Uploaded November 2015 | Updated September 2026, 5 hours ago
IMPORTANT!!! Please note that this video is for educational purpose only. By watching this video, you agree that I'm not responsible of what might happen with the use of informations provided.
Please note that this video is a demonstration, not really a tutorial. Set up a dual-boot like this one can take few hours, depending on many technological factors. Maybe a day I will release a complete tutorial about how to do it.
Also, because of the way about how Apple implements security on iOS devices, this kind of multi-booting is really not the same thing than on any other desktop computers, laptops, even not like ones we can do on some Android devices. Main issues of iOS multi-booting are the Secure Bootchains on regular (flashed) boot, DFU boot and even the Baseband. Using kloader, we can "simulate" a new regular or DFU bootchain. This partially solve that part of the problem, but kloader stills need a jailbroken main filesystem to host itself and be able to run. Because we usually work with DFU bootchain when doing kloader bootstraps, this means tethered. DFU bootloaders usually wait for executable ARM images on USB connection. That's a good thing, this is like booting a computer from an USB stick when hard drive OS can't boot. It could be possible to untether those kloader bootstraps, but it requires years of high ARM assembly and Reverse Engineering knowledge. The other part of issues is the Baseband, found on iPhones and cellular iPads. The Baseband has its own bootchain, with its own bootloaders. Kloader can't, unfortunately, do Baseband bootstraps. This means that the Baseband won't work on other iOS versions than the main one. So, phone calls, cellular internet and everything related to the Baseband won't work.
In this video, I'm doing a kloader bootstrap from a signed iOS 6.1.3 file system to an unsigned iOS 6.0 one. The method used to chainload iOS 6.0 is almost the same than the one used in this video youtube.com/watch?v=hyDGOfM0Aqk but I added rd=disk0s1s3 in iBEC's boot-args string. This tells the kernel to search for launchd in that root device.
iOS Multi-Booting status list :
A4 SecureROM and less, Multi-Booting 5.x and newer, with 4.x and lower using DFU Limera1n exploit [FAILED]
A4 SecureROM and less, Multi-Booting similar iOS versions (like 5.x and 6.x) using DFU Limera1n exploit [PASS]
iPhone 4 (N90AP), Multi-Booting iOS 7.x with lower using DFU Limera1n exploit [FAILED]
A5 SecureROM and up (32-bits), Multi-Booting really similar iOS versions (6.1.3 and 6.0) using kloader bootstrap method [PASS]
A5 SecureROM and up (32-bits), Multi-Booting 6.1.3 with 5.x using kloader bootstrap method [CURRENTLY WORKING ON]
A5 SecureROM and up (32-bits), Multi-Booting 6.1.3 with 7.x and newer using kloader bootstrap method [FAILED]
A5 SecureROM and up (32-bits), Multi-Booting 9.x with 7.x using kloader bootstrap method [FAILED]
As you can see, iOS 6.0 is really stable except the baseband which isn't even loaded, because of the reason I tell above. Switching from 6.1.3 to 6.0 is relatively fast when bootchain files are ready. Switching from 6.0 to 6.1.3 is fully untethered.
One thing I can say, Swing Copters as well as many other AppStore apps works perfectly! Also, this kind of dual boot can be do to have a jailbroken, full of tweaks iOS 6.1.3 and a clean iOS 6.0 set up.
Special thanks to @blackgeektuto for Beehind downgrade and @xerub for the Odysseus Method, used in Beehind. This saved me lot of time, because I had to restore my N94AP to 9.0.2 and downgrade it back to 6.1.3 multiple times. Also, a special thanks to @dayt0n and @iH8Sn0w for many advices about boot-args and verbose booting.
IMPORTANT!!! Please note that this video is for educational purpose only. By watching this video, you agree that I'm not responsible of what might happen with the use of informations provided.
Please note that this video is a demonstration, not really a tutorial. Set up a dual-boot like this one can take few hours, depending on many technological factors. Maybe a day I will release a complete tutorial about how to do it.
Also, because of the way about how Apple implements security on iOS devices, this kind of multi-booting is really not the same thing than on any other desktop computers, laptops, even not like ones we can do on some Android devices. Main issues of iOS multi-booting are the Secure Bootchains on regular (flashed) boot, DFU boot and even the Baseband. Using kloader, we can "simulate" a new regular or DFU bootchain. This partially solve that part of the problem, but kloader stills need a jailbroken main filesystem to host itself and be able to run. Because we usually work with DFU bootchain when doing kloader bootstraps, this means tethered. DFU bootloaders usually wait for executable ARM images on USB connection. That's a good thing, this is like booting a computer from an USB stick when hard drive OS can't boot. It could be possible to untether those kloader bootstraps, but it requires years of high ARM assembly and Reverse Engineering knowledge. The other part of issues is the Baseband, found on iPhones and cellular iPads. The Baseband has its own bootchain, with its own bootloaders. Kloader can't, unfortunately, do Baseband bootstraps. This means that the Baseband won't work on other iOS versions than the main one. So, phone calls, cellular internet and everything related to the Baseband won't work.
In this video, I'm doing a kloader bootstrap from a signed iOS 6.1.3 file system to an unsigned iOS 6.0 one. The method used to chainload iOS 6.0 is almost the same than the one used in this video youtube.com/watch?v=hyDGOfM0Aqk but I added rd=disk0s1s3 in iBEC's boot-args string. This tells the kernel to search for launchd in that root device.
iOS Multi-Booting status list :
A4 SecureROM and less, Multi-Booting 5.x and newer, with 4.x and lower using DFU Limera1n exploit [FAILED]
A4 SecureROM and less, Multi-Booting similar iOS versions (like 5.x and 6.x) using DFU Limera1n exploit [PASS]
iPhone 4 (N90AP), Multi-Booting iOS 7.x with lower using DFU Limera1n exploit [FAILED]
A5 SecureROM and up (32-bits), Multi-Booting really similar iOS versions (6.1.3 and 6.0) using kloader bootstrap method [PASS]
A5 SecureROM and up (32-bits), Multi-Booting 6.1.3 with 5.x using kloader bootstrap method [CURRENTLY WORKING ON]
A5 SecureROM and up (32-bits), Multi-Booting 6.1.3 with 7.x and newer using kloader bootstrap method [FAILED]
A5 SecureROM and up (32-bits), Multi-Booting 9.x with 7.x using kloader bootstrap method [FAILED]
As you can see, iOS 6.0 is really stable except the baseband which isn't even loaded, because of the reason I tell above. Switching from 6.1.3 to 6.0 is relatively fast when bootchain files are ready. Switching from 6.0 to 6.1.3 is fully untethered.
One thing I can say, Swing Copters as well as many other AppStore apps works perfectly! Also, this kind of dual boot can be do to have a jailbroken, full of tweaks iOS 6.1.3 and a clean iOS 6.0 set up.
Special thanks to @blackgeektuto for Beehind downgrade and @xerub for the Odysseus Method, used in Beehind. This saved me lot of time, because I had to restore my N94AP to 9.0.2 and downgrade it back to 6.1.3 multiple times. Also, a special thanks to @dayt0n and @iH8Sn0w for many advices about boot-args and verbose booting.
