This project is obsolete. Apple patched the TSS/Cryptex bug it relied on. The original signing and installation flow is no longer usable for new installs. The code is shared for educational purposes and to document the work.
CryptSn0w packaged an SBInject-based jailbreak as a device-personalized Cryptex: a disk image with an associated trust cache and an Apple signing ticket. The original installer obtained that ticket from Apple's signing service.
The project includes SpringBoard and Settings tweak injection through ElleKit, Sileo package management, PreferenceLoader, optional root SSH, and a macOS installer. The bootstrap also contains code to restore its services after a reboot.
The Cryptex carried the bootstrap, Sileo, ElleKit, SSH, and a fixed set of loaders. Its trust cache listed the hashes of those binaries. That gave the project a trusted base, but it did not automatically trust every package installed later. Adding each new binary to the cache would have required updating and signing the cache whenever its contents changed.
CryptSn0w used JIT (just-in-time) execution permissions to load supported new code through that existing base. An already trusted worker, or an SBInject-managed process, first entered the required debugged state. The loader then adjusted dyld's signature checks and copied the payload's code into anonymous memory, making it executable after the copy. Dyld still handled loading and linking. This ran existing native machine code without adding its hash to the fixed trust cache.
The broker routed supported package executables and native install scripts
through codex-exec-worker. SBInject applied the same approach inside
SpringBoard and Settings, allowing ElleKit to load compatible tweak libraries.
Installing a supported payload therefore did not require a new Apple-signed
trust cache for that payload.
Some binaries still needed patching, rehashing, or ad-hoc signing to work with the loader. They also had to use the supported execution path; they did not become trusted system-wide. Compatibility depended on the process and OS build, and changing the fixed bootstrap or loaders still required rebuilding the installation. This all depended on the original Cryptex bootstrap, whose installation path is now obsolete.
See the worker and SBInject loader for the implementation.
The SwiftUI app runs the same installer as the command line. It requires macOS 14 or newer and Swift 6.2 or newer to build:
make app
open dist/CryptSn0w.appKeep the app in dist/ so it can find the repository, or select the repository
with the app's folder chooser. Retained root SSH access is off by default;
the temporary SSH stage is always part of installation. The app is subject
to the same TSS/Cryptex limitation described above. See
MacApp/README.md for its build and UI details.
| Path | Contents |
|---|---|
Dopamine-CryptexBootstrap/setup.sh |
Dependency setup and build/install entry point |
Dopamine-CryptexBootstrap/CryptexBootstrap/ |
Cryptex build, deployment, and runtime code |
Dopamine-CryptexBootstrap/CryptexBootstrap/SBInject/ |
SpringBoard and Settings injection |
MacApp/ |
SwiftUI installer and app packaging |
The main runtime log was /var/tmp/codex-dopamine-cryptex-bootstrap.log.
App launcher and TrollStore registration logs were
/var/mobile/.sbinject-app-launcher.log and
/var/mobile/.sbinject-trollstore-registration.log.
TSS request construction, personalization, and related installation details are intentionally omitted. The files retain placeholders for educational reference.
Some details are also omitted to avoid prematurely disclosing information relevant to other potential TSS issues. This does not mean we have an unreleased untethered jailbreak or a working exploit that we are withholding.
- 0xjohnny — project maintainer; the original root SSH proof of concept, Cryptex bootstrap, build and signing workflow, Sileo bootstrap and package handling, reboot recovery, and later iOS compatibility and runtime fixes.
- GenericCoding — project maintainer; SBInject and Sileo integration, Settings/PreferenceLoader integration, the two-stage installer, native macOS app, TrollStore/app-launcher integration, and runtime fixes.
- Varik Matevosyan / var77 — project maintainer; device-discovery fixes in the CLI and macOS app so a phone connected over both USB and Wi-Fi appears as one device, with USB preferred.
- hrtowii — the original SBInject proof of concept that this port builds on.
Other repository collaborators include jakeashacks, and forcequitOS.
- opa334 — Dopamine, opainject, litehook, libSandy, and AltList.
- Évelyne Bélanger and the ElleKit contributors — ElleKit, used for tweak injection and hooking.
- Sileo Team — Sileo, the package manager. This product includes software developed by the Sileo Team.
- Dustin Howett, Dhinak G, Yves000, and the PreferenceLoader contributors — PreferenceLoader, including the Swift metadata, heap, and string helpers used by the Settings bridge.
- Procursus Team — the Procursus bootstrap and packages and the ldid fork, based on saurik's ldid.
- jjolano — HookKit and Shadow.
- Frida contributors — Frida Gum, used by HookKit's Gum provider.
- doronz88 and the pymobiledevice3 contributors — pymobiledevice3, used for device communication and Cryptex services.
- m1stadev — PyIMG4, used to parse and check Image4 manifests.
- The maintainers of OpenSSH, libplist, and Requests for the SSH, plist, and HTTP tools used by this project.
The copied PreferenceLoader helpers retain their source attribution and license.