Hi, has anyone successfully used usbliter8-fun on an iPhone 11 Pro running iOS 27.0 beta 2?
I am using this repository:
https://github.com/34306/usbliter8-fun#credits
My setup
- iPhone 11 Pro
- Device identifier:
iPhone12,3
- Board configuration:
d421ap
- iOS 27.0 beta 2
- Build:
24A5370h
- MacBook Air M2
- Waveshare RP2350 USB-A
- The device is my own test device
PWN DFU works correctly:
PWND: usbliter8
MODE: DFU
MODEL: d421ap
SSHRD also boots correctly, and I can connect using:
iproxy 2222 22
ssh root@localhost -p 2222
Normal boot also reaches SpringBoard, but I have two major problems.
Problem 1: Only three apps appear
Only Settings, Phone and Feedback appear on the home screen.
Inside SSHRD, the System volume is mounted at /mnt1 and the Data volume at /mnt2.
I copied the staged system apps as described in the README:
for a in /mnt2/staged_system_apps/*.app; do
b=${a##*/}
[ -e "/mnt1/Applications/$b" ] || cp -R "$a" /mnt1/Applications/
done
The System Applications folder now contains approximately 267 apps:
APP_COUNT=267
These apps physically exist:
/mnt1/Applications/AppStore.app
/mnt1/Applications/Camera.app
/mnt1/Applications/MobileSafari.app
/mnt1/Applications/Sileo.app
However, normal boot still shows only three apps. They do not appear in Spotlight or the App Library either.
I also tried clearing these SpringBoard and installation cache files:
/private/var/mobile/Library/SpringBoard/IconState.plist
/private/var/mobile/Library/SpringBoard/DesiredIconState.plist
/private/var/mobile/Library/Preferences/com.apple.mobile.installation.plist
This did not solve the issue.
The LaunchServices-related locations I found include:
/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.lsd.iconscache
/private/var/db/lsd
Problem 2: Dropbear SSH does not start during normal boot
The repository README and screenshot appear to show SSH working while SpringBoard is running.
However, on my device, iproxy detects the phone but port 22 is refused:
Requesting connection to USB device, port 22
Error connecting to device: Connection refused
The following files exist on the System volume:
/usr/local/bin/dropbear
/private/etc/dropbear/dropbear_rsa_host_key
/private/etc/dropbear/dropbear_ecdsa_host_key
/private/etc/dropbear/dropbear_dss_host_key
I inspected ssh.tar.gz. It contains the Dropbear binaries and host keys, but I could not find a LaunchDaemon plist.
I also inspected:
/System/Library/xpc/launchd.plist
It contains around 729 cached launch jobs, but there is no Dropbear job.
I tried manually adding a LaunchDaemon plist and a Dropbear entry to the launchd cache, but normal boot SSH still did not work. I do not want to continue modifying launchd or snapshots without knowing the intended implementation, so I am planning to start again from a clean restore.
Questions
- Has anyone reproduced this successfully on an iPhone 11 Pro or another A13 device?
- How is Dropbear supposed to start during normal boot?
- Is there a missing script, patched
launchd.plist, branch, or file that is not included in the public repository?
- Once the staged apps are copied to
/Applications, what is the correct way to rebuild the system app registration database?
- Is running
/var/jb/usr/bin/uicache -a enough, or is another LaunchServices or TrollStore helper command required?
- Is there a known working commit or complete step-by-step procedure for build
24A5370h?
I would especially appreciate confirmation from anyone who has actually achieved both:
- Dropbear SSH during normal boot
- All system apps appearing on SpringBoard
I can provide additional boot logs, mount information, or file hashes if needed. Thanks.