How to Build SSH Ramdisk for iOS BootROM Exploits

When working with iOS BootROM exploits such as checkm8 or usbliter8, one of the most useful next steps after achieving code execution is getting an interactive environment on the device. An SSH ramdisk is the usual answer.

Instead of booting the full iOS system, you boot a temporary in-memory filesystem that you control. That gives you a root shell, avoids normal sandbox restrictions, and lets you mount the real NAND storage so you can prepare a jailbreak environment such as /var/jb.

For modern iOS versions, building a ramdisk entirely from scratch is usually unrealistic because of dependencies on the DYLD shared cache and proprietary components. In practice, the common approach is to extract Apple’s official Restore Ramdisk from an IPSW, inject your own binaries, and redirect the startup flow to launch SSH instead.

This guide walks through that process on macOS.

Prerequisites

Before starting, make sure you have the following:

1. A macOS environment
2. pyimg4 for working with Image4 and im4p payloads
3. An IPSW file for your target device and iOS version
4. A binpack archive such as ssh.tar.gz containing static ARM64 tools like dropbear and bash

Step 1: Locate the Restore Ramdisk in the IPSW

After downloading the IPSW, rename it to .zip and extract it. Inside the extracted directory, you should find BuildManifest.plist.

That file tells you which Restore Ramdisk belongs to your target device. A small Python snippet is enough to locate it:

import plistlib
 
with open("BuildManifest.plist", "rb") as f:
    plist = plistlib.load(f)
 
# Assuming Identity 0 is the "Erase" install variant
manifest = plist["BuildIdentities"][0]["Manifest"]
ramdisk_path = manifest["RestoreRamDisk"]["Info"]["Path"]
print(f"Target Ramdisk: {ramdisk_path}")

Example output:

Target Ramdisk: 094-32147-023.dmg

Step 2: Extract the Image4 Payload

The ramdisk file inside the IPSW is wrapped in an Image4 container. You need to extract the raw DMG payload before you can modify it.

# Verify that the payload is not encrypted
pyimg4 im4p info -i 094-32147-023.dmg
 
# Extract the raw DMG
pyimg4 im4p extract -i 094-32147-023.dmg -o ramdisk_raw.dmg

If pyimg4 im4p info reports Encrypted: True, you will need the correct decryption material for that iOS version before you can continue.

Step 3: Expand the Ramdisk Safely

Apple’s Restore Ramdisks are usually packed tightly, with almost no free space for additional binaries. You should not just resize the original image in place. A safer method is to rebuild it into a fresh, larger DMG and copy the contents across.

This avoids APFS inconsistencies that can later cause a kernel panic during boot.

# Create a mount point
mkdir SSHRD
 
# Mount the original raw DMG
sudo hdiutil attach -mountpoint SSHRD ramdisk_raw.dmg -owners off
 
# Create a larger image by copying the mounted content
sudo hdiutil create -size 254m -imagekey diskimage-class=CRawDiskImage -format UDZO -fs APFS -layout NONE -srcfolder SSHRD -copyuid root ramdisk_expanded.dmg
 
# Detach the original image
sudo hdiutil detach -force SSHRD

Step 4: Inject the Binpack

Now mount the expanded image and extract your SSH tool archive into it:

# Mount the expanded DMG
sudo hdiutil attach -mountpoint SSHRD ramdisk_expanded.dmg -owners off
 
# Extract the binpack
sudo gtar -x --no-overwrite-dir -f ssh.tar.gz -C SSHRD/

Using GNU tar here helps preserve permissions and avoids clobbering existing directories unexpectedly.

Step 5: Hijack the Startup Process

On a normal Restore Ramdisk, the boot process eventually launches /usr/local/bin/restored_external. That program is meant to drive the restore process and flash the device.

For an SSH ramdisk, you want a different outcome: keep the device alive, start dropbear, and prevent the restore flow from taking over.

One practical way to do that is:

1. Rename the original restored_external
2. Replace it with your own shell script

# Back up the original restore daemon
sudo mv SSHRD/usr/local/bin/restored_external SSHRD/usr/local/bin/restored_external.bak
 
# Install a replacement startup script
sudo bash -c 'cat > SSHRD/usr/local/bin/restored_external <<EOF
#!/bin/sh
echo "Hello from SSH Ramdisk!" > /dev/console
 
# Start Dropbear on port 22
/usr/local/bin/dropbear -R -E -p 22
 
# Stay alive so the ramdisk does not immediately reboot
while true; do sleep 1; done
EOF'
 
# Make it executable
sudo chmod +x SSHRD/usr/local/bin/restored_external

Step 6: Repackage the Ramdisk

Once the filesystem is ready, detach the DMG and wrap it back into an im4p container so that iBoot and iBEC will accept it.

# Unmount the DMG
sudo hdiutil detach -force SSHRD
 
# Wrap it back into an Image4 payload
pyimg4 im4p create -i ramdisk_expanded.dmg -o ramdisk_patched.im4p -f rdsk -d "SSH Ramdisk"

Step 7: Boot the SSH Ramdisk

Assuming you have already sent patched iBSS and iBEC with irecovery, you can now send the ramdisk and boot it:

# Send the ramdisk
irecovery -f ramdisk_patched.im4p
irecovery -c "ramdisk"
 
# Send the patched kernelcache
irecovery -f kernel_patched.im4p
 
# Boot from the memory disk
irecovery -c "setenv boot-args rd=md0 debug=0x2014e -v"
irecovery -c "bootx"

After the device comes up, forward the USB connection and SSH into it:

iproxy 2222:22
ssh -p 2222 root@localhost

If your binpack uses the default setup, the password is often:

alpine

At that point you should have a root shell inside the ramdisk environment, which is enough to start mounting storage and preparing a rootless jailbreak layout.

Conclusion

An SSH ramdisk is one of the most practical building blocks in BootROM-based iOS research. It gives you a controlled userland environment early in the boot chain, without needing the full OS to come up cleanly.

The high-level workflow is straightforward:

1. Extract the official Restore Ramdisk from the IPSW
2. Rebuild it into a larger image
3. Inject an SSH binpack
4. Replace the default startup path
5. Repackage and boot it

Once that flow is working reliably, it becomes much easier to automate later steps such as mounting NAND partitions and preparing a jailbreak bootstrap.