A rootless arm64/arm64e TLS trust and certificate-pinning bypass for authorized iOS security testing. It is designed for the modern Dopamine + ElleKit environment and includes a standalone Home Screen control app.
Caution
Enabling this tweak deliberately disables TLS certificate validation in supported processes. Anyone able to intercept the device's traffic may be able to read or modify sensitive data. Use a dedicated research device, only on systems you are authorized to test, and disable the bypass when testing is complete.
| Environment | Status |
|---|---|
| iPhone12,1, iOS 18.4.1 (22E252), Dopamine rootless, ElleKit 1.2, arm64e | Runtime verified |
| arm64 rootless devices | Built and statically validated; runtime coverage may vary |
| iOS 26-era rootless Dopamine/ElleKit | Targeted by the build and public API strategy, but not yet runtime verified |
| Rootful jailbreaks | Not supported by this package layout |
The project is compiled with an iOS 26 SDK and a minimum deployment target of iOS 15. Runtime behavior is verified on iOS 18.4.1; do not interpret that as a claim that every iOS 26 build or jailbreak configuration has been tested.
SecTrustEvaluateSecTrustEvaluateWithErrorSecTrustEvaluateAsyncSecTrustEvaluateAsyncWithErrorSecTrustGetTrustResultsec_protocol_options_set_verify_block- Public
NSURLSessionserver-trust delegate challenges - Common AFNetworking
AFSecurityPolicychecks - Common TrustKit validator checks
Direct BoringSSL callback replacement is intentionally disabled on arm64e. Blindly substituting private BoringSSL callbacks causes pointer-authentication failures on modern hardware. Apps that ship a completely private TLS stack or compare certificate/SPKI hashes outside these paths may still require a targeted hook.
SpringBoard, Sileo, Dopamine, Frida server, SSH, the control app, and several other jailbreak control processes are excluded for stability.
Requirements:
- A rootless Dopamine jailbreak
- ElleKit
- UIKit Tools (
uicache) - A trusted CA certificate for Burp Suite, mitmproxy, or another authorized interception proxy
Install the .deb from the Releases page:
scp com.offsetsecurity.universaltrustbypass_0.3.2_iphoneos-arm64.deb root@iphone:/var/jb/tmp/
ssh root@iphone
dpkg -i /var/jb/tmp/com.offsetsecurity.universaltrustbypass_0.3.2_iphoneos-arm64.debThe package registers OFFSET Trust Bypass as a Home Screen app and enables the broad profile. Open the app to confirm the switch is on. Force-close and reopen each target app after changing the switch.
No respring is normally required. If SpringBoard has not refreshed the icon database, run:
uicache -p /var/jb/Applications/OffsetTrustBypass.app- Install the interception proxy's CA profile on the device.
- Enable full trust under Settings → General → About → Certificate Trust Settings.
- Configure the Wi-Fi HTTP and HTTPS proxy.
- Open OFFSET Trust Bypass and enable the switch.
- Force-close and reopen the target app.
The trusted CA and this bypass solve different problems: the CA handles ordinary system trust, while this tweak neutralizes pinning and custom trust decisions in covered paths.
The 0.3.2 device validation covered:
- Offline self-signed trust rejection while disabled and acceptance while enabled
- A deliberately rejecting
NSURLSessiondelegate - A live self-signed HTTPS endpoint
- Safari/WebKit networking
- App Store plus
appstored,itunesstored, and Apple Media Services traffic through Burp - Apple Invites 508.1 traffic to
gateway.icloud.comthrough Burp with successful responses - Protected-process and recent-crash checks after enabling the broad profile
The package includes an offline invalid-certificate test, a live self-signed endpoint test, and a deliberately rejecting NSURLSession delegate test:
offset-trust-bypass-selftestThe self-test restores the bypass to off when it exits. Re-enable it from the Home Screen app afterward.
You can also run individual probes:
offset-tls-probe --offline-only
offset-tls-probe https://self-signed.badssl.com/
offset-tls-probe --delegate-pin-test https://example.com/A successful enabled test should report a nonzero hook_mask, offline_self_signed_allowed=true, and a successful HTTP result. A disabled test should report hook_mask=0x0 and reject the invalid certificate.
The Home Screen app is the normal control surface. Equivalent commands are available over SSH:
offset-trust-bypass-mode status
offset-trust-bypass-mode all
offset-trust-bypass-mode safari
offset-trust-bypass-mode appstore
offset-trust-bypass-mode canary
offset-trust-bypass-mode offMode changes apply to newly launched processes. Force-close and reopen affected apps.
Emergency disable:
offset-trust-bypass-mode offBuild requirements on macOS:
- Xcode with an iPhoneOS SDK
clangthroughxcrunldiddpkg-debsips
Then run:
make packageThe package is written under build/. The build emits universal arm64 + arm64e binaries and runs compiler static analysis before packaging.
The tweak dynamically resolves ElleKit's MSHookFunction and MSHookMessageEx, installs the low-level Security and Network hooks immediately, and rescans Objective-C classes when new images load. The NSURLSession coverage hooks delegate implementations that explicitly handle server-trust challenges, which closes a common gap left by trust-only bypasses.
The enable state is stored in a device-wide mobile-user preference domain. The control app is excluded from injection and writes the same preference consumed by root and mobile processes. Disabling does not attempt to unpatch an already running process; relaunching is the safe boundary.
This project exists because of the work pioneered by the original iOS SSL Kill Switch from iSEC Partners and SSL Kill Switch 2 by Alban Diquet (@nabla_c0d3). SSL Kill Switch 2 demonstrated the practical value of a system-wide black-box pinning bypass and added App Store and TrustKit coverage.
OFFSET Trust Bypass is an independent modern implementation for rootless Dopamine/ElleKit and arm64e pointer authentication. It does not copy source from those projects, but it gratefully credits their design goal and the research path they established.
ElleKit and Dopamine are separate projects owned by their respective maintainers.
MIT. See LICENSE.
This tool is for security research performed on devices and applications you own or are explicitly authorized to test. You are responsible for complying with applicable law, program rules, and engagement scope.