My Journey with the iPad jailbreaking part 1: Dopamine and the terminal

So, I got my dad's old iPad when he got a new one. It was a perfectly functional iPad 7th generation, with an Apple A10 Bionic processor. It was a decently powerful machine, and I didn't want to let it rot back at home, even though I couldn't really take notes on it (no Pencil support). I didn't even have an Apple ID in the beginning. But I took the device with me anyway in the hopes that I could find a use for it. And boy oh boy, did I find some uses after a little bit of effort.

The Dopamine Rush

So on getting it, I went through standard setup. Nothing fancy. No default iCloud. Just whatever it "needed." I got iTunes on Windows and the Bonjour service, and proceeded to fiddle with it. And it was sadly, mind-numbingly boring. I couldn't even access my own filesystem properly. I was just stuck with the default apps, and the App Store. The only terminal emulator I could get was iSH, which is Alpine (my beloved), but it's an x86 interpreter, not an emulator, and it has no JIT functionality. So we were back to square one. But there was one last trick we had to pull. I had to jailbreak the device to get full (mostly) access to the shell. And that's where Dopamine comes in. Dopamine is a jailbreak for iOS 15 and 16, and it's a semi-untethered jailbreak, meaning it doesn't persist on restart, and it's a rootless jailbreak, meaning it doesn't give you full root access to the filesystem, and instead binds to /var/jb/, which is only partial access to the operating system. But it was enough to get me started.

The first step was to get Impactor, a tool that lets you sideload IPA files onto your iOS device using your Apple ID, registering you as a developer. This was pretty seamless, and I was able to use it to get TrollStore onto the device.
IPA files are basically the iOS equivalent of APK files on Android. They're the packaged applications that can be installed on iOS devices (under certain conditions). Importantly, TrollStore lets you install unsigned IPA files, letting me sideload apps that Apple doesn't allow on the App Store.
Finally, through TrollStore, I was able to get access to Dopamine, and from there, it was a matter of waiting as it installed the jailbreak onto my device. After that, I was able to set up Sileo, a package manager based on APT (yes, the same APT that Debian and Ubuntu use) that lets you install packages onto your iOS device. I was able to get the zsh shell from there, and I was finally able to get a proper terminal emulator on my iPad. Using vim on the iPad and having access to LuaJIT was definitely an experience that was puzzling, but interesting.

So about those packages... (Procursus and the Procursus Bootstrap)

So, how do these packages work? Well, most *NIX packages are built for x86_64 or ARM64 architectures, and iOS devices use ARM64. So the packages need to be compiled for the correct architecture, and that's where Procursus comes in — a bootstrap that provides a base system for jailbroken iOS devices, letting you install and run *NIX software on your device, built with Makefiles and the GNU utils, which means it's one of the few bootstraps that are actually POSIX-compliant and cross-platform compatible. That means you can use the same commands and tools on your iOS device as you would on a Linux or macOS system.

So this is the story of how I got my iPad jailbroken, and how I was able to get OpenSSH running on it to connect to my server or my laptop. But I was still limited in what I could do with it. Primarily, there was one thing that I wanted to do with it, and that was to get a proper window manager running on it. And this used to be possible, but since the advent of the rootless jailbreak, direct access to the device is no longer possible, and so something like termux-x11 is no longer possible.

Or is it?

Working title for Part 2: "Trying to get a window manager running on my jailbroken iPad."

PS: I know this post is pretty short, but I wanted to get it out there before I forget the details of how I got it working. Part 2 will be a lot more technical, and will take some time to see if it can be done. But I wanted to get this out there first, so that I can have a record of how I got to this point, and to get back into the habit of writing blog posts again.

PPS: I also want to note that this is not a guide on how to jailbreak your iPad. I am not responsible for any damage that may occur to your device if you attempt to do so. This is just a record of my own journey, and I am not an expert in jailbreaking. I highly recommend using this guide if you want to learn more about jailbreaking.

PPPS: This thing unironically has a lot of potential with compiler toolchains, aircrack-ng, nmap, nginx, arp, and other tools that are perfect for a little reconnaissance. Now, if only this thing had monitor mode and packet injection, I could do some real pentesting with it. But alas, it does not.