Field Notes

entity

checkm8

StatusStableUpdatedStands on9 sourcesSupportsnotes

checkm8 (read “checkmate”) is a permanent bootrom exploit for Apple devices built on A5 through A11 SoCs — in iPhones, everything from the 4S through the X. The independent iOS researcher axi0mX released it for free on 27 September 2019 inside the open-source ipwndfu jailbreaking tool, calling it “a permanent unpatchable bootrom exploit for hundreds of millions of iOS devices” and releasing it “for the benefit of iOS jailbreak and security research community.”1 2 It was the first publicly released bootrom exploit for then-current Apple devices since limera1n in 2010, and at release more than 80% of iPhones in use were vulnerable by one mobile-security vendor’s installed-base count.3 4 Apple retroactively assigned it CVE-2019-8900 in February 2025.5

The vulnerability and the exploit

The SecureROM (bootrom) is the first code an Apple device runs and the root of the secure boot chain: it is mask-programmed read-only memory, so every device ships with the same bootrom for life and no software update can change it. checkm8 exploits a use-after-free in the SecureROM’s USB DFU handling, combined with a heap-leak primitive that lets the attacker groom the bootrom heap so the freed IO buffer is not reallocated over. Triggering the pair overwrites the callback and next pointers of a USB request structure, which delivers code execution in the SecureROM context; the payload then patches the image-signature check, allowing unsigned or patched boot images to run.6 7

Exploitation has hard preconditions: physical possession of the device, entry into DFU mode via a hardware button sequence, and a USB connection to a host computer. It cannot be triggered remotely or from the running operating system, and axi0mX described its reliability as imperfect — it “uses a race condition” and may need several attempts.2 7 The exploit is also not persistent: it lives only in memory, and a reboot returns the device to its unexploited state.2

What bootrom code execution buys is control of the whole boot: dumping the SecureROM, decrypting iOS firmware keybags with the device’s AES engine, demoting the device to enable JTAG, and booting custom kernels or ramdisks — the primitive on which jailbreaks, research tooling, and forensic extraction all build.1

flowchart TD
  USB["USB cable + DFU mode"] --> ROM["SecureROM: checkm8 code execution"]
  ROM --> IMG["unsigned or patched boot images: custom kernel or ramdisk"]
  IMG --> OUT["file-system dump, keybag decrypt, SecureROM dump, JTAG"]
  SEP["Secure Enclave"] -.->|"passcode still gates data-class keys"| OUT

Device coverage and the A12 boundary

Vulnerable hardware spans the A5–A11 generations: iPhone 4S through iPhone X, iPads from the iPad 2 through the 7th generation, iPod touch 5th–7th generation, Apple Watch Series 1–3, Apple TV HD and Apple TV 4K (1st generation), the original HomePod, and the T2 security chip in Intel Macs.7 8

The iPhone XS, XS Max, and XR — the A12 generation, released September–October 2018 — and every later device are not exploitable. Trail of Bits’ launch-day assessment listed exactly those models as safe, and axi0mX confirmed he could not make the exploit work on them.9 2 Two refinements matter for how this boundary is usually stated:

  • The fix predates the public exploit. A12 silicon shipped a year before axi0mX’s release. axi0mX found the bug in the first place by analyzing a patch Apple shipped in an iOS 12 beta in summer 2018, which fixed the same use-after-free in iBoot, the second-stage loader.2
  • Apple patched the exploit’s helper, not the bug. Independent reverse engineering found that the A12 SecureROM still contains the use-after-free (which reportedly survived in silicon until the A14 generation), but Apple closed the heap-leak primitive that makes it exploitable; without the leak, the freed buffer is simply reallocated over and the attack collapses.6 8

For the devices already shipped, no fix was ever possible: the vulnerable code is read-only, which is why “permanent” and “unpatchable” were accurate descriptions rather than marketing.9

Apple later narrowed the A11 case further from the SEP side. On iPhone 8, 8 Plus, and X, jailbreaks from iOS 14 onward require the passcode to be removed, and on iOS 16 the device must not have had a passcode set since its last erase; palera1n’s documentation spells out the constraint, and Elcomsoft attributes it to an Apple SEP patch specifically “developed to curb bootloader-based extractions,” recommending checkm8 extraction for A11 iPhones only on iOS 11 through 13.11 12 The SecureROM itself was never patched — Apple could not do that — but the SEP countermeasure reduces what a tampered boot yields on exactly the newest vulnerable phones.

Use in the jailbreaking community

checkm8 has been the foundation of every jailbreak for A9–A11 iPhones since its release:

  • checkra1n (first beta November 2019) is a community semi-tethered jailbreak explicitly “based on the ‘checkm8’ bootrom exploit,” covering iPhone 5s through X on iOS 12–14.10
  • palera1n (2022 onward) carries the line to iOS and iPadOS 15 through 18 plus tvOS and bridgeOS, on A8–A11 devices and T2 Macs, with rootful and rootless modes and active releases through 2024 and later.11

Both are semi-tethered because checkm8 itself is non-persistent: the device must be re-exploited over USB after every reboot. The same primitive also supports the SSH-ramdisk ecosystem used for device repair, downgrade research, and data recovery on vulnerable hardware.

Use in security research

Project Sandcastle (Corellium, March 2020) booted Android on the iPhone 7 and 7 Plus, crediting “the PongoOS team and axi0mx”; the port ran on the checkra1n/checkm8 boot path and was framed by its authors as forensics research and e-waste reduction as much as a novelty.13 More broadly, the ability to dump the SecureROM, decrypt firmware keybags, and boot arbitrary code made the boot chain and the T2/bridgeOS stack auditable by outside researchers for the first time in years — the reason axi0mX gave for releasing the exploit for free.2 11

Use in forensics

Commercial forensic vendors adopted the public exploit within months:

  • Cellebrite integrated checkm8 in UFED 7.28 (January 2020), marketed as a “first-to market solution” performing “a forensically sound temporary jailbreak” and full file system extraction, including keychain, on unlocked or known-passcode devices, with a partial BFU dump for locked devices whose passcode is unknown.14 15 The integration is still maintained: UFED 7.65 (May 2023) extended checkm8 extraction to iOS 15.7.3 on iPhone 7, 8, and X.16
  • MSAB shipped checkm8-based extraction in XRY 9.0.1 (April 2020).17
  • Elcomsoft built its “bootloader-level extraction” line on checkm8 for A5-and-later devices (with limera1n, SHAtter, steaks4uce, and Pwnage 2.0 covering older hardware) and continues to update it, adding the newest iOS and iPadOS point releases on vulnerable devices as late as April 2026.12
  • Oxygen Forensic Detective lists checkm8-based full file system extraction spanning iOS 12.4 through current iPadOS 18 releases on supported hardware.18

The direction of reuse is the reverse of the usual “Cellebrite exploit leaked” story: the jailbreak community published the exploit for free, and the vendors productized it. That said, the capability class predates the public exploit. Grayshift's GrayKey was unlocking iPhone X on iOS 11 for law-enforcement customers in early 2018 — a private capability that Apple’s iOS 12 broke later that year — and Malwarebytes noted at checkm8’s release that the bug “could already be in secret use” by forensics companies, which remains speculation rather than evidence.19 20 21 What checkm8 changed was not the existence of boot-level extraction but its price and permanence: a capability that had been a trade secret became a free, unpatchable public primitive.

  1. axi0mX/ipwndfu, GitHub. The README describes checkm8 as a “permanent unpatchable bootrom exploit,” lists its SecureROM dump, keybag decryption, and JTAG demotion capabilities, and warns it “is not reliable” on every attempt. ↩↩

  2. Ars Technica on checkm8 (Dan Goodin’s interview with axi0mX, Ars Technica, 28 September 2019); saved copy. ↩↩↩↩↩↩

  3. Checkm8 Exploit Opens Door to Unpatchable Jailbreak on iPhone 4S Through iPhone X, MacRumors, 27 September 2019. ↩

  4. checkm8 iOS vulnerability, Lookout threat intelligence, 30 September 2019. The >80% figure is derived from Lookout’s own installed base. ↩

  5. CVE-2019-8900, NVD, published 21 February 2025 with Apple as the assigning source. Apple’s own description confirms the DFU-plus-USB preconditions, the non-persistence, and that Secure Enclave-protected information remains inaccessible without the passcode. ↩

  6. checkm8 BootROM exploit write-up (Alfie CG, 21 July 2023); saved copy. Source for the two-bug mechanism and for the claim that the use-after-free itself was patched only in the A14 generation. ↩↩

  7. Zimperium Analysis of checkm8, Zimperium, 3 October 2019. Vendor analysis; the 32-bit brute-force observation is at “What devices are affected?”. ↩↩↩↩

  8. checkm8 Exploit, The Apple Wiki. Community-maintained; used here for SoC-level device coverage (S1P–S3, T2) and the leak-patch mechanics, which agree with the Alfie CG analysis. ↩↩

  9. Tethered jailbreaks are back, Trail of Bits, 27 September 2019. ↩↩

  10. checkra1n, official site and FAQ. The FAQ describes the project as “based on the ‘checkm8’ bootrom exploit,” documents the A11 passcode-removal requirement, and answers “No” to whether checkra1n can decrypt data or access a locked device without the passcode. ↩↩

  11. palera1n and the palera1n documentation. The man page describes iOS/iPadOS/tvOS 15+ jailbreaking “utilizing the checkm8 bootROM exploit” and details the A11 passcode constraints; v2.0 (July 2024) added iPadOS 17.6/18, tvOS, and T2 support. ↩↩↩

  12. Elcomsoft on low-level iOS extraction (Oleg Afonin, Elcomsoft blog, 14 April 2026); saved copy. Vendor practitioner source for the A11 SEP countermeasure and the current maintenance state of checkm8 extraction. ↩↩

  13. Project Sandcastle and “Project Sandcastle” brings Android to the iPhone, Ars Technica, 5 March 2020. ↩

  14. Cellebrite on checkm8 full file system extraction (Cellebrite product announcement for UFED 7.28, January 2020); saved copy, captured from the Wayback Machine after the live page stopped serving. ↩

  15. Cellebrite’s Checkm8, CDFS, 11 March 2020. Independent reseller walkthrough with the UFED 7.28 device-and-iOS support table (iPhone 5s through X) and the note that locked devices with an unknown passcode should be escalated to Cellebrite. ↩

  16. Cellebrite UFED & Responder v7.65 Now Available, Cellebrite, May 2023. ↩

  17. Checkm8 exploit is now integrated in XRY 9.0.1, MSAB, 22 April 2020. ↩

  18. Supported Device Extraction in Oxygen Forensic Detective, Oxygen Forensics, February 2025, and the OFD v18.0 release notes. ↩

  19. Cops Around the Country Can Now Unlock iPhones, Records Show, Motherboard (Vice), 12 April 2018. ↩

  20. Apple Just Killed The ‘GrayKey’ iPhone Passcode Hack, Forbes, 24 October 2018. ↩

  21. New iOS exploit checkm8 allows permanent compromise of iPhones, Malwarebytes Labs, 26 September 2019. The “secret use” remark is flagged as speculation in the article itself. ↩

Built on 9 sources (9 external).

Working out connections…