Since July 2025, certain A5 and A6-based iPhones and cellular iPads have been unable to activate. This affects devices which have an IMEI number beginning in 9900. Due to this, bypassing activation by renaming or moving Setup.App is necessary. On A6 devices, you can use Legacy iOS Kit to boot an SSH Ramdisk in order to make the necessary modifications from a computer. This is also possible on A5 devices, but booting a ramdisk relies on using the checkm8 exploit to put the phone in pwned DFU mode, which on A5 devices requires specialized hardware (Raspberry Pi Pico or Arduino with USB Host Shield) in order to use.
This guide will cover a new method of bypassing the activation that I discovered which does not require any specialized hardware, or even a computer if running iOS 8 or iOS 9.
You will need the following:
This process has been tested on iOS 9.3.6 and 6.1.3 so far. It is likely that any version in between these two will also work.
After setting up iOS on an affected device, you will be stuck in a loop where it attempts to activate, thinks it has, brings you to the "Welcome to iPhone" screen, and then as soon as you load the homescreen, it will re-open Setup.app and restart the process over again.
With no SIM card inserted, get your device to the Welcome to iPhone screen. If you get a message that activation has failed due to the device being unable to connect to the activation server, try again until it passes. This can take several tries sometimes. Once on the Welcome to iPhone screen, insert the SIM card. Wait until the indicator in the top left corner of the display changes from "No SIM" to "No Service" or "Searching" - some indication that it has detected the SIM card. This can take up to 1 minute in my testing, but sometimes happens within a couple seconds.
Once the phone detects the SIM card, prepare your SIM eject tool to eject the SIM. Eject the SIM card and immediately after, press the "Get Started" button. If successful, the device will load the home screen and then immediately after, the No SIM Card Inserted pop-up will appear. This seemingly blocks Setup.app from immediately re-opening.
On iOS 6, the glitch seems easier to trigger. Just inserting and removing the SIM card while the device is attempting to activate is often enough to glitch you directly to the home screen.
If you are unable to trigger the glitch, try varying the amount of time between when you eject the SIM card and when you press the Get Started button. In my experience, you usually have to perform these actions at the same time or close to it, but a couple times I've had to wait a second or so before pressing Get Started after ejecting the SIM.
Once on the home screen, dismiss the pop-up. You will now have somewhere between 30 seconds to 1 minute to use the device before it will detect that it isn't activated and re-enter the setup loop. On iOS 6, depending on how you trigger the glitch, the device may return to the activation screen after only 5-10 seconds. If this happens, repeat the glitch until this does not happen.
If on iOS 8 or 9, during this short period of time, you can quickly open Safari, load carbon.sep.lol, and jailbreak directly from Safari. If you are on iOS 6, you can instead attempt to jailbreak with Aquila. (I have not tested this yet).
Once jailbroken, install iFile, navigate to /Applications, and either rename Setup.App or move it into the root directory. After you do this, the activation loop should stop and you will be able to use the device as normal. You have now bypassed activation.
If you are running iOS 9, this process does still allow you to downgrade to iOS 8.4.1 or 6.1.3 if you want to. Once bypassed, just install OpenSSH from Cydia and then follow the instructions in Legacy iOS Kit to downgrade. Once downgraded, you will have to repeat the process to bypass activation on the new install.
Note that this process will still leave your device in an unactivated state. This means that sideloading applications with your Apple ID will not be possible, and certain Apple services will not function. You can still install apps by sideloading them with AppSync. This is the same outcome as if you used the old method which required checkm8-a5. There is currently no way of putting an affected device in a correctly activated state unless you have previously backed up valid activation tickets from your device.
Last Modified: July 10th, 2026