Jailbreaking iPhone with checkra1n

How to boot checkra1n from a flash drive

Bootra1n is a Linux distribution which enables users to boot checkra1n on any PC without having to install additional software or an OS. 

Bootra1n flash doesn't have signed loader, which is why you will need to boot directly into your computer. This is a standard procedure on all modern computers with UEFI and Secure boot.

To disable Secure boot, you will need to enter computer firmware settings.

On some computers, you can enter firmware with a hotkey once it is turned on, but usually, this is not possible because of fast boot technology, that boots directly into the installed operating system.

You can force your computer to allow you to enter the firmware directly from Windows.

Firmware varies by manufacturer and model. We used HP Probook 440G5 for our demonstration (many recent HP computers have similar firmware setting).

How to enter firmware settings (BIOS)

1. Search for Advanced startup option.

2. When you go to the Advanced startup, you should see Windows setting screen with startup option preselected. Click Restart now.

3. The computer will reboot into advanced startup mode, giving you an option to do various maintenance and recovery-related operations. Select troubleshoot.

4. On the next screen, select Advanced options.

5. Select UEFI Firmware Settings.

6. Restart your computer.

7. After restarting the computer you will either enter firmware settings (BIOS) or you will be presented with further options. The correct option is BIOS Setup.

8. When you enter BIOS, you need to search for Secure boot option and disable it. In our example of BIOS, it's located under the advanced settings page.

9. Save your changes. The way how to do that depends on a computer which you are using (in our example, you can either click F10 or go to the main section and save it there).

Before you save your settings (which will effectively restart the computer), make sure that USB flash drive with bootra1n is inserted into the computer.

10. When the secure boot is disabled it effectively disables the fastboot as well, so you should be able to call the boot menu of your device with hotkey after powerup. Usually, it's one of the following keys: ESC, F2, F9, F10 (please refer to your device manual).

11. Once your computer enters the boot menu, you should be presented with an option to boot from the flash drive. On our HP Probook, it is General Udisk option.

12. When you boot from the flash drive, you will be presented with a boot menu for bootra1n. Select void linux (USB safe).

Booting from flash drive doesn't access your computer hard disk, only the flash drive, and anything you connect to USB.

13. Once the boot sequence is finished, you will be presented with a login screen. Use login root and password voidlinux. At the shell prompt, type checkra1n and hit enter. This will run checkra1n in interactive mode.

Jailbreaking with checkra1n

The version of checkra1n on flash disk supports all models from iPhone 5s to iPhone X (iPhone XR/XS are not supported), all iPads with A7-A11 bionic processor (see https://checkra.in/ ) and iOS 12.0 up to 14.5.1. You can enable option unsupported device support if you want to try the combination that is not supported.

1. With checkra1n running on your computer, connect your device via a Lightning cable and then click the Start button and select OK.

If the USB security is enabled in iOS device settings and the device was not connected to any computer for more then one hour, you will need to unlock the device or put it manually to restore mode, otherwise, it will not be detected by checkra1n.

It is recommended to use the standard Lightning to USB Cable. Do not use any USB hubs (only USB-C to USB-A adapter if needed).

2. Select “Next” and then proceed with the instructions that the app gives you. This will result in your device going into DFU Mode.

3. Checkra1n will essentially take over the process once it detects the device in DFU Mode. The iPhone or iPad will reboot a few times during the process so don’t get concerned when that happens.

4. When you are finally told that the process is finished, you can unplug the Lightning cable and tap the checkra1n app on your device to launch the app.

Checkra1n  is a semi-tethered jailbreak where the device is able to start up on its own, but it will no longer have a patched kernel, and therefore will not be able to run modified code. It will, however, still be usable for normal functions, just like stock iOS, unlike a tethered jailbreak, which would not boot at all. You can read more about jailbreaking iOS device here.

Don't forget to reenable your secure boot, or windows might not start.