OS Compatibility & Container Scope
Why forcequitOS/worse_query reaches SystemGroup MobileGestalt caches on iOS/iPadOS 27.0–27.3 Beta 1, and what remains available on 26.0–26.7.2.
- Live SystemGroup: 27.0–27.3b1
- 26.0–26.7.2: Local plist + Pairing
- 27.3 container fix in v1.0.7+
- Userland container escape only
Why SystemGroup Needs iOS 27.x
GestaltX builds on forcequitOS/worse_query by Taj C (forcequitOS), the direct successor to bad_query. When an app requests its class-7 App Group container from containermanagerd, the daemon processes <app group>/Library/Caches alongside sandbox extension flag 0x8100000000 without rejecting a crafted symbolic link target, granting file operations across sibling container classes.
Crucially, Apple's container layout and sandbox profile rules differ between OS branches: on iOS and iPadOS 27.0 through 27.3 Beta 1, worse_query reaches /var/containers/Shared/SystemGroup/* (where com.apple.MobileGestalt.plist lives) and /var/containers/Data/System. On iOS 26.0 through 26.7.2, those two System paths remain outside worse_query's reach. As Taj C explicitly notes upstream, worse_query is a userland container escape, never a kernel exploit or jailbreak.
Container Path Access Matrix
The table below maps exact worse_query filesystem paths from upstream documentation against GestaltX modules:
| Container Path | iOS / iPadOS 27.0–27.3b1 | iOS / iPadOS 26.0–26.7.2 | iOS 18.x / Patched | GestaltX Impact |
|---|---|---|---|---|
/var/containers/Shared/SystemGroup/* | Read / Write | Blocked | Patched / Absent | Hosts systemgroup.com.apple.mobilegestaltcache |
/var/containers/Data/System | Read / Write | Blocked | Patched / Absent | System container scope exposed on iOS 27.x |
/var/mobile/Containers/Shared/AppGroup | Parent + Child | Individual /* | Patched / Absent | Parent enumeration requires iOS 27.x |
/var/mobile/Containers/Data/Application/* | Accessible | Accessible | Patched / Absent | Sandbox data for user apps (Launch Images / Audio) |
/var/mobile/Containers/Data/PluginKitPlugin/* | Accessible | Accessible | Patched / Absent | App extension and widget data containers |
/var/mobile/Containers/Data/InternalDaemon/* | Accessible | Accessible | Patched / Absent | Userland daemon container directories |
If you run iOS 27.3 Beta 1, make sure you install v1.0.7 or v1.1.1; builds v1.0.6 and earlier could miss PosterBoard and App Launch Image containers on 27.3 prior to the container discovery fix.
What Works on iOS 26.0 to 26.7.2
Starting in v1.0.5, GestaltX's About screen explicitly lists supported live OS versions as iOS / iPadOS 27.x while keeping installation enabled on 26.0–26.7.2:
| OS Branch | GestaltX Mode | Available Capabilities |
|---|---|---|
| iOS / iPadOS 27.0 – 27.2.x | Full Live Access | All MobileGestalt presets, MG Control, Face ID recovery, PosterBoard, Launch Images & App Audio |
| iOS / iPadOS 27.3 Beta 1 | Full (use v1.0.7+) | Requires v1.0.7 or v1.1.1 for updated 27.3 Wallpaper & Launch Image container discovery |
| iOS / iPadOS 26.0 – 26.7.2 | Local Plist + App Scope | Installs cleanly; SystemGroup MobileGestalt blocked; local plist Share import & Pairing/Audio paths available |
| iOS / iPadOS 18.x & older | Unsupported (#130) | worse_query primitive targets 26.0–26.7.2 / 27.x only; older branches use legacy exploits (Nugget / MisakaX) |
On iOS 26.x, you can import any exported com.apple.MobileGestalt.plist via the Share Extension to audit, search, and edit typed CacheExtra keys in MG Control, or pair GestaltX with WQFiles and WorkTweaks for user-application container tasks.
Unsupported Versions & Hardware
Users on iOS 18.x (such as 18.6 or 18.7, tracked in issue #130) cannot use GestaltX for live device access because the worse_query container vulnerability does not exist on iOS 18. Similarly, if you rely on live SystemGroup access on iOS 27.0–27.3 Beta 1, disable automatic OTA updates before testing newer beta seeds until community maintainers confirm containermanagerd behavior.
Finally, distinguish writable plist flags from physical silicon support: enabling Always-On Display on non-LTPO screens draws extra standby power, and enabling Apple Intelligence flags cannot bypass server-side SoC checks that pause model downloads around 147 MB on older chips (#144).
USB-C Sideloading & Backup Gear
Provisioning GestaltX with SideStore, AltStore, Impactor, or iLoader and generating a Pairing file for App Audio Library requires a reliable wired USB data cable, while an external SSD keeps a clean off-device copy of com.apple.MobileGestalt.plist and full Finder/iTunes backups:
| Hardware | Role in GestaltX Workflow | Specification | Amazon |
|---|---|---|---|
| Anker 240W USB-C Data & Power Cable | Wired IPA signing & Pairing file capture | USB-IF certified USB-C data & 240W power lead | Check price |
| Apple 60W Woven USB-C Sync Cable | Mac / Windows sync & recovery restore | Woven 1m USB-C charge and USB 2 data cable | Check price |
| SanDisk 1TB Extreme Portable USB-C SSD | Off-device OriginalGestalt.plist & iOS backups | 1TB NVMe USB-C 3.2 Gen 2 (up to 1,050 MB/s) | Check price |
| UGREEN Revodok 10Gbps USB-C Hub | Multi-port USB-C & USB-A bridge for MacBooks | 10Gbps data ports with 100W PD pass-through | Check price |
As an Amazon Associate, this site earns from qualifying purchases.
Common questions
Can Pairing or LocalDevVPN enable live MobileGestalt writes on iOS 26.x?
No. Pairing + LocalDevVPN in GestaltX v1.1.1 resolves notification-sound paths for App Audio Library. Live on-device read/write access to systemgroup.com.apple.mobilegestaltcache via worse_query requires iOS or iPadOS 27.0–27.3 Beta 1.
Does GestaltX work on iPadOS 27 as well as iOS 27?
Yes. GestaltX supports both iPhone and iPad on 27.x and includes dedicated iPad presets for Stage Manager, Apple Pencil settings, and iPad app compatibility.
Is worse_query a jailbreak or tweak injector?
No. worse_query cannot patch kernel memory, bypass codesigning (PPL/SPTM), or inject dynamic libraries into running processes. It operates strictly on mutable files inside reachable container directories.