Broque Ramdisk Pro is a free iCloud Bypass software for iOS that can certainly come in clutch if you bought a secondhand device and it turned out locked or you got scammed.

I’ve been there before having purchased an iPhone X from eBay where the listing claimed it’s unlocked and works fine. Turns out the device was, in fact, iCloud Activation Locked and the seller was asking a whopping $200 extra to remove it from their account.

These kinds of scams are unfortunately quite frequent so tools for bypassing iCloud Activation are very common, however, many of them are paid or require you to purchase credits to use them.

Enter Broque Ramdisk Pro, a completely free iCloud Bypass tool for those of you who got scammed and are now stuck with a paperweight device.

What is Broque Ramdisk Pro?

Broque Ramdisk Pro for Windows and macOS, developed by iOS Nemes1s is a free iCloud Bypass tool based on the checkm8 BootROM exploit (CVE-2019-8900) released by axi0mX that works by creating a custom Ramdisk and booting it on compatible devices.

The ramdisk allows the user to bypass the Setup.app which is the OOBE application on iOS that handles (amongst other things) the iCloud Activation.

The way iOS activation works is by communicating with the Apple Albert server located at albert.apple.com which receives the request from the device, checks to see if that specific Serial Number / IMEI combo is locked to a certain Apple ID, and then returns a response.

The response received from the activation server can either be an HTML page in cases where the device is locked, or an Activation Ticket otherwise.

From my experience, the device sends its model, Serial Number, IMEI, SIM IMSI, SIM ICCID, iOS version as well as several randomness keys to the activation server. If any of these values is malformed the activation fails.

How does Broque Ramdisk Pro fix this?

The tool uses the checkm8 exploit and it works by exploiting the fact that devices can be factory-activated. It’s a state in which the device doesn’t ask for activation anymore because they are activated for debugging purposes.

The Setup.app also has its own configuration file called com.apple.purplebuddy.plist which we can abuse to add the following keys:

<key>SetupDone</key>
<true/>
<key>SetupFinishedAllSteps</key>
<true/>

This makes the Setup app believe all steps have already finished and won’t try to run again.

However, we still need to FactoryActivate the device using Broque because otherwise the lockdownd daemon would periodically check the activation status and spawn Setup.app.

TIP: Another way to bypass iCloud is to take advantage of the checkm8 exploit to unload the /usr/libexec/mobileactivationd daemon, or generate a fake Activation Ticket.

Here are some of the features of Broque Ramdisk Pro:

• Bypass the activation screen (iCloud Bypass)
• Remove the Apple ID
• Change Serial Number
• Bypass MDM
• Generate Activation Ticket
• Jailbreak iOS 15.0 – iOS 18 (checkm8)
• Passcode Bypass
• Bypass ScreenTime lock
• Extract Keychain Data

Should you use Broque Ramdisk Pro?

To better understand if this tool is what you need I have prepared a pros/cons table below.

I’ve been using Broque Ramdisk Pro for 7 months and so far I’ve noticed several issues that can be deal breakers for many users. I will detail them down below.

For those of you who are unaware, MDM stands for Mobile Device Management and it’s used in organizations to lock various features of the device to prevent the user (employee, student, etc.) from accessing them.

Bypassing MDM liberates the device to be used with all features.

Another great feature that I found useful on Broque was the option to fix driver-related issues. It assists you through installing iTunes and the Apple Mobile drivers without which the device wouldn’t be discoverable by the tool.

How to use Broque Ramdisk Pro to bypass iCloud

If you are new to using this tool, I will guide you through each step to successfully bypass the activation lock on the device.

Please use this software responsibly. This tool is intended for devices you own and that belong to you. Do not try to unlock someone else’s device. We provide this guide for educational and research purposes. You are responsible of your own actions.

To bypass iCloud activation using Broque just follow the instructions below.

Registering the ECID of your device is important. The tool will not work without it and it is used for personalization of various bypass components.

You can easily register the ECID for free with Broque Bot on Telegram. Do not forget to add “0x” in front of your ECID number, so if your ECID is 0000019AB810A211 the command would be:

/register 0x0000019AB810A211

The bot should reply that the ECID was successfully registered. If it fails make sure you copied the whole ECID.

What devices are supported?

Since Broque is based on the checkm8 hardware exploit released back in 2019, the devices supported are A11 and older.

Below you can see the full compatibility chart. If a device is not present in this table it means you cannot bypass it using Broque and a different solution might be required.

Final Thoughts

As you can see this tool provides a free alternative to the plethora of paid tools that use the same open-source checkm8 exploit.

There are limitations to Broque, such as the SIM card not working after bypass and some features not being available on macOS, but overall it’s a quality package and I’ve been using it for many months without major issues.

As always, I recommend you use the tool responsibly and within the boundaries of what’s legal. It’s a great tool and comes with great responsibility.

More iDevice Central Guides

• iOS 17 Jailbreak RELEASED! How to Jailbreak iOS 17 with PaleRa1n
• How to Jailbreak iOS 18.0 – iOS 18.2.1 / iOS 18.3 With Tweaks
• Download iRemovalRa1n Jailbreak (CheckRa1n for Windows)
• Dopamine Jailbreak (Fugu15 Max) Release Is Coming Soon for iOS 15.0 – 15.4.1 A12+
• Cowabunga Lite For iOS 16.2 – 16.4 Released in Beta! Install Tweaks and Themes Without Jailbreak
• Fugu15 Max Jailbreak: All Confirmed Working Rootless Tweaks List
• iOS 14.0 – 16.1.2 – All MacDirtyCow Tools IPAs
• iOS Jailbreak Tools for All iOS Versions