Tutorials Browse All Help Topics ! You can also share related tutorial here to advertising for you !

About MFC Ramdisk bypass iPhone & iPad Device function

Compatible Software Version
Author By

MFC Ramdisk function is used for devices like iPhone and iPad to bypass iCloud password and lock screen without jailbreaking, also for research, product development, etc. and this function is unlimited if you have a valid membership of mfc software (no additional fee or credits required, MFC software version must be 4.0 or later)

Main functions:

A, Bypass ICloud - For user who lost the iCloud email and password , if the device did not do factory default reset by software, after bypass still can use the device as normal
B, Bypass Lock Screen - usually the device already did factory default reset, so may show you a "Hello" Screen, After bypass the device will not able the network
C. Read iCloud account informations
D. Free up device space

Support Models:

A, iPhone SE、6s、6s Plus、7、7 Plus、8、8 Plus and iPhone X
B, iPad some models
C. More models coming soon

System Requirements:

- All Windows 10/ Windows 11 (Recommend Win10 64 bit)

Follow these simple steps:

1. Open the mfc software and log in
2. Put your device into DFU mode and connect to mfc software (Cable can be Lightning to USB, the DCSD not required)
3. Double-click to select the device in the detected list
4. Navigate to the ramdisk tab and press "connect" and wait for the process to complete
5. Press the "Backup Activation" button to do backup. You can manually check the backup files (usually the backup files is located in c:/mfc/iBackups/xxxx, and the path is also can find in the operation log)
6. Press "Exit & Reboot " button then do factory default reset for the device via mfc restore function and then back to ramdisk tab repeat above steps 1-4
7,At the end press the "Restore Activation" button, once finish Press "Exit & Reboot " , All Done

Ps. if device is already did factory default reset ("Hello" Screen),  Go to Ramdisk tab, put device in normal mode and Do step 1 (Get Hello), then Go to Diag option tab change the serial number (FCHP606DG07R), once done go back to Ramdisk tab continue with Step 2 (Inject Hello), the last step is Normal Activation.

Here is a full logs for steps 1-4

[info] Connecting using DFU ...
[info] Installing USB driver for device: "Apple Mobile Device (DFU Mode)" (05AC:1227).
[info] Thread priority before boost is 0x2
[info] Current thread priority is 0xf
[info] stage 1, heap grooming ...
[info] Reset result: Success
[info] stage 2, aquired
[info] stage 3, exploit
[info] Uploading payload
[done] Device is now in pwned DFU Mode! :D
[info] Loading required files ...
[info] Finished loading required files ...
[info] Successfully patched signature checks!
[info] Heap repaired.
[info] Shsh sent (file size:63144 bytes)
[info] iBss sent (file size:1471378 bytes)
[info] iBec sent (file size:1471378 bytes)
[info] Devicetree sent (file size:40461 bytes)
[info] Ramdisk sent (file size:120590612 bytes)
[info] Adc sent (file size:13269959 bytes)
[info] Rdtrust sent (file size:12226 bytes)
[info] Kernel sent (file size:18721200 bytes)
[info] Connecting...
[info] Ramdisk ramdisk tool jun 29 2020 00:18:13 assigned to current device!
[info] Connecting to ramdisk!
[erro] ssh>connecting to Socket error: disconnected
[info] Loading /mnt2
[info] Calling requested function!
[info] Starting sesison!
[info] Disconnecting ...
[info] Connecting ...
[info] ssh_userauth_password
[info] Ramdisk SCPConnection session init required ...
[info] Sending SSH command...
[info] Sending SSH command successfull!
[info] Ramdisk SCPConnection session init completed!
[info] Listing path /mnt2
[info] Disconnecting SSHSession
[info] Finished listing 1 files in 32 dirs
[info] New root loaded: /mnt2
[done] Current root dir: /mnt2


What is different between Restore Full Dir & Restore Activation ?

A: Restore Activation, this only restore the activation data

A: Restore Full Dir, restore the data you backuped by yourself

How is work ?
Restore Activation : This is through the software to automatically restore the backup data
Restore Full Dir : this you can holding down"shift" key and select related data folder to restore
Both functions are support manual data restore by holding down the "shift" key to select the relevant data folder
{erro] Exploit failed! end:(

A: This is a data communication error, please put the idevice back into DFU mode again and repeat above steps

[erro] ssh>connecting to Socket error: disconnected

A: Usually displayed when Connecting to ramdisk, Generally the software will automatically retry the connection, and start load idevice data directory. by default is mnt2

Can i rename or modify the data structure under c:/mfc

A: If you can't understand what the data does, it's best not to do it

How can I make sure that the activation data I am backing up is correct

A: Regarding the backup of activation data, according to the state of the device, Generally, the data structure is as follows: (Data locate at c:/mfc)


[warn] Failed to install usb driver! Error:Operation timed out

A: You need manually update the driver in device manager (Apple Mobile Device(DFU Mode)(libusbK)), locate : C:/MFC/usb_driver , Do not apply wrong driver which can case blue screen


This tool is only for personal study and research purposes, please do not used for commercial purposes, do not do anything illegal things, otherwise you need take all responsibility.



Do you think this tutorial is helpful?

These might also can help you with