Boot a Virtual iPhone via Apple's Virtualization.framework

(github.com)

182 points | by hentrep 6 hours ago ago

61 comments

  • root9876 4 hours ago ago

    > during iOS setup, don't pick Japan or the EU as your region (extra regulatory checks the VM can't satisfy)

    I'm curious what are these checks

    • benoau 4 hours ago ago

      It will be to prevent access to third-party app stores as both the EU and Japan legislated they must be allowed.

      > In a support document about alternative app marketplaces in the EU, Apple explained that “device eligibility for alternative app marketplaces is determined using on-device processing with only an indicator of eligibility sent to Apple.” In practice, iOS users in the EU who want to install alternative marketplaces will need to set the country or region of their Apple ID to an eligible country or region. Moreover, they will also need to be physically located in supported EU countries.

      > In the case iOS users in the EU leave eligible regions, Apple will offer a “grace period” until apps downloaded from alternative app stores can no longer be updated. “If you’re gone for too long, you’ll lose access to some features, including installing new alternative app marketplaces. Apps you installed from alternative app marketplaces will continue to function, but they can’t be updated by the marketplace you downloaded it from,” the company explained.

      https://www.thurrott.com/apple/298862/apple-adds-some-condit...

      • dingdongditchme 2 hours ago ago

        Wait so a third party app-store is allowed in the EU? I was not aware these even existed...

        • xkgt 2 hours ago ago

          It is wild that Apple finds it cheaper to build and maintain different App store behaviors than to simplify and make alt app stores available in all markets. Other governments/markets don't care?

          • benoau an hour ago ago

            It's a very slow process, first there is investigations, then legislation, then enactment, then enforcement which is separately a very slow process. It requires a lot of willpower to get and keep the ball rolling and in fact nobody has even achieved the full extent of what they require yet! The EU may still be years away from meaningful compliance, Japan has only taken baby steps forming a new bureau just to enforce compliance of two companies widely accused of malicious compliance.

            And then there is additional discouragement and pressure in the form of sanction and trade deal threats for regulating American tech platforms.

            • exe34 20 minutes ago ago

              > And then there is additional discouragement and pressure in the form of sanction and trade deal threats for regulating American tech platforms.

              What people don't realise is that local companies aren't just competing with each other, they're competing against the US military.

          • surajrmal 28 minutes ago ago

            Who said it's cheaper?

          • tonyhart7 2 hours ago ago

            "Other governments/markets don't care?"

            its the least of their problems

            • grim_io an hour ago ago

              There's an endless supply of bodies of water to be renamed.

        • aaronbrethorst 2 hours ago ago
          • DANmode an hour ago ago

            Any working way to spoof your locale to trick this into any form of usability?

            • surajrmal 25 minutes ago ago

              You need to fake the cell towers and change your accounts billing address. It's not trivial.

            • aaronbrethorst an hour ago ago

              I have never tried. I'm sure there are some reddit threads about this though.

    • astafrig 3 hours ago ago

      In addition to the third-party installation capability mentioned by siblings, Japan also has a regional capability for reassigning the side button to a third-party voice assistant (`com.apple.developer.side-button-access.allow`).

    • rootnod3 4 hours ago ago

      For Japan it might be the Felica chip.

      • koito17 2 hours ago ago

        That would surprise me. I don't recall having to change my iPhone's region after moving to Japan. Transport IC cards in Apple Pay have "just worked".

        I am vaguely aware that some phone manufacturers silently remove certain NFC hardware (or disable some driver) in order to avoid paying Sony patent fees. Apple doesn't seem to do that, though.

  • pranav_tech26 31 minutes ago ago

    Finally, local iOS virtualization without third-party hacks. Huge win for CI pipelines, though macOS host dependencies still limit scale.

  • hamandcheese 4 hours ago ago

    This seams neat, but I'm not sure I understand the purpose/difference between this and using the iOS simulator.

    • dagmx 4 minutes ago ago

      The simulator is a different SDK target than iOS itself.

      You have to compile completely independently for it, and depending on your dependencies they may not compile for the simulator.

      Additionally the simulator runs a really ancient and feature restricted version of Metal. That means you can’t test a lot of graphical things that the hardware actually supports.

    • restes 4 hours ago ago

      The iOS Simulator consists of (some of) the userspace components of iOS compiled to run on macOS. This would be a full iPhone image running as-is via virtualization.

      • RussianCow 4 hours ago ago

        That explains the difference, but what's the purpose?

        • whynotmaybe 3 hours ago ago

          The simulator doesn't have a camera. The android emulator allows to configure the camera and use a picture, it's very handy to test your qr/barcode reader without needing to use a physical device. Maybe this also allows to use an image as camera?

        • gcampos 3 hours ago ago

          You cannot run Network Extensions on the simulator

        • a012 3 hours ago ago

          You can test your application, game, website without a physical phone?

          • leoh 3 hours ago ago

            Can do that with the simulator too

            • refulgentis 3 hours ago ago

              Running on ported userspace components, with a shim, isn't the same as running on the OS in itself.

              That really matters, sometimes.

              But not the vast majority of the time.

              (source: been coding iOS since pre-SDK iPhone OS 1.0)

              • RussianCow 3 hours ago ago

                Can you give some examples of where it matters? I'm genuinely curious.

                • bradfitz 2 hours ago ago

                  Last I checked, VPN network extensions wouldn't run in the simulator.

              • dingdongditchme 2 hours ago ago

                Is the simulator faster than this? I would suspect so.

        • VladVladikoff 3 hours ago ago

          Spam. Click farms. Etc.

          • trollbridge 3 hours ago ago

            It would also make testing far easier. I got bit with something that failed on real life iPhones with language set to es_US that worked fine on the simulator.

          • trueno an hour ago ago

            oh. is this why icloud spam texts are running wild now

            • greggsy 35 minutes ago ago

              No, it’s just trivial to generate iCloud email addresses that won’t get picked up by spam filter.

        • leoh 3 hours ago ago

          If functional, you can download apps from the App Store, sign in to iCloud.. probably do a bunch of agentic stuff as if you had a real device

    • zffr 34 minutes ago ago

      Here are some reasons to use this instead of the simulator: security research, testing, automation

    • speedyapoc 2 hours ago ago

      Looks like this tool can provide a jailbroken environment for the latest iOS versions whereas one does not exist on iOS simulator or a real device

    • ChrisMarshallNY 3 hours ago ago

      The simulator is a completely different OS. It may even still be using Intel.

      I always figured that Apple never set up a true emulator (like what Android does), because they didn't want people exploring their OS with a debugger.

      • kridsdale1 3 hours ago ago

        Incorrect. The iOS simulator is and always has been, simply iOS frameworks running fully natively on macOS. It’s best to think of it as an alternative window managers but the apps are native Mac processes. They can be seen and debugged via the terminal using top and ps and lldb alongside all other processes. They just present gui via the Simulator Mac app container.

        They do not live in a VM and are certainly not emulated at an instruction set level. They are Mac apps.

        • ChrisMarshallNY 3 hours ago ago

          Ah. That makes sense.

          I would think that "Mac apps," means that they are, actually, a different OS (I actually already knew that, which was why I said what I said. The Intel thing was a spitball).

          But one of the few joys geeks get, these days, is telling other geeks they are wrong, so I feel as if I’ve done my bit to make this a happier place.

  • catlifeonmars an hour ago ago

    Does this include a virtual baseband?

  • senor_digimon 40 minutes ago ago

    Can this be used for account recovery?

  • boredatoms 6 hours ago ago

    Is this what apple does in xcode?

    • vlovich123 5 hours ago ago

      If you’re talking about the simulator, no. That doesn’t virtualize - it literally just runs it locally on your machine. Less RAM overhead and CPU since it uses your normal instruction set and doesn’t run a separate kernel and userspace.

      • valleyer 5 hours ago ago

        At least historically, it actually did run its own entire userspace, including daemons (all the way to launchd, IIRC), etc. All compiled for Intel, back in the day. Shared the kernel though.

        Many of the nominally shared system pieces between Mac and iPhone (like Foundation) actually had many subtle compile-time differences.

      • theflyestpilot 5 hours ago ago

        so can this receive web push notifications?

  • dvduval 3 hours ago ago

    Will there ever be a day where I could run this on a PC or something like it?

    • greggsy 34 minutes ago ago

      Probably not, but you can run it on a Mac today.

  • TylerJaacks 5 hours ago ago

    This project is really cool its a shame you have to disable or partial disable SIP which can break some things.

    • fishfasell 2 hours ago ago

      Yeah real shame that I know I could never run this on a corporate machine and only ever as a hobbyist.

      • userbinator an hour ago ago

        That means you're working for the wrong companies ;-)

      • sneak an hour ago ago

        Have corporate buy you a research Air that isn’t on the MDM.

  • ironqcold 5 hours ago ago

    Interesting project. If it actually works it opens up a ton of possibilities for testing and reverse engineering.

  • chews 5 hours ago ago

    What a release! Congrats to the builder, lots of great work done here and in IOS profiling in general has been done here recently. Corellium went research only and I lost the ability to actually profile my applications the way I'd like. I've got a fun thing over coffee in the morning!

  • orangea 6 hours ago ago

    what is "PCC"?

    • busymom0 6 hours ago ago

      Private cloud compute I think. I learnt about it today too from this reddit post which mentions how:

      > At WWDC, Apple announced that starting in the 27.x versions of iOS, macOS, etc., devs would be able to call Private Cloud Compute directly from Swift with no additional API configuration. Presently, the only way to get free cloud inference is by joining the App Store Small Business Program.

      https://www.reddit.com/r/appledevelopers/comments/1vztibh/re...

  • leoh 3 hours ago ago

    Will Apple break this?

    • rvz 2 hours ago ago

      They will find a way to break it.