HackiOS Project Boots iOS 16.5 Firmware on Android Devices and QEMU

Project Overview

The HackiOS project has demonstrated the ability to boot Apple's open-source XNU kernel, specifically version xnu-8796.121.2 from iOS 16.5, on Android phone hardware. It then runs the complete and unmodified iOS 16.5 user space, including launchd, backboardd, SpringBoard, and applications, on top of this kernel.

Technical Implementation

Achieving this required several custom components: an EFI loader, replacements for Apple's closed drivers, a UEFI port, and a Linux Wi-Fi driver operating through a compatibility layer. The project does not include any Apple files directly; instead, a script downloads the iOS 16.5 IPSW from Apple's CDN and extracts necessary components on the user's machine.

The system operates in two environments: a POCO X5 Pro 5G (Snapdragon 778G) and QEMU (virt, aarch64). On the POCO X5 Pro 5G, the UEFI is started via fastboot boot, and the entire system resides in RAM. This means the phone returns to its original Android state after a reboot, as nothing is permanently flashed.

Purpose and Usage

HackiOS is described as a research bench rather than a custom ROM. Each session runs for a predetermined duration, after which the kernel returns control to the loader and provides its log. This setup is intended for research purposes, allowing developers and researchers to study iOS behavior on non-Apple hardware.

The project requires a Linux x86-64 host with approximately 12 GB of free disk space and 4 GB of free RAM. Installation involves cloning the repository, setting up common components, fetching the iOS 16.5 IPSW, building APFS images, and then running a session in QEMU.

Interaction and Controls

Once running, the lock screen appears after 2-3 minutes. User interaction is managed through mouse gestures (left button held acts as a finger) and specific keybindings for actions like home, lock/power, and volume control. Scripted interactions are also possible for automated testing and control.