Caution
By following this guide, you're responsible for any damage that could be done to your device. Be careful for any commands you're going to run.
Some parts are based on dualbootfun.
Tested iOS versions: 14.8 and 16.5
-
iPhone/iPad running i(Pad)OS 16.7RC or earlier (anything below iOS 17 supporting TrollStore) Note that this guide does not cover iOS 17.0 as
/var
and/var/mobile
are split into separate volumes. I'm not sure about unintended behaviors there so don't try if you have iOS 17.0, unless it's a checkm8-vulnerable iPad. -
Have Filza installed through TrollStore
-
Have terminal, command line knowledge. Most of the following commands require root privilege.
-
Have responsibility if anything happens
# If /dev folder contains disk0s1sX (iOS 15.x and earlier), replace disk1 with disk0s1
newfs_apfs -A -v DataB /dev/disk1
# "disk1s8" is an example. Replace it with your newly created volume
mount_apfs /dev/disk1s8 /private/var/mnt
- Download var.tar.xz, then use Filza to extract all folders and move them into
/var/mnt
. Be sure to check folders’ permissions and ownership. - Copy Filza’s app bundle (UUID folder) to
/var/mnt/containers/Bundle/Application
- Copy
/var/containers/Data/System/com.apple.mobileactivationd
to/var/mnt/containers/Data/System
- Copy
/var/keybags
,/var/lib
and/var/wireless
to/var/mnt/
- Copy
/var/root/Library/Lockdown
to/var/mnt/root/Library/
- Copy
/var/root/Library/Catacomb
to/var/mnt/root/Library/
umount -f /var/mnt
Important
Userspace reboot while your new data volume is mounted will enter recovery mode (you can safely exit). Instead, use the kill command described below.
- Mount the newly created volume on top of
/private/var
- Set
-1
as kill pid to kill all processes except launchd, restarting all daemons to use the mounted /var
# “disk1s8” is an example. Replace it with your volume
mount_apfs /dev/disk1s8 /private/var && kill -TERM -1
- During boot, you may see Apple logo with a progress bar just like factory reset and software update. This is normal.
- Once booted up, you may be greeted with Activation Locked screen instead of Hello screen. This is normal.
- Continue setting up as normal, it won’t ask for your Apple ID right away but will keep spamming with alerts once you get to Home Screen.
- Don't forget to block OTA after finish setting up.
- Enjoy!
If you have one of system apps already installed in second /var, simply overwrite its main executable with PersistenceHelper.
- After logging in to your Apple ID, you may get numerous failures across Apple apps. Simply reboot your device and boot to your secondary var again, or run
kill -TERM -1
as described above.
- Solved, see above for solution