palera1n running on a Samsung Galaxy S3 (ARMv7, 1GB RAM) running postmarketOS. checkm8 hit on the first attempt. Officially "unsupported." Demonstrably works.
The full chain: Pixel 4A → SSH → Galaxy S3 (postmarketOS) → USB OTG → iPhone X. Each step documented with real screenshots from a live run.
The Galaxy S3's Linux USB host stack is precise enough to hit the checkm8 UaF race condition reliably — something that takes 10–15 retries on x86 palen1x. PongoOS boots and displays the palera1n boot logo on the iPhone screen.
PongoOS uploads the KPF module, patches the kernel, sets rootdev=md0, and fires bootx. The verbose kernel boot fills the iPhone screen. The S3 terminal shows "Booting Kernel..." and returns to prompt — job done.
Fully booted into iOS with rootful palera1n jailbreak active and Broque Ramdisk iCloud bypass persisted via system directory hooks. The Galaxy S3 is now a hardware key — plug in to unlock after every reboot.
| Feature | Status |
|---|---|
| checkm8 exploit (Checkmate!) | ✓ Confirmed |
| PongoOS boot | ✓ Confirmed |
| Kernel boot | ✓ Confirmed |
| Rootful jailbreak (-f) | ✓ Confirmed |
| iCloud bypass (Broque Ramdisk) | ✓ Confirmed |
| Rootless jailbreak (-l) | ✓ Confirmed |
| --pongo-shell | ✓ Confirmed |
| --force-revert | ? Untested ( should work ) |
s3ra1n ships as a Python wrapper around the official palera1n v2.2.0 armel binary. Clone the repo, drop the binary, run the script — interactive menu handles everything else.