gitwtfhub

wtf is ich_a12_plus_ramdisk?

pa7r0n/ich_a12_plus_ramdisk — explained in plain English

Analysis updated 2026-05-18

46PythonAudience · researcherComplexity · 5/5LicenseSetup · hard

TL;DR

ICH_A12+ Ramdisk is a research tool that boots an SSH-accessible ramdisk on A12/A13 iPhones and iPads already in a pwned DFU state, for inspecting the device you own.

Mindmap

mindmap
  root((ramdisk tool))
    What it does
      SSH ramdisk boot
      Pwned DFU entry
      Partition mounting
    Tech stack
      Python
      Bash scripts
      SSH
    Use cases
      Security research
      System inspection
      Kernel patch testing
    Limits
      Data partition on iOS 17+
      Own-device use only

Code map

Detail Auto

An interactive map of this repo's files and how they connect — its source is parsed live in your browser. Click Visualize to build it.

filefunction / class

Why would anyone build with this?

REASON 1

Boot a research SSH ramdisk on an A12 or A13 device already in pwned DFU mode.

REASON 2

Mount and inspect a device's system, preboot, and xART partitions for security research.

REASON 3

Choose between a patched or stock kernel when booting the ramdisk.

REASON 4

Build a boot image for a specific signed iOS version listed by the tool.

What's in the stack?

PythonBashSSH

How it stacks up

pa7r0n/ich_a12_plus_ramdiskagricidaniel/goghbetta-tech/harness-sdd
Stars464646
LanguagePythonPythonPython
Setup difficultyhardmoderateeasy
Complexity5/53/52/5
Audienceresearcherdeveloperdeveloper

Figures from each repo's GitHub metadata at analysis time.

How do you spin it up?

Difficulty · hard Time to first run · 1h+

Requires a device already in pwned DFU via usbliter8 and RP2350 hardware, plus a Mac with the right USB cable.

MIT license: free to use and modify, but upstream tool licenses this depends on also apply.

Wtf does this do

ICH_A12+ Ramdisk is a research tool that sets up an SSH-accessible ramdisk on iPhone and iPad models using Apple's A12 or A13 chip, after the device has already been put into a special exploited DFU (Device Firmware Update) mode using a separate tool called usbliter8. The README is explicit that this is not a jailbreak, and is intended only for research on devices you personally own. Once a device is in the required pwned DFU state and connected to a Mac by USB cable, this project's scripts handle the rest of the process automatically: checking the connection, building a customized boot image for the specific iOS version installed, sending it to the device, and finally opening an SSH connection into the device using a default password. From there, a user can mount the device's system, preboot, and other internal partitions to inspect them, though the project notes that fully mounting the main user data partition is not solved on iOS 17 and newer due to additional Apple security protections. The tool supports a range of iOS versions and lets the user choose between a patched kernel, which relaxes some Apple security checks for research purposes, or the stock unmodified kernel. It also includes flags to skip certain firmware steps or change boot behavior. The project is built on top of other open-source tools in this space, including usbliter8 and several patch-finding utilities credited in the README, and is released under the MIT license.

Yoink these prompts

Prompt 1
Explain the boot chain that ICH_A12+ Ramdisk uses to reach an SSH shell on an A12 device.
Prompt 2
What's the difference between the patched kernel and stock kernel options in this tool?
Prompt 3
Walk me through setting up ICH_A12+ Ramdisk after usbliter8 has put my device in pwned DFU.
Prompt 4
Why does mounting the Data partition not work on iOS 17 and newer with this tool?

Frequently asked questions

wtf is ich_a12_plus_ramdisk?

ICH_A12+ Ramdisk is a research tool that boots an SSH-accessible ramdisk on A12/A13 iPhones and iPads already in a pwned DFU state, for inspecting the device you own.

What language is ich_a12_plus_ramdisk written in?

Mainly Python. The stack also includes Python, Bash, SSH.

What license does ich_a12_plus_ramdisk use?

MIT license: free to use and modify, but upstream tool licenses this depends on also apply.

How hard is ich_a12_plus_ramdisk to set up?

Setup difficulty is rated hard, with roughly 1h+ to a first successful run.

Who is ich_a12_plus_ramdisk for?

Mainly researcher.

View the repo → Decode another repo

This repo across BitVibe Labs

Don't trust strangers blindly. Verify against the repo.