Palera1n jailbreak, with the main focus on adding support for tweaks. This version boots the device with AMFI patches. On the first run, it'll boot a ramdisk which dumps your onboard blob, and installs Sileo and Substitute.

Substitute is a tweak injection system that runs on already jailbroken devices. Basically, it is used to run tweaks. Substitute 2.3.1 is using a newly designed tweak injection system that allows loading a big number of tweaks for ultimate customization with minimal overhead on iOS 15.

On top of that, Palera1n with support for tweaks is works on all releases between iOS 15.0 up to iOS 15.7.1. Tethered jailbreak is able to temporarily jailbreak the device during a single boot. To start the device with a patched kernel, it must be “re-jailbroken” with a PC. This also means that you will need a PC every time to boot your iPhone or iPad.

Palera1n for iOS 16.0 up to iOS 16.2

Palera1n for iOS 16 with tweak support was officially released soon. Of course, this version works only with checkm8 compatible iPhones and iPads mentioned below. What's more, there will be created a graphic interface (GUI) to make the jailbreak process more user-friendly.

In the new release of Palera1n iOS 16 jailbreak for A11 devices, the Pogo app will be replaced with a new Palera1n loader app. From now on, this tool will be used to prepare the Bootstrap, and install Sileo in uicache, the default manager for tweaks.iOS 16.0 – iOS 16.2 is supported.

On top of that the loader for Palera1n for iOS 16, also offers tools to fix some common issues such as refreshing icon cache, remounting rootfs and preboot as read/write, start daemons, respring SpringBoard, and activate installed tweaks with substitute-launcher.

Two iPhone screens showing the palera1n loader app interface for iOS 15 and iOS 16.

Note: Palera1n for iOS 16 was released in the official GitHub in branch. It's still recommended to use it at this stage only for experience users. A9 – A10 are not supported because Apple doesn't allow to install iOS 16 on those devices.

At this stage of development, Nebulas custom launchd and script aren’t spawning the loader app yet. If you’re installing with the experimental iOS 16 branch, you can install TrollStore using an SSH Ramdisk, then jailbreak the device and install the loader app with TrollStore.

Supported devices

All A9-A11 systems on a chip (SoC) are supported by jailbreak. Below, you can find the actual list of compatible Palera1n Jailbreak iPhones and iPads. The jailbreak was tested to run and work without issues on iPhone X (GSM),iPhone 8, iPhone 7, and iPhone 6s running iOS 15.

for iOS 15.0 – 15.7.1

  • A9 – iPhone 6S, iPhone 6S Plus, iPhone SE,iPad (2017) 5th Generation.
  • A9X – iPad Pro (12.9 in.) 1st generation, iPad Pro (9.7 in.).
  • A10 – iPhone 7 and iPhone 7 Plus, iPad (2018, 6th generation),iPad (2019, 7th generation) (iOS 14 not supported).
  • A10X – iPad Pro 10.5” (2017),iPad Pro 12.9” 2nd Gen (2017).
  • A11 – iPhone 8, iPhone 8 Plus, and iPhone X.

for iOS 16.0 – 16.2

  • A11 – iPhone 8, iPhone 8 Plus, and iPhone X.

How to jailbreak iOS

To jailbreak iOS 15 or iOS 16 using Palera1n first check if your device is on the supported list. Remember to disable the passcode on A10/A11 devices before proceeding with the jailbreak.

  1. Install libimobiledevice on your Linux or Mac through brew. This library is required to connect your iPhone through USB to the computer.
    brew install libimobiledevice

    or on Linux distribution:

    sudo apt install libimobiledevice-utils libusbmuxd-tools
  2. Clone the Palera1n repo from GitHub. It is used to exploit iOS firmware and boot the device with AMFI patches. Next CD into this repository. Palera1n checkm8 jailbreak with installed Sileo and Substitute (tweaks support) on iOS 15.0 – 15.7.1, and iOS 16 – 16.2. This is a work in progress and iPhones: X, 8+, 8, 7+, 7, 6s+, 6s, SE; iPods: Touch 7; iPads: 5, 6, 7, and the Air 2 are supported.
    git clone --recursive https://github.com/palera1n/palera1n && cd palera1n
  3. Run the Palera1n script to jailbreak your iOS 15 / iOS 16 device with tweaks support.
    ./palera1n.sh --tweaks <your iOS version here>

    or enable semi-tethered jailbreak with tweak support (it will use 5-10 extra GB of your storage).

    ./palera1n.sh --tweaks  --semi-tethered <your iOS version here>
  4. Palera1n will replace the Tips app with Pogo IPA (can be also installed via TrollStore).
  5. Open the modified Tips app and tap on install.
  6. Access Sileo from your Home Screen.

Note: To install Pogo app make sure your device is in normal mode. You'll have to uicache in the Pogo app every time you will reboot your iPhone.

If you want to start from DFU mode add the argument after the script file to execute.

./palera1n.sh --dfu <your iOS version here>

Palera1n Jailbreak offers access to verity of options and subcommands while jailbreaking iOS 15 or iOS 16. Below you can find the list of all available features with proper description.

Options:
    --help              Print this help
    --tweaks            Enable tweaks
    --semi-tethered     When used with --tweaks, make the jailbreak semi-tethered instead of tethered
    --dfuhelper         A helper to help get A11 devices into DFU mode from recovery mode
    --skip-fakefs       Don't create the fakefs even if --semi-tethered is specified
    --no-baseband       Indicate that the device does not have a baseband
    --restorerootfs     Remove the jailbreak (Actually more than restore rootfs)
    --debug             Debug the script
    --serial            Enable serial output on the device (only needed for testing with a serial cable)

Subcommands:
    dfuhelper           An alias for --dfuhelper
    clean               Deletes the created boot files

Possible Issues

Palera1n Jailbreak for iOS 15 – iOS 16 is still a work in progress, and you can get into some issues while jailbreaking. Here are some discovered solutions for various situations.

  1. “sudo usbmuxd -p -f” should fix most USB issues on Linux and install usbmuxd.
  2. If your device is stuck in recovery, please run futurerestore --exit-recovery, or use irecovery -n.
  3. The Palera1n black screen after verbose issue can be fixed by using an onboard blob. You can dump one using SSHRD Script.
  4. If Pogo didn't install to Tips for some reason, you can install the Pogo IPA using TrollStore.
  5. Make AFC2 work, use “ldid -s /usr/bin/killdaemon && killdaemon”. Ensure you have procursus' ldid and AFC2 installed first.

What's new

Version 1.4.1

  • ibot.patched fix.
  • Use payload on the X.
  • Other random changes and fixes.

Version 1.4.0

  • Does not mount user data partition for iPhone X compatibility.
  • Deploys files to the rootfs (fakefs if required).
  • Fix deviceid finding.
  • Use apticket.der because dumping rdisk seems to freeze.
  • Add /.installed_palera1n with info.
  • uicache loader app on boot (no more Tips app hijacking).
  • Fix rootless.
  • Webkit fix on iOS 16.
  • Switch to local boot.
  • Fix home button on iPhone 7(+) and 8(+).
  • Increase stability.
  • Supports iOS 15 – iOS 16.2 on all checkm8 devices.

Version 1.3.0

  • Fully fix deep sleep bug.
  • Supports for iOS 15 – iOS 15.7.1 on all checkm8 devices.
  • Increase stability.
  • Fix TrollStore, camera, and screen recording.

Version 1.2.0

  • Numerous fixes.
  • Let Pogo install tweak support.

Version 1.1.1

  • Support iPad beta URLs.
  • Make sure auto-boot is always set to false (unless restoring rootfs).
  • Wait for sshd to start before running postboot.
  • Fix Tips check error.
  • Fix --restorerootfs.

Version 1.1.0

  • Check if Tips is installed.
  • Only prompt for disclaimer once.
  • Check for DFU.

Comments

  • qbap

    qbap4 months ago

    List of repositories for Palera1n (rootless iOS 15 - 15.7):

    https://mineek.github.io/repo (Procursus rootless packages)
    https://repo.palera.in (a ton of miscellaneous packages)
    https://beta.anamy.gay (Contains Sileo Nightly)

  • JaX411

    JaX4114 months ago

    To update the Palera1n script through GitHub go inside the folder and use the pull command.

    cd palera1n & git pull

  • W1n4T0n5

    W1n4T0n54 months ago

    I encountered this problem when the theme source, error: architecture not found [", "iphone-arm64"] what should i do?

    • qbap

      qbap4 months ago

      You probably not running A9-A11 compatible device. Since iPhone XS and newer, there is arm64e architecture, and it's not supported by palera1n jailbreak, and it never will.

  • nekit

    nekit4 months ago

    After the command ./palera1n.sh writes no directory found if anything, I'm with Mac OS

    • qbap

      qbap4 months ago

      You must "cd palera1n" into the folder if you downloaded the files with the git command. You are executing the ./palera1n.sh from the directory where the file doesn't exist. Do everything exactly like in the article and it will work.

  • chocho

    chocho4 months ago

    I get stuck at inflating: gaster

    [*] Command ran: sudo ./palera1n.sh
    ...
    Hello, iPhone9,3 on 15.7!
    [*] Switching device into recovery mode...
    Telling device with udid 3b6XXXXXXXXX to enter recovery mode.
    Device is successfully switching to recovery mode.
    [*] Waiting for device to reconnect in recovery mode
    [*] Getting device info...
    [*] Press any key when ready for DFU mode
    Get ready (0)
    Hold volume down + side button (0)
    Keep holding (0)
    Release side button, but keep holding volume down (0)
    [*] Device entered DFU!
    [*] Creating ramdisk
    Archive: gaster-Linux.zip
    inflating: gaster

    • qbap

      qbap4 months ago

      The Palera1n Tweak version you are using doesn't work on iOS 15.7. It supports only iOS 15.0 up to 15.3.1. Use the other branch for iOS 15.7 but it's more for developer use (tweaks will not work).

  • ala

    ala4 months ago

    Is there any ISO version or windows version?

    • qbap

      qbap4 months ago

      Palera1n was released with support for macOS and Linux. For Windows users, the only workaround to install Palera1n and jailbreak iOS 15 is to use a Linux USB e.g. create a bootable Ubuntu USB stick with Rufus on Windows.

  • ChoCho

    ChoCho4 months ago

    Thank you @qbap for your response.

    What would be my best bet to jailbreak iPhone 7 on 15.7?
    I'm learning how to tweak apps.

    • qbap

      qbap4 months ago

      The is no jailbreak for iOS 15.7 available with tweaks support. There are a few in development like Blizzard Jailbreak, and Cheyote Jailbreak, but they were never released. For the moment you must wait.

  • plasticarmyman

    plasticarmyman4 months ago

    Stuck on Inflating Gaster

    i've restarted several times but it still will not run

    :~/palera1n$ sudo ./palera1n.sh --tweaks 15.2
    [*] Command ran: sudo ./palera1n.sh --tweaks 15.2
    palera1n | Version 1.1.1-tweaks-1481b3d
    Written by Nebula and Mineek | Some code and ramdisk from Nathan | Loader app by Amy

    [*] Getting device info...
    [*] Creating ramdisk
    Archive: gaster-Linux.zip
    inflating: gaster

    • qbap

      qbap4 months ago

      Use the command with --debug to get more information about what is going on in the background.

  • Abrakovitcc

    Abrakovitcc4 months ago

    iPad 6 stuck on black screen. How to use onboard blob and dump it via sshrd?

    • qbap

      qbap4 months ago

      You can dump onboard blob using “SSHRD Script”. Google for it. It’s available on GitHub.

  • lb

    lb4 months ago

    10.21.22

    A9 15.4.1 device

    Pogo loaded, when "install" pressed, immediately get "Error Installing Bootstrap - 1"
    Any suggestions ?
    Thank you

    • qbap

      qbap4 months ago

      Assuming this is rootless, click remove, then install again.

    • lb

      lb4 months ago

      Thank you, yes it is rootless.
      When you say, remove then install again, what exactly should be removed and installed again ?

    • qbap

      qbap4 months ago

      Reinstall the Pogo app.

    • lb

      lb4 months ago

      Thank you for your assistance.

      Will try reinstalling Pogo app and follow up with results.

      Palera1n on device is primarily for SSH access.

  • koes1

    koes13 months ago

    palerain install on ip se ios 15.7 succes, but pogo not install on Itips, where i can download pogo ipa file?
    thanks.

    • qbap

      qbap3 months ago

      The download link for Pogo IPA is available in section “ How to jailbreak iOS 15” step 4. It must be installed through TrollStore.

  • r23

    r233 months ago

    No connected device found, terminating
    When jailbreaking I get a usbmuxd error with ports 2222 --> 22.
    i have installed usbmuxd. help!

    • qbap

      qbap3 months ago

      Linux has some weird usbmuxd issues. The dev have tried everything to fix them, but there are still issues. Instead, compile and install usbmuxd2.

  • Lar

    Lar3 months ago

    Palera1n 15.7 run on A9 15.4.1 device, below is as far as I get: 'Permission denied' (see script below)

    l-3:~ l$ git clone --recursive https://github.com/palera1n/palera1n && cd palera1n
    Cloning into 'palera1n'...
    ....
    Submodule path 'ramdisk': checked out '427918b472a56845c41867d11fe2db1fe8969fc8'
    l-3:palera1n l$ ./palera1n.sh --tweaks 15.4.1
    Password:
    tee: logs/08:58:28-2022-11-17-Darwin-18.7.0.log: Permission denied.

    Any suggestions ?

    Thank you

    • qbap

      qbap3 months ago

      First check if you have permission to read and write to this folder. If not run the script as an administrator. On Linux use command su before the script.

      By the way you can’t run Palera1n from the device, it’s required to use a computer through cable.

    • Lar

      Lar3 months ago

      Thank you, the A9 15.4.1 device is connected to mac computer via USB and after running the git clone and the putting device into DFU mode this is what I get: 'Darwin-18.7.0.log: Permission denied' after entering password...

    • qbap

      qbap3 months ago

      You don't have permission. This is nothing more to explain. Clone the repository to a folder like Desktop where you have 100% permission to execute. The issue here is with your computer, not Palera1n.

  • Sajjad

    Sajjad2 months ago

    Is there any way to restore rootfs on palera1n? Thanks

    • qbap

      qbap2 months ago

      Yes, there is an option to restore rootfs on Palera1n Jailbreak.
      Use the --restorerootfs command argument.

      E.g. ./palera1n.sh --restorerootfs

  • tobey

    tobey2 months ago

    Can I jailbreak successfully if the iPhone is stuck on activation lock?

    • qbap

      qbap2 months ago

      Yes, you can jailbreak your device with Palera1n, but this is not an activation lock bypass tool. Instead, try iRa1n that is based on checkm8, and it can bypass iCloud activation lock on iOS 15.

  • Afi

    Afi2 months ago

    Hello, the jailbreak does not work like many users and I am still stuck on the creation of the ramdisk that is not done ... I am sending you attached my logs report .... https://pastebin.com/HNrRU8fF

    I use an iphone 7 with ios 15.1
    I made this from a KaliLinux VM from my Windows, and all works correctly my iphone is well detected by the VM

    • qbap

      qbap2 months ago

      Virtual Machines are not supported by checkm8, therefore Palera1n Jailbreak will not work to jailbreak iPhone 7 with iOS 15.1. On Linux, you must use a Live CD. The jailbreak uses a bug in through cable connection.

  • Ben best

    Ben best1 month ago

    Will this work on an iPod touch 7 gen?????

Post a comment