tr4mpass

tr4mpass: iCloud Activation Lock Bypass

New improved version will be released soon

Free, open-source tool that removes iCloud activation lock from iPhones and iPads. Runs locally on your computer – no servers, no payments, no accounts needed. Just plug in your device and run.

Supports iOS 12 through 26.1 | iPhone 5s through iPhone 15 Pro

For developers and security researchers: read 26.3-vulnerability.md for potential vulnerabilities that could enable bypass on iOS 26.3 and later.

How to Use

1. Download

git clone https://github.com/tr4m0ryp/tr4mpass.git
cd tr4mpass

2. Run

./start.sh

That’s it. The script will:

• Install everything needed (works on macOS, Linux, and Windows via WSL)
• Build the tool automatically
• Detect your device when you plug it in
• Guide you into DFU mode step by step
• Run the bypass
• Tell you when it’s done

Best results for A5-A11/checkm8: use native Linux (including Kali) or macOS with direct USB access. WSL + usbipd can miss checkm8 timing windows.

3. Put Your Device in DFU Mode

The script will walk you through this, but here’s the short version:

iPhone 7 and older (Home button):

1. Connect to your computer via USB
2. Hold Power + Home for 10 seconds
3. Release Power, keep holding Home for 5 more seconds
4. Screen should be completely black (no Apple logo)

iPhone 8, X, and newer (Face ID / no Home button):

1. Connect to your computer via USB
2. Quick-press Volume Up, quick-press Volume Down
3. Hold Side button until screen goes black
4. Hold Side + Volume Down for 5 seconds
5. Release Side, keep holding Volume Down for 10 seconds
6. Screen should be completely black

Supported Devices

iPhone

iPad

Other

What Does “Signal Preserved” Mean?

• Yes – After bypass, your iPhone keeps full cellular service (calls, texts, data). SIM card works normally.
• No (WiFi only) – After bypass, the device works on WiFi but cellular service is disabled. This applies to older devices (A7/A8) and all WiFi-only iPads.

Advanced Usage

If you prefer to run things manually instead of using start.sh:

# Build
make

# Just identify your device (no bypass)
./tr4mpass --detect-only

# Run with full debug output
./tr4mpass --verbose

# Force a specific bypass path
./tr4mpass --force-path-a    # checkm8 (A5-A11 devices)
./tr4mpass --force-path-b    # session activation (A12+ devices)

# Preview what would happen without doing it
./tr4mpass --dry-run

brew install libimobiledevice libirecovery libusb libplist openssl pkg-config

sudo apt-get install -y \
    libimobiledevice-dev libusb-1.0-0-dev libplist-dev \
    libssl-dev libssh2-1-dev pkg-config build-essential usbutils usbmuxd

# Debian/Kali package names vary by release for libirecovery and libcurl dev:
sudo apt-get install -y libirecovery-1.0-dev || sudo apt-get install -y libirecovery-dev
sudo apt-get install -y libcurl4-openssl-dev || sudo apt-get install -y libcurl4-gnutls-dev

sudo dnf install -y \
    libimobiledevice-devel libirecovery-devel libusb1-devel \
    libplist-devel openssl-devel pkg-config gcc make

wsl --install

How It Works (Technical)

tr4mpass has two bypass paths, selected automatically based on your device’s chip:

Path A – checkm8 (A5 through A11)

Uses a permanent hardware vulnerability in the BootROM (the very first code that runs when the device powers on). This vulnerability cannot be patched by Apple because the BootROM is burned into silicon at the factory.

DFU Mode -> checkm8 exploit -> load ramdisk -> jailbreak kernel
-> inject activation record -> cleanup Setup.app -> verify

Path B – Session Activation (A12 and later)

Does not use a hardware exploit. Instead, it manipulates the device’s identity in DFU mode, then uses Apple’s own activation protocol (drmHandshake session mode) to change the lock state.

DFU Mode -> identity manipulation -> signal detection
-> session handshake -> activation record -> cleanup -> verify

Architecture

+-------------------------+
|        start.sh         |  Guided wrapper (OS detect, deps, DFU guide)
+-------------------------+
|         main.c          |  CLI, device detection, path selection
+-------------------------+
|  Path A    |   Path B   |  Bypass strategies
+------------+------------+
| checkm8    | identity   |  Exploit / manipulation
| jailbreak  | session    |  Activation protocol
+------------+------------+
| DFU protocol | activation record | deletescript |
+--------------+-------------------+--------------+
| libusb | libimobiledevice | libplist | OpenSSL  |
+--------+------------------+---------+----------+

Source Files

The codebase is written in C99 (21 source files, 20 headers). Every file is under 300 lines. The Makefile auto-discovers all sources – no manual file lists.

iOS 26.3+ (Research in Progress)

Current bypass methods work up to iOS 26.1. For iOS 26.2 and later, Apple hardened several security layers that break existing approaches.

We have identified a potential bypass vector through VU#346053 – an unpatched vulnerability in Apple’s activation server that accepts unsigned XML payloads. This could enable bypass via a captive portal during device setup, without needing any exploit or jailbreak.

This is not implemented yet. See 26.3-vulnerability.md for the full technical analysis, proposed attack chain, and implementation roadmap.

Disclaimer

This tool is for authorized security research only (Apple Security Bounty program).

• Only use on devices you own or have written authorization to test.
• Bypassing activation lock on stolen devices is illegal.
• No warranty. Use at your own risk.
• Results are not guaranteed for every device or iOS version.

References

This project was built on extensive research and analysis of open-source tools, security disclosures, Apple documentation, and community knowledge.

Open-Source Tools and Libraries

Security Research and Disclosures

Apple Documentation

Analysis and Articles

Commercial Tools Analyzed

During development, the following proprietary tools were analyzed to understand bypass flows and protocol implementations: