Bypassing Activation on "Bricked Activation Devices"

Recently, Apple has been disabling or bricking activation services for older devices.

The list includes but is not limited to:

iPhones

-iPhone 2G

-iPhone 3G

-iPhone 3GS

-iPhone 4 (GSM)

-iPhone 4S (specifically on IMEIs starting with "9900")

iPads

-iPad 1 (GSM)

-iPad 2 (GSM)

This list may expand in the future.

I was holding off on making this tutorial for a while, but due to recent events (Apple accidentally unsigning baseband firmware, and the current activation bricking) I'll make it.

Preparation

Method 1 requires:

-Legacy iOS Kit

If Method 1 does not work:

Method 2 requires:

-Legacy iOS Kit

-Raspberry Pi Pico

-checkm8-a5

-Micro USB OTG Y Cable

Method 1 Process

First, install Legacy iOS Kit. Let it run its initial setup process and pull any updates.

If your device is an iPhone 2G-4 running a version less or equal to iOS 6.1.6, you may proceed to "Hacktivate" it (go to Useful Utilities -> Hacktivate Device). No further action will be required.

However, if you have an iPhone 4/4S running iOS 7 or higher, please continue.


This part assumes that you have restored iOS with Cydia preinstalled. There is a chance that OpenSSH was installed with it. If you do not, continue with Method 2.

In Legacy iOS Kit, navigate to Useful Utilities -> SSH Ramdisk. In the option that pops up, select "kDFU".

It will then try to boot the iPhone into "pwned DFU mode". If it doesn't work, stop the script and try again. If it continues to fail, you will need to use Method 2.

Once you arrive at the SSH Ramdisk menu, select "Connect to SSH". Then once you're at the iPhone's prompt, execute "mount.sh".

Then, run cd /mnt1/Applications.

After changing to the Applications folder, run rm -rf ./Setup.app/. After which, run reboot_bak.

If done right, your device should boot straight to the home screen.

Method 2 Process

First, install Legacy iOS Kit. Let it run its initial setup process and pull any updates.

Next, download checkm8-a5. The ZIP file should contain 3 UF2 files. You will need to flash the correct UF2.

"8940.uf2" - For iPhone 4S/iPad 2

"8942.uf2" - For iPad mini/iPod Touch 5

"8945.uf2" - For iPad 3/Apple TV

After which, plug your device into power/your computer and enter DFU mode.

You will then need to connect everything up with the Adapter:

-Pi connects to the male Micro USB port

-Standard Micro USB cable connects to female Micro USB port for power

-iPhone connects to the female USB-A port

You will see the LED on the Pi flash rapidly. You will know it has succeeded in pwning when the LED stays on and flashes consistently without a pattern.

If the LED starts flashing rapidly and then erratically, the iPhone is in a half-pwned state and you will need to reenter DFU mode to retry.

Once successful, go into Legacy iOS Kit and go to Useful Utilities -> SSH Ramdisk.

Once you arrive at the SSH Ramdisk menu, select "Connect to SSH". Then once you're at the iPhone's prompt, execute "mount.sh".

Then, run cd /mnt1/Applications.

After changing to the Applications folder, run rm -rf ./Setup.app/. After which, run reboot_bak.

If done right, your device should boot straight to the home screen.