A complete guide on how to use RP2350 to pwn DFU for apple A12 and A13 devices, we are using RP2350 board on this tutorial
usbliter8 BootROM exploit, which uses an RP2350-based board such as the Raspberry Pi Pico 2 to put supported Apple A12/A13 devices into PWNED DFU. It was publicly reported in June 2026 and targets a vulnerability in the USB controller/BootROM, so it isn't something Apple can fix with a normal iOS update.
Basic setup
You generally need:
- Raspberry Pi Pico 2 / RP2350
- Appropriate usbliter8 firmware
- USB cable for the RP2350
- Lightning-to-USB-A cable for the A12/A13 device
- An iPhone/iPad supported by the exploit
- A Mac/PC for the subsequent DFU operation NOTE: Currently Supported devices include iPhone XR, XS/XS Max, iPhone 11/11 Pro/11 Pro Max, iPhone SE 2, and several A12/A13 iPads.
How the workflow works
- Put the A12/A13 device into normal DFU mode.
- Connect the Apple device to the RP2350 hardware pwner.
- The RP2350 sends the specially crafted USB interaction used by usbliter8.
- The BootROM vulnerability is triggered.
- If successful, the device changes to PWNED DFU.
- Disconnect the iPhone/iPad from the RP2350 and connect it to your computer.
- You can then perform the legitimate research/recovery operations supported by the software you're using.
A successful exploit is commonly identified by a PWN:[usbliter8] indication. Reports put the actual exploitation stage at well under a couple of seconds.
Important distinction: the RP2350 isn't itself "unlocking" the iPhone. It is acting as the USB hardware needed to trigger the BootROM vulnerability. The subsequent capabilities depend on what software/ramdisk is loaded after PWNED DFU.