QSLCL: Universal Silicon Core Loader
Video Presentation: Watch QSLCL in action on YouTube
What is this?
QSLCL runs on:
- Apple A12-A18+ DFU (no bootrom exploit exists)
- Qualcomm EDL / Firehose
- MediaTek BROM / Preloader
- Samsung Exynos
- Broadcom, Rockchip, Allwinner, NVIDIA
72KB binary. 20+ commands. USB4 80Gbps. ChaCha20/AES.
Why I built this
I'm 19 from the Philippines. Most hardware tools are vendor-specific.
Checkra1n works on A11 and below. Nothing works on A12+.
I wanted to change that.
The Technical Challenge
Apple A12+ has:
- PAC (Pointer Authentication)
- SEP (Secure Enclave)
- KTRR/APRR (Memory protection)
- GXF (Control flow integrity)
No bootrom exploit exists. RAM execution in DFU mode is the only window.
How QSLCL Works
DFU mode accepts RAM uploads (for recovery)
QSLCL uses this window before Secure Boot locks everything
def upload_to_dfu(dev, binary):
chunk_size = 4096 # DFU-friendly
for offset in range(0, len(binary), chunk_size):
dev.write(binary[offset:offset+chunk_size])
dev.execute(0x4000) # RAM entry point