FilzaSlop

FilzaJailedDS fork with:

• A sandbox escape for iOS 18, iOS 26, and iOS 27 beta 1–4.
• App container access.
• Other less interesting directories listed below.
• A PosterBoard Wallpaper Lab.

Not every feature currently works on iOS 18 or iOS 26. Open an issue if you find a problem.

The unsigned IPA is available on the Releases page.

Paths

Container roots

/private/var/mobile/Containers/Data/Application/
/private/var/mobile/Containers/Shared/AppGroup/
/private/var/mobile/Containers/Data/PluginKitPlugin/
/private/var/mobile/Containers/Data/VPNPlugin/
/private/var/mobile/Containers/Data/InternalDaemon/
/private/var/mobile/Containers/Data/System/
/private/var/mobile/Containers/Shared/SystemGroup/
/private/var/mobile/Containers/Data/Protected/

Additional paths

/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/
/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.installcoordinationd/Library/InstallCoordination/

Notable app data

# Notes
/private/var/mobile/Containers/Shared/AppGroup/<Notes-group-UUID>/NoteStore.sqlite

# Safari app data
/private/var/mobile/Containers/Data/Application/<Safari-app-UUID>/

# Direct in-app shortcut (UUID resolved dynamically)
Device Storage/[MHA-C2] Safari Tabs/Safari/SafariTabs.db

# Safari shared data: group.com.apple.safari
/private/var/mobile/Containers/Shared/AppGroup/<Safari-group-UUID>/

PosterBoard

Wallpaper Lab can:

• Inspect the PosterBoard descriptor store.
• Import the bundled Cipher wallpaper.
• Import extracted .tendies wallpaper packages.
• Apply the PosterBoard refresh preferences.
• Roll back the latest import.

Place additional packages in:

Documents/Device Storage/[MHA-C2] Wallpaper Lab/Imports/

Use the Wallpaper button at the Wallpaper Lab root. Imports add new descriptor directories and keep a rollback backup. They do not overwrite the PosterBoard database or existing descriptors.

Signing

Keep this bundle and CodeDirectory identifier:

com.apple.mobile.MobileHouseArrest

Changing it disables the MobileHouseArrest path.

Build

export THEOS="$HOME/theos"
make clean
make package FINALPACKAGE=1

Inject FilzaApplySandboxExt.dylib into Filza and sign the app.

PoCs

• MobileHouseArrest
• Geod MCM
• InstallCoordination
• CFPrefs zero-file

Credits

• 34306/FilzaJailedDS
• CrazyMind90
• XPF and ChOma contributors
• SerStars/nugget-wallpapers
• mightycooldude12