Comment by walterbell
2 days ago
Progress update, https://eshard.com/posts/emulating-ios-14-with-qemu-part2
iOS emulated in QEMU with:
• Restore / Boot
• Software rendering
• Kernel and userspace debugging
• Pairing with the host
• Serial / SSH access
• Multitouch
• Network
• Install and run any arbitrary IPA
In other news, Cellebrite acquired Corellium iOS/Android virtualization for $170M, https://news.ycombinator.com/item?id=44221982
The eShard thing and this GitHub are fairly different, as far as I know.
The eShard people found an earlier version of this repository and set about patching one billion parts of the iOS kernel, library cache, and userland to make it run on the limited emulator.
Meanwhile, the actual emulator has been advancing, arguably more quickly than the eShard patch set.
The current set of patches needed for the latest commits on this repo to run iOS are less than 10 instructions, all to enable the software-rendering/framebuffer fallback code path instead of trying to use display drivers.
https://github.com/ChefKissInc/QEMUAppleSilicon/wiki/Filesys...
In the interest of completeness I looked deeper and there are a few more patches to the kernel and SEP OS done at emulation time:
https://github.com/ChefKissInc/QEMUAppleSilicon/blob/6eff3ab...
but really nothing too extensive or hard to port. It’s mostly flipping various can_has_debug returns, bypassing sigcheck, and the classic patch to flip launchd into research device mode.
> set about patching one billion parts of the iOS kernel, library cache, and userland to make it run on the limited emulator
You don’t say! They’ve hacked the whole process and it feels extremely brittle. Like there’s no chance they can sustainably port this to another version of the software, let alone hardware.
Thanks for the wiki pointer.
Presumably to build a exploit test framework.