Shelly12 Run SSH on iOS 12 device. Only worked on iPad Air 1, iOS 12.4 Working Get root Set tfp0 to hsp4 Escape Sandbox Restore/Remount RootFS Defeat KASLR Bypass AMFI Spawn SSH Shell