Using a tool like Legacy iOS Kit (a Python script for Mac/Linux), you can downgrade your A5 device to iOS 6.1.3 and then install a true untethered jailbreak like p0sixpwn or Absinthe . Your iPhone 4s will then reboot into a jailbroken iOS 6 forever.
In the world of Apple’s iOS ecosystem, the term “jailbreak” refers to the process of removing software restrictions imposed by iOS, allowing root access to the operating system. Among the many versions of iOS, occupies a special place. Released in August 2016, it was primarily a patch for three critical zero-day vulnerabilities (known as Trident) used in targeted spyware attacks. For years, security researchers and jailbreak developers sought an untethered jailbreak for iOS 9.3.5 — one that survives a reboot without needing a computer to re-trigger the exploit. This essay explores why such a jailbreak was rare, the technical obstacles involved, and the eventual solutions that emerged, while emphasizing the broader implications for device security and user freedom.
This friction kept the dream of an solution alive. The community wanted a "set it and forget it" method. ios 9.3.5 untethered jailbreak
The pursuit of an has been a decade-long saga for legacy Apple device owners . As of May 2026 , the landscape has finally shifted, providing users with a definitive way to permanently jailbreak their 32-bit devices without needing a computer after every reboot. Current Status: Semi-Untethered vs. Fully Untethered
Before diving into the "how," it is crucial to understand the "what." In the world of iOS modding, the term "untethered" is the gold standard. Using a tool like Legacy iOS Kit (a
Since this is the definitive solution for 9.3.5, here is the safest installation method:
Before we hunt for the tool, we must understand the terminology. A jailbreak removes Apple’s sandbox restrictions, granting root access to the file system. Among the many versions of iOS, occupies a special place
The exploit primitives required for an untethered jailbreak have not been found in iOS 9.3.5's kernel or bootloader. Furthermore, the only people skilled enough to find them (Luca Todesco, Pangu Team, TaiG) have retired from jailbreaking or moved to 64-bit research.
Moreover, an untethered jailbreak typically requires a (e.g., in iBoot or the kernel’s early initialization) or a way to persistently install a modified kernelcache. After iOS 9, such low-level bugs became exceedingly rare and valuable — often worth millions on the zero-day market.