Almost booting an iOS kernel in QEMU

[return_0e]

>..but XNU is now open source.

Well XNU has always been 'open-source' [1] for some time on Intel machines but its just that ARM support remained closed (until 2017) which is why the darwin-on-arm [2] project existed. But I'm assuming that the OP means that the ARM64 code was recently open-sourced in the XNU sources[3] making a possible open-source ARM port much simpler. I still find it quite interesting to see some regained attempts in emulating iOS; with Corellium being the furthest at doing this.

[1] (https://opensource.apple.com)

[2] (https://github.com/darwin-on-arm/xnu)

[3] (https://github.com/apple/darwin-xnu/search?p=5&q=ARM64&unsco...)

[w0utert]

In a way, it seems strange nobody made a full-blown iPhone/iPad iOS emulator yet. Not a simulator like the one Apple makes, but an emulator like for game systems. I would guess the amount of information available about iPhone hardware and software would make it much easier to emulate than e.g. a gamecube, Wii, PS3, etc, especially for older models. Such an emulator could obviously be used for piracy, but could also be an intersting tool for a homebrew scene (custom firmware, developing iOS apps on Linux & Windows, etc.

Is there a practical reason why this would be hard or impossible? Or is it just for fear of Apple's lawyers?

[KenanSulayman]

It seems Corellium (linked to from the blogpost) has done that. That said, it seems they only run iPhone 6, et al., which was jailbroken (untethered), so it's significantly easier to emulate than trying to run the only unencrypted file (kernel cache) targeting an undocumented CPU with Qemu of an iOS beta that was released a few days ago.

[rjvbk]

It seems strange to me that there are no Chinese OEMs selling mobiles with iOS. I mean, I understand it's hard, but is it THAT hard?

[mirimir]

Interesting. I would love virtual iPhones. For testing apps, anonymously. But I doubt that I'd get an invite from Corellium, either :(

[Ecco]

Reads as an ad for Corellium...