tr4mpass: iCloud Activation Lock Bypass
New improved version will be released soon
Free, open-source tool that removes iCloud activation lock from iPhones and iPads. Runs locally on your computer -- no servers, no payments, no accounts needed. Just plug in your device and run.
Supports iOS 12 through 26.1 | iPhone 5s through iPhone 15 Pro
For developers and security researchers: read 26.3-vulnerability.md for potential vulnerabilities that could enable bypass on iOS 26.3 and later.
How to Use
1. Download
git clone https://github.com/tr4m0ryp/tr4mpass.git
cd tr4mpass
2. Run
./start.sh
That's it. The script will:
- Install everything needed (works on macOS, Linux, and Windows via WSL)
- Build the tool automatically
- Detect your device when you plug it in
- Guide you into DFU mode step by step
- Run the bypass
- Tell you when it's done
Best results for A5-A11/checkm8: use native Linux (including Kali) or macOS with direct USB access. WSL + usbipd can miss checkm8 timing windows.
3. Put Your Device in DFU Mode
The script will walk you through this, but here's the short version:
iPhone 7 and older (Home button):
- Connect to your computer via USB
- Hold Power + Home for 10 seconds
- Release Power, keep holding Home for 5 more seconds
- Screen should be completely black (no Apple logo)
iPhone 8, X, and newer (Face ID / no Home button):
- Connect to your computer via USB
- Quick-press Volume Up, quick-press Volume Down
- Hold Side button until screen goes black
- Hold Side + Volume Down for 5 seconds
- Release Side, keep holding Volume Down for 10 seconds
- Screen should be completely black
Supported Devices
iPhone
| Device | Chip | Bypass Method | Signal Preserved |
|---|
| iPhone 5s | A7 | Path A (checkm8) | No (WiFi only) |
| iPhone 6 / 6 Plus | A8 | Path A (checkm8) | No (WiFi only) |
| iPhone 6s / 6s Plus | A9 | Path A (checkm8) | Yes |
| iPhone SE (1st gen) | A9 | Path A (checkm8) | Yes |
| iPhone 7 / 7 Plus | A10 | Path A (checkm8) | Yes |
| iPhone 8 / 8 Plus | A11 | Path A (checkm8) | Yes |
| iPhone X | A11 | Path A (checkm8) | Yes |
| iPhone XR | A12 | Path B (session) | Yes |
| iPhone XS / XS Max | A12 | Path B (session) | Yes |
| iPhone 11 / Pro / Pro Max | A13 | Path B (session) | Yes |
| iPhone SE (2nd gen) | A13 | Path B (session) | Yes |
| iPhone 12 / Mini / Pro / Pro Max | A14 | Path B (session) | Yes |
| iPhone 13 / Mini / Pro / Pro Max | A15 | Path B (session) | Yes |
| iPhone SE (3rd gen) | A15 | Path B (session) | Yes |
| iPhone 14 / Plus | A15 | Path B (session) | Yes |
| iPhone 14 Pro / Pro Max | A16 | Path B (session) | Yes |
| iPhone 15 / Plus | A16 | Path B (session) | Yes |
| iPhone 15 Pro / Pro Max | A17 | Path B (session) | Yes |
iPad
| Device | Chip | Bypass Method |
|---|
| iPad Air | A7 | Path A (checkm8) |
| iPad Air 2 | A8X | Path A (checkm8) |
| iPad mini 4 | A8 | Path A (checkm8) |
| iPad Pro (1st gen) | A9X | Path A (checkm8) |
| iPad (5th-7th gen) | A9-A10 | Path A (checkm8) |
| iPad Pro (2nd gen) | A10X | Path A (checkm8) |
| iPad Pro (3rd/4th gen) | A12/A12Z | Path B (session) |
| iPad Air (4th/5th gen) | A14/M1 | Path B (session) |
| iPad Pro (5th/6th gen) | M1/M2 | Path B (session) |
Other
| Device | Chip | Bypass Method |
|---|
| iPod touch (6th gen) | A8 | Path A (checkm8) |
| iPod touch (7th gen) | A10 | Path A (checkm8) |
| Apple TV 4K (1st gen) | A10X | Path A (checkm8) |
| Apple Watch Series 1-3 | S1P/S3 | Path A (checkm8) |
What Does "Signal Preserved" Mean?
- Yes -- After bypass, your iPhone keeps full cellular service (calls, texts, data). SIM card works normally.
- No (WiFi only) -- After bypass, the device works on WiFi but cellular service is disabled. This applies to older devices (A7/A8) and all WiFi-only iPads.
Advanced Usage
If you prefer to run things manually instead of using start.sh:
# Build
make
# Just identify your device (no bypass)
./tr4mpass --detect-only
# Run with full debug output
./tr4mpass --verbose
# Force a specific bypass path
./tr4mpass --force-path-a # checkm8 (A5-A11 devices)
./tr4mpass --force-path-b # session activation (A12+ devices)
# Preview what would happen without doing it
./tr4mpass --dry-run
brew install libimobiledevice libirecovery libusb libplist openssl pkg-config
sudo apt-get install -y \
libimobiledevice-dev libusb-1.0-0-dev libplist-dev \
libssl-dev libssh2-1-dev pkg-config build-essential usbutils usbmuxd
# Debian/Kali package names vary by release for libirecovery and libcurl dev:
sudo apt-get install -y libirecovery-1.0-dev || sudo apt-get install -y libirecovery-dev
sudo apt-get install -y libcurl4-openssl-dev || sudo apt-get install -y libcurl4-gnutls-dev
sudo dnf install -y \
libimobiledevice-devel libirecovery-devel libusb1-devel \
libplist-devel openssl-devel pkg-config gcc make
Native Windows is not supported. Install WSL first:
wsl --install
Then open a WSL terminal and follow the Linux instructions.
How It Works (Technical)
tr4mpass has two bypass paths, selected automatically based on your device's chip:
Path A -- checkm8 (A5 through A11)
Uses a permanent hardware vulnerability in the BootROM (the very first code that runs when the device powers on). This vulnerability cannot be patched by Apple because the BootROM is burned into silicon at the factory.
DFU Mode -> checkm8 exploit -> load ramdisk -> jailbreak kernel
-> inject activation record -> cleanup Setup.app -> verify
Path B -- Session Activation (A12 and later)
Does not use a hardware exploit. Instead, it manipulates the device's identity in DFU mode, then uses Apple's own activation protocol (drmHandshake session mode) to change the lock state.
This is the beginning of the README. Read the rest at the original. Read the full README ↗
