Pinned Tweet
To anyone wondering about my repo, the domain expired. I don't really need a fancy website anymore, so I'm moving my repo to Github Pages.
jakeajames.github.io
Open-sourced CryptSn0w, our now obsolete untethered iOS ≤27/≤A20 Pro jailbreak via rare Apple server-side TSS/Cryptex bug. PATCHED, educational only. NOT a working jb
Built w @GenericCoding @D4RK7ET. SBInject: @htrowii. Help: @Jakeashacks @forcequitOS
github.com/0xjohnnydev/crypt…
Jake James retweeted
Really glad to have had the chance to work on this with @0xjohnny, @D4RK7ET, and for @htrowii giving us her process injection technique, and for the input and advice from @Jakeashacks without whom there were points this wouldn't have been possible.
github.com/0xjohnnydev/crypt…
mine can, but let’s be honest yours is cooler 😎, I never imagined MIE devices to get jailbroken with persistence twice in the span of what, one month?
Here's my project using the now patched TSS bug.
Actual TSS & deploy bit to be released at a later date.
github.com/jakeajames/tr0y/
hrtowii.dev/blog/making-a-no…
i whipped up a quick writeup here regarding this bug ^^
github repo:
github.com/hrtowii/lycorine-…
Replying to @0xjohnny
3/3 Root access =/= stable jb. Devices w/ the patchworked environment installed can still use what's there, but Apple's server now blocks further modifications. The bug itself is unfortunately useless now. Some1 will surely publish a technical writeup/PoC for those interested.
This bug was so special that I had to come back after years and get myself somewhat up to speed with latest iOS.
Replying to @Jakeashacks
Mr. Jake James it makes me beyond thrilled to hear you're still up to shenanigans in 2026
As others noted, Apple patched the not-so-secret server side bug. It enabled root access and jailbreaking even on iOS 27.2b3 (18 Pro Max). A public release would've meant an instant patch, so it stayed private. Despite efforts to preserve it, it's cooked. RIP 🪦😭
To celebrate iOS 27’s release, why not release a sandbox escape?
Announcing airlift: a PoC abusing a media sync path for out-of-scope access across much of /var/mobile via macOS↔iOS pairing.
No MobileGestalt edits yet; looking into it.
github.com/0xjohnnydev/airli…
Jake James retweeted
Dopamine 3 is out
infosec.exchange/@opa334/117…
Jake James retweeted
Titan: a PPL & SPTM bypass for A14 - A17
github.com/alfiecg24/Titan
Jake James retweeted
#deepsec "A Journey to Break Apple's PPL". PPL's been the kernel's last line of defense on A12+ for years, and it's held up. @pattern_F_ shares two ways through — and maybe one opens the door to an iOS 26 jailbreak…? 🙊 deepsec.cc/202607/speaker-pa…
who needs unsigned code execution when you can just manipulate the existing code
As someone said to me earlier, if you can do this to your iOS 18/26 DarkSword-vulnerable device, at what point is this environment no longer considered “limited” 😂
Beta of Gravity Lite is live with latest Cyanide: github.com/zeroxjf/cyanide
📱🫨




























