joranv1/ios-sailfish

选用指南

AI 根据 README 整理 · 2026/10/22 21:21:33

使用方式

通过fastboot boot命令临时启动，不刷写引导分区；需要自行构建内核、iOS根文件系统、GPU固件等，并按照README中的步骤操作。

查看 README 依据

-> fastboot boot pixel-boot.img (temporary; nothing is flashed to boot) -> shim: stops the watchdog, loads the payload appended to the kernel image -> XNU Mach-O + generated Apple Device Tree (ADT) + boot-args + GPU firmware -> XNU -> UFS driver -> HFS+ root in the userdata partition -> dyld + shared cache -> launchd -> daemons -> backboardd (+ sweetgl.dylib) + SpringBoard ```

1. **Kernel:** `tools/xnu-build-local.sh xnu/out-local-NNNN` builds XNU with all patches in `xnu/patches/` (blacktop/darwin-xnu-build, Xcode 15.4 and KDK 13.5 unpacked in `research/`). 2. **iOS root:** download the iPhone 8 IPSW `iPhone_4.7_P3_16.7.16_20H392` and build the image with `sudo tools/mkiosroot-mac.sh OS.dmg SYSTEMOS.dmg APPOS.dmg ios16-root.img`. Before flashing, attach it read-write on the Mac (`hdiutil attach -imagekey diskimage-class=CRawDiskImage ios16-root.img`) and add what the build script does not do yet:

3. **GPU firmware:** the Adreno 530 microcode (`a530_pm4.fw`, `a530_pfp.fw`, without their 4-byte headers) and the zap shader (`a530_zap.mdt` + `.b02`) come from the phone's own vendor firmware. They are not in this repository. 4. **Boot image:** `tools/mkadt.py ADT --pixel1` (needs the iPhone 8 device tree `d20ap` from the IPSW), then ```sh python3 tools/mkpayload.py KERNEL ADT payload --cmdline "$ARGS" \ --blob GPU-PM4=pm4.bin --blob GPU-PFP=pfp.bin \ --blob GPU-ZAP-MDT=a530_zap.mdt --blob GPU-ZAP-SEG=a530_zap.b02

部署要求

需要一台已解锁引导加载程序的Google Pixel 1（sailfish），以及一台装有Xcode 15.4和KDK 13.5的Mac用于构建内核。安装过程会清除userdata分区中的所有数据。

查看 README 依据

You need a Google Pixel 1 (`sailfish`) with an **unlocked bootloader**, a Mac with Xcode 15.4 and the KDK 13.5 (for the kernel build), and [TWRP for sailfish](https://dl.twrp.me/sailfish/) (booted temporarily, never flashed). **Everything on `userdata` is lost.** Bootloaders, recovery, modem and persist are never touched. Keep your partition backups and any device dumps out of git (`.gitignore` covers `backup/`, `research/`, `logs/`).

已知限制

项目为实验性质，不可作为日常手机系统使用；缺少Wi-Fi、蓝牙、蜂窝网络、音频、摄像头、传感器、GPS、Touch ID和SEP，且无硬件视频解码器，不支持Metal，安全机制被关闭。

查看 README 依据

"tools: granule-probe, 16K page check for other phones". > Experimental, not a usable phone OS. Many things are missing or stubbed (see below) and Apple's security model is mostly switched off. It installs into the `userdata` partition and so **erases Android's user data**. ## Status (2026-10-21) - Boots from `fastboot boot` to the lock screen in **about 20 seconds**. - **GPU acceleration on the Adreno 530**: CoreAnimation's own OpenGL ES renderer runs on Mesa's freedreno driver, through our own kernel GPU driver.

| Buttons | Power, volume up, volume down = **Home** (PMIC/TLMM), as HID keys | | Battery | Fuel gauge readout and charging at 1.5 A (PMI8994) | | Device identity | iPhone 8 (`iPhone10,1` / `D20AP`), Home-button UI | | Activation | mobileactivationd's own "Hactivation" path, chosen through device-tree security status. No Apple servers involved | ## What does not work (yet) - **No Wi-Fi, Bluetooth, cellular, audio, camera, sensors, GPS, Touch ID or SEP.**

- **No hardware video decoder:** HEIC images and video do not decode. The stock wallpapers' HEIC layers are converted to PNG when the root is built (`tools/wallpaper-heic2png.sh`). - **No Metal.** CoreAnimation falls back to its OpenGL ES renderer, which is what runs on the GPU. Apps that need Metal do not work. - **No thermal management:** keep turbo off for normal use. - **Security is off:** permissive code signing (AMFI) and sandbox policies, a stub AppleKeyStore, no data protection. Do not put anything personal on it. ## How it boots ``` Pixel bootloader (aboot, unlocked)