tr4m0ryp/tr4mpass

Free, open-source tool that removes iCloud activation lock from iPhones and iPads. Runs locally on your computer -- no servers, no payments, no accounts needed. Just plug in your device and run.

Supports iOS 12 through 26.1 | iPhone 5s through iPhone 15 Pro

For developers and security researchers: read 26.3-vulnerability.md for potential vulnerabilities that could enable bypass on iOS 26.3 and later.

git clone https://github.com/tr4m0ryp/tr4mpass.git
cd tr4mpass

./start.sh

That's it. The script will:

• Install everything needed (works on macOS, Linux, and Windows via WSL)
• Build the tool automatically
• Detect your device when you plug it in
• Guide you into DFU mode step by step
• Run the bypass
• Tell you when it's done

Best results for A5-A11/checkm8: use native Linux (including Kali) or macOS with direct USB access. WSL + usbipd can miss checkm8 timing windows.

The script will walk you through this, but here's the short version:

iPhone 7 and older (Home button):

1. Connect to your computer via USB
2. Hold Power + Home for 10 seconds
3. Release Power, keep holding Home for 5 more seconds
4. Screen should be completely black (no Apple logo)

iPhone 8, X, and newer (Face ID / no Home button):

1. Connect to your computer via USB
2. Quick-press Volume Up, quick-press Volume Down
3. Hold Side button until screen goes black
4. Hold Side + Volume Down for 5 seconds
5. Release Side, keep holding Volume Down for 10 seconds
6. Screen should be completely black

• Yes -- After bypass, your iPhone keeps full cellular service (calls, texts, data). SIM card works normally.
• No (WiFi only) -- After bypass, the device works on WiFi but cellular service is disabled. This applies to older devices (A7/A8) and all WiFi-only iPads.

If you prefer to run things manually instead of using start.sh:

# Build
make

# Just identify your device (no bypass)
./tr4mpass --detect-only

# Run with full debug output
./tr4mpass --verbose

# Force a specific bypass path
./tr4mpass --force-path-a    # checkm8 (A5-A11 devices)
./tr4mpass --force-path-b    # session activation (A12+ devices)

# Preview what would happen without doing it
./tr4mpass --dry-run

brew install libimobiledevice libirecovery libusb libplist openssl pkg-config

sudo apt-get install -y \
    libimobiledevice-dev libusb-1.0-0-dev libplist-dev \
    libssl-dev libssh2-1-dev pkg-config build-essential usbutils usbmuxd

# Debian/Kali package names vary by release for libirecovery and libcurl dev:
sudo apt-get install -y libirecovery-1.0-dev || sudo apt-get install -y libirecovery-dev
sudo apt-get install -y libcurl4-openssl-dev || sudo apt-get install -y libcurl4-gnutls-dev

sudo dnf install -y \
    libimobiledevice-devel libirecovery-devel libusb1-devel \
    libplist-devel openssl-devel pkg-config gcc make

wsl --install

tr4mpass has two bypass paths, selected automatically based on your device's chip:

Uses a permanent hardware vulnerability in the BootROM (the very first code that runs when the device powers on). This vulnerability cannot be patched by Apple because the BootROM is burned into silicon at the factory.

DFU Mode -> checkm8 exploit -> load ramdisk -> jailbreak kernel
-> inject activation record -> cleanup Setup.app -> verify

Does not use a hardware exploit. Instead, it manipulates the device's identity in DFU mode, then uses Apple's own activation protocol (drmHandshake session mode) to change the lock state.

DFU Mode -> identity manipulation -> signal detection
-> session handshake -> activation record -> cleanup -> verify

+-------------------------+
|        start.sh         |  Guided wrapper (OS detect, deps, DFU guide)
+-------------------------+
|         main.c          |  CLI, device detection, path selection
+-------------------------+
|  Path A    |   Path B   |  Bypass strategies
+------------+------------+
| checkm8    | identity   |  Exploit / manipulation
| jailbreak  | session    |  Activation protocol
+------------+------------+
| DFU protocol | activation record | deletescript |
+--------------+-------------------+--------------+
| libusb | libimobiledevice | libplist | OpenSSL  |
+--------+------------------+---------+----------+

The codebase is written in C99 (21 source files, 20 headers). Every file is under 300 lines. The Makefile auto-discovers all sources -- no manual file lists.

Current bypass methods work up to iOS 26.1. For iOS 26.2 and later, Apple hardened several security layers that break existing approaches.

We have identified a potential bypass vector through VU#346053 -- an unpatched vulnerability in Apple's activation server that accepts unsigned XML payloads. This could enable bypass via a captive portal during device setup, without needing any exploit or jailbreak.

This is not implemented yet. See 26.3-vulnerability.md for the full technical analysis, proposed attack chain, and implementation roadmap.

This tool is for authorized security research only (Apple Security Bounty program).

• Only use on devices you own or have written authorization to test.
• Bypassing activation lock on stolen devices is illegal.
• No warranty. Use at your own risk.
• Results are not guaranteed for every device or iOS version.

This project was built on extensive research and analysis of open-source tools, security disclosures, Apple documentation, and community knowledge.

During development, the following proprietary tools were analyzed to understand bypass flows and protocol implementations: