jailbreakit

README

jailbreakit

jailbreakit is a CLI helper for authorized iOS pentesting workflows.

It detects a connected iPhone, checks jailbreak compatibility, recommends a route, and guides the user through palera1n or Dopamine setup. The goal is not to create a new jailbreak. The goal is to make the repetitive setup work easier for pentesters and security researchers working on devices they are allowed to test.

Why

iOS jailbreak setup for pentesting is repetitive and easy to get wrong:

• identify the device model, chip, and iOS version
• check which jailbreak supports that version
• choose between palera1n and Dopamine
• run the correct first-time/rootful/rootless commands
• download the matching Dopamine IPA instead of the wrong latest release
• install a CLI signer and handle Apple ID login/2FA
• remember the iPhone trust-profile step after sideloading

jailbreakit turns that into one guided flow:

jailbreakit

Platform Support

Current target platforms:

• macOS
• Linux

Windows is not supported yet. The project is currently iPhone-first; iPad, iPod, Apple TV, and T2 metadata exist as initial compatibility data, but the main tested workflow is iPhone jailbreak setup for authorized security testing.

Install

Clone the repository:

git clone https://github.com/Waariss/jailbreakit.git
cd jailbreakit

Build the binary:

go build -o jailbreakit ./cmd/jailbreakit

Run it:

./jailbreakit

Install into your Go bin path:

go install ./cmd/jailbreakit
jailbreakit

Requirements

Core tools:

• Go 1.24+ to build from source
• palera1n for checkm8/palera1n flows
• libimobiledevice for ideviceinfo device detection
• curl or network access for downloads

macOS:

brew install libimobiledevice curl

Linux package names vary by distribution. Debian/Ubuntu-style systems usually need:

sudo apt install -y libimobiledevice-utils curl

Check your machine:

./jailbreakit doctor

Install package-manager dependencies where supported:

./jailbreakit doctor --install

palera1n should be installed from the official project instructions. jailbreakit does not guess unofficial package sources for it.

Usage

The normal user flow is intentionally short:

./jailbreakit

Common utility commands:

./jailbreakit doctor
./jailbreakit detect
./jailbreakit recommend --ios 15.8.8 --product iPhone8,1
./jailbreakit version

Advanced commands are hidden from the default help:

./jailbreakit help advanced

Development

Run tests:

go test ./...

Check formatting:

gofmt -w cmd internal

GitHub Actions runs gofmt and go test ./... on pushes and pull requests. Tagged releases build macOS and Linux binaries.

What It Does

Guided mode:

1. Detects the connected device.
2. Maps ProductType to model and chip.
3. Checks the iOS jailbreak matrix from The Apple Wiki, with versioned embedded fallback data when the site is unavailable.
4. Shows compatible jailbreak routes.
5. Runs palera1n, or downloads and sideloads the matching Dopamine IPA.
6. Prints the next iPhone-side steps, including developer-profile trust instructions.

Example recommendation:

ProductType:  iPhone8,1
Model:        iPhone 6s
Chip:         A9
iOS:          15.8.8

Options:
[1] palera1n 2.2.1 - rootless or rootful fakefs, semi-tethered
[2] Dopamine 2.5 Beta 3 - rootless, semi-untethered

For Dopamine 2.5 Beta 3, jailbreakit resolves the release tag to 2.5b3 and downloads:

https://github.com/opa334/Dopamine/releases/download/2.5b3/Dopamine.ipa

Routes outside the currently automated runners are still shown as recommendations when compatibility data is available. For example, iOS 12/13/14 may show tools such as Chimera, unc0ver, checkra1n, Odyssey, or Taurine as recommend-only. Those routes require the upstream tool or guide until runner automation is implemented.

Dopamine Sideloading

jailbreakit is CLI-first. If no signer is available, guided mode can download the plumesign CLI, mark it executable, and continue.

Manual signer install:

./jailbreakit signer install --platform macos
./jailbreakit signer install --platform linux-aarch64
./jailbreakit signer install --platform linux-x86_64

The signer is saved to:

./bin/plumesign

Apple ID handling:

• jailbreakit does not store Apple ID credentials.
• Signing and authentication are delegated to the selected local signer.
• If credentials are required, the local signer handles password and 2FA prompts interactively.
• The selected signer may maintain its own local authentication or session state.
• Users are encouraged to use an app-specific password or a dedicated lab Apple ID.

After Dopamine is installed, trust the developer profile on the iPhone:

Settings > General > VPN & Device Management

Then open Dopamine and tap Jailbreak.

palera1n Notes

Rootless flow:

./jailbreakit run palera1n --rootless

Rootful first-time BindFS creation:

./jailbreakit run palera1n --rootful

After the device returns to recovery mode, boot the existing rootful BindFS:

./jailbreakit run palera1n --rootful-boot

Guided mode handles this flow and tells the user when the second step is needed.

Privacy

jailbreakit is local-first.

• No telemetry
• No remote command execution
• No Apple ID credential storage
• No device identifiers are uploaded by default
• Downloads are performed only from configured upstream project URLs

Data

Compatibility and device metadata are versioned with the binary:

• internal/matrix/compatibility.json contains embedded fallback jailbreak data.
• internal/device/product-map.json contains embedded product metadata for iPhone-first detection, with initial iPad, iPod, Apple TV, and T2 coverage.

The Apple Wiki remains the preferred live source when reachable.

Disclaimer

jailbreakit is intended strictly for authorized assessments, iOS pentesting, and responsible security research. Use it only on devices and environments where you have explicit permission.

Do not use this tool on devices you do not own or do not have explicit written permission to assess.

This project is a helper/orchestrator. It is not affiliated with Apple, palera1n, Dopamine, Impactor, or The Apple Wiki.

Jailbreaking can cause data loss, boot issues, restore requirements, or device instability. We are not responsible for any data loss, device damage, bricked devices, account issues, failed jailbreak attempts, or any other outcome caused by using this tool or the underlying third-party tools. When using palera1n, Dopamine, plumesign, or any related tooling, the user accepts full responsibility for anything that happens to their device during the process.

This tool does not bypass iCloud, Activation Lock, MDM, passcodes, or device ownership protections.

Credits

This project orchestrates and references work from:

• claration/Impactor
• opa334/Dopamine
• palera1n/palera1n
• The Apple Wiki

Respect the licenses, documentation, and safety guidance of the upstream projects.

Status

Early MVP. Expect changes to commands, compatibility data, and sideloading flow as the project matures.