Boot a Virtual iPhone via Apple's Virtualization.framework

6 hours ago (github.com)

Finally, local iOS virtualization without third-party hacks. Huge win for CI pipelines, though macOS host dependencies still limit scale.

> during iOS setup, don't pick Japan or the EU as your region (extra regulatory checks the VM can't satisfy)

I'm curious what are these checks

  • It will be to prevent access to third-party app stores as both the EU and Japan legislated they must be allowed.

    > In a support document about alternative app marketplaces in the EU, Apple explained that “device eligibility for alternative app marketplaces is determined using on-device processing with only an indicator of eligibility sent to Apple.” In practice, iOS users in the EU who want to install alternative marketplaces will need to set the country or region of their Apple ID to an eligible country or region. Moreover, they will also need to be physically located in supported EU countries.

    > In the case iOS users in the EU leave eligible regions, Apple will offer a “grace period” until apps downloaded from alternative app stores can no longer be updated. “If you’re gone for too long, you’ll lose access to some features, including installing new alternative app marketplaces. Apps you installed from alternative app marketplaces will continue to function, but they can’t be updated by the marketplace you downloaded it from,” the company explained.

    https://www.thurrott.com/apple/298862/apple-adds-some-condit...

  • In addition to the third-party installation capability mentioned by siblings, Japan also has a regional capability for reassigning the side button to a third-party voice assistant (`com.apple.developer.side-button-access.allow`).

  • For Japan it might be the Felica chip.

    • That would surprise me. I don't recall having to change my iPhone's region after moving to Japan. Transport IC cards in Apple Pay have "just worked".

      I am vaguely aware that some phone manufacturers silently remove certain NFC hardware (or disable some driver) in order to avoid paying Sony patent fees. Apple doesn't seem to do that, though.

This seams neat, but I'm not sure I understand the purpose/difference between this and using the iOS simulator.

  • Here are some reasons to use this instead of the simulator: security research, testing, automation

  • Looks like this tool can provide a jailbroken environment for the latest iOS versions whereas one does not exist on iOS simulator or a real device

  • The simulator is a completely different OS. It may even still be using Intel.

    I always figured that Apple never set up a true emulator (like what Android does), because they didn't want people exploring their OS with a debugger.

    • Incorrect. The iOS simulator is and always has been, simply iOS frameworks running fully natively on macOS. It’s best to think of it as an alternative window managers but the apps are native Mac processes. They can be seen and debugged via the terminal using top and ps and lldb alongside all other processes. They just present gui via the Simulator Mac app container.

      They do not live in a VM and are certainly not emulated at an instruction set level. They are Mac apps.

      1 reply →

Is this what apple does in xcode?

  • If you’re talking about the simulator, no. That doesn’t virtualize - it literally just runs it locally on your machine. Less RAM overhead and CPU since it uses your normal instruction set and doesn’t run a separate kernel and userspace.

    • At least historically, it actually did run its own entire userspace, including daemons (all the way to launchd, IIRC), etc. All compiled for Intel, back in the day. Shared the kernel though.

      Many of the nominally shared system pieces between Mac and iPhone (like Foundation) actually had many subtle compile-time differences.

Interesting project. If it actually works it opens up a ton of possibilities for testing and reverse engineering.

What a release! Congrats to the builder, lots of great work done here and in IOS profiling in general has been done here recently. Corellium went research only and I lost the ability to actually profile my applications the way I'd like. I've got a fun thing over coffee in the morning!

what is "PCC"?

  • Private cloud compute I think. I learnt about it today too from this reddit post which mentions how:

    > At WWDC, Apple announced that starting in the 27.x versions of iOS, macOS, etc., devs would be able to call Private Cloud Compute directly from Swift with no additional API configuration. Presently, the only way to get free cloud inference is by joining the App Store Small Business Program.

    https://www.reddit.com/r/appledevelopers/comments/1vztibh/re...