Difference between revisions of "Jailbreak"

Revision as of 15:42, 15 November 2013

1 See Also
2 Exploits which were used in order to jailbreak 1.x
3 Exploits which are used in order to jailbreak 2.x
4 Exploits which are used in order to jailbreak 3.x
5 Exploits which are used in order to jailbreak 4.x
6 Exploits which are used in order to jailbreak 5.x
- 6.1 5.0
- 6.2 5.0.1
- 6.3 5.1
- 6.4 5.1.1
7 Exploits which are used in order to jailbreak 6.x
- 7.1 6.0 / 6.0.1 / 6.0.2 / 6.1 / 6.1.1 / 6.1.2
8 Exploits which are used in order to jailbreak 7.x
9 Jailbreak Tools

This is the process by which full execute and write access is obtained on all the partitions of the iPhone. It is done by patching /private/etc/fstab to mount the System partition as read-write. This is entirely different from an unlock. Jailbreaking is the first action that must be taken before things like unofficial activation (hacktivation), and unofficial unlocking can be applied.

The original jailbreak also included modifying the AFC service (used by iTunes to access the filesystem) to give full filesystem access from root. This was later updated to create a new service (AFC2) that allows access to the full filesystem.

Modern jailbreaks also include patching the kernel to get around code signing and other restrictions. See Kernel Patches.

NOTE: The legality of jailbreaking your device varies with each country/region. Wikipedia has a summary of legality for some countries.

Version numbers are the first to jailbreak and last is the last supported version. Last will only be listed if a newer version is out that does not support the device and iOS.

Exploits which were used in order to jailbreak 1.x

1.0.2

Restore Mode (iBoot had a command named cp, which had access to the whole filesystem)

1.1.1

Symlinks (an upgrade jailbreak)
libtiff exploit (Adapted from the PSP scene, used by JailbreakMe)

1.1.2

Mknod (an upgrade jailbreak)

1.1.3 / 1.1.4 / 1.1.5

Soft Upgrade (an upgrade jailbreak)
Ramdisk Hack
Dual Boot Exploit - Works up to iOS 2.0 beta 3
diags - Works up to iOS 2.0 beta 5

Exploits which are used in order to jailbreak 2.x

Exploits which are used in order to jailbreak 3.x

3.0 / 3.0.1

Pwnage + Pwnage 2.0 (iPhone, iPod touch, and iPhone 3G)
ARM7 Go (from iOS 2.1.1) + 0x24000 Segment Overflow ( iPod touch 2G)
Pwnage + iBoot Environment Variable Overflow (iPhone, iPod touch, and iPhone 3G)
0x24000 Segment Overflow + iBoot Environment Variable Overflow (iPod touch 2G and iPhone 3GS)

3.1 / 3.1.1

Pwnage + Pwnage 2.0 (together for untethered jailbreak on iPhone, iPod touch, and iPhone 3G)
usb_control_msg(0x21, 2) Exploit (tethered jailbreak on iPod touch 2G new bootrom, iPhone 3GS new bootrom, and iPod touch 3G)
0x24000 Segment Overflow + usb_control_msg(0x21, 2) Exploit (iPod touch 2G old bootrom and iPhone 3GS old bootrom)

3.1.2

Pwnage + Pwnage 2.0 (together for untethered jailbreak on iPhone, iPod touch, and iPhone 3G)
usb_control_msg(0x21, 2) Exploit (tethered jailbreak on iPod touch 2G new bootrom, iPhone 3GS new bootrom, and iPod touch 3G)
0x24000 Segment Overflow + usb_control_msg(0x21, 2) Exploit (iPod touch 2G old bootrom and iPhone 3GS old bootrom)
MobileBackup Copy Exploit + Incomplete Codesign Exploit + BPF_STX Kernel Write Exploit (all devices, used in Spirit)
Malformed CFF Vulnerability + Incomplete Codesign Exploit + IOSurface Kernel Exploit (all devices, used in Star)

3.1.3

Pwnage + Pwnage 2.0 (together for untethered jailbreak on iPhone, iPod touch, and iPhone 3G)
0x24000 Segment Overflow (for iPod touch 2G and iPhone 3GS devices with older bootroms)
- + Limera1n Exploit (iPhone 3GS old bootrom, used in sn0wbreeze)
- + usb_control_msg(0xA1, 1) Exploit (iPod touch 2G old bootrom, used in sn0wbreeze)
usb_control_msg(0xA1, 1) Exploit+ Incomplete Codesign Exploit + BPF_STX Kernel Write Exploit (iPod touch 2G new bootrom, used in sn0wbreeze)
Limera1n Exploit + Incomplete Codesign Exploit + BPF_STX Kernel Write Exploit (iPod touch 3G and iPhone 3GS new bootrom, used in sn0wbreeze)
MobileBackup Copy Exploit + Incomplete Codesign Exploit + BPF_STX Kernel Write Exploit (all devices, used in Spirit)
Malformed CFF Vulnerability + Incomplete Codesign Exploit + IOSurface Kernel Exploit (all devices, used in Star)

3.2

MobileBackup Copy Exploit + Incomplete Codesign Exploit + BPF_STX Kernel Write Exploit (all devices, used in Spirit)
Malformed CFF Vulnerability + Incomplete Codesign Exploit + IOSurface Kernel Exploit (iPad, used in Star)
Limera1n Exploit + Incomplete Codesign Exploit + BPF_STX Kernel Write Exploit (iPad used in sn0wbreeze 2.9.x)

3.2.1

Malformed CFF Vulnerability + Incomplete Codesign Exploit + IOSurface Kernel Exploit (iPad, used in Star)
Limera1n Exploit + Incomplete Codesign Exploit + IOSurface Kernel Exploit (iPad, used in sn0wbreeze 2.9.x)

3.2.2

Limera1n Exploit + Packet Filter Kernel Exploit (iPad)

Exploits which are used in order to jailbreak 4.x

4.0 / 4.0.1

Pwnage + Pwnage 2.0 (iPhone 3G)
0x24000 Segment Overflow (iPod touch 2G and iPhone 3GS devices with older bootroms)
Malformed CFF Vulnerability + Incomplete Codesign Exploit + IOSurface Kernel Exploit (all devices, used in Star)
Limera1n Exploit + Packet Filter Kernel Exploit (iPhone 3GS New bootrom, iPod touch 3G, iPhone 4 GSM model)

4.0.2

Pwnage + Pwnage 2.0 (iPhone 3G)
ARM7 Go (from iOS 2.1.1) + 0x24000 Segment Overflow (iPod touch 2G)
0x24000 Segment Overflow (iPhone 3GS)
limera1n's bootrom exploit + Packet Filter Kernel Exploit (iPhone 3GS new bootrom, iPod touch 3G, iPhone 4 GSM model, and iPod touch 4G)

4.1

Pwnage + Pwnage 2.0 (together to jailbreak the iPhone 3G)
ARM7 Go (from iOS 2.1.1) + 0x24000 Segment Overflow (together for untethered jailbreak on iPod touch 2G old bootrom)
limera1n's bootrom exploit + 0x24000 Segment Overflow (together for untethered jailbreak on iPhone 3GS old bootrom)
limera1n's bootrom exploit + Packet Filter Kernel Exploit (together for untethered jailbreak on iPhone 3GS new bootrom, iPod touch 3G, iPhone 4 GSM model, iPod touch 4G, and Apple TV 2G))
usb_control_msg(0xA1, 1) Exploit + Packet Filter Kernel Exploit (together for untethered jailbreak on iPod touch 2G)

4.2.1

Pwnage + Pwnage 2.0 (together to jailbreak the iPhone 3G)
ARM7 Go (from iOS 2.1.1) + 0x24000 Segment Overflow (together for untethered jailbreak on iPod touch 2G old bootrom)
limera1n's bootrom exploit + 0x24000 Segment Overflow (together for untethered jailbreak on iPhone 3GS old bootrom)
limera1n's bootrom exploit + HFS Legacy Volume Name Stack Buffer Overflow (together for untethered jailbreak on iPhone 3GS new bootrom, iPod touch 3G, iPad, iPhone 4 GSM model, iPod touch 4G, and Apple TV 2G)
usb_control_msg(0xA1, 1) Exploit + HFS Legacy Volume Name Stack Buffer Overflow (together for untethered jailbreak on iPod touch 2G)

4.2.6 / 4.2.7 / 4.2.8

limera1n's bootrom exploit + HFS Legacy Volume Name Stack Buffer Overflow (together for untethered jailbreak on iPhone 4 CDMA model)
T1 Font Integer Overflow (used for Saffron)

4.2.9 / 4.2.10

limera1n's bootrom exploit (Tethered jailbreak on iPhone 4 CDMA model)

4.3

limera1n's bootrom exploit + 0x24000 Segment Overflow (together for untethered jailbreak on iPhone 3GS old bootrom)
limera1n's bootrom exploit (tethered jailbreak on iPhone 3GS new bootrom, iPod touch 3G, iPad, iPhone 4 GSM model, iPod touch 4G, and Apple TV 2G)
T1 Font Integer Overflow (used for Saffron)

4.3.1 / 4.3.2 / 4.3.3

limera1n's bootrom exploit + 0x24000 Segment Overflow (together for untethered jailbreak on iPhone 3GS old bootrom)
limera1n's bootrom exploit + ndrv_setspec() Integer Overflow (together for untethered jailbreak on iPhone 3GS new bootrom, iPod touch 3G, iPad, iPhone 4 GSM model, and iPod touch 4G)
T1 Font Integer Overflow (used for Saffron)

4.3.4 / 4.3.5

limera1n's bootrom exploit + 0x24000 Segment Overflow (together for untethered jailbreak on iPhone 3GS with old bootrom)
limera1n's bootrom exploit (Tethered jailbreak) on iPhone 3GS with new bootrom, iPod touch 3G, iPad, iPhone 4 GSM model, and iPod touch 4G)

Exploits which are used in order to jailbreak 5.x

5.0

limera1n's bootrom exploit + 0x24000 Segment Overflow (together for untethered jailbreak on iPhone 3GS with old bootrom)
limera1n's bootrom exploit (Tethered jailbreak) on iPhone 3GS with new bootrom, iPod touch 3G, iPad, iPhone 4, and iPod touch 4G)
Racoon String Format Overflow Exploit (used both for payload injection and untether)+HFS Heap Overflow- iPhone 4S only

5.0.1

limera1n's bootrom exploit + 0x24000 Segment Overflow (together for untethered jailbreak on iPhone 3GS with old bootrom)
limera1n's bootrom exploit + Racoon String Format Overflow Exploit+HFS Heap Overflow on iPhone 3GS with new bootrom, iPod touch 3G, iPad, iPhone 4, and iPod touch 4G)
Racoon String Format Overflow Exploit (used both for payload injection and untether)+HFS Heap Overflow - iPad 2 and iPhone 4S with Absinthe

5.1

limera1n's bootrom exploit (Tethered jailbreak) on iPhone 3GS with new bootrom, iPod touch 3G, iPad, iPhone 4, and iPod touch 4G)
limera1n's bootrom exploit + 0x24000 Segment Overflow (together for untethered jailbreak on iPhone 3GS with old bootrom)

5.1.1

limera1n Exploit + 0x24000 Segment Overflow (together for untethered jailbreak on iPhone 3GS with old bootrom)
limera1n Exploit + Rocky Racoon (together for untethered jailbreak on iPhone 3GS with new bootrom, iPhone 4, iPod touch 3G, and iPod touch 4G)

Exploits which are used in order to jailbreak 6.x

6.0 / 6.0.1 / 6.0.2 / 6.1 / 6.1.1 / 6.1.2

limera1n's bootrom exploit (Tethered jailbreak) on iPhone 3GS with new bootrom, iPhone 4, and iPod touch 4G)
limera1n's bootrom exploit + 0x24000 Segment Overflow (together for untethered jailbreak on iPhone 3GS with old bootrom)
Symbolic Link Vulnerability
Timezone Vulnerability
Shebang Trick
AMFID code signing evasion
launchd.conf untether
IOUSBDeviceFamily Vulnerability
ARM Exception Vector Info Leak
dynamic memmove() locating
vm_map_copy_t corruption for arbitrary memory disclosure
kernel memory write via ROP gadget

Exploits which are used in order to jailbreak 7.x

None

Jailbreak Tools

Apple TV 2G

Jailbreak Tool	Works with firmware...
Jailbreak Tool	4.1/4.0	4.2/4.1	4.2.1/4.1.1	4.3/4.2	4.3/4.2.1	4.3/4.2.2	4.3	4.4/5.0	4.4.1/5.0	4.4.2/5.0	4.4.3/5.0.1	4.4.4/5.0.1	5.0/5.1	5.0.1/5.1.1	5.0.2/5.1.1	5.1/6.0	5.1.1/6.0.1	5.2/6.1	5.2.1/6.1.3	5.3/6.1.4	6.0/7.0.1	6.0/7.0.2	6.0.1/7.0.3	6.0.2/7.0.4
evasi0n	No															1.0			No
greenpois0n	no package management GUI	No	RC6-RC6.1	No
limera1n	no package management GUI	No
PwnageTool	no package management GUI	Restore from a custom firmware with unofficial bundle¹	4.2	No	4.3-4.3.3.1	4.3-4.3.3.1²	No							5.1.1 (no package management GUI)	No
redsn0w	No				0.9.6rc16	No										0.9.15b1¹	0.9.15b3³					No
Seas0nPass (Mac)	No		0.6.7¹ - 0.7.1	0.7.2¹	0.7.3¹ - 0.7.5	0.7.6.??? - 0.7.7.???	0.7.8.???	0.7.9.???¹	0.7.9.210¹	0.7.9.230¹	0.7.9.270¹	0.7.9.290¹ - 0.8.0.320	0.8.3.470¹	0.8.4.518¹ - 0.8.5.555	0.8.6.565	No		0.8.9.655	No
Seas0nPass (Windows)	No				0.3.7.????	0.3.13.????	0.3.29.???? - 0.3.45.4035	0.3.37.????¹		0.3.42.3335¹	0.3.44.????¹	0.3.45.4035¹ - 0.8.3.5592	0.8.3.5592¹	0.8.4.6306¹ - 0.8.5.6546	0.8.6.7558	No		0.8.9.11241	No
sn0wbreeze	no package management GUI	No			2.5-2.7.1	No										2.9.8			No
unthredera1n	no package management GUI	Yes														No

¹ Tethered jailbreak.
² User needs to manually add PwnageTool firmware bundle into application.
³ Point at 6.0 IPSW. Also Tethered jailbreak.

Apple TV 3G

Jailbreak Tool	Works with firmware...
Jailbreak Tool	5.0/5.1	5.0.1/5.1	5.0.2/5.1.1	5.1/6.0	5.1.1/6.0.1	5.2/6.1	5.2.1/6.1.3	5.3/6.1.4	6.0/7.0.1	6.0/7.0.2	6.0.1/7.0.3	6.0.2/7.0.4
Absinthe	No
evasi0n	No
redsn0w	No
Seas0npass	No
Sn0wbreeze	No

Apple TV 3G Rev A

Jailbreak Tool	Works with firmware...
Jailbreak Tool	5.2/6.1	5.2.1/6.1.3	5.3/6.1.4	6.0/7.0.1	6.0/7.0.2	6.0.1/7.0.3	6.0.2/7.0.4
Absinthe	No
evasi0n	No
redsn0w	No
Seas0npass	No
Sn0wbreeze	No

Jailbreak/Deprecated iPads

iPad 2

Jailbreak Tool	Works with firmware...
Jailbreak Tool	4.3	4.3.1	4.3.2	4.3.3	4.3.4	4.3.5	5.0	5.0.1	5.1	5.1.1	6.0	6.0.1	6.1	6.1.2	6.1.3	7.0	7.0.2	7.0.3	7.0.4
Absinthe	No							0.2-0.4	No	2.0¹-2.0.4	No
evasi0n	No										1.0			1.4	No
redsn0w	No							0.9.10b7-0.9.11b4	No	0.9.12b1	No
Saffron	No			Yes	No

¹ Not compatible with iPad 2 (Wi-Fi) Rev A

iPad 3

Jailbreak Tool	Works with firmware...
Jailbreak Tool	5.1	5.1.1	6.0	6.0.1	6.1	6.1.2	6.1.3	7.0	7.0.2	7.0.3	7.0.4
Absinthe	No	2.0-2.0.4	No
evasi0n	No		1.0			1.4	No
redsn0w	No	0.9.12b1	No

iPad 4

Jailbreak Tool	Works with firmware...
Jailbreak Tool	6.0	6.0.1	6.1	6.1.2	6.1.3	7.0	7.0.2	7.0.3	7.0.4
evasi0n	1.0			1.4	No

iPad Air

Jailbreak Tool	Works with firmware...
Jailbreak Tool	7.0.3	7.0.4
evasi0n	No

iPad mini 1G

Jailbreak Tool	Works with firmware...
Jailbreak Tool	6.0	6.0.1	6.0.2	6.1	6.1.2	6.1.3	7.0	7.0.2	7.0.3	7.0.4
evasi0n	1.0				1.4	No

iPad mini 2G

Jailbreak Tool	Works with firmware...
Jailbreak Tool	7.0.3	7.0.4
evasi0n	No

Jailbreak/Deprecated iPhones

iPhone 4 (GSM model)

Jailbreak Tool	Works with firmware...
Jailbreak Tool	4.0	4.0.1	4.0.2	4.1	4.2.1	4.3	4.3.1	4.3.2	4.3.3	4.3.4	4.3.5	5.0	5.0.1	5.1	5.1.1 (9B206)	5.1.1 (9B208)	6.0	6.0.1	6.1	6.1.2	6.1.3	7.0	7.0.2	7.0.3	7.0.4
Absinthe	No														2.0	2.0.2	No
evasi0n	No																1.0			1.4	No
greenpois0n	No			RC4	RC5-RC6.1	No
limera1n	Yes				No
PwnageTool	No			4.1-4.1.3	4.2	4.2^{1 3}	4.3	4.3.2	4.3.3-4.3.3.1	4.3.3^{1 3}			5.0.1	No	5.1.1		No
redsn0w	No			0.9.6b2-0.9.6rc16	0.9.6b4¹-0.9.6rc16 or 0.9.7b6^{1 2}	0.9.6rc9¹-0.9.6rc16¹	0.9.6rc9¹-0.9.6rc16	0.9.6rc13¹-0.9.6rc16	0.9.6rc16	0.9.8b3¹	0.9.8b7¹	0.9.9b3¹	0.9.10b6	0.9.10b6¹	0.9.12b1-0.9.14b2		0.9.15b1¹	0.9.15b1⁴				No
Saffron	No					Yes				No
sn0wbreeze	No			2.1	2.2	2.3b4¹	2.5	2.6-2.6.1	2.7-2.7.1	No		2.8b8¹	2.9.1	No	2.9.6		2.9.8			2.9.10	2.9.14¹	No
Star	Yes		No
unthredera1n	No					Yes											No

¹ Tethered jailbreak.
² If SHSHs were saved for iOS 4.2b3 and if you have a developer access to its IPSW, Jailbreak Monte can be used.
³ Requires an unofficial firmware bundle.
⁴ Requires pointing redsn0w at 6.0 IPSW. Also Tethered jailbreak.

iPhone 4 (GSM Rev A model)

Jailbreak Tool	Works with firmware...
Jailbreak Tool	6.0	6.0.1	6.1	6.1.2	6.1.3	7.0	7.0.2	7.0.3	7.0.4
evasi0n	1.0			1.4	No
redsn0w	0.9.15b3					No
sn0wbreeze	2.9.8			2.9.10	2.9.14¹	No

Must point redsn0w at the 6.0 IPSW. Tethered.

iPhone 4 (CDMA model)

Jailbreak Tool	Works with firmware...
Jailbreak Tool	4.2.5	4.2.6	4.2.7	4.2.8	4.2.9	4.2.10	5.0	5.0.1	5.1	5.1.1	6.0	6.0.1	6.1	6.1.2	6.1.3	7.0	7.0.2	7.0.3	7.0.4
Absinthe	No							2.0	No	2.0	No
evasi0n	No										1.0			1.4	No
greenpois0n	No	RC5 b4-RC6.1	No
PwnageTool	No	4.2	No	4.2²	No			5.0.1	No
redsn0w	No	0.9.6rc9-0.9.10b8b	0.9.8b2-0.9.10b8b	0.9.6rc18-0.9.10b8b	0.9.8b3¹-0.9.10b8b¹	0.9.8b7¹-0.9.10b8b¹	0.9.9b3¹-0.9.10b8b¹	0.9.9b9¹-0.9.10b8b	0.9.10b6¹-0.9.10b8b¹	0.9.12b1	0.9.14b1¹	0.9.15b3³				No
Saffron	No	Yes			No
sn0wbreeze	No	2.2-2.9.3	2.6-2.9.3	2.7-2.9.3	No		2.8b9¹-2.9.3¹	2.8b11¹-2.9.3	2.9.2¹-2.9.3¹	2.9.7	2.9.8			2.9.10	2.9.14¹	No
unthredera1n	No	Yes									No

¹ Tethered jailbreak.
² Requires unofficial bundle.
³ Requires pointing redsn0w at 6.0 IPSW. Also Tethered jailbreak.

iPhone 4S

Jailbreak Tool	Works with firmware...
Jailbreak Tool	5.0	5.0.1 (9A405)	5.0.1 (9A406)	5.1	5.1.1	6.0	6.0.1	6.1	6.1.1	6.1.2	6.1.3	7.0	7.0.2	7.0.3	7.0.4
Absinthe	0.1.2-1			No	2.0	No
evasi0n	No					1.0			1.3	1.4	No
redsn0w	No	0.9.10b7	0.9.11b2	No	0.9.12b1	No

iPhone 5

Jailbreak Tool	Works with firmware...
Jailbreak Tool	6.0	6.0.1	6.0.2	6.1	6.1.2	6.1.3	6.1.4	7.0	7.0.2	7.0.3	7.0.4
evasi0n	1.0				1.4	No

iPhone 5c

Jailbreak Tool	Works with firmware...
Jailbreak Tool	7.0.1	7.0.2	7.0.3	7.0.4
evasi0n	No

iPhone 5s

Jailbreak Tool	Works with firmware...
Jailbreak Tool	7.0.1	7.0.2	7.0.3	7.0.4
evasi0n	No

Jailbreak/Deprecated iPod touches

iPod touch 5G

Jailbreak Tool	Works with firmware...
Jailbreak Tool	6.0	6.0.1	6.1	6.1.2	6.1.3	7.0	7.0.2	7.0.3	7.0.4
evasi0n	1.0			1.4	No

@@ Line 164: / Line 164: @@
 |-
 ! rowspan="2" | [[Jailbreak]] Tool
-! colspan="23" | Works with [[firmware]]...
+! colspan="24" | Works with [[firmware]]...
 |-
 | [[Mojave 8M89 (Apple TV 2G)|4.1/4.0]]
@@ Line 189: / Line 189: @@
 | [[Innsbruck 11A502 (Apple TV 2G)|6.0/7.0.2]]
 | [[InnsbruckTaos 11B511d (Apple TV 2G)|6.0.1/7.0.3]]
+| [[InnsbruckTaos 11B554a (Apple TV 2G)|6.0.2/7.0.4]]
 |-
 | [[evasi0n]]
 | colspan="15" {{no}}
 | colspan="3" {{yes|1.0}}
-| colspan="5" {{no}}
+| colspan="6" {{no}}
 |-
 | [[Greenpois0n (jailbreak)|greenpois0n]]
@@ Line 199: / Line 200: @@
 | {{no}}
 | {{yes|RC6-RC6.1}}
-| colspan="20" {{no}}
+| colspan="21" {{no}}
 |-
 | [[limera1n]]
 | {{partial|no package management GUI}}
-| colspan="22" {{no}}
+| colspan="23" {{no}}
 |-
 | [[PwnageTool]]
@@ Line 214: / Line 215: @@
 | colspan="7" {{no}}
 | {{partial|5.1.1 (no package management GUI)}}
-| colspan="9" {{no}}
+| colspan="10" {{no}}
 |-
 | [[redsn0w]]
@@ Line 222: / Line 223: @@
 | {{yes|0.9.15b1<sup>1</sup>}}
 | colspan="5" {{yes|0.9.15b3<sup>3</sup>}}
-| colspan="2" {{no}}
+| colspan="3" {{no}}
 |-
 | [[Seas0nPass]] (Mac)
@@ Line 241: / Line 242: @@
 | colspan="2" {{no}}
 | {{yes|0.8.9.655}}
-| colspan="6" {{no}}
+| colspan="7" {{no}}
 |-
 | [[Seas0nPass]] (Windows)
@@ Line 257: / Line 258: @@
 | colspan="2" {{no}}
 | {{yes|0.8.9.11241}}
-| colspan="5" {{no}}
+| colspan="6" {{no}}
 |-
 | [[sn0wbreeze]]
@@ Line 265: / Line 266: @@
 | colspan="10" {{no}}
 | colspan="3" {{yes|2.9.8}}
-| colspan="5" {{no}}
+| colspan="6" {{no}}
 |-
 | [[unthredera1n]]
 | {{partial|no package management GUI}}
 | colspan="14" {{yes}}
-| colspan="8" {{no}}
+| colspan="9" {{no}}
 |}
 <sup>1</sup> [[Tethered jailbreak]].<br />
@@ Line 280: / Line 281: @@
 |-
 ! rowspan="2" | [[Jailbreak]] Tool
-! colspan="11" | Works with [[firmware]]...
+! colspan="12" | Works with [[firmware]]...
 |-
-| [[Hoodoo 9B179b (Apple TV 3G)|5.0/5.1]]
+| 5.0/5.1
-| [[Hoodoo 9B206f (Apple TV 3G)|5.0.1/5.1]]
+| 5.0.1/5.1
-| [[HoodooTide 9B830 (Apple TV 3G)|5.0.2/5.1.1]]
+| 5.0.2/5.1.1
-| [[Sundance 10A406e (Apple TV 3G)|5.1/6.0]]
+| 5.1/6.0
-| [[SundanceTide 10A831 (Apple TV 3G)|5.1.1/6.0.1]]
+| 5.1.1/6.0.1
-| [[Brighton 10B144b (Apple TV 3G)|5.2/6.1]]
+| 5.2/6.1
-| [[BrightonMaps 10B329a (Apple TV 3G)|5.2.1/6.1.3]]
+| 5.2.1/6.1.3
-| [[BrightonTide 10B809 (Apple TV 3G)|5.3/6.1.4]]
+| 5.3/6.1.4
-| [[Innsbruck 11A470a (Apple TV 3G)|6.0/7.0.1]]
+| 6.0/7.0.1
-| [[Innsbruck 11A502 (Apple TV 3G)|6.0/7.0.2]]
+| 6.0/7.0.2
-| [[InnsbruckTaos 11B511d (Apple TV 3G)|6.0.1/7.0.3]]
+| 6.0.1/7.0.3
+| 6.0.2/7.0.4
 |-
 | [[Absinthe]]
-| colspan="11" {{no}}
+| colspan="12" {{no}}
 |-
 | [[evasi0n]]
-| colspan="11" {{no}}
+| colspan="12" {{no}}
 |-
 | [[redsn0w]]
-| colspan="11" {{no}}
+| colspan="12" {{no}}
 |-
 | [[Seas0npass]]
-| colspan="11" {{no}}
+| colspan="12" {{no}}
 |-
 | [[Sn0wbreeze]]
-| colspan="11" {{no}}
+| colspan="12" {{no}}
 |}
@@ Line 314: / Line 316: @@
 |-
 ! rowspan="2" | [[Jailbreak]] Tool
-! colspan="6" | Works with [[firmware]]...
+! colspan="7" | Works with [[firmware]]...
 |-
+| 5.2/6.1
-| [[Brighton 10B144b (Apple TV 3G Rev A)|5.2/6.1]]
-| [[BrightonMaps 10B329a (Apple TV 3G Rev A)|5.2.1/6.1.3]]
+| 5.2.1/6.1.3
+| 5.3/6.1.4
-| [[BrightonTide 10B809 (Apple TV 3G Rev A)|5.3/6.1.4]]
-| [[Innsbruck 11A470a (Apple TV 3G Rev A)|6.0/7.0.1]]
+| 6.0/7.0.1
-| [[Innsbruck 11A502 (Apple TV 3G Rev A)|6.0/7.0.2]]
+| 6.0/7.0.2
-| [[InnsbruckTaos 11B511d (Apple TV 3G Rev A)|6.0.1/7.0.3]]
+| 6.0.1/7.0.3
+| 6.0.2/7.0.4
 |-
 | [[Absinthe]]
-| colspan="6" {{no}}
+| colspan="7" {{no}}
 |-
 | [[evasi0n]]
-| colspan="6" {{no}}
+| colspan="7" {{no}}
 |-
 | [[redsn0w]]
-| colspan="6" {{no}}
+| colspan="7" {{no}}
 |-
 | [[Seas0npass]]
-| colspan="6" {{no}}
+| colspan="7" {{no}}
 |-
 | [[Sn0wbreeze]]
-| colspan="6" {{no}}
+| colspan="7" {{no}}
 |}
@@ Line 345: / Line 348: @@
 |-
 ! rowspan="2" | [[Jailbreak]] Tool
-! colspan="18" | Works with [[firmware]]...
+! colspan="19" | Works with [[firmware]]...
 |-
 | 4.3
@@ Line 365: / Line 368: @@
 | 7.0.2
 | 7.0.3
+| 7.0.4
 |-
 | [[Absinthe]]
@@ Line 371: / Line 375: @@
 | {{no}}
 | {{yes|2.0<sup>1</sup>-2.0.4}}
-| colspan="8" {{no}}
+| colspan="9" {{no}}
 |-
 | [[evasi0n]]
@@ Line 377: / Line 381: @@
 | colspan="3" {{yes|1.0}}
 | {{yes|1.4}}
-| colspan="4" {{no}}
+| colspan="5" {{no}}
 |-
 | [[redsn0w]]
@@ Line 384: / Line 388: @@
 | {{no}}
 | {{yes|0.9.12b1}}
-| colspan="8" {{no}}
+| colspan="9" {{no}}
 |-
 | [[Saffron]]
 | colspan="3" {{no}}
 | {{yes}}
-| colspan="14" {{no}}
+| colspan="15" {{no}}
 |}
 <sup>1</sup> Not compatible with [[k93aap|iPad 2 (Wi-Fi) Rev A]]
@@ Line 397: / Line 401: @@
 |-
 ! rowspan="2" | [[Jailbreak]] Tool
-! colspan="10" | Works with [[firmware]]...
+! colspan="11" | Works with [[firmware]]...
 |-
 | 5.1
@@ Line 409: / Line 413: @@
 | 7.0.2
 | 7.0.3
+| 7.0.4
 |-
 | [[Absinthe]]
 | {{no}}
 | {{yes|2.0-2.0.4}}
-| colspan="8" {{no}}
+| colspan="9" {{no}}
 |-
 | [[evasi0n]]
@@ Line 419: / Line 424: @@
 | colspan="3" {{yes|1.0}}
 | {{yes|1.4}}
-| colspan="4" {{no}}
+| colspan="5" {{no}}
 |-
 | [[redsn0w]]
 | {{no}}
 | {{yes|0.9.12b1}}
-| colspan="8" {{no}}
+| colspan="9" {{no}}
 |}
@@ Line 431: / Line 436: @@
 |-
 ! rowspan="2" | [[Jailbreak]] Tool
-! colspan="8" | Works with [[firmware]]...
+! colspan="9" | Works with [[firmware]]...
 |-
 | 6.0
@@ Line 441: / Line 446: @@
 | 7.0.2
 | 7.0.3
+| 7.0.4
 |-
 | [[evasi0n]]
 | colspan="3" {{yes|1.0}}
 | {{yes|1.4}}
-| colspan="5" {{no}}
+| colspan="6" {{no}}
 |}
@@ Line 452: / Line 458: @@
 |-
 ! rowspan="2" | [[Jailbreak]] Tool
-! Works with [[firmware]]...
+! colspan="2" | Works with [[firmware]]...
 |-
 | 7.0.3
+| 7.0.4
 |-
 | [[evasi0n]]
-| {{no}}
+| colspan="2" {{no}}
 |}
@@ Line 464: / Line 471: @@
 |-
 ! rowspan="2" | [[Jailbreak]] Tool
-! colspan="9" | Works with [[firmware]]...
+! colspan="10" | Works with [[firmware]]...
 |-
 | 6.0
@@ Line 475: / Line 482: @@
 | 7.0.2
 | 7.0.3
+| 7.0.4
 |-
 | [[evasi0n]]
 | colspan="4" {{yes|1.0}}
 | {{yes|1.4}}
-| colspan="4" {{no}}
+| colspan="5" {{no}}
 |}
@@ Line 486: / Line 494: @@
 |-
 ! rowspan="2" | [[Jailbreak]] Tool
-! Works with [[firmware]]...
+! colspan="2" | Works with [[firmware]]...
 |-
 | 7.0.3
+| 7.0.4
 |-
 | [[evasi0n]]
-| {{no}}
+| colspan="2" {{no}}
 |}
@@ Line 500: / Line 509: @@
 |-
 ! rowspan="2" | [[Jailbreak]] Tool
-! colspan="24" | Works with [[firmware]]...
+! colspan="25" | Works with [[firmware]]...
 |-
 | [[Apex 8A293 (iPhone 4 GSM)|4.0]]
@@ Line 526: / Line 535: @@
 | [[Innsbruck 11A501 (iPhone 4 GSM)|7.0.2]]
 | [[InnsbruckTaos 11B511 (iPhone 4 GSM)|7.0.3]]
+| [[InnsbruckTaos 11B554a (iPhone 4 GSM)|7.0.4]]
 |-
 | [[Absinthe]]
@@ Line 531: / Line 541: @@
 | {{yes|2.0}}
 | {{yes|2.0.2}}
-| colspan="8" {{no}}
+| colspan="9" {{no}}
 |-
 | [[evasi0n]]
@@ Line 537: / Line 547: @@
 | colspan="3" {{yes|1.0}}
 | {{yes|1.4}}
-| colspan="4" {{no}}
+| colspan="5" {{no}}
 |-
 | [[Greenpois0n (jailbreak)|greenpois0n]]
@@ Line 543: / Line 553: @@
 | {{yes|RC4}}
 | {{yes|RC5-RC6.1}}
-| colspan="19" {{no}}
+| colspan="20" {{no}}
 |-
 | [[limera1n]]
 | colspan="4" {{yes}}
-| colspan="20" {{no}}
+| colspan="21" {{no}}
 |-
 | [[PwnageTool]]
@@ Line 561: / Line 571: @@
 | {{no}}
 | colspan="2" {{yes|5.1.1}}
-| colspan="8" {{no}}
+| colspan="9" {{no}}
 |-
 | [[redsn0w]]
@@ Line 579: / Line 589: @@
 | {{partial|0.9.15b1<sup>1</sup>}}
 | colspan="4" {{partial|0.9.15b1<sup>4</sup>}}
-| colspan="3" {{no}}
+| colspan="4" {{no}}
 |-
 | [[Saffron]]
 | colspan="5" {{no}}
 | colspan="4" {{yes}}
-| colspan="15" {{no}}
+| colspan="16" {{no}}
 |-
 | [[sn0wbreeze]]
@@ Line 602: / Line 612: @@
 | {{yes|2.9.10}}
 | {{partial|2.9.14<sup>1</sup>}}
-| colspan="3" {{no}}
+| colspan="4" {{no}}
 |-
 | [[Star]]
 | colspan="2" {{yes}}
-| colspan="22" {{no}}
+| colspan="23" {{no}}
 |-
 | [[unthredera1n]]
 | colspan="5" {{no}}
 | colspan="11" {{yes}}
-| colspan="8" {{no}}
+| colspan="9" {{no}}
 |}
 <sup>1</sup> [[Tethered jailbreak]].<br />
@@ Line 622: / Line 632: @@
 |-
 ! rowspan="2" | [[Jailbreak]] Tool
-! colspan="8" | Works with [[firmware]]...
+! colspan="9" | Works with [[firmware]]...
 |-
 | [[Sundance 10A403 (iPhone 4 (Rev A) GSM)|6.0]]
@@ Line 632: / Line 642: @@
 | [[Innsbruck 11A501 (iPhone 4 GSM Rev A)|7.0.2]]
 | [[InnsbruckTaos 11B511 (iPhone 4 GSM Rev A)|7.0.3]]
+| [[InnsbruckTaos 11B554a (iPhone 4 GSM Rev A)|7.0.4]]
 |-
 | [[evasi0n]]
 | colspan="3" {{yes|1.0}}
 | {{yes|1.4}}
-| colspan="4" {{no}}
+| colspan="5" {{no}}
 |-
 | [[redsn0w]]
 | colspan="5" {{partial|0.9.15b3}}
-| colspan="3" {{no}}
+| colspan="4" {{no}}
 |-
 | [[sn0wbreeze]]
@@ Line 646: / Line 657: @@
 | {{yes|2.9.10}}
 | {{partial|2.9.14<sup>1</sup>}}
-| colspan="3" {{no}}
+| colspan="4" {{no}}
 |}
@@ Line 655: / Line 666: @@
 |-
 ! rowspan="2" | [[Jailbreak]] Tool
-! colspan="18" | Works with [[firmware]]...
+! colspan="19" | Works with [[firmware]]...
 |-
 | [[Phoenix 8E128 (iPhone 4 CDMA)|4.2.5]]
@@ Line 675: / Line 686: @@
 | [[Innsbruck 11A501 (iPhone 4 CDMA)|7.0.2]]
 | [[InnsbruckTaos 11B511 (iPhone 4 CDMA)|7.0.3]]
+| [[InnsbruckTaos 11B554a (iPhone 4 CDMA)|7.0.4]]
 |-
 | [[Absinthe]]
@@ Line 681: / Line 693: @@
 | {{no}}
 | {{yes|2.0}}
-| colspan="8" {{no}}
+| colspan="9" {{no}}
 |-
 | [[evasi0n]]
@@ Line 687: / Line 699: @@
 | colspan="3" {{yes|1.0}}
 | {{yes|1.4}}
-| colspan="4" {{no}}
+| colspan="5" {{no}}
 |-
 | [[Greenpois0n (jailbreak)|greenpois0n]]
 | {{no}}
 | {{yes|RC5 b4-RC6.1}}
-| colspan="16" {{no}}
+| colspan="17" {{no}}
 |-
 | [[PwnageTool]]
@@ Line 701: / Line 713: @@
 | colspan="3" {{no}}
 | {{yes|5.0.1}}
-| colspan="10" {{no}}
+| colspan="11" {{no}}
 |-
 | [[redsn0w]]
@@ Line 716: / Line 728: @@
 | {{partial|0.9.14b1<sup>1</sup>}}
 | colspan="4" {{partial|0.9.15b3<sup>3</sup>}}
-| colspan="3" {{no}}
+| colspan="4" {{no}}
 |-
 | [[Saffron]]
 | {{no}}
 | colspan="3" {{yes}}
-| colspan="14" {{no}}
+| colspan="15" {{no}}
 |-
 | [[sn0wbreeze]]
@@ Line 736: / Line 748: @@
 | {{yes|2.9.10}}
 | {{partial|2.9.14<sup>1</sup>}}
-| colspan="3" {{no}}
+| colspan="4" {{no}}
 |-
 | [[unthredera1n]]
 | {{no}}
 | colspan="9" {{yes}}
-| colspan="8" {{no}}
+| colspan="9" {{no}}
 |}
 <sup>1</sup> [[Tethered jailbreak]].<br />
@@ Line 751: / Line 763: @@
 |-
 ! rowspan="2" | [[Jailbreak]] Tool
-! colspan="14" | Works with [[firmware]]...
+! colspan="15" | Works with [[firmware]]...
 |-
+| 5.0
-| [[Telluride 9A334 (iPhone 4S)|5.0]]
-| [[Telluride 9A405 (iPhone 4S)|5.0.1 (9A405)]]
+| 5.0.1 (9A405)
 | [[Telluride 9A406 (iPhone 4S)|5.0.1 (9A406)]]
+| 5.1
-| [[Hoodoo 9B179 (iPhone 4S)|5.1]]
+| 5.1.1
-| [[Hoodoo 9B206 (iPhone 4S)|5.1.1]]
+| 6.0
-| [[Sudance 10A405 (iPhone 4S)|6.0]]
+| 6.0.1
-| [[Sudance 10A523 (iPhone 4S)|6.0.1]]
+| 6.1
-| [[Brighton 10B142 (iPhone 4S)|6.1]]
+| 6.1.1
-| [[Brighton 10B145 (iPhone 4S)|6.1.1]]
+| 6.1.2
-| [[Brighton 10B146 (iPhone 4S)|6.1.2]]
+| 6.1.3
-| [[BrightonMaps 10B329 (iPhone 4S)|6.1.3]]
+| 7.0
-| [[Innsbruck 11A465 (iPhone 4S)|7.0]]
+| 7.0.2
-| [[Innsbruck 11A501 (iPhone 4S)|7.0.2]]
+| 7.0.3
-| [[InnsbruckTaos 11B511 (iPhone 4S)|7.0.3]]
+| 7.0.4
 |-
 | [[Absinthe]]
@@ Line 772: / Line 785: @@
 | {{no}}
 | {{yes|2.0}}
-| colspan="9" {{no}}
+| colspan="10" {{no}}
 |-
 | [[evasi0n]]
@@ Line 779: / Line 792: @@
 | {{yes|1.3}}
 | {{yes|1.4}}
-| colspan="9" {{no}}
+| colspan="5" {{no}}
 |-
 | [[redsn0w]]
@@ Line 787: / Line 800: @@
 | {{no}}
 | {{yes|0.9.12b1}}
-| colspan="9" {{no}}
+| colspan="10" {{no}}
 |}
@@ Line 794: / Line 807: @@
 |-
 ! rowspan="2" | [[Jailbreak]] Tool
-! colspan="10" | Works with [[firmware]]...
+! colspan="11" | Works with [[firmware]]...
 |-
 | 6.0
@@ Line 806: / Line 819: @@
 | 7.0.2
 | 7.0.3
+| 7.0.4
 |-
 | [[evasi0n]]
 | colspan="4" {{yes|1.0}}
 | {{yes|1.4}}
-| colspan="5" {{no}}
+| colspan="6" {{no}}
 |}
@@ Line 817: / Line 831: @@
 |-
 ! rowspan="2" | [[Jailbreak]] Tool
-! colspan="3" | Works with [[firmware]]...
+! colspan="4" | Works with [[firmware]]...
 |-
 | 7.0.1
 | 7.0.2
 | 7.0.3
+| 7.0.4
 |-
 | [[evasi0n]]
-| colspan="3" {{no}}
+| colspan="4" {{no}}
 |}
@@ Line 831: / Line 846: @@
 |-
 ! rowspan="2" | [[Jailbreak]] Tool
-! colspan="3" | Works with [[firmware]]...
+! colspan="4" | Works with [[firmware]]...
 |-
 | 7.0.1
 | 7.0.2
 | 7.0.3
+| 7.0.4
 |-
 | [[evasi0n]]
-| colspan="3" {{no}}
+| colspan="4" {{no}}
 |}
@@ Line 847: / Line 863: @@
 |-
 ! rowspan="2" | [[Jailbreak]] Tool
-! colspan="8" | Works with [[firmware]]...
+! colspan="9" | Works with [[firmware]]...
 |-
 | 6.0
@@ Line 857: / Line 873: @@
 | 7.0.2
 | 7.0.3
+| 7.0.4
 |-
 | [[evasi0n]]
 | colspan="3" {{yes|1.0}}
 | {{yes|1.4}}
-| colspan="4" {{no}}
+| colspan="5" {{no}}
 |}