This guide will show you how to get around the Activation Failed error on a A9-based iDevice that is running iOS 9.
You must be running a version of iOS 9 that is between 9.2 and 9.3.3 for this to work. You will also need access to a computer running macOS or Linux.
The first step is to back up activation records from a newer version of iOS. If you have downgraded your device with turdus_merula, just restore back to a newer version. If you have a device that was never updated, dump your shsh blobs, then update to a newer version. You can downgrade untethered back to iOS 9 with turdus merula if you have shsh blobs saved.
You can grab these files from any newer jailbroken version of iOS - I've always used 10.3.3 because it's easy to jailbreak and I can confirm that it works this way.
1. Jailbreak your device and install Filza File Manager and OpenSSH from Cydia.
2. Open Filza and back up the following files/directories to another folder on the phone - where doesn't matter, you just have to make sure you know where you saved them to.
/private/var/mobile/library/FairPlay - Back up this folder.
/private/var/mobile/containers/Data/System - Find the folder that is labelled com.apple.mobileactivationd. Back up the Libary folder that is inside that directory.
/private/var/wireless/Library/Preferences/ - Back up the com.apple.commcenter.device_specific_nobackup.plist file.
/System/Library/Caches/com.apple.factorydata - Back up this directory.
3. Once these files are all backed up to a folder, use FileZilla on your computer to connect to the device with SSH. Set FileZilla to connect via SFTP, not FTP. The host address will be the local IP address of your phone (click on your WiFi network in settings to find this). The port will be 22. The username will be root, and the password alpine (unless you've changed it). If the computer fails to connect to the device, reinstall OpenSSH in Cydia and try again - it should work.
4. Once connected, find the directory you backed up all of those files to, and copy them to your computer.
5. Restore the device back to iOS 9.
1. Download Legacy iOS Kit and boot an SSH Ramdisk on the device (under Useful Utilities). After it boots, chose the option to connect to SSH.
2. Run the command mount_hfs /dev/disk0s1s1 /mnt1.
3. Open FileZilla again, and connect to the device. This time, you'll want to enter the localhost IP address (127.0.0.1 with a port address) that is shown in the terminal. The username and password are the same as before.
4. We will now need to manually move some jailbreak-related files onto the device. Download them from here.
5. Copy Cydia.app, MTerminal.app, and iFile.app to /mnt1/Applications. Two files will fail to transfer - this won't cause any issues. Once copied, right click on each, chose set permissions, and then for each .app directory, set the permissions to 777 and check the box to made this recursively apply to all folders and files within the directory.
6. In the terminal SSH connection, run nvram oblit-inprogress=5. This will set it so that the device will erase all content and settings the next time it is rebooted.
7. Reboot the phone. If you're tether downgraded, tether boot it once. You should see a progress bar with no Apple Logo. Once this finishes and the device reboots again, enter it back into the SSH ramdisk. Remember to mount /mnt1 again.
8. Copy cydia.tar to /mnt1.
9. Run the following command in the terminal to extract the tar archive: tar --preserve-permissions --no-overwrite-dir -xvf /mnt1/cydia.tar -C /mnt1
10. Copy the launchctl file to /bin, /sbin, and /usr/bin. Add 777 permissions to each.
11. Copy .cydia_no_stash to /mnt1.
12. Create a directory in /mnt1 called "new_dpkg" or something similar, then copy the dpkg folder into it.
13. In the ramdisk terminal, run the command mv /mnt1/Applications/Setup.app /mnt1. This will temporarily bypass Setup.app so that we can finish setting up the hacktivation.
14. Exit the ramdisk and boot the device.
15. You should now be at the lock screen. Connect to WiFi, then open safari and navigate to jbme.ddw.nt. Hit the go button to jailbreak the device. This page only reactivates an existing jailbreak, and does not install Cydia - that's why we had to do that manually.
16. Once it finishes and tells you to lock the device, lock it. It won't actually respring, so you should just press the power or home buttons once, then go back to the homescreen. You should now be jailbroken. If MTerminal and iFile open, but Cydia crashes, you will have to open MTerminal, run "su" to log in as root, and re-run thet tar extraction command from earlier - leaving off the "mnt1". This will only be required on certain iOS versions though - 9.3.3 has not needed this any of the times I've done it.
17. Cydia will open at this point, but dpkg will likely not work properly. I think this is also version dependant. If it doesn't work, here's how to fix it:
Open MTerminal, then run su to log in as root. Type the command rm -R /usr/lib/dpkg to delete the broken copy of dpkg from the device. Then, type mv /new_dpkg/dpkg /usr/lib. Double check in iFile that we have successfully moved the new copy to the /usr/lib directory. Then, go back to MTerminal and type cd /var, then run mkdir lib to create a "lib" directory. Then, enter ln -S /usr/lib/dpkg /var/lib, which will make it so that when Cydia tries to load a dpkg-related file from /var/lib/dpkg, it will automatically link it to /usr/lib/dpkg.
If you've done everything correctly, Cydia should now be working.
1. In Cydia, install Filza and OpenSSH.
2. Connect to the device over SSH in FileZila again. Like last time, if you can't connect, reinstall OpenSSH in Cydia and it should start working.
3. Copy the FairPlay folder to /private/var/mobile/Library
4. In the Library folder we backed up from mobileactivationd, there should be in internal folder. Inside that, there should be a file called data_ark.plist. Find the mobileactivationd folder on your device. In FileZilla, it will only show you the random GUID - use Filza to figure out which of the folders in /private/var/containers/data/system is mobileactivationd. Then, copy that data_ark.plist file into the /Library/internal folder on the device, overwriting the one that's there.
5. Copy the com.apple.commcenter.device_specific_nobackup.plist you saved to /private/var/wireless/Library/Preferences, overwriting the one that's there.
6. Copy the com.apple.factorydata folder we saved to /System/Library/Caches/ on the device, overwriting the one that's there.
1. In the backup of mobileactivationd you made, there should be an activation_records folder with a plist inside of it. Copy it to /private/var/mobile/Library/mad/activation_records (create the activation_records directory if it is missing). Also copy it to /private/var/root/Libary/Lockdown/activation_records/, again, creating the activation_records directory if it is missing. At this point
2. Move Setup.app back into the /Applications directory.
3. Run uicache in Terminal.
4. Reboot your device. You should now be "activated", and able to complete setup as normal. Most functions that require an activated device should work, but sideloading (without AppSync) may still not work.
1. In Filza, navigate to /private/var/mobile/Library/Caches/ and open com.apple.MobileGestalt.plist. Under the cacheextra dropdown, add a new key. Set the type to boolean, and the value to YES. In the data box, enter a6vjPkzcRjrsXmniFsm0dg. Save the plist.
2. In the backup of mobileactivationd you made, there should be an activation_records folder with a plist inside of it. Copy it to /private/var/mobile/Library/mad/activation_records (create the activation_records directory if it is missing). Also copy it to /private/var/root/Libary/Lockdown/activation_records/, again, creating the activation_records directory if it is missing. At this point
2. Move Setup.app back into the /Applications directory.
3. Run uicache in Terminal.
4. Reboot your device. You should now be "activated", and able to complete setup as normal. Most functions that require an activated device should work, but sideloading (without AppSync) will still not work.
Guide adapted from marley.
Last Modified: April 13th, 2025