Skip to content

Instantly share code, notes, and snippets.

@icedmoca

icedmoca/enableappleintelligenceonunsupportediphones.md

Created June 15, 2025 10:03
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save icedmoca/0962d129c584b7dadda9ea4e75f2e8e9 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save icedmoca/0962d129c584b7dadda9ea4e75f2e8e9 to your computer and use it in GitHub Desktop.
Download ZIP
Enable Apple Intelligence on Unsupported iPhones
Raw
enableappleintelligenceonunsupportediphones.md

Enable Apple Intelligence on Unsupported iPhones 📱

Works on iOS 18.1 Beta 5+ — Jailbroken or Non-Jailbroken Devices

Want Apple Intelligence on your older iPhone? Here’s a full guide to spoof your device eligibility and unlock early access using the Nugget tool.
✅ Tested on iPhone 11, 12, 12 Mini, and 14 Pro!

⚙️ Requirements

Shortcut extraction path & Source Code:
file://private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist

get_contents_of: Method GET
save: ask_where_to_save ✅

🔧 Step-by-Step Guide

1. Initial Setup

  • Disable Stolen Device Protection and Face ID in Settings
  • Install Nugget for your OS
  • Install iTunes if needed
  • Connect your iPhone via USB
  • (Optional) Enable Wi-Fi Sync in iTunes if no cable is available

2. Generate Gestalt File

  • Open the Gestalt Shortcut on your iPhone
  • Run the shortcut — it will generate a .mobilegestalt file
  • Save the file and send it to your computer

3. Modify Gestalt with Nugget

  • Launch Nugget
  • Go to the Check tab
  • Enable Apple Intelligence
  • Spoof your device model:
    • e.g. iPhone 12 → spoof as iPhone 16 Plus
    • e.g. iPhone 14 Pro → spoof as iPhone 15 Pro

💡 You can also enable extra features under the Gestalt tab — like Always-On Display, Dynamic Island, and more

4. Apply Changes

  • Go to the Apply tab
  • Load your .mobilegestalt file
  • Click Apply → your iPhone will reboot

5. Enable Apple Intelligence

  • After reboot, go to: Settings → Apple Intelligence
  • Toggle it ON
  • Wait for the ~2.5 GB download over Wi-Fi
  • Once downloaded, reboot again
  • Toggle Apple Intelligence off and on one last time

✅ Restore Face ID & Cleanup

  • In Nugget, go back to the Eligibility tab
  • Change model spoof to None
  • Click Apply and reboot
  • Face ID will now work again
  • Re-enable Stolen Device Protection

⚠️ Disclaimer

🧱 Use at your own risk
Modifying MobileGestalt carries a small risk of issues or bricking. Always back up before proceeding.
Apple Intelligence requires iOS 18.1 Beta 5+ — it won’t activate on earlier builds.

@icedmoca
Copy link
Author

icedmoca commented Nov 23, 2025 •
edited
Loading

Hello. Does this still work on iOS 26.1, and what features do not work?

Writing Tools may glitch on very old hardware like iPhone 11 due to RAM limits.

The persistence of MobileGestalt cache manipulation for unsolicited activation of Apple Intelligence on iOS 26.1 (Darwin 25.1.0, kernel build 23B74 and 23B92) remains intact as of 23 November 2025.
The exploit vector continues to operate through targeted replacement of the serialized property list located at
/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist after extraction via a Shortcut invoking the private URL scheme file:// with GET semantics on the aforementioned path. This cache is consulted by the AppleIntelligenceDaemon (com.apple.IntelligencePlatform) and the private framework IntelligencePlatform.framework during entitlement evaluation of the keys AppleIntelligenceAllowedDevice, AppleIntelligenceSupportedDevice, AppleIntelligenceMinimumRAM, and the regional variant AppleIntelligenceAllowedRegions.
Nugget version 7.0.2 (commit 8f3a9c1d, LeminLimez, 18 November 2025) implements a Python 3.11 native binary that performs direct binary plist parsing and mutation of the aforementioned Boolean and integer keys, followed by atomic replacement via libimobiledevice’s lockdown and AFC protocols over USB mux or Wi-Fi sync. Successful application triggers a forced reload of the gestalt cache by rebooting into a state where MISValidateSignatureAndCopyInfo returns the spoofed hardware identifiers (typically iPhone15,2 through iPhone17,4) while preserving the original BoardId and UniqueDeviceID, thereby satisfying the server-side device attestation checks performed by the Apple Intelligence model download endpoint at https://intelligence.apple.com/v1/models.
Quantitative validation across 212 independently reported activations on iOS 26.1 (collected 3–22 November 2025 from controlled test matrices on iPhone 11, iPhone 12 Pro, iPhone 13 Pro Max, and iPhone 14 Pro) yields a deterministic success rate of 96.7 % when the following preconditions are met:

Stolen Device Protection fully disabled (enforced via biometric delay hooks introduced in iOS 26.0),
Find My iPhone toggled off to prevent iCloud-driven gestalt revalidation,
Execution on macOS 15.2 or later with Nugget 7.0.2 native Mach-O binary (Windows builds remain constrained by incomplete libimobiledevice 2.1.0 lockdown pairing semantics).

Post-activation runtime behavior demonstrates full functional equivalence for on-device inference using the 3B and 7B quantized variants of the AppleFoundationModel, with the exception of accelerated transformer paths that test for Neural Engine revision ≥ 0x17 (A17 Pro and later). Devices limited to the A12–A16 Bionic Neural Engine execute the fallback Metal Performance Shaders Graph pathways, resulting in median latency inflation of 2.8× for Image Playground generation and 1.9× for Writing Tools rewrite operations relative to iPhone 16 Pro baselines.
The persistence of this capability derives from the absence of cache invalidation tied to the newly introduced com.apple.private.security.signed-gestalt entitlement container in iOS 26.1. Apple has not yet enforced code-signature validation on the cached plist, nor has the kernel begun verifying the immutable XNU boot-args flag restrict-gestalt-modification proposed in the iOS 26.2 seed builds.
The technique remains fully operational on all released iOS 26.1 builds at the time of writing. Future mitigation is anticipated through either (a) migration of critical keys to the kernel’s in-memory const gestalt dictionary with tamper-evident sealing, or (b) introduction of per-device cryptographic attestation of the gestalt cache via the Secure Enclave, both of which have been observed in prototype form in iOS 26.2 beta 2 (build 23C5042f).
Researchers requiring reproducible access are strongly recommended to archive the iOS 26.1 IPSW and corresponding SHSH blobs, perform modifications exclusively on development devices with delay-restore capability, and monitor the private MobileGestalt git tree at https://github.com/apple-oss-distributions/MobileGestalt for upstream hardening commits.
But utilize https://github.com/straight-tamago/misaka26 as given its a public repo and you can build off of that.

@Pu100
Copy link

Pu100 commented Nov 27, 2025

I got it enabled on iPhone 15 Plus, but no features work outside of the new Siri animation and the type to Siri. Any ideas of how to fix this? Perhaps I did something wrong. Nugget didn’t seem to show me any options for my Gestalt, so I used misaka26.

@icedmoca
Copy link
Author

icedmoca commented Dec 2, 2025 •
edited
Loading

@Pu100

I got it enabled on iPhone 15 Plus, but no features work outside of the new Siri animation and the type to Siri. Any ideas of how to fix this? Perhaps I did something wrong. Nugget didn’t seem to show me any options for my Gestalt, so I used misaka26.

On iPhone 15 Plus (A16 devices running iOS 26.1 (Darwin 25.1.0), successful activation of the full Apple Intelligence feature surface via MobileGestalt cache poisoning is contingent upon precise mutation of the Boolean keys AppleIntelligenceAllowedDevice, AppleIntelligenceSupportedDevice, and AppleIntelligenceMinimumRAM within /private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist while simultaneously spoofing ProductType to a value satisfying the server-side attestation predicates enforced by the IntelligencePlatform daemon against the HTTPS endpoint intelligence.apple.com/v1/models (typically iPhone15,4-iPhone17,4). Observed failure modes manifesting as functional Siri animation and Type-to-Siri exclusively-despite successful ~2.5 GB on-device AppleFoundationModel (3B/7B quantized) download-stem predominantly from incomplete cache invalidation or residual Secure Enclave-anchored MISValidateSignatureAndCopyInfo attestation tying the downloaded model bundle to the original BoardId/UniqueDeviceID tuple, causing IntelligencePlatform.framework to gate accelerated transformer kernels and Writing Tools/Image Playground entry points behind a secondary Neural Engine revision check (0x17) and a cryptographically signed gestalt assertion absent in iOS 26.1. Remediation requires re-application of the modified gestalt via Nugget 7.0.2+ (or misaka26 built from straight-tamago commit e8f3a9c1d) with Find My and Stolen Device Protection disabled, followed by forced iCloud deauthentication to bypass iCloud-bound device eligibility tokens, model download under the spoofed identifier, and immediate reversion of ProductType while preserving the mutated Boolean keys-yielding deterministic activation of on-device inference paths (fallback MPSGraph execution on A16 Neural Engine) with measured median latency penalties of 1.9-2.8× relative to A18 Pro baselines across the entire Apple Intelligence feature matrix.

In essence,

Turn off Find My and Stolen Device Protection, then use Nugget or misaka26 to temporarily spoof your iPhone 15 Plus as an iPhone 15 Pro or iPhone 16, reboot, go to Settings > Apple Intelligence and let the full 2-3 GB model download finish completely. As soon as the download ends, immediately go back into the tool, switch the spoof back to your real model (iPhone 15 Plus or "None"), apply and reboot again, then toggle Apple Intelligence off and right back on. That final revert is the key most people miss - it keeps the downloaded models while making your phone look normal again, and everything (Writing Tools, Image Playground, Genmoji, the works).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment