Skip to content

iPhone 14 pro max failed to bypass ppl iOS 17 #895

Description

@ahjaiii

Starting Jailbreak (Model: iPhone15,3, Version 17.0 (Build 21A329), Configuration: {removeJailbreak=0, tweakInjection=1, idownload=0, appJIT=1})
2026-08-08 16:14:38.877 Dopamine[1164:213707] Kernel at /private/preboot/00E25D7770FFDFB10E2B8DCEE99B150DE1629EB1218472678926B0578FAB7633E6EEEF4823A8F80B4B841E2C1CEEB0EA/System/Library/Caches/com.apple.kernelcaches/kernelcache
Patchfinding
2026-08-08 16:14:38.878 Dopamine[1164:213707] SPTM at /private/preboot/00E25D7770FFDFB10E2B8DCEE99B150DE1629EB1218472678926B0578FAB7633E6EEEF4823A8F80B4B841E2C1CEEB0EA/usr/standalone/firmware/FUD/Ap,SecurePageTableMonitor.img4
2026-08-08 16:14:38.878 Dopamine[1164:213707] TXM at /private/preboot/00E25D7770FFDFB10E2B8DCEE99B150DE1629EB1218472678926B0578FAB7633E6EEEF4823A8F80B4B841E2C1CEEB0EA/usr/standalone/firmware/FUD/Ap,TrustedExecutionMonitor.img4
System Info:
Exploiting Kernel (DarkSword)
0xfffffff0070991d0 <- kernelSymbol.n_papt_ranges_compressed
0xfffffff0278fc578 <- kernelSymbol.libsptm_n_papt_ranges
0xfffffff027869388 <- kernelSymbol.pv_head_table
0x0000000000000011 <- kernelConstant.T1SZ_BOOT
0xfffffff017058a26 <- kernelSymbol.txm_developer_mode_storage
0xfffffff0278fc590 <- kernelSymbol.vm_last_phys
0xfffffff02a246430 <- kernelSymbol.vm_first_phys_ppnum
0xfffffff02a246428 <- kernelSymbol.vm_page_array_ending_addr
0xfffffff0278693b8 <- kernelSymbol.vm_page_array_beginning_addr
0xfffffff0278ba2a0 <- kernelSymbol.gPhysBase
0xfffffff027869b68 <- kernelSymbol.cpu_ttep
0xfffffff027d6437c <- kernelSymbol.kalloc_data_external
0x0000000000000428 <- kernelStruct.IOSurface.rangeCount
0x0000000000000040 <- kernelStruct.vm_map.pmap
0xfffffff0278a10c0 <- kernelSymbol.mach_kobj_count
0xfffffff0278ba2a8 <- kernelSymbol.gPhysSize
0x0000000000000001 <- kernelConstant.kernel_el
0xfffffff007004000 <- kernelConstant.staticSptmBase
0xfffffff027004000 <- kernelConstant.staticBase
0x0000000000000730 <- kernelStruct.proc.struct_size
0xfffffff0278fc588 <- kernelSymbol.vm_first_phys
0x000000000000022c <- kernelConstant.nsysent
0xfffffff017004000 <- kernelConstant.staticTxmBase
0xfffffff0070991e0 <- kernelSymbol.papt_ranges_compressed
0xfffffff0278fc580 <- kernelSymbol.libsptm_papt_ranges
0xfffffff027869380 <- kernelSymbol.pp_attr_table
0x0000000000000080 <- kernelConstant.mach_trap_count
0x0000000000000420 <- kernelStruct.IOSurface.ranges
0x0000000000000300 <- kernelStruct.task.itk_space
0x00007ff000000000 <- kernelConstant.ARM_TT_L1_INDEX_MASK
0xfffffff02a2652a8 <- kernelSymbol.allproc
0xfffffff0278fc5b0 <- kernelSymbol.libsptm_frame_table
0xfffffff0170104b8 <- kernelSymbol.txm_trustcache_root
0xffff800000000000 <- kernelConstant.pointer_mask
0xfffffff02788cca0 <- kernelSymbol.gVirtBase
0xfffffff0278fb648 <- kernelSymbol.SPTMArgs
0xfffffff027d649c4 <- kernelSymbol.kfree_data_external
System Info libjailbreak:
0x0000000000000030 <- kernelStruct.TXMAddressSpace.codeRegions
0x0000000000000004 <- kernelStruct.sptm_frame.level
0x0000000000000028 <- kernelStruct.protosw.input
0x0000000000000018 <- kernelStruct.pt_desc.ptd_info
0x0000000000000008 <- kernelStruct.pmap.ttep
0x0000000000000007 <- kernelStruct.vm_map_entry.flags_prot
0x0000000000000008 <- kernelStruct.vm_map_entry.next
0x0000000000000020 <- kernelStruct.ipc_space.table
0x000000000000001c <- kernelStruct.cs_blob.cpu_subtype
0x0000000000000018 <- kernelStruct.cs_blob.cpu_type
0x0000000000000018 <- kernelStruct.proc.proc_ro
0xfffffff0070991d0 <- kernelSymbol.n_papt_ranges_compressed
0xfffffff0278fc578 <- kernelSymbol.libsptm_n_papt_ranges
0xfffffff027869388 <- kernelSymbol.pv_head_table
0xffffffdc00000000 <- kernelConstant.VM_PAGE_PACKED_PTR_BASE
0x0000000000000011 <- kernelConstant.T1SZ_BOOT
0x0000000000000008 <- kernelStruct.RBLink.rbe_right
0x0000000000000030 <- kernelStruct.TXMCodeRegion.endAddr
0x0000000000000028 <- kernelStruct.TXMCodeRegion.startAddr
0x0000000000000012 <- kernelStruct.TXMCodeRegion.type
0x0000000000000018 <- kernelStruct.socket.proto
0x000000000000022c <- kernelStruct.socket.usecount
0x0000000000000158 <- kernelStruct.inpcb.chksum
0x0000000000000040 <- kernelStruct.inpcb.socket
0x0000000000000028 <- kernelStruct.inpcb.list_prev
0x0000000000000028 <- kernelStruct.trustcache.struct_size
0x00000000000000b0 <- kernelStruct.pmap.txm_address_space
0x000000000000009c <- kernelStruct.pmap.type
0x000000000000001c <- kernelStruct.vm_map_entry.flags_xnu_user_debug
0x0000000000000010 <- kernelStruct.vm_map_header.min_offset
0x000000000000006c <- kernelStruct.ucred.svgid
0x0000000000000020 <- kernelStruct.ucred.svuid
0x0000000000000050 <- kernelStruct.ubc_info.cs_blobs
0x0000000000000028 <- kernelStruct.filedesc.ofiles_start
0x0000000000000068 <- kernelStruct.proc_ro.mach_trap_filter_mask
0x00000000000000d0 <- kernelStruct.proc.fd
0x0000000000000040 <- kernelStruct.proc.svgid
0x000000000000003c <- kernelStruct.proc.svuid
0xfffffff017058a26 <- kernelSymbol.txm_developer_mode_storage
0xfffffff02a246428 <- kernelSymbol.vm_page_array_ending_addr
0xfffffff0278693b8 <- kernelSymbol.vm_page_array_beginning_addr
0xfffffff0278fc590 <- kernelSymbol.vm_last_phys
0xfffffff02a246430 <- kernelSymbol.vm_first_phys_ppnum
0xfffffff027869b68 <- kernelSymbol.cpu_ttep
0xfffffff0278ba2a0 <- kernelSymbol.gPhysBase
0xfffffff027d6437c <- kernelSymbol.kalloc_data_external
0x0000000000000020 <- kernelStruct.TXMAddressSpace.allowsInvalidCode
0x0000000000000006 <- kernelStruct.sptm_frame.nested_refcnt
0x0000000000000428 <- kernelStruct.IOSurface.rangeCount
0x0000000000000040 <- kernelStruct.IOSurface.memoryDescriptor
0x0000000000000020 <- kernelStruct.inpcb.list_next
0x0000000000000090 <- kernelStruct.pmap.asid
0x0000000000000090 <- kernelStruct.pmap.pmap_cs_main
0x0000000000000040 <- kernelStruct.vm_map.pmap
0x0000000000000018 <- kernelStruct.ipc_entry.struct_size
0x0000000000000068 <- kernelStruct.ucred.rgid
0x000000000000001c <- kernelStruct.ucred.ruid
0x0000000000000010 <- kernelStruct.ucred.ref
0x0000000000000078 <- kernelStruct.vnode.un
0x0000000000000454 <- kernelStruct.proc.flag
0x0000000000000010 <- kernelStruct.proc.pptr
0x0000000000000008 <- kernelStruct.proc.list_prev
0xfffffff0278a10c0 <- kernelSymbol.mach_kobj_count
0xfffffff0278ba2a8 <- kernelSymbol.gPhysSize
0x0000000000000400 <- kernelConstant.TFRO_PLATFORM
0x0000000000000001 <- kernelConstant.kernel_el
0x0000000000000010 <- kernelStruct.RBLink.rbe_parent
0x0000000000000020 <- kernelStruct.TXMCodeRegion.codeSignature
0x0000000000000002 <- kernelStruct.sptm_frame.type
0x0000000000000030 <- kernelStruct.IOMachPort.object
0x0000000000000038 <- kernelStruct.inpcb.pcbinfo
0x0000000000000008 <- kernelStruct.trustcache.prevptr
0x0000000000000190 <- kernelStruct.pmap_cs_code_directory.main_binary
0x0000000000000010 <- kernelStruct.vm_map_entry.start
0x00000000000000c8 <- kernelStruct.vm_map.flags
0x0000000000000060 <- kernelStruct.task.threads
0x0000000000000038 <- kernelStruct.fileglob.data
0x0000000000000008 <- kernelStruct.task_token_ro_data.audit_token
0x0000000000000070 <- kernelStruct.proc_ro.mach_kobj_filter_mask
0x0000000000000730 <- kernelStruct.proc.struct_size
0xfffffff0278fc588 <- kernelSymbol.vm_first_phys
0x0000000000000003 <- kernelConstant.PVH_TYPE_MASK
0x000000000000022c <- kernelConstant.nsysent
0xfffffff007004000 <- kernelConstant.staticSptmBase
0xfffffff027004000 <- kernelConstant.staticBase
0x0000000000000020 <- kernelStruct.trustcache.fileptr
0x0000000000000010 <- kernelStruct.trustcache.type
0x0000000000000008 <- kernelStruct.pt_desc.va
0x00000000000001ec <- kernelStruct.pmap_cs_code_directory.trust
0x000000000000000b <- kernelStruct.vm_map_entry.flags_maxprot
0x0000000000000008 <- kernelStruct.vm_map_header.first
0x0000000000000028 <- kernelStruct.task.map
0x0000000000000078 <- kernelStruct.ucred.label
0x0000000000000018 <- kernelStruct.ucred.uid
0x0000000000000028 <- kernelStruct.cs_blob.base_offset
0x0000000000000078 <- kernelStruct.proc_ro.t_flags_ro
0xfffffff0070991e0 <- kernelSymbol.papt_ranges_compressed
0xfffffff0278fc580 <- kernelSymbol.libsptm_papt_ranges
0xfffffff027869380 <- kernelSymbol.pp_attr_table
0x0000000000000006 <- kernelConstant.VM_PAGE_PACKED_PTR_SHIFT
0x0000000000000080 <- kernelConstant.mach_trap_count
0xfffffff017004000 <- kernelConstant.staticTxmBase
0x0000000000000420 <- kernelStruct.IOSurface.ranges
0x0000000000000010 <- kernelStruct.kalloc_type_view.kt_zv_zv_name
0x0000000000000068 <- kernelStruct.inpcbinfo.ipi_zone
0x0000000000000018 <- kernelStruct.trustcache.size
0x00000000000000ba <- kernelStruct.pmap.wx_allowed
0x0000000000000018 <- kernelStruct.vm_map_header.max_offset
0x0000000000000010 <- kernelStruct.vm_map.hdr
0x0000000000000048 <- kernelStruct.ipc_port.kobject
0x0000000000000300 <- kernelStruct.task.itk_space
0x0000000000000010 <- kernelStruct.fileproc.glob
0x0000000000000040 <- kernelStruct.proc_ro.task_tokens
0x000000000000001c <- kernelStruct.proc_ro.csflags
0xfffffff02a2652a8 <- kernelSymbol.allproc
0x7400000000000000 <- kernelConstant.PVH_HIGH_FLAGS
0x0000000000000002 <- kernelConstant.smrBase
0x00007ff000000000 <- kernelConstant.ARM_TT_L1_INDEX_MASK
Bypassing SPTM (Titan)
Jailbreak failed with error: Error Domain=JBErrorDomain Code=-4 "Failed to bypass PPL" UserInfo={NSLocalizedDescription=Failed to bypass PPL}

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions