Checkm8 Exploit Opens Door to Unpatchable Jailbreak on iPhone 4S Through iPhone X

A security researcher who goes by "axi0mX" on Twitter today released "checkm8," which he claims is a bootrom exploit for iOS devices equipped with A5 through A11 chips, including the iPhone 4S through iPhone X, several iPad models dating back to the iPad 2, and the fifth-generation iPod touch and later.

trio iphones ios
This would be the first publicly released bootrom exploit since the iPhone 4 in 2010 and pave the way for a permanent, non-patchable jailbreak on hundreds of millions of affected iOS devices. Since the bootrom is read-only, Apple cannot patch this type of exploit with a software update.


The bootrom exploit has many other possibilities on affected devices, including downgrading iOS versions without SHSH blobs or APTickets, dual booting iOS, and running custom firmwares, according to jailbreak enthusiasts.

This is significant news in the jailbreaking community, as the last bootrom exploit known as "limera1n" was released by George "geohot" Hotz nearly a decade ago for devices with A4 chips and earlier, including the iPhone 4, iPhone 3GS, the third- and fourth-generation iPod touch, and the original iPad.

Top Rated Comments

zorinlynx Avatar
44 months ago

This can't be good for the security of these devices...

And have malware installed or spying on you. No thanks. Apple should have gotten their sh** together and not have had the exploit open for nearly a week.
This is a bootrom exploit. It can only be exploited when the device is in DFU recovery mode and will not affect the security of devices being used normally.

This is really the best kind of jailbreak exploit because only the people who really want to go out of their way to jailbreak can use it. Regular users are safe; all it means is that people can do whatever they like with these devices they own now.
Score: 35 Votes (Like | Disagree)
itsmilo Avatar
44 months ago

All the cool kids violate their warranty. Didn't you know?
one restore on iTunes and your warranty is „restored“ so to speak
Score: 28 Votes (Like | Disagree)
tobefirst ⚽️ Avatar
44 months ago
I haaaaaaate the new force press/haptic touch menu on iOS 13. I would consider jail breaking just to go back to how that worked on my X on iOS 12.
Score: 16 Votes (Like | Disagree)
Jeremy1026 Avatar
44 months ago
I haven't been jailbroken since the 3G, what's the big draw of a jailbreak now a days?
Score: 15 Votes (Like | Disagree)
redheeler Avatar
44 months ago
Good, now we can have proper downgrade rights on these devices. It's sad that something like this is needed to, for example, downgrade to iOS 10 on an iPad Air 2 for the simple purpose of running 32-bit apps.
Score: 14 Votes (Like | Disagree)
Krevnik Avatar
44 months ago

Once the data is copied off the phone can't you brute force it without fear of being locked out? What's the encryption like?
You can read through the details yourself if you want: https://www.apple.com/business/docs/site/iOS_Security_Guide.pdf

The NAND itself is encrypted with AES 256. The passcode is the weak point, but to generate the AES 256 key from the passcode, you need the passcode and the unique AES 256 key burned into the Secure Enclave on the SOC. The passcode is run through PBKDF2 and then tangled with the AES 256 key in a one-way operation.

So dumping the flash raw means you face AES 256 at full strength, even if you know the passcode, because you also need the AES 256 key from the SOC to be able to recreate the key yourself if you aren't just brute forcing AES.

The fastest way to crack an iPhone is to brute force the passcode and bypass the lockout on attempts if you can. It also gives you the most access to the content.

Individual containers/files can be encrypted with separate keys based on the level of access the OS should have in different states of lock/unlock, on top of the NAND encryption. So if you dump the flash unencrypted, you then also need to crack the containers for things like email and messages which are also AES 256 encryption. All the more reason to focus even more on the passcode and attempt lockout mechanisms.


This is a bootROM exploit. Every iPhone ever manufactured excluding the iPhone XS and 11 series will always be vulnerable to this exploit regardless of any iOS updates. There is no patch.
Apple still manufactures the iPhone 8 and 3rd Gen Air. I wouldn't be surprised if we see manufacturing runs of those that include the patched boot ROM.
Score: 14 Votes (Like | Disagree)

Popular Stories

iOS 16

iOS 16.3 Now Available for Your iPhone With These 4 New Features

Friday February 3, 2023 1:13 pm PST by
Apple released iOS 16.3 in late January following nearly six weeks of beta testing. The software update is available for the iPhone 8 and newer, and while it is a relatively minor update, it still includes a handful of new features, changes, and bug fixes. Below, we've recapped new features in iOS 16.3, including support for physical security keys as a two-factor authentication option for...
magsafe duo perspective feature

Apple Releases New MagSafe Duo Firmware

Tuesday February 7, 2023 12:41 pm PST by
Apple today released updated firmware for the MagSafe Duo charger that is designed to work with the Apple Watch and MagSafe-compatible iPhone models. The new firmware is version 10M3063, but in the settings app, you'll see a 256.1067.0 version number, up from 186.0.0.0. The MagSafe Duo was first released in 2020 alongside the iPhone 12 models, and it has not had a firmware update before....
oneplus 11 3

Camera Comparison: Apple's iPhone 14 Pro Max vs. OnePlus 11 5G

Tuesday February 7, 2023 10:11 am PST by
Chinese smartphone company OnePlus today announced the official debut of the OnePlus 11 5G, which is the company's latest flagship smartphone. The device was already announced in China, but today marks the global launch so we thought we'd compare the OnePlus 11 5G to the iPhone 14 Pro Max to see how the camera measures up. Subscribe to the MacRumors YouTube channel for more videos. Apple's...
HomePod 2 White and Midnight Feature Purple Orange

Apple Releases tvOS 16.3.1 and HomePod 16.3.1 Software Updates

Monday February 6, 2023 10:13 am PST by
Apple today released new tvOS 16.3.1 and HomePod 16.3.1 software updates, with the software coming two weeks after the tvOS 16.3 and HomePod 16.3 updates were released. According to Apple's release notes for HomePod software 16.3.1, the update includes general performance and stability improvements. Notes for tvOS 16.3.1 are unavailable as of yet, but are probably similar to the HomePod...
iPhone 15 Pro Blue Feature

iPhone 15 Pro 'Buttonless Design' Rumors: Everything We Know

Monday February 6, 2023 7:44 am PST by
The iPhone 15 Pro models will feature a "buttonless design" thanks to additional Taptic Engines, according to multiple corroborated reports, so what do we know about the change so far? Apple analyst Ming-Chi Kuo was first to report that the volume and power buttons on this year's two high-end iPhone models will adopt a solid-state design, similar to the iPhone 7's home button, replacing a...
iPhone 14 Pro Purple Side Perspective Feature Purple

Gurman: Apple Considering New High-End iPhone Alongside Pro and Pro Max

Sunday February 5, 2023 6:07 am PST by
Apple has discussed selling a new top-of-the-line iPhone alongside the Pro and Pro Max models in 2024 at the earliest, according to Bloomberg's Mark Gurman. Based on this timeframe, the device would be part of the iPhone 16 lineup or later. In a September 2022 edition of his weekly "Power On" newsletter, Gurman said there was "potential" for an iPhone 15 Ultra to replace the iPhone 15 Pro...
iphone ultra concept daehnert

'iPhone Ultra' Concept Envisions Apple's Rumored Future Top-Tier Smartphone

Tuesday February 7, 2023 5:38 am PST by
Apple has reportedly considered releasing a new top-of-the-line iPhone alongside future Pro and Pro Max models, tentatively referred to as "iPhone Ultra," and one designer has taken it upon himself to envision what such a device could potentially look like. German industrial designer Jonas Daehnert came up with this impressive-looking concept (pictured) by marrying design elements of the...
Apple iPad 10th gen Magic Keyboard Folio Apple Pencil Feature Blue

Apple Could Break an iPad Tradition This Year

Wednesday February 8, 2023 3:13 am PST by
Apple usually releases a new entry-level iPad every year, but the current lineup and rumors for 2023 may indicate that this will be the first year when the company breaks this convention. When Apple introduced the 10th-generation iPad last year, it added the device to the lineup above the ninth-generation model from 2021. As a result, Apple currently sells both the ninth- and 10th-generation ...