Remember: The iPhone 4s is a 32-bit relic. As of 2025, Apple will likely stop supporting activation servers for this device entirely, meaning future bypasses may become impossible. If you have a locked 4s on iOS 9.3.5, your window to unlock it is right now.
For a functional, semi-permanent bypass on iOS 9.3.5, the security community relies on Sliver by the developer Matthew Pierson (a popular tool from the r/setupapp subreddit). This tool utilizes the Checkm8 exploit.
Requirements:
The Process (Simplified):
What you get:
The major downside: On the iPhone 4s with iOS 9.3.5, this is a tethered bypass. Every time the battery dies or you turn off the phone, you must re-run Sliver on the Mac. If you don’t, you will be back at the Activation Lock screen.
If you want full control, you can jailbreak the 4s on 9.3.5 using Phoenix (via a sideloading tool like Sideloadly or 3uTools). Once jailbroken: iphone 4s activation lock bypass ios 9.3.5
This removes the Activation Lock record from the local filesystem. When the phone reboots, it will bypass the server check. This is a permanent bypass for the 4s.