Alfie (@alfiecg

Alfie

271 posts

Alfie

@alfiecg_dev

19 • Popping iOS @ Cellebrite

EL2

Joined August 2022

Pinned
Alfie
@alfiecg_dev
Aug 8, 2025
I’m thrilled to announce that I will be joining @CellebriteLabs next month, kickstarting my career as a full-time iOS researcher. I hope to wrap up some final projects and release them in the coming weeks, but most of my public work will stop after this - it’s been a blast! 🚀💯
55K
Alfie
@alfiecg_dev
Oct 3, 2024
My iOS 14 jailbreak for arm64 devices that uses a custom kernel exploit, full physical R/W, trustcache injection and now persistence. Tweaks are loaded at boot, which is super cool!
00:00
185K
Alfie
@alfiecg_dev
Sep 24, 2024
I've published a new blog post detailing how to write an iOS kernel exploit for PhysPuppet from scratch. Enjoy!
alfiecg.uk
A step-by-step guide to writing an iOS kernel exploit
Introduction Memory management in XNU Page tables Physical use-after-free Exploitation strategy Heap spray Kernel memory read/write Conclusion Bonus: arm64e, PPL and SPTM
74K
Alfie
@alfiecg_dev
Mar 1, 2025
I've just published a new blog post detailing how I developed a deterministic kernel exploit for iOS. Enjoy!
alfiecg.uk
Trigon: developing a deterministic kernel exploit for iOS (part 1)
Background Vulnerability Experimentation Arbitrary physical mapping Dynamically finding our mapping base Finding the kernel base A10(X) A11 Non-KTRR devices Virtual kernel read/write Page table panic...
149K
Alfie
@alfiecg_dev
Oct 24, 2024
Successful untethered downgrade from iOS 17.5.1 to iOS 14.3 with Blackbird. Great work by @dora2ios, @mineekdev and @imnotclarity!
82K
Alfie
@alfiecg_dev
Sep 2, 2024
TrollStore for iOS 17.0 is finally here! TrollRestore allows you to install TrollStore on iOS/iPadOS 15.0 - 16.7 RC and 17.0. It is developed by JJTech and @dedbeddedbed and it is 100% reliable.
GitHub - JJTech0130/TrollRestore: TrollStore installer for iOS 17.0
From github.com
168K
Alfie
@alfiecg_dev
Jan 22, 2025
Full kernel read/write with CVE-2023-32434 using a deterministic exploit strategy (100% success rate)! arm64e is certainly not as easy, but for now all of arm64 should be doable with this strategy. Shoutout to @staturnzdev and @imnotclarity for lots of help and ideas.
48K
Alfie
@alfiecg_dev
Dec 27, 2023
What a crazy talk - looks like we have an unpatchable KTRR bypass for A12-A16 (possibly A17) as long as we have a PPL bypass. This will revolutionise jailbreaking for the next few years.
[email protected]
@opa334dev
Dec 27, 2023
Very excited for this one! #37c3
154K
Alfie
@alfiecg_dev
Oct 14, 2024
PAC who?
Alfie
@alfiecg_dev
Oct 14, 2024
6f4c2490d3dc708e463e9f0779c23bd598c24df0de4595719b9570f151d03fea bug.txt Something cool I've found, I hope to be able to offer a demo soon 👀
150K
Alfie
@alfiecg_dev
Mar 25, 2024
iOS 14.0 - 16.6.1 (arm64) ✅ iOS 14.0 - 16.5.1 (A12 - A14) ✅ iOS 14.0 - 16.5 (A15 - A16) ✅ Remaining versions: ⏱️
122K
Alfie
@alfiecg_dev
Apr 4, 2024
TrollInstallerX is now out, supporting almost every device from iOS 14.0 - 16.6.1. It's quick, easy and extremely reliable. 🔥
GitHub - alfiecg24/TrollInstallerX: A TrollStore installer for iOS 14.0 - 16.6.1
From github.com
110K
Alfie
@alfiecg_dev
Jun 8, 2025
Finally managed to exploit Trigon on arm64e! Certainly more complicated than arm64, but it uses some cool tricks that certainly make it a really nice exploit. Just like the original, it’s a very quick exploit, and of course deterministic too.
32K
Alfie
@alfiecg_dev
May 20, 2025
I've just released the slides from my @0x41con talk with @opa334dev - "The State of iOS Jailbreaking in 2025".
GitHub - alfiecg24/Presentations
From github.com
49K
Alfie
@alfiecg_dev
Jan 5, 2025
CVE-2023-32434 is much more powerful than just a PUAF - it can also be used as a physical mapping primitive. This allows for a deterministic exploit that doesn’t use any memory corruption. I don’t have a complete exploit yet, but so far it’s been a fun project!
83K