Links

Surface RT & 2 Jailbreak USB

All-in-one jailbreak package for Surface RT & Surface 2
The Surface RT & 2 Jailbreak USB is an all-in-one package to enable Surface RT & Surface 2 tablets to run third party applications under Windows RT 8.1 or to boot alternative operating systems such as Windows 10 Build 15035 or Linux.

Requirements

  • A Surface RT with UEFI v3.31.500 or a Surface 2 with UEFI v2.6.500 or v4.22.500.
  • A device with a cleared eMMC or a Windows RT 8.1 installation that has not been updated beyond October 2016. Updates released after this date contain "Jailbreak Killing" updates that will prevent installation.
  • 1GB+ USB Drive.

Download

Download the Surface RT & 2 Jailbreak USB files from the link below.
Surface_RT_2_Jailbreak_USB_v1.5a.zip
3MB
Binary
Surface RT & 2 Jailbreak USB Files

Extract

This will permanently delete any data stored on the USB drive.
  1. 1.
    Format a USB drive as FAT32.
  2. 2.
    Right click on the downloaded file and select "Extract All..."
  3. 3.
    Select a destination for the extracted files.
  4. 4.
    Click "Extract".
Selecting and formatting USB drive
Extracting Zip file to USB drive
Expected contents of USB drive after extraction

Apply Jailbreak

The use of the Surface RT & 2 Jailbreak USB is entirely at your own risk.

Disabling Secure Boot

With Keyboard
Without Keyboard
The Surface RT requires the use of a USB hub and external keyboard, Touch/Type Covers are not supported. The Surface 2 supports the Touch/Type Cover or the use of a USB hub and external keyboard.
  1. 1.
    Install Golden Keys
    1. 1.
      Insert Jailbreak USB into the devices USB port.
    2. 2.
      Hold the Volume Down button and press the Power button. If the device is already powered on and boot looping due the eMMC being cleared then hold the Volume Down until the device boots and do not touch the Power Button.
    3. 3.
      Once the Surface logo appears release the Volume Down button.
    4. 4.
      Using Arrow Keys select "Install Golden Keys" and press Enter.
    5. 5.
      Use the Arrows Keys to highlight "Accept and Install" and press Enter.
    After selecting "Accept and Install" to continue or "Decline" to cancel the device will reboot automatically.
  2. 2.
    Install Yahallo
    1. 1.
      Insert Jailbreak USB into the devices USB port.
    2. 2.
      Hold the Volume Down button and press the Power button. If the device is already powered on and boot looping due the eMMC being cleared then hold the Volume Down until the device boots and do not touch the Power Button.
    3. 3.
      Once the Surface logo appears release the Volume Down button.
    4. 4.
      Using Arrow Keys select "Install Yahallo" and press Enter.
    When "Install Yahallo" is selected from the boot menu Yahallo will launch automatically and will not prompt for confirmation.
  3. 3.
    Uninstall Golden Keys
    1. 1.
      Insert Jailbreak USB into the devices USB port.
    2. 2.
      Hold the Volume Down button and press the Power button. If the device is already powered on and boot looping due the eMMC being cleared then hold the Volume Down until the device boots and do not touch the Power Button.
    3. 3.
      Once the Surface logo appears release the Volume Down button.
    4. 4.
      Using Arrow Keys select "Uninstall Golden Keys" and press Enter.
    When "Uninstall Golden Keys" is selected from the boot menu the device will reboot automatically and will not prompt for confirmation.
From Windows RT 8.1
Configurating Jailbreak USB From Another Device
  1. 1.
    Install Golden Keys
    1. 1.
      Insert Jailbreak USB into the devices USB port.
    2. 2.
      Run "Jailbreak_USB_Menu.cmd" as administrator.
    3. 3.
      Select Option 1 (Sets default USB Boot entry to "Install Golden Keys").
    4. 4.
      Select Option B (Sets device to boot from USB on next reboot).
    5. 5.
      Select Option R (Reboots device).
    6. 6.
      Wait for the boot menu countdown to complete.
    7. 7.
      Use the Volume Keys to highlight "Accept and Install".
    8. 8.
      Use the Windows Key on the on device to confirm.
    After selecting "Accept and Install" to continue or "Decline" to cancel the device will reboot automatically.
  2. 2.
    Install Yahallo
    1. 1.
      Insert Jailbreak USB into the devices USB port.
    2. 2.
      Run "Jailbreak_USB_Menu.cmd" as administrator.
    3. 3.
      Select Option 3 (Sets default USB Boot entry to "Install Yahallo").
    4. 4.
      Select Option B (Sets device to boot from USB on next reboot).
    5. 5.
      Select Option R (Reboots device).
    6. 6.
      Wait for the boot menu countdown to complete.
    7. 7.
      When prompted press and hold the Power button to power off the device.
    When "Install Yahallo" is selected from the boot menu Yahallo will launch automatically and will not prompt for confirmation.
  3. 3.
    Uninstall Golden Keys
    1. 1.
      Insert Jailbreak USB into the devices USB port.
    2. 2.
      Run "Jailbreak_USB_Menu.cmd" as administrator.
    3. 3.
      Select Option 2 (Sets default USB Boot entry to "Uninstall Golden Keys").
    4. 4.
      Select Option B (Sets device to boot from USB on next reboot).
    5. 5.
      Select Option R (Reboots device).
    6. 6.
      Wait for the boot menu countdown to complete.
    When "Uninstall Golden Keys" is selected from the boot menu the device will reboot automatically and will not prompt for confirmation.
See USB Boot Menu Navigation for details on using "Jailbreak_USB_Menu.cmd".
  1. 1.
    Install Golden Keys
    1. 1.
      Insert Jailbreak USB into the device you are using to set its configuration.
    2. 2.
      Run "Jailbreak_USB_Menu.cmd" as administrator.
    3. 3.
      Select Option 1 (Sets default USB Boot entry to "Install Golden Keys").
    4. 4.
      Eject the jailbreak USB.
    5. 5.
      Insert Jailbreak USB into the target devices USB port.
    6. 6.
      Hold the Volume Down button and press the Power button. If the device is already powered on and boot looping due the eMMC being cleared then hold the Volume Down until the device boots and do not touch the Power Button.
    7. 7.
      Once the Surface logo appears release the Volume Down button.
    8. 8.
      Wait for the boot menu countdown to complete.
    9. 9.
      Use the Volume Keys to highlight "Accept and Install".
    10. 10.
      Use the Windows Key on the on device to confirm.
    After selecting "Accept and Install" to continue or "Decline" to cancel the device will reboot automatically.
  2. 2.
    Install Yahallo
    1. 1.
      Insert Jailbreak USB into the device you are using to set its configuration.
    2. 2.
      Run "Jailbreak_USB_Menu.cmd" as administrator.
    3. 3.
      Select Option 3 (Sets default USB Boot entry to "Install Yahallo").
    4. 4.
      Eject the jailbreak USB.
    5. 5.
      Insert Jailbreak USB into the target devices USB port.
    6. 6.
      Hold the Volume Down button and press the Power button. If the device is already powered on and boot looping due the eMMC being cleared then hold the Volume Down until the device boots and do not touch the Power Button.
    7. 7.
      Once the Surface logo appears release the Volume Down button.
    8. 8.
      Wait for the boot menu countdown to complete.
    9. 9.
      When prompted press and hold the Power button to power off the device.
    When "Install Yahallo" is selected from the boot menu Yahallo will launch automatically and will not prompt for confirmation.
  3. 3.
    Uninstall Golden Keys
    1. 1.
      Insert Jailbreak USB into the device you are using to set its configuration.
    2. 2.
      Run "Jailbreak_USB_Menu.cmd" as administrator.
    3. 3.
      Select Option 2 (Sets default USB Boot entry to "Uninstall Golden Keys").
    4. 4.
      Eject the jailbreak USB.
    5. 5.
      Insert Jailbreak USB into the target devices USB port.
    6. 6.
      Hold the Volume Down button and press the Power button. If the device is already powered on and boot looping due the eMMC being cleared then hold the Volume Down until the device boots and do not touch the Power Button.
    7. 7.
      Once the Surface logo appears release the Volume Down button.
    8. 8.
      Wait for the boot menu countdown to complete.
    When "Uninstall Golden Keys" is selected from the boot menu the device will reboot automatically and will not prompt for confirmation.

Confirming Secure Boot Is Disabled

Assuming no errors have occurred Secure Boot is now disabled on your device. If an operating system is present this can be verified by running "msinfo32.exe" once booted into Windows.
msinfo32.exe showing Secure Boot is disabled

Windows Configuration

These steps are only required for users who wish to run third party applications under Windows RT 8.1, users who wish to run Windows 10 or Linux can ignore these steps.
Once Secure Boot is confirmed to be disabled complete one of the following steps:
Enabling UMCI Audit Mode (Recommended)
Enabling Test Mode (Alternative)
Third party applications are not required to be signed in any way when UMCI Audit Mode is enabled and no watermark will be displayed on the desktop. Files that have been previously signed will continue to work normally.
  1. 1.
    Launch "Jailbreak_USB_Menu.cmd" from the Jailbreak USB.
  2. 2.
    Select Option 8 (Enable UMCI Audit Mode) and wait for confirmation.
  3. 3.
    Select Option R (Reboot).
If UMCI Audit Mode has been successfully enabled it will now be possible to run unsigned executables on Windows RT 8.1.
Windows RT 8.1 running unsigned Winfile executable (Ported to ARM by @never_released).
Winfile_Unsigned.zip
220KB
Binary
Third party applications are required to be test signed when running under Test Mode. See the SignTool page for further information.
  1. 1.
    Launch "Jailbreak_USB_Menu.cmd" from the Jailbreak USB.
  2. 2.
    Select Option 6 (Enable Test Signing) and wait for confirmation.
  3. 3.
    Select Option R (Reboot).
If Test Mode has been successfully enabled the Test Mode watermark will be visible it will now be possible to run test signed executables on Windows RT 8.1. The Test Mode watermark may not be shown if Windows is not activated.
Windows RT 8.1 running test signed Winfile executable (Ported to ARM by @never_released).
Winfile_Signed.zip
222KB
Binary

Troubleshooting

Jailbreak Killing Updates

When configuring the boot options to "Install Golden Keys" on the device to be jailbroken, a warning will be provided if the installation would fail due to the presence of "Jailbreak Killing" updates.
Configuration Menu "Jailbreak_USB_Menu.cmd" warning of "Jailbreak Killing" updates
If the device has a Windows RT 8.1 installation that has been updated beyond October 2016 the options are either attempting to manually remove the "Jailbreak Killing" updates, restore the device using a Bare Metal Recovery image (Restoring from the Recovery Partition will not work) or to clear the eMMC.
If the device had a Windows RT 8.1 installation that was updated past October 2016 at some point and was later reset using the built in Recovery Partition then the device will still be patched against Golden Keys but no error will be reported.
The fastest and most reliable method in all cases is to clear the eMMC from the command prompt.
  1. 1.
    Follow the instructions on the Clearing eMMC page.
  2. 2.
    The device is now cleared of all data and Jailbreak can be attempted again.

Unsupported UEFI

Attempting to run Yahallo on a device with an unsupported UEFI will result in an error message when booting Yahallo. When configuring the boot options to "Install Yahallo" on the device to be jailbroken, a warning will be provided if the UEFI is not supported by Yahallo and provide an option to install a supported version.
Installing a UEFI update will require a Windows RT 8.1 installation on the device.
Configuration Menu "Jailbreak_USB_Menu.cmd" offering UEFI Update
UEFI Update complete
A UEFI update can also be installed manually, the UEFI update can be installed by opening the directory for the the relevant device, right clicking the INF file, clicking install and rebooting the device.
Installing Surface 2 UEFI Update

Digital Signature Error

If Status Code 0xc0000428 is displayed when attempting to install Yahallo (Windows cannot verify the digital signature for this file.) then see Jailbreak Killing Updates and once resolved try again.

USB Boot Failed

If the USB drive does not boot on the target device try the following steps:
  1. 1.
    Follow the instructions on the Format USB Drive page.
  2. 2.
    Extract again starting at Step 2.

USB Boot Menu Navigation

If a keyboard is not available then running "Jailbreak_USB_Menu.cmd" on the USB drive will offer configuration choices (Boot Defaults) to automate what will happen when the target device is booted from the Jailbreak USB drive.
Setting "Boot Defaults" using "Jailbreak_USB_Menu.cmd" can be done on any Windows device however the options under "Settings" and "Misc" and the Status Indicators will only appear on a Surface RT or Surface 2 running Windows RT 8.1.
Configuration Menu "Jailbreak_USB_Menu.cmd" running on a Surface (ARM)
Configuration Menu "Jailbreak_USB_Menu.cmd" running on a Desktop PC (x86/x64)
The boot default can be set to Install Golden Keys, Uninstall Golden Keys, Install Yahallo and Uninstall Yahallo. The default Boot Menu Timeout can also be modified to any duration the user requires, by default it is set to 30 seconds. Once the the countdown is complete the selected action will automatically run.
When interacting with the Windows Boot Manager the Surface RT requires the use of a USB hub and external keyboard, Touch/Type Covers are not supported. The Surface 2 supports the Touch/Type Cover or the use of a USB hub and external keyboard.
The Windows Key and Volume Buttons should only be used when selecting "Accept and Install" or "Decline" on the Install Golden Keys confirmation page only. Attempting to use the Windows Key or Volume Buttons for any Windows Boot Manager navigation on either device will cause the automatic countdown to stop.
USB Boot Menu

Credits

  • Yahallo - @imbushuo
  • Yahallo Compilation - @Leander
  • Golden Keys - @never_released & TheWack0lian
  • GoldenKeysUSB - @lgibson02
  • Installation Menu & Guide - @jwa4