Jailbreaking Apple Watch
summary
Claims a working first public Apple Watch jailbreak that achieves kernel code execution on watchOS 2 and 3 by chaining a sandboxed app extension exploit to a kernel info leak and a use after free. Method dumps an encrypted kernel by leaking four bytes via crash panics taking more than 50 crashes over two weeks, builds read/write primitives, patches kernel to get root and disable code signing, remounts system, installs SSH and runs tools via SSH over Bluetooth proxy and direct Wi‑Fi, and demonstrates file exfiltration and runtime tooling like Frida.
AI-written summary · about
chapters (12)
- 0:00Introduction to Apple Watch
- 1:03Jailbreak objectives
- 2:12Security and attack strategy
- 4:07Vulnerabilities and exploits
- 6:49Kernel dumping techniques
- 9:41Kernel analysis and symbols
- 11:51WatchOS 3 exploitation
- 13:42Kernel patching and escalation
- 16:50System-level security bypass
- 19:23SSH and communication
- 23:23Proving the jailbreak
- 25:21Conclusion and Q&A
related talks
29miOS Runtime Manipulation (PWND)
44mExploiting Unpatched iOS Vulnerabilities for Fun and Profit
36mState Of IOS Jailbreaking In 2025
50mTake a Jailbreak -Stunning Guards for iOS Jailbreak-
49mJailbreaking The Apple HomePod: Fun With Checkm8 And Smart Speakers
40mIntroduction into Reverse Engineering and iOS Security
52mDeveloping Killer Apple Watch Applications
36mTesting iOS Apps without Jailbreak in 2018