Bypass the passcode (PIN) lock screen on supported A12 and A13 iPhone and iPad models while retaining cellular signal functionality. Compatible devices include iPhone XR, XS, XS Max, iPhone 11 series, iPhone SE 2 and selected iPad models. Check compatibility, view the $29.99 service price, prepare your RP2350 module and complete the process using iRemove Software and USBLiter8.
USBLiter8 is a hardware-level SecureROM exploit designed for supported Apple devices powered by A12 and A13 processors. It requires physical access to the device, DFU Mode, and a compatible Raspberry Pi Pico (RP2350-based) module connected over USB.
The exploit runs before iOS and Apple’s signed boot chain are loaded, placing the device into a modified—or “pwned”—DFU state. This allows iRemove software to perform supported low-level service operations that are normally restricted.
USBLiter8 provides the hardware-level connection that allows iRemove software to communicate with supported devices in DFU Mode and complete the required service process.
This service must only be used with devices you own or are legally authorized to service.
Special reseller pricing, bulk device management, API access, and priority support for professional unlock services.
Find your supported iPhone or iPad model and view the current passcode bypass service price. Get instant delivery, secure activation, and support for compatible A12 and A13 devices.
| Pricing | |||||
|---|---|---|---|---|---|
| Model | Service Name | Price | Model | Service Name | Price |
| iPhone11,2 | iPhone XS | $35 | iPhone11,8 | iPhone XR | $35 |
| iPhone11,4 / 11,6 | iPhone XS Max | $35 | iPhone12,1 | iPhone 11 | $35 |
| iPhone12,3 | iPhone 11 Pro | $35 | iPhone12,5 | iPhone 11 Pro Max | $35 |
| iPhone12,8 | iPhone SE (2nd generation) | $35 | iPad11,1 / 11,2 | iPad mini (5th generation) | $30 |
| iPad11,3 / 11,4 | iPad Air (3rd generation) | $30 | iPad11,6 / 11,7 | iPad (8th generation) | $30 |
| iPad12,1 / 12,2 | iPad (9th generation) | $30 | |||
Follow this step-by-step guide to prepare your RP2350 module and complete the iOS passcode bypass process using iRemove Software and the USBLiter8 exploit.
Use this procedure only with an iPhone or iPad that you own or are legally authorized to service.
Before starting the process, make sure you have the following equipment:
During Part 2, you must repeat Steps 1–3 and Steps 11–15 before completing Step 16. You do not need to flash the RP2350 module again.
Connect the locked iPhone or iPad to your Mac or Windows PC and launch the iRemove Software.
The software will recognize the device and prompt you to put it into DFU Mode. Carefully follow the on-screen instructions.
Connect the Raspberry Pi Pico RP2350 module to your computer using a USB Type-C data cable.
Follow the instructions displayed in the software to open the RP2350 flashing section.
Select the correct Raspberry Pi Pico or RP2350 module model from the list.
We recommend using the Waveshare RP2350 USB-A model. It has a built-in USB-A port, allowing you to connect the locked device directly without soldering a cable to the board.
If you use a standard Raspberry Pi Pico board, you may need to prepare and solder a compatible USB cable to it.
Confirm that the module selected in the software matches the RP2350 model connected to your computer.
Make sure the RP2350 module is connected via USB Type-C and that the correct model is selected. Click the Flash button.
Wait until the flashing process is complete. Your RP2350 module is now flashed and ready to use.
Disconnect the USB Type-C cable from both the computer and the RP2350 module.
Connect the locked device cable to the USB Type-A port on the RP2350 module.
Make sure the locked device is still in DFU Mode before connecting it to the RP2350 module.
If you are unsure, reconnect the device directly to your computer and check it using the software. If the software recognizes the device and displays its information, it is in the correct mode.
Connect the locked device to the RP2350 module using the appropriate USB cable. The process should start automatically.
The status light on the RP2350 module indicates the current stage of the process:
Disconnect the RP2350 module from both the computer and the locked device. Connect the RP2350 module to the computer first, and then reconnect the locked device to the module. The process should restart automatically.
Once the process has completed successfully, disconnect the locked device from the RP2350 module and reconnect it directly to your computer.
The software will recognize the device and prompt you to start the passcode bypass process or order the required service.
Click Start. Do not disconnect the locked device until the software confirms that this part of the process has been completed.
After the process is complete, you must restore your device using the latest iOS version. Follow the official Apple guide: Restore your iPhone or iPad to factory settings.
The procedure must now be completed a second time. Repeat the following steps in the same order:
Do not repeat Steps 4–9. The RP2350 module has already been flashed and is ready for the second process.
After the second process has finished, wait for the software to display the completion message before disconnecting the device.
Congratulations! The procedure has been completed successfully. You can now sign in with your own Apple ID and test all available device functions.
One compatible RP2350 module is required to complete the process. We recommend the Waveshare RP2350 USB-A because its built-in USB-A port allows you to connect the device without soldering a USB cable directly to the board.
The Waveshare RP2350 Zero, Pimoroni Tiny 2350 and Raspberry Pi Pico 2 may require additional wiring or soldering before use.
The easiest and recommended option. It includes USB-C for connecting the module to your computer and a built-in USB-A host port for connecting the supported iPhone or iPad.
A compact RP2350 development board with a USB-C connector. This model does not include a USB-A host port, so additional cable preparation and board-specific wiring may be required.
A postage-stamp-sized RP2350 development board with USB-C. It is suitable for experienced users because a compatible USB cable must be prepared using the board-specific wiring.
The official RP2350 development board from Raspberry Pi. It is supported, but it does not include a USB-A host port. Additional wiring and soldering are required.
Find answers about supported iPhone and iPad models, iOS compatibility, required RP2350 equipment, pricing and the iRemove passcode bypass process.
The iRemove A12–A13 Passcode Bypass Service is designed to remove the passcode or PIN lock screen from supported iPhone and iPad models powered by Apple A12 and A13 processors. The process uses iRemove Software, a compatible RP2350 module and the USBLiter8 exploit.
The service currently supports the following iPhone models:
The service currently supports selected A12-based iPad models:
Connect your device to iRemove Software to confirm its exact model and service eligibility before placing an order.
The service supports compatible iPhone and iPad devices running iOS or iPadOS 18.x through 26.x. Compatibility may depend on the exact device model, processor and installed firmware version.
Yes. On supported iPhone and cellular-capable iPad models, the iRemove A12–A13 passcode bypass is designed to retain cellular signal functionality after the procedure is completed successfully.
Yes. This procedure cannot be completed using iRemove Software alone. You need a compatible Raspberry Pi Pico RP2350 module, USB data cables and physical access to the locked device.
We recommend the Waveshare RP2350 USB-A module because it includes a built-in USB-A port and does not require a USB cable to be soldered directly to the board.
Yes. The latest version of iRemove Passcode Bypass Software is available for supported Windows PCs and Mac computers. Use a reliable data-capable USB cable and follow the instructions displayed by the software.
No. The RP2350 module only needs to be flashed during the first part of the procedure. When repeating the required steps during Part 2, do not flash the module again. The prepared module is already ready for the second process.
The current service price is $35 per supported iPhone and $30 per iPad. Connect your device to iRemove Software before ordering to confirm its model, firmware version, and service eligibility.
No. The device must be supported and remain on the passcode-locked screen. This procedure must only be used with an iPhone or iPad that you own or are legally authorized to service.
We value each customer and are always happy to receive your feedback. The iRemove service has an excellent rating based on over 3,900 customer reviews. iRemove Tools holds the top position among the 16 best companies in the 'Cell Phone Recycling and Unlocking Service' category on Trustpilot.
“ Once again, the iRemove Tools team delivers outstanding results! Their work is truly impressive. ”
Wholesalers and small business owners will love the benefits our partnership offers. You can become our partner if you have a GSM store, workshop, or other business. The iRemove Partnership Program supports GSM Fusion, DHRU, and other popular GSM services. We use API connections for connecting reseller websites to the services we offer. We have also developed a client system for quick access to all services.
Do you have a tech blog? Are you running a YouTube channel or Instagram account? Join the iRemove Affiliate Program to earn extra money and enjoy passive income. You can offer Mac users the iRemove unlock and bypass services and benefit from being our affiliate. If you wish to start earning extra money today, please send us your Affiliate Request.
Please don't worry. Please contact our support team. We are always happy to assist you.
Contact our friendly support team
