@forcequitOS

I make stuff, sometimes iOS jailbreak related. Follow along for updates...

 /usr/libexec/
forcequit.cc
Joined February 2022
  • Tweets257
  • Following69
  • Followers1.1K
13Media
Introducing bad_query, a zero-day sandbox escape PoC for iOS 26 and 27. This bug has been patched earlier today in iOS 27.0 beta 5, but not 26.6.1. Be careful out there, and use this for good. Coordinated release with @0xjohnny and @rooootdev :p github.com/forcequitOS/bad_q…

GitHub - forcequitOS/bad_query: Sandbox escape PoC for iOS 26 and 27.

Sandbox escape PoC for iOS 26 and 27. Contribute to forcequitOS/bad_query development by creating an account on GitHub.

github.com
31
98
1
591
78,018
forcequit retweeted
Mineek@mineekdevOct 18
Hey @discord @discord_support my discord account got violations for "child safety" however the content I posted is just not a violation at all. Let's not let AI make management decisions for our accounts? Can I please speak to a human and resolve this.
16
6
52
6,754
If you’re on any iOS 27.x beta: please restore to 26.6.1 RC (heavily preferred since it has DelayOTA) or 27.0.1. If you’re on an iPhone 18 Pro (Max): install 27.0.1, it patches some important issues for usability If you’re on any other stable iOS release: *STAY WHERE YOU ARE!*
238
44
5
607
122,120
Rest in peace to maybe the most insane bug ever. This was bound to happen… I barely did anything with it, so I don’t have much to show unfortunately LOL
13
14
654
46,365
RIP to the 2nd sandbox escape for iOS 27.x 🙃
johnny
@0xjohnnyOct 5
Heads up: Apple patched my iOS sandbox escape, Airlift, in iOS 27.2 beta 3. Confusingly, as of now, Airlift works on 27.0, 27.0.1, 27.2b1, and 27.2b2. I'm assuming 27.1 public will have it patched as well. Remember, there are always more bugs...
2
3
95
13,318
15 Pro → 18 Pro
17
2,154
forcequit retweeted
johnny
@0xjohnnySep 14
To celebrate iOS 27’s release, why not release a sandbox escape? Announcing airlift: a PoC abusing a media sync path for out-of-scope access across much of /var/mobile via macOS↔iOS pairing. No MobileGestalt edits yet; looking into it. github.com/0xjohnnydev/airli…

GitHub - 0xjohnnydev/airlift: AirLift — paired-Mac AirTraffic/ATAirlock sandbox escape for iOS 27.0

AirLift — paired-Mac AirTraffic/ATAirlock sandbox escape for iOS 27.0 - 0xjohnnydev/airlift

github.com
8
127
9
957
87,719
And so 30 days later, iOS 26.7 RC has patched bad_query!
4
63
6,016
You’ve gotta be kidding me.
3
63
7,808
iOS 26.6.2 does not patch bad_query and it’s been public for almost a month. Apple, what are we doing? Thanks @0xjohnny for diffing 26.6.2 in under an hour 🤝
2
11
2,327
I managed to pull off dylib embedding in Swift Playgrounds. This requires a sandbox escape (like bad_query), or maybe backup modification. Here's a demo of some App Store apps running in Playgrounds. (Enchanted LLM, Glimpse 2, Web Archive Inspector)
7
1
47
4,763
I kinda did the bare minimum for this "budget LiveContainer" demo which is why I'm only demoing simple apps with no launch screens/localization/resources (and why I'm not releasing this yet). Better app support is possible though, I'll probably work on that in the future.
6
1,160
The Polishing Cloth (2026) is a disappointment to say the least. While it is a good cloth still, it simply does not match the quality of its predecessor. At least it’s half the price.
4
16
1,821
Worth it.
forcequit@forcequitOSAug 29
A story in three pictures.
4
1
15
3,440
A story in three pictures.
4
2
1
237
15,367
So 26.6.1's final release has a new build number... ...but Apple didn't patch bad_query, so there's a zero-day sandbox escape in an iOS version that released today, a week after I published bad_query and they patched it in 27.0 beta 5.
3
13
141
14,552
Probably 26.6.1 stable and maybe 27.0 beta 6 coming out on Monday? 26.6.1 stable I assume will have a different build number, and should (hopefully) patch bad_query and the other sandbox escapes
5
3
48
7,768
Long shot, but I’ll try anyways. Does anyone have an Apple Watch running watchOS 27 beta 1-4? If so, please reply with your Apple Watch model if you have a Mac and would be willing to get me a MobileGestalt cache dump from your watch for research, thank you!
6
2
35
6,288
If this can be figured out, the potential for cool MobileGestalt tweaks on watchOS (27.0b1-b4) might be possible, including faces from other models...? For those interested in contributing, see here: github.com/forcequitOS/watch…

GitHub - forcequitOS/watchos_survey: Please help me, or don't.

Please help me, or don't. Contribute to forcequitOS/watchos_survey development by creating an account on GitHub.

github.com
1
1
3
1,553
forcequit retweeted
roooot@rooootdevAug 11
hi, I was planning to hold off on releasing this but as iOS 27 beta 5 unexpectedly patched the sbx escape im releasing the app now. mond is a simple mobilegestalt editor that currently supports iOS 27 and 26 (YMMV) and utilizes the cmg/bad_query exploit. github.com/rooootdev/mond

GitHub - rooootdev/mond: Edit MobileGestalt on iOS 27.0 beta 1 - 4!

Edit MobileGestalt on iOS 27.0 beta 1 - 4! Contribute to rooootdev/mond development by creating an account on GitHub.

github.com
102
90
4
588
103,468
forcequit retweeted
johnny
@0xjohnnyAug 11
Apple pulled a Red Wedding on my sandbox escape and MobileGestalt bugs in iOS 27 beta 5, likely thanks to Mythos. So I’m releasing the PoCs now. Coordinated release with @rooootdev and @forcequit. 0xjohnnydev.github.io/blog/i…

The iOS 27 Beta 5 Red Wedding

Four sandbox escape and MobileGestalt PoCs, their paths, and what survived iOS 27 beta 5.

jftechllc.com
19
29
3
232
52,697
Load more