Jailbreak Website
Homescreen with CydiaBlog post made on 2025-10-25
Recently I've been tinkering with my brother's old iPhone SE 2016 that's been successfully iCloud-password-forgottened, particularly downgrading it to iOS 9, and it's been a pleasant experience - community tools are amazing, though are a bit complicated at a first glance, and there aren't a lot of resources on it (at least for my case). So, here I am, writing a blog post about it. I should note though, that if your iPhone is not locked to iCloud account you should absolutely use alex-free's a999activator, which does a lot more sophisticated activation algorithm, requiring you to activate on a newer iOS version and then copies the tickets onto iOS 9, which is more reliable and will allow you to sideload kok3shi9 with Sideloadly. It wasn't viable in my case, so here's a little write-up on how to do that manually.
If your device has an iCloud logged in and it isn't yours, you really should first try to contact the original owner and try to get them to unlock it remotely - and if you found it somewhere and don't know the original owner you should really think about doing anything with it before getting it to police or other local government organization that will return it to the original owner. Remember - stealing is against the law in most if not all countries of the world.
I am not responsible for any damage you do to your iPhone. You should at any moment be able to just restore through iTunes, but nevertheless. You take all the risks.
With legal disclaimers out of the way, lets get to downgrading this baby!
First of all, you'll need either a Mac machine with macOS or Linux. No, the VM won't do. No, you don't need to install it. The easiest way for a Windows user to setup that is to take a USB drive (it doesn't have to be big, even 4 GiB is probably fine) and write a Linux distro to it and setup some persistent storage. I wouldn't walk you through it here, but there's countless resources on the internet for that. I use Linux on all of my machines, so it isn't a problem for me. I have to warn you though - if you don't have iOS 9.3.2/3 SHSH blobs, you will need to downgrade tethered - and you will need a Linux machine everytime the iDevice turns off to boot it, so you will need to setup some persistence storage on the USB to not download everything again and again. Let me Google that for you. Also, you will need some Linux terminal knowledge like basic directory hopping, listing, untarring archives, etc.
First of all, we'll need to downgrade to iOS 9.3.2. You can also use 9.3.3, but not higher - as the device is unactivated, we'll be unable to sideload the jailbreak application, so we'll use a Trident based exploit which will run from Safari, and it's been patched out in iOS 9.3.4. I just prefer the second patch version. First of all we'll need to download IPSW firmware file, which can be downloaded from ipsw.me, appledb.dev, etc. I wil use ipsw.me, though that doesn't really matter because they all just link to Apple's servers. You will need to install 10.2.1 first to install 9.3.2, so download both of those. Once the IPSW files are downloaded, you will need to download a tool called turdus merula - it is the thing that allows us to downgrade your A9 and A10 devices. Download the version for your OS. Then open the terminal and do this to create a directory and extract it there:
$ mkdir -p ~/Ware/turdus $ cd ~/Ware/turdus $ cp ~/Downloads/turdus_m3rula_1.1_b0ea3ee7_linux-amd64.tar.gz . $ tar xvf turdus_m3rula_1.1_b0ea3ee7_linux-amd64.tar.gz
Also, we'll need usbmuxd, install it through your's package manager (Debian/Ubuntu: sudo apt install usbmuxd, Arch: sudo pacman -S usbmuxd), and run it in foreground:
$ sudo usbmuxd
Then, you'll want to follow iOS CFW guide's tutorial for tethered downgrade, first install 10.2.1 (only up until Restore section inclusive), then start over but with iOS 9.3.2, BUT don't boot it yet. Follow through the tutorial up until "Getting ptrblock" inclusive and come back here. Next you'll want to download LukeZGD's Legacy-iOS-Kit:
$ cd ~/Ware $ git clone https://github.com/LukeZGD/Legacy-iOS-Kit.git --depth 1 $ cd Legacy-iOS-Kit $ ./restore.sh # run once to bootstrap it $ ./restore.sh # run second time to actually run it
You'll want to select Useful Utilities >> SSH Ramdisk. Follow instructions to enter DFU, and then select SSH shell and run these commands:
# mount_hfs /dev/disk0s1s1 /mnt1 # mount the root partition # mv /mnt1/Applications/Setup.app /mnt1/Applications/Setup.bak # exit
And then select "Install bootstrap (iOS 7/8/9)", select Yes and wait for the process to end. Then select "Reboot device", and continue to the turdus merula tutorial (the last "Booting" section). After that you should be booted into iOS right at the "swipe to unlock" screen. Important: don't forget to save the <NUMBERS>-iPhone-8,4-current-pteblock2.bin somewhere - Google Drive, catbox.moe, Telegram Private Messages, etc. Even if you are sure about that you configured persistence right, and even if you did - better safe than sorry. You just wouldn't be able to turn on your iPhone without it, and will be forced to reinstall the system.
Next up you'll want to connect to Wi-Fi on your just-downgraded device, open Safari and go to jbme.ddw.nu (in case it ever goes down, I have a mirror on my GitHub Pages: thisisignitedoreo.github.io/jbme64-9.3.3). Click "go", wait for the "All set" popup, click "close" and lock the screen. It will unlock the screen itself, if not try again. Now you'll be able to open Cydia on the lockscreen.
Jailbreak WebsiteHomescreen with CydiaI recommend adding https://lukezgd.github.io/repo and installing "AppSync Unified" (LukeZGD Repo) for installing unsigned and ad-hoc signed applications from iOS IPA archives, including old games, "Apple File Conduit "2"" (BigBoss) for filesystem access from PC, and "Filza File Manager" (BigBoss) for managing files on the device, and activate the system by opening /private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist in Filza, opening root and adding key a6vjPkzcRjrsXmniFsm0dg inside dictionary CacheExtra, of type Boolean, value YES. That is all you will need for a simple old game player. <halfjoke>Next you'll want to install the best iOS 9 wallpaper - dark purple roses</halfjoke> and enjoy the system - install old tweaks, games and applications.
