The researcher says it works without root or administrator privileges and without password prompts. But he's not revealing how it works to Apple because there's no money for him in its invite-only/iOS-only bounties.