Putting an iOS 6 device back to work in 2026

1. Before you start

For most devices Apple no longer signs iOS 6. If the device lands in recovery mode and you restore it with Finder or iTunes, you get the newest signed firmware and iOS 6 is gone permanently — iPad 4 → 10.3.3, iPod touch 5 → 9.3.5, iPhone 5 → 10.3.4. Stuck in recovery, do not open Finder: Legacy iOS Kit → Main Menu → Exit Recovery Mode (§2.18). Get the kit before you need it, from https://github.com/LukeZGD/Legacy-iOS-Kit/releases/latest (§2.5).

Exceptions, restorable today: iPod4,1/iPhone2,1 (signed 6.1.6 IPSW) and iPad2,1/2,2/2,3/iPhone4,1 (signed 6.1.3 OTA). Apple has made no commitment to keep signing these, so re-check before you commit (§10) — and if you own one of the four 6.1.3 models, mint permanent blobs today: Legacy iOS Kit → Save SHSH Blobs → iOS 6.1.3.

Everything else is one-way: never tap Erase All Content and Settings on a jailbroken iOS 6 device. It routinely boot-loops, and the fix is that restore. If the device is already on iOS 6, harvest it before you erase anything — Save SHSH Blobs → Onboard Blobs, then Misc Utilities → Activation Records (§2.4).

Find your model identifier

Settings → General → About → Model, then look that number up at https://ipsw.me/device-finder. Not the back case: iPad2,1 and iPad2,4 are both A1395, and only iPad2,1 has a signed iOS 6. Dead device: Legacy iOS Kit reads the identifier over USB in DFU. Full detail: §2.1

Check it can run iOS 6

• iPhone 5c (iPhone5,3/5,4) — no iOS 6 firmware exists. Stop here.
• iPad 1 (iPad1,1), iPod touch 3 (iPod3,1) — no official iOS 6. Legacy iOS Kit → Restore/Downgrade → iOS 6, unofficial and untethered (§2.11c).
• Everything else — find your identifier in §2.3's table; it names the route for your row. If that row says blobs required — iPad2,4, iPad mini 1, iPad 3, iPad 4, iPhone5,1/5,2, iPod5,1 — §2.11b ranks every option for your exact model.

What each route needs from a computer

• macOS — restore and jailbreak both run natively.
• Windows — boot a Linux live USB for the restore only; Aquila jailbreaks natively in Windows, with desktop iTunes installed for the USB driver — the desktop installer, not the Microsoft Store build.
• Linux — restore natively; no Linux Aquila build, so jailbreak by sideloading aquila-app with the kit's Sideload IPA (§2.16).

The dual-boot route in §2.11a is the exception: after you have jailbroken the host it needs no computer at any point.

2. Get it onto iOS 6, and jailbroken

Install Legacy iOS Kit from https://github.com/LukeZGD/Legacy-iOS-Kit/releases/latest; every restore runs through it. macOS and Linux only — on Windows, boot an Ubuntu live USB to restore, then return to Windows to jailbreak.

Already on iOS 6? Do not erase it. Back it up, then Legacy iOS Kit → Save SHSH Blobs → Onboard Blobs and Misc Utilities → Activation Records, in Normal mode while it is still activated. If it is already jailbroken, go straight to section 3; if it is not, do Jailbreak below first.

Find your row

Activate

Main Menu → Attempt Activation, and retry on failure. iPhone 4 and older need a valid SIM inserted: insert one, or use Hacktivate, which also covers any device whose IMEI begins 9900.

Jailbreak

1. Get Aquila v2.1.1 from https://github.com/staturnzz/aquila/releases — Windows or macOS, no Linux build. The device must already be activated and past Setup Assistant.
2. macOS: unzip, double-click aquila. Windows: run aquila.exe and install Apple's iTunes for the USB driver — the desktop installer, not the Microsoft Store build.
3. Plug in and run it; it installs Cydia and reboots.
4. On Linux, sideload aquila-app from https://github.com/LukeZGD/aquila-app/releases with the kit's Sideload IPA — needs an Apple ID entered on the computer, and the device activated with internet.
5. Applies but dies on reboot — disproportionately an A5(X) or A6(X) device on 6.1.3? Sideload aquila-app-v1.2.2-p0sixspwn.ipa from that same aquila-app releases page instead. iOS 6.1.3–6.1.6 only.

Ignore evasi0n — that domain is a gambling site now.

3. Fix HTTPS — do this first

One profile install fixes certificate trust for Safari, Cydia and apps — all three share one trust evaluation. No jailbreak needed, and it is removable.

On the device:

1. Check the clock first: Settings → General → Date & Time. A wrong date causes certificate errors this fix will not touch.
2. Open Safari and go to http://tlsroot.litten.ca/beeg.mobileconfig — plain http://, no redirect. The device cannot open the https:// version yet, which is the whole point.
3. Settings opens an Install Profile sheet for "Hanabi's Updated Root CA's."
4. Not Verified in red is expected. Keep going.
5. Tap Install → Install → Done.
6. Reboot only if your jailbreak is untethered. Aquila, from §2.15, is untethered: reboot. Tethered, dual-booted with CoolBooter, or unsure: do not — a reboot on a tethered jailbreak leaves the device un-jailbroken and possibly unable to boot without a computer. The reboot is not required either way: securityd re-reads the trust store, so force-quitting Safari and Cydia is enough.

That is the fix. Safari, Cydia and your apps should now open https:// sites that failed a minute ago.

To undo it: Settings → General → Profiles → Remove. Full detail: §3.5.

Check what you installed

You just added 32 root certificate authorities over unauthenticated HTTP, which is the attack a root store exists to prevent. If you have a computer to hand, confirm the bytes:

curl -O https://tlsroot.litten.ca/beeg.mobileconfig
shasum -a 256 beeg.mobileconfig

Expect 1fdbbe4b4571ede657ce4a792434fbef94c052c043e4ef992e905d8a68ced281. Anything else: remove the profile by the path above.

Also install SSLPatch — jailbroken devices

iOS 6.0 through 6.1.5 carries CVE-2014-1266, "goto fail," where certificate signature verification can be skipped entirely. Apple fixed it in 6.1.6, which shipped only for the iPhone 3GS and iPod touch 4. In Cydia, search SSLPatch and install com.rpetrich.sslpatch from BigBoss, already a default source. It is a Substrate tweak, so there is no stock-device route to it — come back after §4.

You want both: the profile so valid chains are trusted, SSLPatch so invalid chains are actually rejected. Full detail: §3.9.

Some sites will still fail

iOS 6 offers no AEAD ciphers, so hardened servers refuse the handshake (-9824). No trust store or profile change fixes this — the ciphers are not implemented in the device's TLS code. Use a different site. If it is a site you run yourself, terminate its TLS on an nginx or Caddy reverse proxy and serve plain http:// to the device. Full detail: §3.11.

4. Make Cydia work

Adding and removing a source

Cydia hides both behind the same button. Sources tab → Edit (top right) → Add (top left) → type the URL → Add Source, then let it refresh. To remove one: Sources → Edit → tap the red minus beside the source → Delete. Cydia installs the newest version of a package by default; where a version is pinned below, open the package, tap the version row, and pick the one named.

Edit sources through that UI, not by hand: /etc/apt/sources.list.d/saurik.list is marked "DO NOT EDIT," and the real list lives at /var/mobile/Library/Caches/com.saurik.Cydia/sources.list. Type http:// unless you know a repo requires TLS. Full detail: §4.7

Fix the stock sources

Stock Cydia ships four:

If your jailbreak also shipped apt.modmyi.com (no DNS — a red error on every refresh) or cydia.zodttd.com (redirects), remove both. Only saurik's mirrors above still work. Full detail: §4.2

Repos that are alive

Cydia does not verify third-party repo signatures, and postinst scripts run as root — plain-HTTP sources mean unsigned code over an unauthenticated channel from strangers. Full detail: §4.4, §4.5

Install these, in this order

1. Mobile Substrate (mobilesubstrate, apt.saurik.com) — must be ≥ 0.9.5100 or AppSync will not install.
2. OpenSSH (openssh 6.7p1-13, apt.saurik.com). The default password is alpine, it is live from the moment the package installs, and everybody knows it: change the root and mobile passwords immediately. Find the device's address in Settings → Wi-Fi → the blue arrow beside your network, then from a computer ssh root@<that address>, password alpine, and run passwd, then passwd mobile, and do not do the first install on untrusted Wi-Fi. Then log in once and confirm it works — before you install any tweak. If your computer's ssh refuses the connection, that is OpenSSH 10.x rejecting SHA-1 host keys and KEX by default, not a broken device: use the ~/.ssh/config block in §3.6, with your device's address on its HostName line. That login is the recovery path — if a Substrate tweak drops the device into safe mode or a boot loop, you SSH in and delete the offending .dylib from /Library/MobileSubstrate/DynamicLibraries/.
3. Substrate Safe Mode (BigBoss) — gets you back in when a tweak breaks SpringBoard. Install this early.
4. AppSync Unified (ai.akemi.appsyncunified 116.2, LukeZGD's repo). Take 116.2; 116.1 is arm64 and needs firmware ≥ 15.0, and every iOS 6 device is armv7. Add Skyglow too and Cydia shows two entries both titled "AppSync Unified" — its copy is the old net.angelxwind.appsyncunified at 84.0. Take the 116.2 one. If the repo will not add, §4.4 has the desktop curl/scp/dpkg fallback.
5. PreferenceLoader (preferenceloader 2.2.6, BigBoss) — required before most tweaks show a Settings pane.
6. iFile — search "iFile" in Cydia; the BigBoss package is eu.heinelt.ifile 2.2.0-1, with no firmware floor. Not Filza — com.tigisoftware.filza 4.0.1-3 declares Depends: firmware (>= 7.0) and simply will not appear for you.
7. IPA Installer (com.slugrail.ipainstaller 3.23, BigBoss), pulls in com.autopear.installipa 3.4.1-1 for /usr/bin/installipa.

Full detail: §4.6

5. Get apps onto it

Install AppSync Unified first (4.6, step 3). Nothing in this section works without it.

The App Store

Sign-in is plausibly restorable; downloads are not. Get apps from Veteris or an IPA instead.

Every known repair ships as a Cydia tweak, so jailbreak first. The three that exist:

• com.podpod123.gsaport — repo http://repo.podpod123.com/. Ports modern GrandSlam sign-in; Messages authenticating with it is the verified part. The repo returns 403 to anything that does not look like Cydia — that is not an outage. Steps in 6.2a.
• net.nekokawa.appstorefix — repo http://cydia.nekokawa.net/. iOS 6.0–6.1.6 only.
• com.aoi.storefix — repo http://aoiblog.jp/. It rewrites /etc/hosts to route your Apple ID traffic through a stranger's machine; read 6.3 before adding this repo. The edits persist after you uninstall the package and there is no undo — back /etc/hosts up first. Its control file declares Conflicts: com.aoi.storefix — on itself. That is malformed and can wedge dpkg.

Success is the sign-in sheet accepting your Apple ID; a download that still fails is expected, not a broken install.

Getting an IPA onto the device

"Download the IPA" means a computer, unless the page serves an itms-services manifest that installs straight from Safari — the one this guide uses is the TubeReplacer author's host, https://cydia.preloading.dev/ipas/youtube/, which warns on the page itself that it "might not work on some iOS versions." Otherwise:

1. Download the .ipa on a computer.
2. scp app.ipa ios6:/var/mobile/Media/Downloads/
3. ssh ios6 'chown mobile:mobile /var/mobile/Media/Downloads/app.ipa' — files landed as root are root:wheel and iFile refuses to open them; that is the "file is corrupt" false alarm.
4. ssh ios6 'installipa /var/mobile/Media/Downloads/app.ipa', or open the file in iFile.

Over USB: brew install libimobiledevice ideviceinstaller, then ideviceinstaller for IPAs. Full detail: 6.9.

Veteris

Add http://repo.victorlobe.me/ in Cydia; install com.victorlobe.veteris 3.2 and com.victorlobe.veterishelper 1.1. It installs classic iOS apps on-device — no computer, no cable. Its IPA sources are undisclosed: same copyright territory as the archives, and you trust a third party's binaries.

6. Messages and FaceTime

GSAPort, by u/EricRen1, ports Apple's modern GrandSlam authentication back to iOS 5–8. Messages works on it — I run it on my own iPad. Install it for that, and treat FaceTime, iCloud and Game Center as worth trying afterwards rather than promised.

Do the jailbreak (§2) and install the certificate profile (§3.5) first; without a current trust store GSAPort cannot reach Apple over HTTPS.

Install it and sign in

1. In Cydia's own Sources UI, add http://repo.podpod123.com/. A 403 is not an outage — this repo returns 403 to anything that does not send Cydia's user agent.
2. Install GSAPort (com.podpod123.gsaport). It declares firmware >= 6.0, << 9.0.
3. Sign in where you normally would — in Settings, or in the app that is asking. GSAPort reads the credentials you type and runs them through Apple's own GSA server, so you are handing a live Apple ID password to a third-party tweak.
4. If you are asked for a verification code, type only the six digits into the password field. Not your password, not password-then-code. This is the step everyone gets wrong.

Full detail: §6.2a

If you also want the App Store

That is a separate trade and it must be a conscious one: AppStoreFix (com.aoi.storefix, http://aoiblog.jp/) rewrites /etc/hosts to route your Apple ID traffic through a stranger's server, and the redirect can only work because certificate validation is being suppressed inside the store processes. Those /etc/hosts edits survive uninstalling the package and there is no undo — back the file up first. Take that route only with a throwaway Apple ID that has no payment method.

Full detail: §6.3

7. YouTube

Safari cannot play YouTube. TubeReplacer replaces the backend of Google's App Store YouTube app. Prerequisites: section 3's certificate profile, and AppSync Unified (ai.akemi.appsyncunified 116.2, http://lukezgd.github.io/repo/) from section 4.

1. Get the YouTube app on the device. Safari → https://cydia.preloading.dev/ipas/youtube/ → tap 1.3.0 or 1.4.0. These are itms-services install manifests: tapping one installs the app in place. Skip 1.0.0 and 1.0.1; no iPad or iPhone 5 support. If the page fails on your version, fetch the IPA on a computer from there or https://iosapps.litten.ca/getAppVersions/com.google.ios.youtube, scp youtube.ipa ios6:/tmp/, then run installipa /tmp/youtube.ipa on the device or tap it in iFile — both from section 4. An unsigned IPA from a stranger runs with the same access as anything else on the device.
2. Add http://cydia.preloading.dev/ in Cydia, install TubeReplacer (dev.preloading.tubereplacer). Uninstall TubeRepair and ProTube first. dpkg blocks TubeRepair but not ProTube, and with ProTube present, liking a video crashes the app.
3. Settings → TubeReplacer → Video Stream → 360p. That is the ceiling.
4. Switch the Google account to code-based 2FA (Google Authenticator) before you sign in. "Tap Yes" does not work, with no hint why. On "browser is not secure," retry, or sign in on a computer first.

When it breaks, check the Cydia repo, not GitHub — GitHub is a partial mirror. Full detail: §5.2–5.4

yt-dlp -f "bv*[vcodec^=avc1][height<=1080][fps<=30]+ba[acodec^=mp4a]/b[vcodec^=avc1][fps<=30]" \
  --merge-output-format mp4 -o "%(title)s.%(ext)s" URL

8. Music, maps and the rest

Maps, Weather, Stocks

Install section 3's SSL certs first, then com.skyglow.mapsx 5.0.0 and com.skyglow.weatherx 3.6 from http://cydia.skyglow.es/. MapsX's changelog says reboot after install: reboot only if your jailbreak is untethered. If it is tethered, or you are not sure, do not reboot — a reboot on a tethered jailbreak leaves the device un-jailbroken and possibly unable to boot without a computer.

Music without iTunes

Never copy audio into /var/mobile/Media/iTunes_Control/Music/ — it may appear and will not play. Use afcclient over USB (brew install libimobiledevice ideviceinstaller), scp over SSH, or Lyrebird's "Download to Music". Files landed by scp root@… are root:wheel, and iFile and the media stack refuse them — the classic false "corrupt file". Fix ownership after every copy:

scp track.m4a ios6:/var/mobile/Media/Downloads/
ssh ios6 'chown mobile:mobile /var/mobile/Media/Downloads/track.m4a'

Apple's iTunes 12.6.5.3 download links are dead. Full detail: §6.9.

VPN

Settings → General → VPN, IPsec or L2TP/IPsec, to a strongSwan server. Never PPTP — its MS-CHAPv2 authentication has been considered broken since 2012. WireGuard cannot work: there is no NetworkExtension.framework on the device at all.

Plex without an account

The old client cannot pass a modern Plex login. Make the server trust the device.

1. Give the device a static lease on your router.
2. Plex Media Server → Settings → Network: add that address, or the subnet (192.168.1.0/24), to the list allowed without authentication.
3. Serve over plain http on the LAN.
4. In the client, add the server manually by address and port.

Anything on those addresses reads your library uncredentialed. Narrow to the one device. Full detail: §6.11.

9. Keep the hardware alive

Swelling: stop now

If the screen is lifting at an edge or the back is bowed, stop using the device and do not charge it unattended. A swelling cell pushes the display out of the chassis; in an iPad it can crack the glass from inside.

Shelving one: charge it to half

A device left flat in a drawer for a year can drop below the voltage at which its protection circuit will allow a charge, and it never wakes up. Before it goes in the drawer, charge to roughly half, and top it up once or twice a year.

10. When it goes wrong

Recovery moves

Most things that look like a brick are a fifteen-second button hold. Do not restore in Finder or iTunes to escape one. That installs the newest signed firmware and iOS 6 is gone permanently — iPad 4 to 10.3.3, iPod touch 5 to 9.3.5, iPhone 5 to 10.3.4, no way back without SHSH blobs. Only the models Apple still signs iOS 6 for can be walked back: iPod touch 4 (iPod4,1) and iPhone 3GS (iPhone2,1), which have the full 6.1.6 IPSW, and iPad 2 (iPad2,1 / 2,2 / 2,3) and iPhone 4S (iPhone4,1), which have the 6.1.3 OTA. iPad2,4 is not one of them. Everything else is a one-way trip.

Tell the two states apart: DFU is a completely black screen. A "Connect to iTunes" graphic means recovery, not DFU.

• Stuck in recovery → Legacy iOS Kit Main Menu → Exit Recovery Mode.
• Stuck in DFU → hold Power and Home together for about 15 seconds.
• Won't boot, or won't activate, after a downgrade → Useful Utilities → Clear NVRAM, possibly more than once. By hand from MTerminal or NewTerm: su (password alpine), then nvram -c, then sync.
• Failed restore → delete any custom IPSWs and retry. On Linux, sudo killall usbmuxd usbmuxd2 first.
• Boot loop or safe mode after a tweak → SSH in and delete the offending .dylib from /Library/MobileSubstrate/DynamicLibraries/. This is your only non-destructive recovery path, and it works only if you got SSH running and tested a login before installing your first tweak.

Full detail: §0, §2.6, §2.18

HTTPS failures

Check the clock first: Settings → General → Date & Time. A shelved device with a flat battery often boots with a bogus date, producing expiry errors the certificate fix will not touch.

iOS 6 surfaces these failures as bare negative numbers. If you do not have one, the probe below prints it.

To test any host over SSH:

(printf '601 Configuration\n\n600 URI Acquire\nURI: https://example.com/\nFilename: /tmp/p.out\n\n'; sleep 8) \
  | /usr/lib/apt/methods/http

Then delete /tmp/p.out.

Full detail: §3.3–3.4