6 ms·

iPhone 11 emulation done in QEMU

389 points by 71bw 1y ago

msgodel 1y ago
Woah this sounds like it boots all the way to Springboard at least! That's pretty huge!
ewuhic 1y ago
Does it support trollstore with ability to decrypt IPAs?
- skvmb 1y ago
  Came here to ask this very question. This would be killer if so!
- mywittyname 1y ago
  For the ignorant: what does this mean?
  - tom1337 1y ago
    trollstore is an inofficial app store for iOS devices which does not require a jailbreak. There are also apps that seem to decrypt the encrypted IPA (which is the file format of an iOS app) so you can view the decrypted app code and the resources. it's kinda the same as decompiling a android java app.
  - watusername 1y ago
    Just to expand a bit on the sibling comment, IPAs downloaded from the App Store are encrypted with a DRM scheme with a key tied to the Apple account. The binaries actually stay encrypted on-disk and the OS has facilities to transparently decrypt them when executed. The usual way of decrypting is to actually execute the app, attach a debugger (normally not possible for production apps) and read the decrypted code from memory.
gnabgib 1y ago
Discussion on upstream repo (356 points, 2022, 144 comments) https://news.ycombinator.com/item?id=30545425 https://news.ycombinator.com/item?id=30545425 Related (mentions this repo): Emulating an iPhone in QEMU (268 points, 2 months ago, 64 comments) https://news.ycombinator.com/item?id=43592409 https://news.ycombinator.com/item?id=43592409
- msgodel 1y ago
  Looking at the issue tracker it sounds like they've made significant progress since then.
  - walterbell 1y ago
    Progress update, https://eshard.com/posts/emulating-ios-14-with-qemu-part2 https://eshard.com/posts/emulating-ios-14-with-qemu-part2 iOS emulated in QEMU with: • Restore / Boot • Software rendering • Kernel and userspace debugging • Pairing with the host • Serial / SSH access • Multitouch • Network • Install and run any arbitrary IPA In other news, Cellebrite acquired Corellium iOS/Android virtualization for $170M, https://news.ycombinator.com/item?id=44221982 https://news.ycombinator.com/item?id=44221982
    - throwaway48476 1y ago
      Presumably to build a exploit test framework.
    - bri3d 1y ago
      The eShard thing and this GitHub are fairly different, as far as I know. The eShard people found an earlier version of this repository and set about patching one billion parts of the iOS kernel, library cache, and userland to make it run on the limited emulator. Meanwhile, the actual emulator has been advancing, arguably more quickly than the eShard patch set. The current set of patches needed for the latest commits on this repo to run iOS are less than 10 instructions, all to enable the software-rendering/framebuffer fallback code path instead of trying to use display drivers. https://github.com/ChefKissInc/QEMUAppleSilicon/wiki/Filesystem-Patches https://github.com/ChefKissInc/QEMUAppleSilicon/wiki/Filesys...
anthk 1y ago
How does Qemu m68k work for Classic Mac BTW?
- LeoPanthera 1y ago
  Not great. Use Mini vMac instead. PPC emulation works fine though.
- lioeters 1y ago
  It works. Technical discussions on running classic Macintosh with Qemu m68k: Qemu-system-m68k to run Mac OS 7-8 - https://www.emaculation.com/forum/viewforum.php?f=37&sid=6a92505dcc6f8e08d41fcf9a309a1f26 https://www.emaculation.com/forum/viewforum.php?f=37&sid=6a9...
dd_xplore 1y ago
Is it emulating iOS? Or only running iOS binaries? Why does it specifically say iPhone 11?
- worldsavior 1y ago
  Probably because it's iPhone 11 binaries.
- dadoum 1y ago
  It's emulating iPhone 11's hardware. It runs iOS 14 and sepOS (Apple Security Enclave's firmware) on top.
jeswin 1y ago
This is the ultimate emulation hack bar none - congrats to everyone involved. This also bodes well for the hackintosh project. It's may no longer be a dead end (though miles away), and eventually we might even see efficient emulation as ARM PCs become generally available.
- storus 1y ago
  ARM is not an open platform like IBM PC was. See Android phones and their custom Linux kernels with undocumented parts...
- yencabulator 1y ago
  "Ultimate" when it's barely emulating something that was released in 2019, discontinued in 2022, and the hardware vendor in question is likely to keep adding obstacles purely to mess with it?
seany 1y ago
Seems like the important part would be emulating the security crap so it can be understood and bypassed. Where is this with that set of things? (being able to run things like banking/DMV emulated would be the killer feature)
VMtest 1y ago
There is still no proper documentation for using qemu on windows host, the options and arguments etc. We have to google and the info and ideas that are scattered across the internet, or referencing the Linux equivalents of it to come up with a solution
- Liquix 1y ago
  to be fair most folks playing around with qemu are probably running unix. windows has plenty of user friendly virtualization options (virtualbox, vmware, hyper-v), not to mention WSL. so windows users would probably only run qemu in hyperspecific cases like this
  - VMtest 1y ago
    nope, not fair, virtualbox for example doesn't use whpx on windows while it has kvm backend on linux now vmware is bloated, I prefer not to register an account to download it as well. hyper-v uses FreeRDP and that requires the guest distribution to support it AFAIK, so it's not a easy out-of-the-box solution and I do use qemu on linux, just at the surface level, with libvirt with virt-manager, it's easy to configure with the UI
startyz 1y ago
cool it is my favorite model of iphones.
- Minks 1y ago
  What makes it your favourite model specifically? I can’t really notice a lot of differences between them and I’ve used multiple devices the last 3 years.
xvilka 1y ago
They should try to push it upstream, at least partially. Otherwise it's doomed to die like previous attempts.
hiimwavy 1y ago
This is incredibly impressive—booting an iPhone 11 all the way to Springboard in QEMU is no small feat. Kudos to the ChefKissInc team and everyone who’s contributed to getting this far!
tifa2up 1y ago
Noob question: can you install iOS apps using this?

389 points by 71bw 1y ago

msgodel 1y ago

Woah this sounds like it boots all the way to Springboard at least! That's pretty huge!

ewuhic 1y ago

Does it support trollstore with ability to decrypt IPAs?

skvmb 1y ago
Came here to ask this very question. This would be killer if so!
mywittyname 1y ago
For the ignorant: what does this mean?
- tom1337 1y ago
  trollstore is an inofficial app store for iOS devices which does not require a jailbreak. There are also apps that seem to decrypt the encrypted IPA (which is the file format of an iOS app) so you can view the decrypted app code and the resources. it's kinda the same as decompiling a android java app.
- watusername 1y ago
  Just to expand a bit on the sibling comment, IPAs downloaded from the App Store are encrypted with a DRM scheme with a key tied to the Apple account. The binaries actually stay encrypted on-disk and the OS has facilities to transparently decrypt them when executed. The usual way of decrypting is to actually execute the app, attach a debugger (normally not possible for production apps) and read the decrypted code from memory.

gnabgib 1y ago

Discussion on upstream repo (356 points, 2022, 144 comments) https://news.ycombinator.com/item?id=30545425 https://news.ycombinator.com/item?id=30545425 Related (mentions this repo): Emulating an iPhone in QEMU (268 points, 2 months ago, 64 comments) https://news.ycombinator.com/item?id=43592409 https://news.ycombinator.com/item?id=43592409

msgodel 1y ago
Looking at the issue tracker it sounds like they've made significant progress since then.
- walterbell 1y ago
  Progress update, https://eshard.com/posts/emulating-ios-14-with-qemu-part2 https://eshard.com/posts/emulating-ios-14-with-qemu-part2 iOS emulated in QEMU with: • Restore / Boot • Software rendering • Kernel and userspace debugging • Pairing with the host • Serial / SSH access • Multitouch • Network • Install and run any arbitrary IPA In other news, Cellebrite acquired Corellium iOS/Android virtualization for $170M, https://news.ycombinator.com/item?id=44221982 https://news.ycombinator.com/item?id=44221982
  - throwaway48476 1y ago
    Presumably to build a exploit test framework.
  - bri3d 1y ago
    The eShard thing and this GitHub are fairly different, as far as I know. The eShard people found an earlier version of this repository and set about patching one billion parts of the iOS kernel, library cache, and userland to make it run on the limited emulator. Meanwhile, the actual emulator has been advancing, arguably more quickly than the eShard patch set. The current set of patches needed for the latest commits on this repo to run iOS are less than 10 instructions, all to enable the software-rendering/framebuffer fallback code path instead of trying to use display drivers. https://github.com/ChefKissInc/QEMUAppleSilicon/wiki/Filesystem-Patches https://github.com/ChefKissInc/QEMUAppleSilicon/wiki/Filesys...

anthk 1y ago

How does Qemu m68k work for Classic Mac BTW?

LeoPanthera 1y ago
Not great. Use Mini vMac instead. PPC emulation works fine though.
lioeters 1y ago
It works. Technical discussions on running classic Macintosh with Qemu m68k: Qemu-system-m68k to run Mac OS 7-8 - https://www.emaculation.com/forum/viewforum.php?f=37&sid=6a92505dcc6f8e08d41fcf9a309a1f26 https://www.emaculation.com/forum/viewforum.php?f=37&sid=6a9...

dd_xplore 1y ago

Is it emulating iOS? Or only running iOS binaries? Why does it specifically say iPhone 11?

worldsavior 1y ago
Probably because it's iPhone 11 binaries.
dadoum 1y ago
It's emulating iPhone 11's hardware. It runs iOS 14 and sepOS (Apple Security Enclave's firmware) on top.

jeswin 1y ago

This is the ultimate emulation hack bar none - congrats to everyone involved. This also bodes well for the hackintosh project. It's may no longer be a dead end (though miles away), and eventually we might even see efficient emulation as ARM PCs become generally available.

storus 1y ago
ARM is not an open platform like IBM PC was. See Android phones and their custom Linux kernels with undocumented parts...
yencabulator 1y ago
"Ultimate" when it's barely emulating something that was released in 2019, discontinued in 2022, and the hardware vendor in question is likely to keep adding obstacles purely to mess with it?

seany 1y ago

Seems like the important part would be emulating the security crap so it can be understood and bypassed. Where is this with that set of things? (being able to run things like banking/DMV emulated would be the killer feature)

VMtest 1y ago

There is still no proper documentation for using qemu on windows host, the options and arguments etc. We have to google and the info and ideas that are scattered across the internet, or referencing the Linux equivalents of it to come up with a solution

Liquix 1y ago
to be fair most folks playing around with qemu are probably running unix. windows has plenty of user friendly virtualization options (virtualbox, vmware, hyper-v), not to mention WSL. so windows users would probably only run qemu in hyperspecific cases like this
- VMtest 1y ago
  nope, not fair, virtualbox for example doesn't use whpx on windows while it has kvm backend on linux now vmware is bloated, I prefer not to register an account to download it as well. hyper-v uses FreeRDP and that requires the guest distribution to support it AFAIK, so it's not a easy out-of-the-box solution and I do use qemu on linux, just at the surface level, with libvirt with virt-manager, it's easy to configure with the UI

startyz 1y ago

cool it is my favorite model of iphones.

Minks 1y ago
What makes it your favourite model specifically? I can’t really notice a lot of differences between them and I’ve used multiple devices the last 3 years.

xvilka 1y ago

They should try to push it upstream, at least partially. Otherwise it's doomed to die like previous attempts.

hiimwavy 1y ago

This is incredibly impressive—booting an iPhone 11 all the way to Springboard in QEMU is no small feat. Kudos to the ChefKissInc team and everyone who’s contributed to getting this far!

tifa2up 1y ago

Noob question: can you install iOS apps using this?