How to install iPadOS 18 on iPad 6 via Tethered Dualboot or Restore using upRa1n

upRa1n is an open-source, Python-based tool that makes it possible to run iPadOS 18 on an iPad 6 — a device Apple officially dropped from iPadOS 18 support. It supports two modes: a tethered dualboot, where iOS 18 runs alongside your existing iPadOS 17 install, and a tethered restore, which replaces iPadOS 17 entirely with iOS 18.

The project was originally created by Zer0xDev and is available at github.com/Zer0xDev/upRa1n, with a fork maintained by Wlado88 at github.com/Wlado88/upra1n. The repository — written almost entirely in Python (98.4%) with a small Shell component (1.6%) — has accumulated 19 stars and 5 forks as of mid-2026, reflecting the niche but passionate community around legacy iOS hardware.

The tool achieves what Apple does not allow by chaining together several community-built exploits and utilities, all orchestrated through a single script: upRa1n.py.

Why Can't the iPad 6 Run iPadOS 18 Officially?

iPadOS 18 is officially available for iPad 7th generation and later, iPad Air 3rd generation and later, iPad mini 5th generation and later, and all iPad Pro models from 11-inch 1st generation onward. The iPad 6, released in 2018, was excluded.

The irony is that the iPad 6 and iPad 7 share the same processor. The Apple A10 Fusion is used in both the 6th and 7th-generation iPad, as well as the 7th-generation iPod touch. The A10 Fusion has two "Hurricane" performance cores running at 2.34 GHz and two "Zephyr" efficiency cores, though they cannot be used simultaneously — at any given time, either the performance cluster or the efficiency cluster is active.

Apple's decision to cut off the iPad 6 while keeping the nearly identical iPad 7 was primarily a business and software support decision, not a hardware one — which is exactly what makes upRa1n possible.

What You're Missing Without It

iPadOS 18 brings Calculator to iPad with Math Notes, new Smart Script handwriting tools in Notes designed for Apple Pencil, more ways to customize the Home Screen and Control Center, and the biggest redesign of the Photos app ever.

Deeply integrated into iPadOS 18, Apple Intelligence unlocks new ways for users to enhance their writing and communicate more effectively, with brand-new systemwide Writing Tools that allow users to rewrite, proofread, and summarize text nearly everywhere they write.

Note: Apple Intelligence requires an A17 Pro chip or M-series processor. Since the iPad 6 runs an A10 Fusion, Apple Intelligence features will not be available even when running iOS 18 via upRa1n. However, the vast majority of iPadOS 18 UI, apps, and non-AI features will work.

The Role of palera1n and checkm8

upRa1n is built on top of the palera1n jailbreak ecosystem, which is itself based on the checkm8 bootrom exploit. Understanding these is important to understanding upRa1n.

palera1n is both a tethered and a semi-tethered jailbreak for devices vulnerable to the checkm8 bootrom exploit, supporting iOS/iPadOS 15.0 through 18.7.9, HomePod Software, tvOS 15.0 and later, as well as bridgeOS 6.0 and later.

palera1n uses a vulnerability in the iBoot bootrom, a low-level program that runs before the operating system. This allows palera1n to inject code that grants root access and activates jailbreaking features.

Because checkm8 is a hardware-level vulnerability, palera1n jailbreak is popular for arm64 (A11 and older) devices because it's based on the checkm8 exploit, which targets hardware and can never be fixed by Apple through software updates. The iPad 6's A10 Fusion is in this category, meaning upRa1n's underlying approach is permanently viable — Apple cannot patch it with a firmware update.

palera1n uses its own components such as binpack, overlay, kpf, and a fork of pongoOS to help it boot into the jailbroken state. All of these components appear directly in the upRa1n repository.

Requirements

Before you begin, check every item on this list. Missing any single requirement will cause the process to fail.

Device:

• iPad 6 (Wi-Fi or Cellular)
• Must be running iPadOS 17.7.10 or 17.7.11 — no other version is supported

Computer:

• macOS machine (Intel or Apple Silicon)
• Confirmed working on macOS Monterey, Sonoma, and Tahoe

Additional:

• If using the iPad 6 Cellular model, the device must be activated before starting
• Homebrew installed: brew.sh
• Python 3: python.org
• Comfort with compiling tools from source and working in Terminal

Dependencies

upRa1n relies on a set of compiled tools that must be placed in /usr/local/bin/. The repo's Releases section includes precompiled binaries for Intel Macs as a convenience, but manual compilation is strongly recommended for reliability.

Step-by-Step Installation

Step 1 — Install Homebrew Dependencies

brew install libimobiledevice libirecovery

For all other tools (aea, img4lib, devicetree-parse, pongoterm), compile from source using make or ./autogen.sh for each project, then copy the resulting binary to /usr/local/bin/.

Step 2 — Clone the Repository

git clone https://github.com/Wlado88/upra1n.git
cd upra1n

Or use the original upstream:

git clone https://github.com/Zer0xDev/upRa1n.git
cd upRa1n

Step 3 — Download the Required Firmware Files

You need two IPSW firmware files:

• iOS 18 IPSW for iPad 7 (Wi-Fi or Cellular — matching your iPad 6 variant). Any iOS 18 version is supported.
• iOS 17.7.10 or 17.7.11 IPSW for iPad 6 (Wi-Fi or Cellular — matching your device).

Place the iOS 18 IPSW file directly inside the upRa1n/ directory. Extract the iOS 17.7.10 (or 17.7.11) IPSW into a subfolder named 17.7.10/ (or 17.7.11/ respectively).

Step 4 — Install Python Packages

pip3 install colorama art paramiko tqdm scp requests pyhpke

Step 5 — Clone SSHRD Script

cd upRa1n
git clone https://github.com/verygenericname/SSHRD_Script.git

Step 6 — Set Up turdus_merula

Download the latest version of turdus_merula from sep.lol. Unzip the download and rename the folder to turdus_merula, then place it inside your upRa1n/ directory.

Step 7 — Verify Your Folder Structure

After completing the above steps, your upRa1n/ folder should look like this:

upRa1n/
├── upRa1n.py
├── Pongo.bin
├── binpack.dmg
├── ramdisk.dmg
├── boot.sh
├── checkra1n-kpf-pongo
├── sep_racer
├── dt-j71bap.diff          ← Wi-Fi device tree diff
├── dt-j72bap.diff          ← Cellular device tree diff
├── ibootpatch2-ssv-patch.zip
├── img4lib-*.zip
├── SSHRD_Script/
├── turdus_merula/
├── [iOS 18 iPad7].ipsw
└── 17.7.10/ (or 17.7.11/)
    └── [extracted iOS 17.7.10 firmware files]

Step 8 — Run the Script

For a tethered restore (replaces iOS 17 with iOS 18):

python3 upRa1n.py restore

For a tethered dualboot (runs iOS 18 alongside iOS 17):

python3 upRa1n.py dualboot

Follow all on-screen instructions in the terminal exactly as they appear.

Command Reference

Usage: python3 upRa1n.py <options>

Commands:

   restore      Tethered restore — replace iPad with iOS 18
   dualboot     Tethered dualboot — run iOS 18 alongside iOS 17
   boot         Boot your device into iOS 18 (required after every restart)

Examples:

   python3 upRa1n.py restore
   python3 upRa1n.py dualboot
   python3 upRa1n.py boot

What "Tethered" Actually Means

This is the most critical concept to understand before using upRa1n. A tethered boot means your iPad cannot start on its own. Every time it restarts or the battery dies, you must:

1. Connect the iPad to your Mac via USB
2. Run: python3 upRa1n.py boot

Without doing this, the device will not reach the iOS 18 home screen. This is not a flaw in upRa1n — it is a fundamental property of how the checkm8 exploit chain functions. A tethered jailbreak can temporarily jailbreak a device during a single boot. To start the device with a patched kernel, it must be re-jailbroken with a computer. This means you will need a PC every time to boot your iPhone or iPad.

If you are away from your Mac and your iPad restarts, it will be unusable until you can reconnect it. Plan accordingly.

How It Works — The Technical Chain

upRa1n layers multiple low-level techniques to boot iOS 18 on hardware Apple excluded from it. Here is what happens under the hood:

1. checkm8 + PongoOS

The process begins by exploiting the A10 Fusion's hardware bootrom vulnerability (checkm8) to launch PongoOS, a lightweight pre-OS environment that enables code execution before iOS loads. This is also where the checkra1n kernel patchfinder (checkra1n-kpf-pongo) runs to modify kernel behavior.

2. Device Tree Patching

Every Apple device has a device tree — a data structure that describes the hardware to the operating system. The iPad 6 and iPad 7 share the same A10 Fusion chip but differ in peripheral configurations (screen dimensions, hardware IDs, sensor mappings). The upRa1n repository includes two patch files specifically for this:

• dt-j71bap.diff — for the iPad 6 Wi-Fi (j71bap)
• dt-j72bap.diff — for the iPad 6 Cellular (j72bap)

These files patch the iPad 7's iOS 18 device tree so it correctly maps to iPad 6 hardware.

3. IMG4 Firmware Manipulation

Apple firmware is packaged in IMG4 format. The img4lib tool unpacks, signs, and repacks iOS firmware images, allowing the script to work with modified boot components that Apple's own verification would normally reject.

4. iBootpatch2 + SSV Bypass

Starting with iOS 15, Apple introduced SSV (Signed System Volume), a security feature that prevents easily remounting the System partition. iBootpatch2, bundled with the SSV patch (ibootpatch2-ssv-patch.zip), patches Apple's second-stage bootloader (iBoot) to bypass this check — allowing iOS 18 to boot without a valid SSV signature for the iPad 6.

5. sep_racer

The sep_racer binary handles interactions with the Secure Enclave Processor (SEP). The SEP manages sensitive operations like Touch ID and encryption keys. On a device running a different iOS version than intended, SEP behavior must be carefully managed — sep_racer is the tool that does this.

6. SSHRD Script

The SSHRD Script (SSH Ramdisk Script) creates a custom SSH-accessible ramdisk, allowing the upRa1n process to communicate with and configure the device over USB during the installation phase — performing file operations that would not be possible through normal iOS access.

7. palera1n for Final Kernel Access

Once the kernel has been patched via PongoOS and the device tree corrected, palera1n provides the final layer of access needed to complete the iOS 18 boot environment on iPad 6 hardware.

Known Issues and Fixes

palera1n Does Not Appear on the Home Screen

After setup, the palera1n app may be missing from the home screen.

Fix: Reboot your device, then run python3 upRa1n.py boot. Alternatively, open the Shortcuts app, create an "Open Application" shortcut, and manually select palera1n from the application list.

Black Wallpaper

The iOS 18 wallpaper may appear as a plain black screen.

Fix: Connect to Wi-Fi, then go to Settings → Wallpaper and set a new wallpaper. This is a purely cosmetic issue with no effect on functionality.

Apps Won't Open

Some App Store applications may refuse to launch after the restore or dualboot.

Fix: Delete the affected app and re-download it fresh from the App Store. Installation state issues introduced during the migration process cause this behaviour and a clean reinstall resolves it.

Poor Performance

iOS 18 may feel slower than expected, particularly for animations and app loading.

Fix: Run the iOS Performance Tweaks script on your device. This community-maintained script applies system-level optimisations specifically designed to improve responsiveness on older hardware running newer iOS versions.

What Works and What Doesn't on iOS 18 via upRa1n

Credits

upRa1n builds on the work of several key contributors from the iOS community:

• asdfugil (Nick Chan) — Original iPad 6 iPadOS 18 installation guide that upRa1n is based on
• verygenericname (Nathan) — SSHRD Script
• kok3shidoll, Clarity, Mineek — turdusra1n
• Mineek, Nick Chan, Samara, HAHALOSAH — palera1n
• crystall1nedev — SSV patch implementation

Risks and Disclaimer

Take these seriously before you proceed:

• Back up your iPad first. Use Finder on macOS to create a full backup before attempting any restore or dualboot. Data loss is a real possibility.
• Unsupported by Apple. This modifies your device in ways Apple does not permit and does not support. Official repair or support from Apple may be refused for a device in this state.
• Permanent Mac dependency. Every restart requires your Mac. If the Mac is unavailable, your iPad cannot boot into iOS 18.
• Not all features will work. Apple Intelligence and certain hardware-gated features (Stage Manager, ProMotion) are absent from the iPad 6 regardless of which iOS version runs on it.
• No warranty. The tool is provided as-is by the community. The authors accept no responsibility for damage, data loss, or device issues.

Frequently Asked Questions

Q: My iPad 6 is on iOS 16. Can I use upRa1n? No. The device must be running iPadOS 17.7.10 or 17.7.11. This is a hard dependency of the exploit chain — no other version is accepted.

Q: Does this work on Windows or Linux? No. upRa1n requires macOS (Intel or Apple Silicon). It has been tested and confirmed working on macOS Monterey, Sonoma, and Tahoe.

Q: Is this the same as jailbreaking? Not exactly. upRa1n uses jailbreak infrastructure (palera1n, PongoOS, checkm8) but its goal is to load a different iOS version rather than to modify the current iOS for tweak injection. The result is a device running iOS 18 — not a jailbroken iOS 17 install.

Q: Do I need to run the boot command every single time? Yes. Every time the iPad restarts or loses power, you must connect it to your Mac and run python3 upRa1n.py boot. This is the defining characteristic of a tethered setup.

Q: Can I go back to iOS 17 if I don't like it? In dualboot mode, your iOS 17 install remains intact. In restore mode, returning to iOS 17 requires a full restore via Finder/iTunes. Keep your backup.

Q: Will Apple patch checkm8 and break this? No. The checkm8 exploit targets hardware, which means it can never be fixed by Apple through software updates. upRa1n's underlying approach is permanently viable on all A10 Fusion devices.

Conclusion

upRa1n is a technically impressive community achievement that gives iPad 6 owners something Apple deliberately withheld: a path to iPadOS 18. By combining checkm8, PongoOS, device tree patching, SSV bypass, and palera1n into a single Python script, it delivers a functional iOS 18 experience on 2018 hardware that shares its processor with a device Apple continued to support.

The tethered requirement and the absence of Apple Intelligence mean this is not a seamless consumer experience — but for the technically minded iPad 6 owner who wants access to Calculator with Math Notes, the redesigned Photos app, the new home screen customisation, and the broader iPadOS 18 feature set, upRa1n makes it genuinely possible.

Wlado88 Fork: https://github.com/Wlado88/upra1n Original Repository: https://github.com/Zer0xDev/upRa1n palera1n: https://palera.in turdus_merula: https://sep.lol