xnu-qemu-arm64

by alephsecurity

alephsecurity / xnu-qemu-arm64
571 Stars 65 Forks Last release: Not found Other 73.6K Commits 0 Releases

Available items

No Items, yet!

The developer of this repository has not created any items for sale yet. Need a bug fixed? Help with integration? A different license? Create a request here:

iOS on QEMU

This project is a fork of the official QEMU repository. Please refer to this README for information about the QEMU project.

The goal of this project is to boot a fully functional iOS system on QEMU.

The project is under active development, follow @alephsecurity and @JonathanAfek for updates.

For technical information about the research, follow our blog: - Running iOS in QEMU to an interactive bash shell (1) - Running iOS in QEMU to an interactive bash shell (2) - Tunnelling TCP connections into iOS on QEMU - Accelerating iOS on QEMU with hardware virtualization (KVM)

Help is wanted!

If you are passionate about iOS and kernel exploitation and want to help us push this project forward, please refer to the open issues in this repo :)


  • Current project's functionality:

    • launchd
      services
    • Interactive bash
    • R/W secondary disk device
    • Execution of binaries (also ones that are not signed by Apple)
    • SSH through TCP tunneling
    • Textual FrameBuffer
    • ASLR for usermode apps is disabled
    • ASLR for DYLD shared cache is disabled
    • GDB scripts for kernel debugging
    • KVM support
    • TFP0 from user mode applications
  • To run iOS 12.1 on QEMU follow this tutorial.

  • This project works on QEMU with KVM! Check this blog post for more information.

  • We have implemented multiple GDB scripts that will help you to debug the kernel:

    • List current/user/all tasks in XNU kernel.
    • List current/user/all threads in XNU kernel.
    • Print the information about specific task/thread.
    • Many more :).
  • To disable ASLR in DYLD shared cache follow this tutorial.

  • Follow here to learn about how we've implemented the TCP tunneling.

  • Follow the code to see all the patches we've made to the iOS kernel for this project:

    • Disable the Secure Monitor.
    • Bypass iOS's CoreTrust mechanism.
    • Disable ASLR for user mode apps.
    • Enable custom code execution in the kernel to load our own IOKit iOS drivers.
    • Enable KVM support.
    • Support getting TFP0 in usermode applications.

We use cookies. If you continue to browse the site, you agree to the use of cookies. For more information on our use of cookies please see our Privacy Policy.