iPhone Security & BootROM Research

palera1n Jailbreak – Complete Guide for iPhone A8–A11 on iOS 15 to iOS 18

4 min read

Quick Summary: palera1n is an actively maintained, open-source jailbreak for iPhone, iPad, iPod touch, Apple TV, and Mac T2 devices based on the checkm8 BootROM exploit. It currently supports iOS/iPadOS 15.0 through iOS 18.x, tvOS 15+, and bridgeOS 6+. The latest stable release is palera1n 2.3 (May 27, 2026).

What Is palera1n?

palera1n is a semi-tethered jailbreak that uses the checkm8 BootROM exploit to gain code execution on devices with Apple A8 through A11 chips. Because it relies on a hardware-level exploit, it works on any iOS version those chips can run — including the very latest iOS 18. It does not depend on software vulnerabilities that Apple can patch in future updates.

Originally written in shell script (v1.x) by Nebula, Mineek, Nathan, and llsc12, it was completely rewritten in C as palera1n-c (v2.x) and is now actively maintained by a larger team. The v1.x branch is deprecated.

Supported Devices

SoC	iPhone / iPod Models	iPad Models
A8 / A8X	iPhone 6, iPhone 6 Plus, iPod touch 7G	iPad Air 2, iPad mini 4
A9 / A9X	iPhone 6s, 6s Plus, iPhone SE (1st gen)	iPad 5th gen, iPad Pro 9.7" / 12.9" 1st gen, iPad Pro 10.5"
A10 / A10X	iPhone 7, iPhone 7 Plus	iPad 6th / 7th gen, iPad Pro 12.9" 2nd gen, iPad mini 5th gen
A11 Bionic	iPhone 8, iPhone 8 Plus, iPhone X	—
T2 (Bridge)	—	MacBook Pro/Air 2018–2020, Mac mini 2018, iMac Pro

Important notes on A10/A11 devices: On iOS 16+, A10(X) devices require the passcode to be disabled while the jailbreak is active. On iOS 16, A10(X) and A11 devices must be erased before the first jailbreak. palera1n 2.0.0 added limited passcode support for A10(X). A11 still requires passcode off on iOS 16+.

Jailbreak Types: Rootless vs. Rootful

palera1n offers two jailbreak modes:

	Rootless	Rootful (FakeFS)
Root filesystem	Read-only (as Apple intends)	Fake writable copy (requires ~5 GB free)
Tweak compatibility	Only rootless-compatible tweaks	All tweaks (broader Cydia/Sileo support)
Security impact	Lower	Higher
iPadOS 17 / 18	✅ Officially supported	❌ Not officially supported
Default package managers	Sileo, Zebra	Sileo, Zebra, Cydia

How to Jailbreak with palera1n (Step-by-Step)

Requirements: macOS or Linux computer, USB-A to Lightning cable (USB-C may have issues on some Macs), the palera1n binary from palera.in.

Download palera1n from the official site palera.in or the GitHub Releases page. Always use the official source to avoid malicious lookalike sites.
Connect the iPhone to your computer with a USB cable.
Enter DFU mode:
- iPhone X and earlier with Home button (iPhone 8/8+/X): Hold Side + Volume Down for 8 seconds, release Side, keep holding Volume Down for 5 more seconds.
- iPhone 7/7+: Hold Side + Volume Down for 10 seconds, release Side, keep holding Volume Down.
- iPhone 6s and earlier: Hold Home + Sleep/Wake for 10 seconds, release Sleep/Wake, keep holding Home for 5 more seconds.
Run palera1n:
- Rootless (recommended): palera1n
- Rootful: palera1n -f
The device will reboot and show the palera1n Loader app on the home screen.
Open the Loader app and tap Install to install the bootstrap and package manager (Sileo or Zebra).
After every reboot, you must run palera1n again from your computer to re-apply the jailbreak (semi-tethered).

What palera1n Enables for GSM & Repair Shops

iCloud Activation Lock bypass — The most in-demand use case. Once jailbroken, bypass tools can operate on iPhone 6 through iPhone X on any iOS version.
Carrier unlock tools — Some tools require a jailbroken environment to access baseband NVM and apply unlock patches.
MDM / DEP bypass — Jailbroken access allows removing enterprise MDM profiles on locked corporate devices returned for repair.
FRP bypass — Access to the file system enables removing Google account locks on compatible devices.
Passcode bypass / data recovery — With boot chain control, passcode-removal tools for forgotten-passcode scenarios can run.
Full-filesystem access — Read/write access to the entire device storage for data forensics or recovery.

Version History (Key Releases)

Version	Date	Key Changes
1.0.0	Oct 4, 2022	Initial release (shell script)
2.0.0	Jul 22, 2024	Rewritten in C; iPadOS 18 + tvOS 15+ support; Apple TV support
2.2	Sep 23, 2025	iPadOS/tvOS 18.4; tvOS 26.0; rewritten loader
2.3 (Latest)	May 27, 2026	tvOS 26.5 / bridgeOS 10.5 support