iBSSloader

Research and tooling to boot Linux on iPad mini 1 (P105AP / iPad2,5, Apple A5) via checkm8, patched iBSS/iBEC, and custom bare-metal payloads — without writing to the iOS install.

This repo combines:

• Device tree port — Apple ADT → Linux DTS/DTB for P105AP
• Kernel build — ARMv7 zImage + platform patches
• iBSS/iBEC chain — primepwn, autogo EOF loader, staging bundles
• Bare-metal probes — framebuffer, GPIO, PMGR, multitouch (Z2 SPI), memory maps
• Linux boot paths — ACE staging-bundle and Legacy-iOS-Kit bootx

Critical addresses: see docs/ADDRESSES.md.

Target: iPad2,5, board P105AP, SoC S5L8942X (dual Cortex-A9, 512 MiB).

Quick start

make all              # ADT → JSON → DTS → DTB, validate
make kernel           # cross-compile armhf zImage
bash scripts/build-ibec.sh   # patched iBSS/iBEC (needs IPSW)
bash scripts/deploy-flashdrive.sh

Boot Linux (USB host with irecovery)

Copy flashdrive/ to your boot machine, enter pwned DFU, then:

# ACE path (staging-bundle + autogo iBEC)
./scripts/run-linux-ace.sh

# LIK path (ramdisk + bootx; needs Legacy-iOS-Kit saved IPSW)
./scripts/run-linux-lik.sh

Scripts resolve paths from the repo / flashdrive directory — no hardcoded home paths.

Optional remote deploy: copy scripts/laptop.env.example → scripts/laptop.env and set LAPTOP=user@host.

Boot on Windows (checkm8)

1. Build in WSL: bash scripts/build-ram-boot.sh
2. Put gaster at tools/gaster.exe
3. DFU the iPad, close conflicting USB tools
4. powershell -ExecutionPolicy Bypass -File scripts\host-boot-checkm8.ps1

See docs/boot.md for full procedure.

Environment variables

Research docs

Status

Artifacts

License

Research tooling — use at your own risk on hardware you own.