---
title: "A cut Apple cable, a $5 board, and an unfixable iPhone exploit"
locale: "en"
url: "https://irz.fr/en/articles/usbliter8-lightning-pico2-en"
markdown_url: "https://irz.fr/en/articles/usbliter8-lightning-pico2-en.md"
category: "tech"
tags: ["RP2350", "USB", "Apple", "bootrom", "security"]
published_at: "2026-08-25T18:35:00.000Z"
author: "Léa Perrin"
translation: "https://irz.fr/fr/articles/usbliter8-lightning-pico2-fr.md"
---

# A cut Apple cable, a $5 board, and an unfixable iPhone exploit

Maker forums are full of Raspberry Pi Pico 2 boards with Apple Lightning cables soldered to them. The reason is usbliter8, a BootROM exploit Apple can never patch, and a wiring job you can do at a desk.

Since mid-August, maker forums keep circling the same strange object: a Raspberry Pi Pico 2 with an Apple Lightning cable cut open and soldered straight onto its pins. Adafruit flagged the pattern on August 20, noting people asking why anyone would do this.[1](https://blog.adafruit.com/2026/08/20/why-are-people-suddenly-adding-apple-lightning-cables-to-raspberry-pi-pico-2-boards/) The same day, CNX Software published an email from a reader who wanted to order a "modified" Pico 2 and offered to collect it in person, and relayed the answer security researcher stacksmashing gave on X: "I literally have this on my desk right now."[2](https://www.cnx-software.com/2026/08/20/why-are-people-suddenly-adding-apple-lightning-cables-to-raspberry-pi-pico-2-boards/)

The answer has a name only a security researcher could love: usbliter8. Published on June 18, 2026 by the security research firm Paradigm Shift after coordinated disclosure with Apple Product Security, it is a BootROM exploit for Apple's A12, A13, S4 and S5 chips. The closest public precedent is checkm8, the 2019 exploit that permanently put A5-through-A11 devices beyond the reach of Apple's patches.[3](https://web.archive.org/web/20260618141609/https://ps.tc/pages/blog-usbliter8.html)[4](https://www.thehackernews.com/2026/06/unpatchable-usbliter8-exploit-breaks.html) And to run it, you need exactly that absurd-looking object: a five-dollar RP2350 board wired to a Lightning plug.

## A backwards pointer

The bug sits in the Synopsys DWC2 USB controller Apple builds into those chips. The controller keeps a small ring buffer for incoming USB Setup packets: three slots, and when the fourth arrives it rewinds its DMA write pointer by a fixed 24 bytes. It also tolerates packets shorter than the 8 bytes the USB spec requires, advancing the pointer only by the bytes that actually showed up.[3](https://web.archive.org/web/20260618141609/https://ps.tc/pages/blog-usbliter8.html)[4](https://www.thehackernews.com/2026/06/unpatchable-usbliter8-exploit-breaks.html)

Fixed rewind, variable advance. Feed the controller the right sequence of undersized packets and the write pointer drifts backwards through memory in 12-byte steps. That is a buffer underflow implemented in hardware, and no software update will ever touch it, because the vulnerable code is burned into the silicon at manufacture.[4](https://www.thehackernews.com/2026/06/unpatchable-usbliter8-exploit-breaks.html)

Whether that memory corruption turns into running code depends on how Apple configured the rest of the chip. On A12 and A13, SecureROM runs the USB DART, the system's IOMMU, in bypass mode, so the stray DMA writes can reach arbitrary SRAM. The A11 driver reset the DMA address after every packet, which is why those older devices are immune; A14 and later configure the DART correctly.[3](https://web.archive.org/web/20260618141609/https://ps.tc/pages/blog-usbliter8.html)[4](https://www.thehackernews.com/2026/06/unpatchable-usbliter8-exploit-breaks.html) A13 made the researchers work for it: Pointer Authentication seals the return addresses, so the exploit corrupts heap metadata, rewrites a panic counter so errors loop instead of rebooting, times its writes around the USB task's context switches, then replaces the USB interrupt handler pointer. When the next interrupt fires, attacker code runs inside the BootROM.[3](https://web.archive.org/web/20260618141609/https://ps.tc/pages/blog-usbliter8.html)

## Why a Pico

The malformed packets at the heart of the exploit sit so far outside the USB specification that ordinary hardware refuses to send them. A Mac cannot. Even the RP2350's own USB controller cannot. The exploit bypasses it entirely: the USB lines are wired to GPIO pins, GPIO12 for D+ and GPIO13 for D− by default, and PIO state machines generate the signalling directly on the wire, building on sekigon-gonnoc's Pico-PIO-USB library.[3](https://web.archive.org/web/20260618141609/https://ps.tc/pages/blog-usbliter8.html)[5](https://web.archive.org/web/20260618140950/https://github.com/prdgmshift/usbliter8)[6](https://blog.elcomsoft.com/2026/07/a12-usbliter8-bootrom-sigpatches/) Elcomsoft, whose forensic toolkit depends on this kind of entry point, sums up the consequence: usbliter8 requires a custom USB implementation, full stop.[6](https://blog.elcomsoft.com/2026/07/a12-usbliter8-bootrom-sigpatches/)

Paradigm Shift tested four boards: the Waveshare RP2350 USB-A, its reference board, the Waveshare RP2350 Zero, the Pimoroni TINY2350 and the Raspberry Pi Pico 2. The previous-generation RP2040 works in theory but is unstable, and the A13 does not work on it at all.[5](https://web.archive.org/web/20260618140950/https://github.com/prdgmshift/usbliter8) The README even warns that the exploit is racy because the RP2350 executes code from external QSPI flash: a cache eviction at the wrong moment breaks the timing.[5](https://web.archive.org/web/20260618140950/https://github.com/prdgmshift/usbliter8)

## Four wires

Hence the recipe now circulating on the forums. Take a Lightning-to-USB-A cable, cut off the USB-A plug, strip the four conductors and solder them to the board: power and ground to VBUS and GND, D+ to GPIO12, D− to GPIO13. Wire colors vary by manufacturer, so the guides insist on a multimeter before the iron. USB-C cables are explicitly ruled out because their pinout differs, and the remaining Lightning tail should stay short.[5](https://web.archive.org/web/20260618140950/https://github.com/prdgmshift/usbliter8)

> The desk recipe
> **From cable to tool**
> - Remove the USB-A end of a Lightning-to-USB-A cable.: Cut
> - Find VBUS, ground, D+ and D− with a multimeter.: Identify
> - D+ to GPIO12, D− to GPIO13, power and ground to the rails.: Solder
> - Load the UF2 firmware, then plug in a DFU-mode device.: Flash

Why Lightning, of all connectors? Because it is what the vulnerable devices still speak: iPhone XS, XS Max and XR, the iPhone 11 family, the second-generation iPhone SE, iPad Air 3rd gen, iPad mini 5th gen, Apple Watch Series 4 and 5, the first Watch SE, the HomePod mini.[4](https://www.thehackernews.com/2026/06/unpatchable-usbliter8-exploit-breaks.html) The plug goes into the phone, the bare wires go to the Pico, and a device put in DFU mode gets exploited in 0.7 to 1.2 seconds, long enough to stamp PWND:[usbliter8] into its USB serial number.[5](https://web.archive.org/web/20260618140950/https://github.com/prdgmshift/usbliter8)

## Pwned, briefly

The payoff is deliberately modest. The official payload can demote the chip's production mode, which lasts until the next reboot, and boot a raw iBoot image with no signature checks, the device equivalent of leaving the front door open for exactly one session.[3](https://web.archive.org/web/20260618141609/https://ps.tc/pages/blog-usbliter8.html)[5](https://web.archive.org/web/20260618140950/https://github.com/prdgmshift/usbliter8) That is much thinner than checkm8's full read/write/execute toolbox, so Elcomsoft published its own A12 patches to restore richer primitives, in the process creating a second, incompatible firmware lineage.[6](https://blog.elcomsoft.com/2026/07/a12-usbliter8-bootrom-sigpatches/)

> **Two exploits, two eras**
> - A5 through A11 chips. Runs on a PC.: checkm8 · 2019
> - A12, A13, S4/S5 chips. Needs a soldered RP2350 board.: usbliter8 · 2026
> - Exploit runtime once the device is plugged in.: 0.7–1.2 s

One boundary holds anyway: the Secure Enclave, which guards passcodes and biometrics, is a separate chip, and usbliter8 does not touch it, though Paradigm Shift notes that BootROM control may open new routes toward it.[3](https://web.archive.org/web/20260618141609/https://ps.tc/pages/blog-usbliter8.html)[4](https://www.thehackernews.com/2026/06/unpatchable-usbliter8-exploit-breaks.html) For everyone else the practical risk stays low: an attacker needs the device in hand, in DFU mode, plugged into a modified cable. As of June 19 there was no CVE, no Apple advisory and no publicly reported exploitation in the wild.[4](https://www.thehackernews.com/2026/06/unpatchable-usbliter8-exploit-breaks.html)

## The missing manual

Then the story leaves the workbench. On July 7, Magnet Forensics, a digital forensics company, sued Paradigm Shift and a former contractor, Mario Del Gaudio, in federal court in Georgia, alleging that the published exploit misappropriates trade secrets from a confidential internal project Del Gaudio worked on as an exploit engineer from November 2023 to November 2024.[7](https://dockets.justia.com/docket/georgia/gandce/1:2026cv03781/361854) Paradigm Shift maintains the research is independent, and nothing has been proven at trial. That did not settle the paperwork: on July 21, Judge Victoria Calvert issued a preliminary injunction, and by July 23 the write-up and the GitHub repository were gone.[8](https://theapplewiki.com/wiki/Usbliter8_Exploit)

The order erased the original documentation, not the knowledge. Forks of the code circulate, the blog post lives in web archives, and the community keeps its own record of the timeline.[2](https://www.cnx-software.com/2026/08/20/why-are-people-suddenly-adding-apple-lightning-cables-to-raspberry-pi-pico-2-boards/)[8](https://theapplewiki.com/wiki/Usbliter8_Exploit) Meanwhile the market moved faster than the lawyers or the soldering irons: Chinese vendors already sell a ready-made "SUNSHINE RP2354A Pico DFU engineering board" with both Lightning and USB-C connectors for about $10, no cutting required.[2](https://www.cnx-software.com/2026/08/20/why-are-people-suddenly-adding-apple-lightning-cables-to-raspberry-pi-pico-2-boards/)

> Illustration: SUNSHINE RP2354A DFU board with two USB-C ports and a Lightning connector. A ready-made RP2354A DFU board with Lightning and USB-C connectors. The soldering step is already optional. Credit: [CNX Software / AliExpress](https://www.cnx-software.com/2026/08/20/why-are-people-suddenly-adding-apple-lightning-cables-to-raspberry-pi-pico-2-boards/).

That is where the story lands, a bit absurdly. A five-dollar hobby board and a connector Apple retired have become the standard toolchain for poking at the earliest code an iPhone ever runs, and the authoritative manual now survives mainly as archives and forks. Paradigm Shift closed its write-up by saying the BootROM "still occasionally has a surprise left to give."[3](https://web.archive.org/web/20260618141609/https://ps.tc/pages/blog-usbliter8.html) The surprise outlived its documentation.

## References

1. [Adafruit, Why are people suddenly adding Apple Lightning cables to Raspberry Pi Pico 2 boards?](https://blog.adafruit.com/2026/08/20/why-are-people-suddenly-adding-apple-lightning-cables-to-raspberry-pi-pico-2-boards/)
2. [CNX Software, Why are people suddenly adding Apple Lightning cables to Raspberry Pi Pico 2 boards?](https://www.cnx-software.com/2026/08/20/why-are-people-suddenly-adding-apple-lightning-cables-to-raspberry-pi-pico-2-boards/)
3. [Paradigm Shift, Introducing usbliter8 (June 18, 2026, archived)](https://web.archive.org/web/20260618141609/https://ps.tc/pages/blog-usbliter8.html)
4. [The Hacker News, Unpatchable 'usbliter8' Exploit Breaks Apple A12 and A13 SecureROM Boot Chain](https://www.thehackernews.com/2026/06/unpatchable-usbliter8-exploit-breaks.html)
5. [Paradigm Shift, usbliter8 PoC repository (June 18, 2026, archived)](https://web.archive.org/web/20260618140950/https://github.com/prdgmshift/usbliter8)
6. [Elcomsoft, A12 usbliter8 BootROM sigpatches](https://blog.elcomsoft.com/2026/07/a12-usbliter8-bootrom-sigpatches/)
7. [Justia, Magnet Forensics, LLC v. Del Gaudio et al, 1:26-cv-03781 (N.D. Ga.)](https://dockets.justia.com/docket/georgia/gandce/1:2026cv03781/361854)
8. [The Apple Wiki, usbliter8 Exploit](https://theapplewiki.com/wiki/Usbliter8_Exploit)