For a long time, iOS 9.3.5 was limited to semi-untethered jailbreaks, requiring you to re-run an app every time your device rebooted. However, as of March 2026, a full untethered jailbreak is now available for these legacy devices using a combination of the Phoenix tool and the iocaste untether. Core Components
: iOS 9.3.5 was the final firmware for many 32-bit devices. If you are on a 64-bit device (like an iPhone 5s or newer), these specific tools will not work. App Compatibility ios 9.3.5 untethered jailbreak
If you are looking for an iOS 9.3.5 untethered jailbreak, here is the definitive guide on what is possible today and how to do it. The Reality of Untethered vs. Semi-Untethered For a long time, iOS 9
is semi-untethered, requiring a "kickstart" after every reboot. It requires Odysseus method (stitching custom bootchain)
If you find someone selling an "iOS 9.3.5 untethered jailbreak" – it is a scam. No exceptions.
Upon first launch, Cydia will "Prepare Filesystem." This may take a few minutes. Once done, it will respring again.
Siguza’s approach was a callback to earlier, more hardware-agnostic methods. He exploited a vulnerability in the way iOS handles resource properties (specifically in IOKit), allowing for an arbitrary read/write primitive in the kernel. But to make it untethered, he bypassed KPP not by patching the kernel directly—which KPP would detect on the next reboot—but by patching the kernel’s data structures in memory only and then forcing a specific system daemon (which runs as root) to load a dynamic library. More importantly, the jailbreak embedded a bootstrap script into the filesystem that would be executed by launchd (the init process) early in the boot cycle. This script would then re-trigger the IOKit exploit before KPP had fully armed itself.