先奉上链接：
http://www.idownloadblog.com/2017/08/10/jailbreak-ios-935-phoenix-move-from-version-1/

这是一个不完美越狱，每次手机重启都需要重新越狱。
需要 MAC 电脑。

1. 下载 Cydia Impactor 软件
2. 下载 Phœnix.ipa
3. 启动 Impactor 并确保手机连上电脑
4. 把 Phoenix.ipa 拖到 Cydia Impactor，如下图：
   图1
5. 输入你的 Apple ID
6. 输入 Apple ID 的密码

• 如果没有开启身份双重验证，直接输入 密码 即可
• 如果开启了，则必须登录苹果网站，创建一个应用专属密码，记住这个密码并输入 Impactor
  图2

7. 当 Impactor 安装好 .ipa，检查确认 Phœnix 安装到手机中

8. Open Settings on your device and navigate to General – Device Management.

9. Select the profile named after the Apple ID you entered into Impactor. Press the Trust button to trust the jailbreak app on your device.

10. 信任 Phœnix 并启动

11. 点击 Prepare for Jailbreak 按钮 -> Begin Installation -> Use Provided Offsets， 耐心等待
    

    图3

12. Your device should respring, and the Cydia app should have appeared on your Home screen. If it doesn’t launch, re-open the jailbreak app and press Kickstart Jailbreak to enable it. This may take several tries to work. You will know it has worked when the app reports Your device is jailbroken, and not Your device is prepared for jailbreak, but the jailbreak is not enabled.

    
    图4
13. In future, you will only have to go through the Kickstart Jailbreak screen, not the other installation screens. You will have to run the app once after every reboot. The app may take several tries to successfully jailbreak.

最最最重要的事，把刚刚生成的应用专用密码删掉：

How to manage app-specific passwords

You can have up to 25 active app-specific passwords at any given time. If you need to, you can revoke passwords individually or all at once.

1. Sign in to your Apple ID account page.

2. In the Security section, click Edit.

3. In the App Specific Passwords section, click View History.

4. Click

   next to a password you want to delete, or Revoke All.

---

另外一篇，针对其他版本的，过程差不多。https://zhuanlan.zhihu.com/p/34003393
看文章的 通过USB连接 部分，ssh 上手机。

2018-10-16:
国庆期间，手机没电了。重新开机，Phœnix 打不开。SB

2018-11.14:
使用 爱思助手 ，刷机越狱 -> 一键越狱 ->

1. 手机上打开 Phœnix 进行越狱
2. 点击 Cyida，如果失败，从步骤 1 重新开始越狱。

不过，网络上报告 爱思助手 有 ios 的病毒，最好是把越狱手机的信息清理一下再用。