tr4mpass: Multi-Path iOS Exploitation Framework (A5-A17) — Security Tool

⌨️ PowerShell Command Button

![licence]() ![tests]() ![status]() ![powershell-7]()

tr4mpass is an advanced, multi-path iOS exploitation framework targeting Apple A5 through A17 silicon. It integrates checkm8 and checkm9 bootloader exploits, dyld memory corruption primitives, and SparseRestore bypasses within a unified C99/C++17 core for device identification, exploitation, and post-bypass operations. The framework additionally provides automated forensic gathering and system repair capabilities, including persistent OTA blocking, factory reset disabling, and Signal/iCloud login fix-ups. Designed for authorized security research, tr4mpass consolidates multiple exploitation paths and post-exploitation utilities into a single toolchain.

✅ Requirements

• OS: Windows 10 / 11
• Shell: PowerShell 5.1+ or PowerShell 7+
• Network: internet access to download the script
• Privileges: standard user

Key Features

• Unified multi-path exploitation engine spanning Apple A5 through A17 silicon, with a single C99/C++17 core that performs device identification, selects the appropriate exploit chain, and orchestrates post-exploitation stages without requiring separate tooling per device class.

• checkm8 bootloader integration for A5–A11 hardware, leveraging the unpatchable BootROM vulnerability to achieve repeatable pwned-device access across the supported legacy range.

• checkm9 (Steaks4uce-2) handshake implementation for T8xxx-series A12–A17 chips, providing a native hardware-handshake primitive for devices outside the checkm8 scope.

• dyld memory corruption primitive implementing the DarkSword-class PAC bypass and library injection path, enabling post-boot code execution research on modern iOS builds.

• SparseRestore-based bypass path operating entirely on-device through the backup/restore subsystem, targeting iOS 17/18 without network dependency for the bypass stage itself.

• Session-based activation path for A12–A17 devices using identity-session provisioning, complementing the hardware-exploit and SparseRestore routes as a third independent bypass strategy.

• Automated forensic gathering module with structured extraction of SMS, contacts, notes, and keychain material from ramdisk-mounted or jailbroken devices, producing organized output directories suitable for downstream analysis.

• System repair and hardening routines, including persistent OTA blocking, factory-reset suppression, and post-bypass fix-ups for Signal and iCloud login flows.

• Diagnostics and provisioning utilities, including a software-only diagnostics mode entry for SysCfg (serial number) manipulation and activation provisioning injection.

• Research primitives for zero-click vector simulation (iMessage/AirDrop) and kernel read/write modeling, isolated from production bypass paths to preserve operational stability.

• Deterministic CLI orchestration with explicit path selection (--force-path-a/b/c), per-stage verbosity, and non-interactive flags for reproducible research runs; device detection can be executed standalone without triggering any exploit stage.

• Native device identification layer backed by a model/chip database and USB state management, ensuring each exploit path is gated on verified hardware and firmware characteristics rather than heuristic assumptions.

• Self-contained logging and trace tooling, including a native tracev3 log scanner and fake-filesystem generator, so evidence collection and audit trails remain local to the operator's environment.

How It Works

tr4mpass operates as a staged pipeline: identify, exploit, bypass, then optionally gather or harden. Each stage is independent and can be invoked in isolation via CLI flags, so operators can validate a device's state before committing to a full chain.

Device identification. On launch, the tool enumerates connected devices over USB, matches chip and board identifiers against an internal model database, and reports the detected SoC family (A5 through A17), iOS build, and DFU/recovery state. This determines which exploitation paths are viable before any payload is sent.

Bootloader exploitation (Path A). For A5-A11 silicon, tr4mpass integrates checkm8, a bootrom-level vulnerability in the USB DFU stack that cannot be patched in software. The framework stages the device into DFU, delivers the exploit payload over the DFU protocol, and gains arbitrary code execution in the boot chain. For T8xxx-series chips, an extended handshake primitive (checkm9) performs an equivalent escalation at the hardware interface layer.

Path B (identity-based activation). On A12-A17 devices where bootrom attacks do not apply, the framework drives a session-based activation flow, provisioning the device through a controlled handshake and injecting the required activation records. This path does not rely on memory corruption and is therefore stable across supported firmware revisions.

Path C (SparseRestore). For iOS 17/18 targets, tr4mpass implements a local-only bypass built on the SparseRestore primitive: a crafted backup manifest is delivered through the device's own restore service to overwrite targeted files outside the normal sandbox. No network services are contacted; all processing occurs on the host and device.

Memory corruption and PAC bypass. Where firmware permits, the dyld exploitation module applies a memory-corruption primitive during dynamic linker operation to achieve library injection and, on PAC-enabled devices, to bypass pointer authentication for subsequent payloads.

Post-exploitation. Once elevated, the framework can either (a) run forensic collection — enumerating and exporting messages, contacts, notes, and keychain items from a jailbroken or ramdisk-booted device to a local directory — or (b) apply system hardening: persistent OTA update blocking, factory-reset prevention, and repair of Signal and iCloud login state.

Determinism and logging. Every stage emits structured trace logs, and destructive operations require explicit flags. The tool never transmits device data off-host; collection artifacts are written only to the operator-specified local path.

Privacy & Data Handling

tr4mpass operates entirely on the local host and the connected device. No telemetry, analytics, crash reporting, or usage statistics are collected, transmitted, or persisted by the framework. The binary performs no outbound network calls during exploitation, bypass, or forensic gathering workflows; all USB, DFU, and recovery-mode communication is confined to the physical bus between host and target.

Data touched during operation

• Device identifiers: chip IDs, ECID, board configuration, and model strings are read into process memory to select the correct exploit path. They are written to disk only when the operator supplies an explicit output directory via --gather or equivalent flags.
• Forensic artifacts: when a gather operation is invoked, the requested classes of data (messages, contacts, notes, keychain items, and similar stores) are extracted over the local connection and written to the operator-designated path. tr4rmpass does not upload, mirror, or forward these artifacts.
• Session material: activation sessions and provisioning payloads are held in memory for the duration of the operation and are not retained after process exit unless the operator directs output to a file.
• Logs: verbose traces are written to the working directory only when --verbose or a log path is specified. Log contents are limited to operation state, device state transitions, and error context; extracted user data is not duplicated into logs.

All output is operator-controlled. tr4rmpass defines no default collection directory, no background service, and no scheduled persistence. Files produced by a run remain on the host filesystem until the operator deletes them. The framework does not create hidden copies, does not write to device-side locations beyond those required by the selected exploit path, and does not retain state between invocations.

Isolation guarantees

The multi-path exploit architecture executes each primitive within its own process boundary where the platform permits, and the framework does not share extracted data across paths. Path A, Path B, Path C, checkm9, and the dyld corruption primitive each read only the device state they require. SparseRestore operations run against a local backup container that is scoped to the invocation.

Operator responsibility

Because tr4rmpass is a research instrument, all handling of extracted data falls to the operator. The framework provides the mechanism; it does not define custody, transfer, or disposal policy. Operators are expected to treat gathered artifacts as sensitive personal data and to apply their own retention and access controls. No component of tr4rmpass phones home, checks for updates over the network, or validates licensing against a remote service.

FAQ

What is tr4mpass?

tr4mpass is a unified C99/C++17 security research framework for Apple iOS devices spanning A5 through A17 silicon (iOS 12.0–26.3). It consolidates three exploitation paths — checkm8/checkm9 bootloader-level pwnage, dyld memory corruption primitives, and SparseRestore-based local bypasses — into a single CLI tool, alongside post-exploitation modules for forensic gathering and system repair. The project is implemented natively; it is not a wrapper around existing Python tooling.

Which devices and iOS versions are supported?

Support is segmented by exploitation path rather than uniformly. Path A (checkm8) covers A5–A11 hardware with an unpatchable BootROM vulnerability. Path B (session-based identity handling) targets A12–A17. Path C (SparseRestore, CVE-2024-44258) applies to iOS 17/18 on compatible devices and operates entirely locally. The checkm9 (Steaks4uce-2) handshake targets T8xxx-series chips. Verify your exact chip and iOS build against the device database before attempting any operation; mismatched path selection will fail cleanly but waste time.

What are the differences between Path A, Path B, and Path C?

Path A exploits the checkm8 BootROM flaw, which cannot be patched by Apple on affected hardware. Path B is session-based: it does not rely on a bootloader vulnerability and instead negotiates activation state through provisioning logic. Path C uses the SparseRestore primitive via the mobilebackup2 protocol and is strictly local — no network dependency. Select the path matching your hardware; the CLI defaults to autodetection, but explicit selection with --force-path-a/b/c is recommended in scripted workflows.

Do any operations require network access?

Path C (SparseRestore) is designed for fully local operation. Path B's activation flow may contact Apple provisioning endpoints as part of its normal session negotiation; this is protocol behavior, not data collection by tr4mpass. Forensic gathering and dyld exploitation are local operations. The tool does not transmit results, telemetry, or device data to any external destination controlled by the project.

What does "Metasploit Mode" data gathering collect, and where does it go?

--gather