Self-hosted remote control for jailbroken iOS devices.
rctl streams the device screen, camera, and audio to a browser; injects touch and keyboard input; exposes a root terminal; and provides controlled access to files, Photos, applications, and system actions. It works directly over a trusted local network or through an authenticated relay hosted on your own VPS.
Install the public package · Read the documentation · Review security · See changes
Warning
rctl provides root-level control of the device. The local port is unauthenticated and must never be forwarded to the public internet. Use the TLS relay for internet access and read the security model before deployment.
As of 2026-10-05, GitHub latest is 0.4.4, with separate rootful and
ordinary Dopamine rootless packages, also distributed through the APT feed.
The full qualification matrix is not yet complete;
release notes identify
the outstanding checks. Back up and retain independent recovery access before
upgrading. Native controller work in current source is not a released app.
0.4.5 is an immutable
pre-release for opt-in testing, adding temporary guest invitations and the
scoped control workspace. Its exact-source CI, release builds, signatures and
artifact provenance passed. Physical guest scenarios, final rootless installation
and clean-VPS requalification remain open; see the release notes and
guest acceptance. It does not advance latest or APT.
Physical testing covers an iPad Air 3 (iPad11,3) on iPadOS 14.4 with rootful
unc0ver/Substitute and an iPad Pro on iPadOS 15.5 with Dopamine/ElleKit. Both
passed the relay-admin device update from 0.4.3 to the exact 0.4.4 candidate,
with relay identity preserved and subsequent LAN/relay control checks. This is
not blanket support for iOS 15/16, every device, or RootHide.
| Profile | Status | Installation |
|---|---|---|
| Local network, rootful iOS 14 | Public | APT repository or GitHub release |
| Self-hosted internet relay | Available; wizard features depend on release | Private package produced by the VPS wizard |
| Rootless Dopamine, tested on iPadOS 15.5 | Public; qualification limits apply | Same APT repository; rootless guide |
See the device release checkpoint and VPS qualification record for exact versions, passed checks, and remaining limits. QUALIFICATION.md defines the publication gates; a successful test is not a published release.
- Low-latency H.264 screen streaming over WebRTC
- Touch, text and Game keyboard input, captured mouse, hardware buttons, clipboard, and app launching
- Device playback audio, room microphone, intercom, and virtual microphone
- Root PTY terminal and bounded file transfer
- Photos and video library with preview, download, copy, and protected deletion
- Front and rear camera streaming, still capture, and device-side recording
- Multi-device, multi-relay enrollment with revocable browser sessions
- Transactional signed updates with watchdog verification and rollback
- No setup UI, account, or secret entry on the controlled device
Choose one deployment profile. The public repository and personalized relay packages intentionally remain separate.
Open the rctl package repository
on the jailbroken device, choose Cydia, Installer, Sileo, or Zebra, and install
rctl. The package manager selects the compatible architecture and offers
updates from the same source. Direct DEB downloads are also available in the
latest GitHub release.
Choose iphoneos-arm for rootful or iphoneos-arm64 for ordinary Dopamine
rootless; these are separate packages, not interchangeable files. Follow the
rootless installation guide for dependencies and installation.
After installation, open:
http://<device-ip>:8080/
The public package contains no relay address or credential. Repository signing, release synchronization, and isolation from personalized packages are described in docs/APT-REPOSITORY.md.
Use this profile for access outside the local network. You need a fresh
Debian/Ubuntu VPS, a domain or subdomain pointing to it, and ports 80 and 443
available. SSH to the VPS and run:
(
set -e
installer="$(mktemp)"
trap 'rm -f "$installer"' 0
curl --proto '=https' --tlsv1.2 -fsSL \
https://github.com/nobottomline/rctl/releases/latest/download/install.sh -o "$installer"
if [ "$(id -u)" -eq 0 ]; then sh "$installer"; else sudo sh "$installer"; fi
)The verified Go wizard checks the host and DNS, installs the digest-pinned relay stack, obtains TLS, and verifies HTTPS and persistence. It does not require a repository clone or compiler.
The 0.4.4 wizard implements searchable local domain hints, manual
domain entry, and confirmed Docker Engine/Compose installation on a clean host.
The latest command above selects the published release, never a draft.
Older installers may require Docker Engine and Compose v2 beforehand.
Domain hints cannot enumerate every domain pointing to a VPS;
choose a domain you control. See setup inputs
for DNS, public IPv4, and optional certificate-contact email behavior.
- Open the HTTPS admin URL printed by the wizard.
- Sign in with the generated admin secret.
- Select Pair device and download the private
.deb. - Install the package on the jailbroken device and approve the pending device.
- Open the device from the admin page.
The personalized package contains a one-time enrollment credential. Keep it private and delete it after installation. The device stores its long-lived relay identity automatically; there is nothing to configure on iOS. For pinned releases, non-interactive installation, upgrades, backup, and recovery, read docs/SETUP.md.
The 0.4.4 release includes an Updates section backed by a restricted host
service: automatic release checks, confirmed relay installation, and optional
scheduled automatic server updates. Device DEB updates require their own
confirmation and preserve relay pairings; upgrading the server does not update
devices automatically. Older installations need one verified bootstrap upgrade
to enable the host service. See update behavior and recovery.
Relay-enabled devices default to LAN + Relay, preserving direct local access when the VPS is unavailable. An administrator can switch an approved online device to Relay only from its action menu in the relay admin page.
In Relay-only mode, rctld binds port 8080 to 127.0.0.1. Relay tunneling
continues to work, while direct LAN connections are rejected.
The daemon refuses this mode until it has an approved persistent relay identity.
Relay login and revocation do not protect the independent LAN port. Use Relay-only mode before joining shared or untrusted Wi-Fi. First approve the device, verify relay control, and establish an independent recovery path such as SSH. The policy is device-wide, survives package upgrades, and does not silently re-enable LAN if the relay goes offline. Installation does not change an existing explicit policy. See security and recovery.
Browser <-- WebRTC / authenticated HTTPS --> Relay (optional)
| |
+--------------- HTTP / WebRTC -----------------+
|
rctld
/ | \
SpringBoard foreground app mediaserverd
screen/input camera/vmic playback audio
The root daemon owns network and relay transports. Small injected components remain in the process that owns each private iOS capability. Local and relay control use the same device APIs, preventing feature drift between deployment profiles. See docs/ARCHITECTURE.md for component and trust boundaries.
Start with the development guide for prerequisites, component-specific checks, and rootful/rootless package builds. Web and relay work do not require a jailbroken device; native device builds require macOS, Theos, the appropriate iOS SDK, and pinned native dependencies.
Installation is separate from building. Use the documented deployment path,
never make package install, and complete the
qualification gates before publishing artifacts.
| Path | Ownership |
|---|---|
daemon/, core/ |
Root API server, transports, security, and shared native code |
springboard/ |
Screen capture and input injection |
app/, audio/ |
Camera, microphone, and playback-audio hooks |
web/ |
Canonical device control client |
relay/ |
Go relay, VPS wizard, and separate admin client |
mobile/ |
Independent native controller applications |
protocol/ |
Versioned wire contracts and generated constants |
layout/ |
Public package payload and lifecycle scripts |
docs/ |
Architecture, protocols, operations, and qualification |
Start with docs/README.md. Protocol changes must preserve iOS 14 support, local operation, relay credential isolation, and compatibility by protocol major.
- Never expose device port
8080to the internet. - Never publish a personalized
.deb, relay database, signing key, or config. - Use trusted HTTPS/WSS and a dedicated high-entropy admin secret.
- Keep the jailbreak and VPS patched, and revoke unused sessions and devices.
- Report vulnerabilities through GitHub private vulnerability reporting.
See SECURITY.md for supported versions and disclosure guidance, and docs/SECURITY.md for the product security model.
Read CONTRIBUTING.md before opening a pull request. Bug reports must be sanitized of device identifiers, relay URLs, tokens, terminal output, and personal media.
Licensed under the Apache License 2.0. Third-party files retain their respective licenses and notices.