oosexgang/hackios-xnu-kernel

选用指南

AI 根据 README 整理 · 2026/10/22 15:51:37

适用场景

适用于在 QEMU 虚拟机或特定 Android 手机（POCO X5 Pro 5G）上运行 iOS 16.5 系统，进行系统启动、驱动替换和用户空间运行的研究。

查看 README 依据

# HackiOS — XNU kernel **HackiOS** boots Apple's open-source **XNU kernel** (`xnu-8796.121.2`, the kernel of iOS 16.5) on Android phone hardware and runs the **unmodified iOS 16.5 user space** on top of it: launchd → backboardd → SpringBoard → apps. Our own EFI loader, our own replacements for Apple's closed drivers, a UEFI port, and a Linux Wi-Fi driver on a compatibility layer make that possible. It runs in two places: - **POCO X5 Pro 5G (redwood, Snapdragon 778G)** — nothing is flashed: the UEFI is started with `fastboot boot`,

the whole system lives in RAM, and after a reboot the phone is back in Android; - **QEMU** (`virt`, aarch64) — the same thing on any Linux computer, no phone needed. This repository is half of the project: | Repository | What | |---|---| | **hackios-xnu-kernel** (this one) | XNU patches, the EFI loader, the UEFI port, Wi-Fi, QEMU scripts, `xl`, prebuilt kernel/loader/UEFI, `common/` scripts |

目标用户

面向对 iOS 内核和系统底层运行机制感兴趣的研究人员和开发者。

查看 README 依据

# HackiOS — XNU kernel **HackiOS** boots Apple's open-source **XNU kernel** (`xnu-8796.121.2`, the kernel of iOS 16.5) on Android phone hardware and runs the **unmodified iOS 16.5 user space** on top of it: launchd → backboardd → SpringBoard → apps. Our own EFI loader, our own replacements for Apple's closed drivers, a UEFI port, and a Linux Wi-Fi driver on a compatibility layer make that possible. It runs in two places: - **POCO X5 Pro 5G (redwood, Snapdragon 778G)** — nothing is flashed: the UEFI is started with `fastboot boot`,

使用方式

通过命令行工具 `common/run.sh` 或 `xl` 启动系统，支持 QEMU 模拟和真实设备运行，提供触摸模拟、截图等交互方式。

查看 README 依据

(Debian/Ubuntu: `git python3 7zip liblz4-dev gcc qemu-system-arm qemu-efi-aarch64`; 7-Zip must be 23 or newer — it reads APFS.) ```sh git clone https://github.com/oosexgang/hackios-xnu-kernel.git hackios cd hackios common/setup.sh # brings hackios-xnu-userland into the same tree, checks the host ios165/fetch.sh # downloads 7.4 GB from Apple's CDN and extracts what is needed (5-15 min) common/build.sh qemu-virt # builds the APFS images (and the kernel, if the toolchain is there) common/run.sh qemu-virt # a 20-minute session in a QEMU window ```

The lock screen appears after 2–3 minutes. - **Mouse with the left button held = finger.** Unlock / leave an app: swipe up from the very bottom edge; back: swipe from the left edge. - Keys: `H` home, `L` lock/power, `↑`/`↓` volume, `F11` (hold) five fingers. - From a script: `qemu/touch.py swipe 0.5 0.985 0.5 0.3 250`, `qemu/touch.py tap 0.615 0.71`, `qemu/touch.py key home`; screenshot: `qemu/screendump.sh shot.png`. - Right after SpringBoard appears the system is still registering apps: give it 30–40 s.

common/build.sh redwood GL=1 # images + out/redwood-boot.img common/run.sh redwood 900 # loader into RAM, system image into RAM, a 15-minute session ``` or step by step with `xl`: ```sh ./xl enter # Android -> fastboot -> our loader in RAM (fastboot boot); it brings up its own USB link ./xl ramdisk # upload the system image into the phone's RAM (2.5 GB, ~80 s), once per loader session XL_SECS=900 XL_CMDLINE="touchscreen=1 cpufreq=1 bootcpu=7 cpus=8 gpu=1 wifi=1 adsp=1" ./xl run ./xl screenshot shot.png ./xl reboot # back to Android ```

部署要求

QEMU 运行需要 Linux x86-64、约 12 GB 空闲磁盘和 4 GB 空闲内存；真机运行需要 POCO X5 Pro 5G 且解锁引导加载程序，并需从设备提取固件。

查看 README 依据

It is a research bench, not a ROM: a session lasts a given number of seconds, then the kernel returns to the loader and hands over its log. ## Quick start: QEMU, no kernel build `prebuilt/` holds the kernel, loader and our programs built from these repositories, so all you need is the system image, which is made on your machine from Apple's IPSW. Needs: Linux x86-64, ~12 GB free disk, 4 GB free RAM. Packages (Arch): ```sh sudo pacman -S --needed git python 7zip lz4 gcc qemu-system-aarch64 qemu-ui-gtk edk2-aarch64 ```

- Debian/Ubuntu UEFI firmware: `QEMU_EFI=/usr/share/AAVMF/AAVMF_CODE.fd QEMU_VARS=/usr/share/AAVMF/AAVMF_VARS.fd`. ## On the phone (POCO X5 Pro 5G) You need a **POCO X5 Pro 5G (redwood)** with an unlocked bootloader, `adb` and `fastboot`, and the images from the section above. Nothing is written to the phone's storage. **The phone's own firmware** is not in the repository and cannot be: it is the vendor's and is taken from the very phone it will run on, from its Android: ```sh adb pull /vendor/firmware/a660_{gmu.bin,sqe.fw,zap.mdt,zap.b00,zap.b01,zap.b02} fw-gpu/ # GPU (gpu=1)

已知限制

当前不支持蜂窝网络、蓝牙、Metal 应用、App Store 内容和 Apple ID 登录，且会话时长有限，结束后内核返回加载器。

查看 README 依据

<img src="docs/lockscreen.jpg" width="190" alt="Lock screen"> <img src="docs/homescreen.jpg" width="190" alt="Home screen"> <img src="docs/control-center.jpg" width="190" alt="Control Center"> <img src="docs/settings.jpg" width="190" alt="Settings"> </p> Photographed on the phone, the Adreno GPU drawing (`gpu=1`). More in [Screenshots](#screenshots). ## What works | Works | Does not work (yet) | |---|---| | Lock screen, swipe to unlock, home screen with all icons (two pages), stock iOS 16 wallpapers | Cellular, Bluetooth |

| System gestures: swipe up (home, app switcher), edge swipe (back), Control Center | Charging under our kernel (the phone only discharges) | | Apps: Settings, Clock, Calendar, Photos, Notes, Safari and more; widgets (Weather, Calendar) on the phone | Metal for apps (in progress: 293 of 456 system shaders already run on the Adreno, see `docs/air.md` in hackios-xnu-userland) | | Phone touchscreen (Goodix GT9916), multitouch, wake on touch; real power and volume keys | App Store content and Apple ID sign-in (no Secure Enclave; FairPlay daemon exits) |

It is a research bench, not a ROM: a session lasts a given number of seconds, then the kernel returns to the loader and hands over its log. ## Quick start: QEMU, no kernel build `prebuilt/` holds the kernel, loader and our programs built from these repositories, so all you need is the system image, which is made on your machine from Apple's IPSW. Needs: Linux x86-64, ~12 GB free disk, 4 GB free RAM. Packages (Arch): ```sh sudo pacman -S --needed git python 7zip lz4 gcc qemu-system-aarch64 qemu-ui-gtk edk2-aarch64 ```