How the Phoenix Jailbreak Works

Author Jonathan Levin has posted a writeup detailing how the Phoenix jailbreak of iOS 9.3.5 works.

The semi-tethered Phoenix jailbreak was recently released by @tihmstar (author of
Prometheus) and @S1guza (author of Cl0ver). It works on all 32-bit devices running iOS 9.3.5.

Levin's writeup is offered as a free addendum to *OS Internals Vol III. It includes some history on the jailbreak, sample code, and an explanation of how it works.


The initiative to the jailbreak can be traced to Stefan Esser, who boasted of its ease and even raised a kickstarter campaign for an online training course with a goal of 111,111 Euro. One of the promised deliverables was such a jailbreak, contingent on the "all-or-nothing" nature of crowdsourcing. This galvanized the jailbreaking community across the world. When it quickly became clear this campaign was doomed to fail and Esser's jailbreak would be just another one of many promised projects to never see the light of day, several teams took to the task of creating and releasing the jailbreak. @tihmstar (author of Prometheus, discussed in Volume II) and @S1guza (author of Cl0ver and NewOSXBook.com forum administrator) - rose to the challenge of ensuring the jailbreak would reach the world with or without Esser's training.

You can download the writeup as a PDF from the link below...

Download