dipa-studio/ios-sweet

选用指南

AI 根据 README 整理 · 2026/10/19 19:11:42

适用场景

适合对将iOS移植到非苹果硬件感兴趣的开发者，用于研究XNU内核、驱动和启动流程。

查看 README 依据

# ios-sweet **Apple's iOS 16 running on a Redmi Note 10 Pro.** This project ports Apple's open-source XNU kernel (xnu-8796, the iOS 16 generation) to the Xiaomi Redmi Note 10 Pro (`sweet`, Qualcomm SM7150 / Snapdragon 732G). On top of it runs the **unmodified iOS 16.7.16 (20H392) userland of the iPhone X**: launchd, the system daemons, backboardd, SpringBoard and the stock apps.

As of **2026-10-18** the phone boots to the **iOS home screen**. You can unlock it, open Settings, pull down Control Center and the notification center, and use the touchscreen and the hardware buttons. Rendering runs entirely on the CPU; there is no GPU driver. > Experimental bring-up, not a usable phone OS. Many things are missing or stubbed (see below), and Apple's security model is mostly switched off. It installs into the `userdata` partition and so **erases Android's user data**. ## What works | Area | State | | --- | --- |

目标用户

面向具备内核构建、底层硬件调试能力的开发者，需要熟悉Linux、fastboot和恢复模式操作。

查看 README 依据

You need a Redmi Note 10 Pro (`sweet`, global or Indian variant, SM7150) with an **unlocked bootloader**, a Linux PC, and a GitHub account for the kernel build. This is the exact path used for the screenshots above; other variants or firmware may need changes. **Everything on `userdata` is lost.** Bootloaders, recovery, modem and persist partitions are never touched. ### 0. Back up the phone

The kernel builds on GitHub's macOS runners with [blacktop/darwin-xnu-build](https://github.com/blacktop/darwin-xnu-build). The workflow fetches xnu-8796, applies `xnu/patches/` in order, and also stages the pinned open-source libpthread, HFS and BearSSL sources it needs. Fork the repo (public repos get free macOS minutes) and run: ```sh gh workflow run xnu.yml -R YOU/ios-sweet gh run download RUN_ID -R YOU/ios-sweet -n xnu-kernel -D xnu/out ``` To check a patch locally before spending a CI run, `tools/xnu-cc.py` replays the compile commands of a previous CI log for single files.

使用方式

通过命令行操作，包括构建内核、制作根文件系统镜像、使用fastboot刷入和启动。

查看 README 依据

Boot OrangeFox (or any recovery with adb root) temporarily and pull at least `persist`, `modemst1`, `modemst2`, `fsg`, `fsc` and `boot`, `dtbo`, `vbmeta`. They contain per-device calibration data. Keep them off git; `.gitignore` already excludes `backup/`, `dtb/` and `recovery/`. The shim needs the stock DTB. Unpack your phone's stock `boot.img`: ```sh python3 tools/unpack_bootv2.py backup/boot.img dtb/boot_unpacked # -> dtb/boot_unpacked/dtb ``` ### 1. Build the kernel

The kernel builds on GitHub's macOS runners with [blacktop/darwin-xnu-build](https://github.com/blacktop/darwin-xnu-build). The workflow fetches xnu-8796, applies `xnu/patches/` in order, and also stages the pinned open-source libpthread, HFS and BearSSL sources it needs. Fork the repo (public repos get free macOS minutes) and run: ```sh gh workflow run xnu.yml -R YOU/ios-sweet gh run download RUN_ID -R YOU/ios-sweet -n xnu-kernel -D xnu/out ``` To check a patch locally before spending a CI run, `tools/xnu-cc.py` replays the compile commands of a previous CI log for single files.

### 2. Build the iOS root image Download the iPhone X (iPhone10,3) iOS 16.7.16 (20H392) IPSW from Apple. Then, on Linux, with `apfs-fuse`, `hfsprogs` and sudo: ```sh # OS, SystemOS and AppOS disk images from the IPSW (see BuildManifest.plist for their names) tools/mkiosroot.sh OS.dmg SystemOS.dmg AppOS.dmg ios16-root.img 16G sudo fsck.hfsplus -fy ios16-root.img sudo mount -t hfsplus -o loop,force ios16-root.img /mnt/iosroot sudo python3 tools/sweet-root-tweaks.py /mnt/iosroot sudo umount /mnt/iosroot img2simg ios16-root.img ios16-root.simg ```

部署要求

需要Redmi Note 10 Pro（sweet，SM7150）且已解锁引导加载程序，一台Linux PC，以及用于内核构建的GitHub账户。

查看 README 依据

You need a Redmi Note 10 Pro (`sweet`, global or Indian variant, SM7150) with an **unlocked bootloader**, a Linux PC, and a GitHub account for the kernel build. This is the exact path used for the screenshots above; other variants or firmware may need changes. **Everything on `userdata` is lost.** Bootloaders, recovery, modem and persist partitions are never touched. ### 0. Back up the phone

已知限制

当前无法离开应用、无Wi-Fi/蓝牙/蜂窝/音频/相机/传感器/GPS/SEP/Face ID，无GPU驱动，仅使用6个A55核心，启动缓慢，安全性关闭，且会擦除Android用户数据。

查看 README 依据

As of **2026-10-18** the phone boots to the **iOS home screen**. You can unlock it, open Settings, pull down Control Center and the notification center, and use the touchscreen and the hardware buttons. Rendering runs entirely on the CPU; there is no GPU driver. > Experimental bring-up, not a usable phone OS. Many things are missing or stubbed (see below), and Apple's security model is mostly switched off. It installs into the `userdata` partition and so **erases Android's user data**. ## What works | Area | State | | --- | --- |

| Battery | IOPMPowerSource service (static 100 %, charging icon; real fuel-gauge readout prepared) | | Device identity | iPhone X (`iPhone10,3` / `D22AP`): no Home button, gesture UI | | Activation | Native "Hactivation" path of mobileactivationd, chosen through device-tree security status. No Apple servers involved | ## What does not work (yet) - **Navigation:** you cannot leave an app (the home gesture and AssistiveTouch Home do nothing yet). - **No Wi-Fi, Bluetooth, cellular, audio, camera, sensors, GPS or SEP / Face ID.** Daemons for them start and fail or keep relaunching.

- **No GPU.** Everything is drawn by the CPU at roughly 20–30 fps. The two Cortex-A76 cores are not used yet. - **Few apps.** The image has only what is on the system volume. There is no App Store, no Apple ID, and some Settings pages are empty. - **Slow boot:** about 4 minutes on the Apple logo. - **Security is off:** permissive code signing (AMFI) and sandbox policies, a stub AppleKeyStore, no data protection. Do not put anything personal on it. ## How it boots ``` ABL (stock Xiaomi bootloader, unlocked) -> fastboot boot shim-boot.img (temporary; nothing is flashed to boot)