(https://github.githubassets.com) (https://avatars.githubusercontent.com) (https://github-cloud.s3.amazonaws.com) (https://user-images.githubusercontent.com/) (https://github.githubassets.com) (https://avatars.githubusercontent.com)   (https://github.githubassets.com/assets/react-fa5e2e82e6e0ecc0.js)  (https://github.githubassets.com/assets/react-compiler-runtime-4610bd6d3de9c049.js)  (https://github.githubassets.com/assets/scheduler-58b860b049ca307c.js)  (https://github.githubassets.com/assets/react-dom-c7f52540bb6b77ed.js)  (https://github.githubassets.com/assets/react-dom-client-35b308126995de85.js)  (https://github.githubassets.com/assets/react-is-e0b593954b4706d8.js)  (https://github.githubassets.com/assets/react-jsx-runtime-4915cb0f5b3aff04.js)  (https://github.githubassets.com/assets/react-reconciler-8e99e505c4429605.js)  (../../github.githubassets.com/assets/light-3a3d2c708970e4e8.css)  (../../github.githubassets.com/assets/light_high_contrast-9c7b506bdc5ea73f.css)  (../../github.githubassets.com/assets/dark-c9dacb4ec19616db.css)  (../../github.githubassets.com/assets/dark_high_contrast-5ef38214a3eabc7d.css)                (../../github.githubassets.com/assets/primer-primitives-02e066689466a8cd.css)  (../../github.githubassets.com/assets/primer-38ae573fa780d76a.css)  (../../github.githubassets.com/assets/global-58d1122073b19732.css)  (../../github.githubassets.com/assets/github-11ab453cdcc1b7c1.css)  (../../github.githubassets.com/assets/repository-542ca59b4b92999d.css)  (../../github.githubassets.com/assets/code-b25a4886e30e3e5f.css)  (https://github.githubassets.com/assets/wp-runtime-46b3e325f566e7d7.js)  (https://github.githubassets.com/assets/app-foundation-799625033ee8341e.js)  (https://github.githubassets.com/assets/app-runtime-24d1e3019d231636.js)  (https://github.githubassets.com/assets/fetch-utilities-27ed50f7568a5f72.js)  (https://github.githubassets.com/assets/ser-2defe2918d9c9884.js)  (../../github.githubassets.com/assets/app-runtime.47c2032941ed0c3c.module.css)  (https://github.githubassets.com/assets/catalyst-5bc36fa5a846f5a0.js)  (https://github.githubassets.com/assets/selector-observer-7ae05416e4a383ae.js)  (https://github.githubassets.com/assets/relative-time-element-b2d8b7dede692c9f.js)  (https://github.githubassets.com/assets/by-473024a3f6cb3892.js)  (https://github.githubassets.com/assets/ja9-b94de714266ba389.js)  (https://github.githubassets.com/assets/3h2-5f8899065b81d778.js)  (https://github.githubassets.com/assets/t2x-a8c06fc4dca92a53.js)  (https://github.githubassets.com/assets/z8-89489fe818ffc5f4.js)  (https://github.githubassets.com/assets/hjg-55b6d77c48226433.js)  (https://github.githubassets.com/assets/wc-a59655378c77af70.js)  (https://github.githubassets.com/assets/runtime-helpers-26f2970b9e869a17.js)  (https://github.githubassets.com/assets/aria-live-e0f60f15396869e3.js)  (https://github.githubassets.com/assets/hotkey-c8899bfd61abc3fe.js)  (https://github.githubassets.com/assets/react-core-ea672e85f35610d6.js)  (https://github.githubassets.com/assets/cc-99eedace671eb2b6.js)  (https://github.githubassets.com/assets/urv-453c749eec9d7d37.js)  (https://github.githubassets.com/assets/4t-f1181f796eb9ea15.js)  (https://github.githubassets.com/assets/pb0-b19b273276c337a2.js)  (https://github.githubassets.com/assets/6n-e6e586acca87c769.js)  (https://github.githubassets.com/assets/z-b2cf9f86cb4bed3b.js)  (https://github.githubassets.com/assets/9k-707f3c96c4acaae5.js)  (https://github.githubassets.com/assets/0r-4a2b771052825f69.js)  (https://github.githubassets.com/assets/ow-98d10140e8228c74.js)  (https://github.githubassets.com/assets/mv-f8391cd0ef287c80.js)  (https://github.githubassets.com/assets/eou-b91079b9ea7074de.js)  (https://github.githubassets.com/assets/eon-36af335a1906af16.js)  (https://github.githubassets.com/assets/yga-dd50cf95593467fe.js)  (../../github.githubassets.com/assets/react-core.ff78dca67876120f.module.css)  (https://github.githubassets.com/assets/n9-7f60e2a3809a50dd.js)  (https://github.githubassets.com/assets/liv-8d5d90262b623f12.js)  (https://github.githubassets.com/assets/primer-react-df146700e95373ad.js)  (https://github.githubassets.com/assets/nc-f9467792939baa36.js)  (https://github.githubassets.com/assets/qmp-308230626a2aedb0.js)  (https://github.githubassets.com/assets/to-b501df3e06c1799a.js)  (https://github.githubassets.com/assets/t7l-699ca510ac327acf.js)  (https://github.githubassets.com/assets/4u-bf6e08201764cb0a.js)  (https://github.githubassets.com/assets/s0-307dd28b274d0fad.js)  (https://github.githubassets.com/assets/fe-f8365f29462c346a.js)  (https://github.githubassets.com/assets/zd-61606dd1c14634aa.js)  (https://github.githubassets.com/assets/7v-88e5da497f84e96d.js)  (https://github.githubassets.com/assets/15-29e547ad6a5a3527.js)  (https://github.githubassets.com/assets/5w-452c3a937483ff49.js)  (https://github.githubassets.com/assets/ja-22b04aaf91e6217b.js)  (https://github.githubassets.com/assets/2-ab32434b896065e6.js)  (https://github.githubassets.com/assets/v0-89b9b8d8eaafbdf7.js)  (https://github.githubassets.com/assets/yr6-0a2f8039ed40ce5f.js)  (https://github.githubassets.com/assets/1p8-31d23072fa67ff09.js)  (https://github.githubassets.com/assets/3s-ebbc335534e40b2a.js)  (https://github.githubassets.com/assets/gw-6f4936e25ac917d3.js)  (https://github.githubassets.com/assets/4y-59cb1959b9b5aac1.js)  (https://github.githubassets.com/assets/0-c097ee47566335a6.js)  (https://github.githubassets.com/assets/jn-bc7dc311ab22f59b.js)  (https://github.githubassets.com/assets/fn-ffd44c69c9418c7d.js)  (https://github.githubassets.com/assets/q6j-256bc816dd682a0f.js)  (https://github.githubassets.com/assets/i2-5e26ac37ee961d06.js)  (https://github.githubassets.com/assets/b2-35e229a50d0f3d05.js)  (https://github.githubassets.com/assets/pg-10c94bf4f9e9df2f.js)  (https://github.githubassets.com/assets/lrk-ea49e115e48ba34b.js)  (https://github.githubassets.com/assets/mlz-fce49bd96df2c99f.js)  (https://github.githubassets.com/assets/dx-72390bda3ecf1bb9.js)  (https://github.githubassets.com/assets/sm-22346830d5e5a763.js)  (https://github.githubassets.com/assets/pr-7e5e6964ac1c13a7.js)  (https://github.githubassets.com/assets/ur-4cd875e44a87e9f6.js)  (https://github.githubassets.com/assets/up-9ba623fe31b3ad8b.js)  (https://github.githubassets.com/assets/gd-c0d7e6321e1379df.js)  (https://github.githubassets.com/assets/d0t-80ea085bb81f43f5.js)  (https://github.githubassets.com/assets/c28-1e45d23d47961036.js)  (https://github.githubassets.com/assets/tiw-bd5ca0d0b9443f44.js)  (https://github.githubassets.com/assets/kt-8f100cf7d7e55767.js)  (https://github.githubassets.com/assets/w7-4a19009ffa56f5cc.js)  (https://github.githubassets.com/assets/ik-3ffdf86429f50a81.js)  (../../github.githubassets.com/assets/primer-react-css.01917ab04fd4fee0.module.css)  (../../github.githubassets.com/assets/w7.860d2889c7ea8788.module.css)  (../../github.githubassets.com/assets/code-view.8f6686ce77506cf0.module.css)  GitHub - oosexgang/hackios-xnu-kernel · GitHub      (repo_source) (https://github.githubassets.com/)   (https://github.com/opensearch.xml) (GitHub) (https://github.com/fluidicon.png) (GitHub)                        (https://github.githubassets.com/assets/pinned-octocat-093da3e6fa40.svg) (https://github.githubassets.com/favicons/favicon.png) (../../github.githubassets.com/favicons/favicon.svg)  (../manifest.json)   (hackios-xnu-kernel.html#start-of-content) Skip to content   (https://github.githubassets.com/assets/n6-452a6933958186aa.js)  (https://github.githubassets.com/assets/keyboard-shortcuts-dialog-9515d860c3e33a72.js)  (../../github.githubassets.com/assets/primer-react-css.01917ab04fd4fee0.module.css)  (../../github.githubassets.com/assets/keyboard-shortcuts-dialog.64e18daa120bcf2c.module.css)    (https://github.githubassets.com/assets/g6m-cc8319b2e8fb7f71.js)  (https://github.githubassets.com/assets/app-install-banner-partial-8b718c21535ba3bc.js)  (../../github.githubassets.com/assets/primer-react-css.01917ab04fd4fee0.module.css)  (../../github.githubassets.com/assets/app-install-banner-partial.a0b761705e3bb3c6.module.css)    (https://github.githubassets.com/assets/h3j-958ce4a5f2c43038.js)  (https://github.githubassets.com/assets/qz-56a40ef159856167.js)  (https://github.githubassets.com/assets/fz-cb55e83c29d0a351.js)  (https://github.githubassets.com/assets/x2u-3350b3adc8582e52.js)  (https://github.githubassets.com/assets/h4-bd2e6ae0f037d842.js)  (https://github.githubassets.com/assets/l8v-b6afd46013f0963f.js)  (https://github.githubassets.com/assets/it-b2af08afaf92d694.js)  (https://github.githubassets.com/assets/marketing-header-c2057cb785114eb2.js)  (../../github.githubassets.com/assets/primer-react-css.01917ab04fd4fee0.module.css)  (../../github.githubassets.com/assets/primer-react-brand-css.605c0b537201e723.module.css)  (../../github.githubassets.com/assets/marketing-header.f9cff99e98ee97fd.module.css)  Navigation Menu       (https://github.com/)    (https://github.com/login?return_to=https%3A%2F%2Fgithub.com%2Foosexgang%2Fhackios-xnu-kernel) Sign in       Appearance settings   Platform   AI CODE CREATION (https://github.com/features/copilot)    GitHub Copilot Write better code with AI    (https://github.com/features/ai/github-app)   GitHub Copilot app Direct agents from issue to merge    (https://github.com/mcp)    MCP Registry Integrate external tools       DEVELOPER WORKFLOWS (https://github.com/features/actions)   Actions Automate any workflow    (https://github.com/features/codespaces)    Codespaces Instant dev environments    (https://github.com/features/issues)    Issues Plan and track work    (https://github.com/features/code-review)   Code Review Manage code changes    (https://github.com/features/code-quality)    Code Quality Enforce quality at merge       APPLICATION SECURITY (https://github.com/security/advanced-security)   GitHub Advanced Security Find and fix vulnerabilities    (https://github.com/security/advanced-security/code-security)   Code security Secure your code as you build    (https://github.com/security/advanced-security/secret-protection)   Secret protection Stop leaks before they start       EXPLORE (https://github.com/why-github) Why GitHub   (https://docs.github.com) Documentation     (https://github.blog) Blog     (https://github.blog/changelog) Changelog     (https://github.com/marketplace) Marketplace       (https://github.com/features) View all features         Solutions   BY COMPANY SIZE (https://github.com/enterprise) Enterprises   (https://github.com/team) Small and medium teams   (https://github.com/enterprise/startups) Startups   (https://github.com/solutions/industry/nonprofits) Nonprofits      BY USE CASE (https://github.com/solutions/use-case/app-modernization) App Modernization   (https://github.com/solutions/use-case/devsecops) DevSecOps   (https://github.com/solutions/use-case/devops) DevOps   (https://github.com/solutions/use-case/ci-cd) CI/CD   (https://github.com/solutions/use-case) View all use cases         BY INDUSTRY (https://github.com/solutions/industry/healthcare) Healthcare   (https://github.com/solutions/industry/financial-services) Financial services   (https://github.com/solutions/industry/manufacturing) Manufacturing   (https://github.com/solutions/industry/government) Government   (https://github.com/solutions/industry) View all industries          (https://github.com/solutions) View all solutions         Resources   EXPLORE BY TOPIC (https://github.com/resources/articles?topic=ai) AI   (https://github.com/resources/articles?topic=software-development) Software Development   (https://github.com/resources/articles?topic=devops) DevOps   (https://github.com/resources/articles?topic=security) Security   (https://github.com/resources/articles) View all topics         EXPLORE BY TYPE (https://github.com/customer-stories) Customer stories   (https://github.com/resources/events) Events & webinars   (https://github.com/resources/whitepapers) Ebooks & reports   (https://github.com/solutions/executive-insights) Business insights   (https://skills.github.com) GitHub Skills        SUPPORT & SERVICES (https://docs.github.com) Documentation     (https://support.github.com) Customer support     (https://github.com/orgs/community/discussions) Community forum   (https://github.com/trust-center) Trust center   (https://github.com/partners) Partners       (https://github.com/resources) View all resources         Open Source   COMMUNITY (https://github.com/open-source/sponsors)   GitHub Sponsors Fund open source developers       PROGRAMS (https://securitylab.github.com) Security Lab     (https://maintainers.github.com) Maintainer Community     (https://stars.github.com) GitHub Stars     (https://archiveprogram.github.com) Archive Program        REPOSITORIES (https://github.com/topics) Topics   (https://github.com/trending) Trending   (https://github.com/collections) Collections          Enterprise   ENTERPRISE SOLUTIONS (https://github.com/enterprise)   Enterprise platform AI-powered developer platform       AVAILABLE ADD-ONS (https://github.com/security/advanced-security)   GitHub Advanced Security Enterprise-grade security features    (https://github.com/features/copilot/copilot-business)    Copilot for Business Enterprise-grade AI features    (https://github.com/enterprise/premium-support)   Premium Support Enterprise-grade 24/7 support           (https://github.com/pricing) Pricing      Search /       (https://github.com/login?return_to=https%3A%2F%2Fgithub.com%2Foosexgang%2Fhackios-xnu-kernel) Sign in    (https://github.com/signup?ref_cta=Sign+up&ref_loc=header+logged+out&ref_page=%2F%3Cuser-name%3E%2F%3Crepo-name%3E&source=header-repo&source_repo=oosexgang%2Fhackios-xnu-kernel) Sign up       Appearance settings            You signed in with another tab or window. (hackios-xnu-kernel.html) Reload to refresh your session. You signed out in another tab or window. (hackios-xnu-kernel.html) Reload to refresh your session. You switched accounts on another tab or window. (hackios-xnu-kernel.html) Reload to refresh your session.    Dismiss alert     (https://github.githubassets.com/assets/cn-1b0e3f3e5de609f6.js)  (https://github.githubassets.com/assets/0b-a7be65069037ffea.js)  (https://github.githubassets.com/assets/t5-2c5d26edae56bda2.js)  (https://github.githubassets.com/assets/5l-60d6b21dcbe3c5b7.js)  (https://github.githubassets.com/assets/1a-76a60fd58c2fa34b.js)  (https://github.githubassets.com/assets/zxp-712c49df0caa3ebe.js)  (https://github.githubassets.com/assets/9t-cf29b4cbc838698f.js)  (https://github.githubassets.com/assets/r3j-2177885dae8b60eb.js)  (https://github.githubassets.com/assets/1tw-b73c2806670e858c.js)  (https://github.githubassets.com/assets/fp-9e8d00d506738dbc.js)  (https://github.githubassets.com/assets/sb-c6bba711348c7a7c.js)  (https://github.githubassets.com/assets/aj-7444763a0a51ca63.js)  (https://github.githubassets.com/assets/3h4-3d890b52746ef5aa.js)  (https://github.githubassets.com/assets/li6-7de87a6b55f755f3.js)  (https://github.githubassets.com/assets/mse-9e75d7cb47e1f075.js)  (https://github.githubassets.com/assets/global-nav-bar-37579a2b479c7352.js)  (../../github.githubassets.com/assets/primer-react-css.01917ab04fd4fee0.module.css)  (../../github.githubassets.com/assets/global-nav-bar.cb08c0f10ef097e7.module.css)  (https://github.com/oosexgang) oosexgang   (hackios-xnu-kernel.html) hackios-xnu-kernel        Repository navigation  (hackios-xnu-kernel.html)    Code   (https://github.com/oosexgang/hackios-xnu-kernel/issues)     Issues 2 (2)    (https://github.com/oosexgang/hackios-xnu-kernel/pulls)    Pull requests 2 (2)    (https://github.com/oosexgang/hackios-xnu-kernel/actions)    Actions   (https://github.com/oosexgang/hackios-xnu-kernel/projects)    Projects   (https://github.com/oosexgang/hackios-xnu-kernel/security)    Security and quality   (https://github.com/oosexgang/hackios-xnu-kernel/pulse)    Insights     Moreitems              (../../avatars.githubusercontent.com/u/343646710@s=60&v=4)   (hackios-xnu-kernel.html)   (oosexgang)  (hackios-xnu-kernel) (hackios-xnu-kernel.html) hackios-xnu-kernel   Public    (https://github.com/login?return_to=%2Foosexgang%2Fhackios-xnu-kernel)    Notifications   You must be signed in to change notification settings  (https://github.com/login?return_to=%2Foosexgang%2Fhackios-xnu-kernel)    Fork91  (91 )     (https://github.com/login?return_to=%2Foosexgang%2Fhackios-xnu-kernel)    Star452  (452 )    You must be signed in to star a repository      About  No description, website, or topics provided.  Resources  (hackios-xnu-kernel.html#readme-ov-file)   Readme   (hackios-xnu-kernel.html#License-1-ov-file)   License   (https://github.com/oosexgang/hackios-xnu-kernel/activity)   Activity   (https://github.com/oosexgang/hackios-xnu-kernel/custom-properties)   Custom properties    Stars    452 stars  Watchers    1 watching  Forks  (https://github.com/oosexgang/hackios-xnu-kernel/forks)   91  forks     (https://github.com/contact/report-content?content_url=https%3A%2F%2Fgithub.com%2Foosexgang%2Fhackios-xnu-kernel&report=oosexgang+%28user%29) Report repository            main           (https://github.com/oosexgang/hackios-xnu-kernel/branches)    Branches   (https://github.com/oosexgang/hackios-xnu-kernel/tags)    Tags    (https://github.com/oosexgang/hackios-xnu-kernel/branches)    (https://github.com/oosexgang/hackios-xnu-kernel/tags)          (Go to file) ()      Go to file        Code         Open more actions menu     Latest commit   History (https://github.com/oosexgang/hackios-xnu-kernel/commits/main/)    2 Commits     (https://github.com/oosexgang/hackios-xnu-kernel/commits/main/)      2 Commits      Folders and files Name  Name  (Last commit message) Last commit message   (Last commit date) Last commit date       (common) (https://github.com/oosexgang/hackios-xnu-kernel/tree/main/common) common        (common) (https://github.com/oosexgang/hackios-xnu-kernel/tree/main/common) common              (docs) (https://github.com/oosexgang/hackios-xnu-kernel/tree/main/docs) docs        (docs) (https://github.com/oosexgang/hackios-xnu-kernel/tree/main/docs) docs              (prebuilt) (https://github.com/oosexgang/hackios-xnu-kernel/tree/main/prebuilt) prebuilt        (prebuilt) (https://github.com/oosexgang/hackios-xnu-kernel/tree/main/prebuilt) prebuilt              (qemu) (https://github.com/oosexgang/hackios-xnu-kernel/tree/main/qemu) qemu        (qemu) (https://github.com/oosexgang/hackios-xnu-kernel/tree/main/qemu) qemu              (tools) (https://github.com/oosexgang/hackios-xnu-kernel/tree/main/tools) tools        (tools) (https://github.com/oosexgang/hackios-xnu-kernel/tree/main/tools) tools              (uefi) (https://github.com/oosexgang/hackios-xnu-kernel/tree/main/uefi) uefi        (uefi) (https://github.com/oosexgang/hackios-xnu-kernel/tree/main/uefi) uefi              (This path skips through empty directories) (https://github.com/oosexgang/hackios-xnu-kernel/tree/main/wifi/lx) wifi/ lx         (This path skips through empty directories) (https://github.com/oosexgang/hackios-xnu-kernel/tree/main/wifi/lx) wifi/ lx               (xnu-deps) (https://github.com/oosexgang/hackios-xnu-kernel/tree/main/xnu-deps) xnu-deps        (xnu-deps) (https://github.com/oosexgang/hackios-xnu-kernel/tree/main/xnu-deps) xnu-deps              (xnu) (https://github.com/oosexgang/hackios-xnu-kernel/tree/main/xnu) xnu        (xnu) (https://github.com/oosexgang/hackios-xnu-kernel/tree/main/xnu) xnu              (xnuloader) (https://github.com/oosexgang/hackios-xnu-kernel/tree/main/xnuloader) xnuloader        (xnuloader) (https://github.com/oosexgang/hackios-xnu-kernel/tree/main/xnuloader) xnuloader              (.gitignore) (https://github.com/oosexgang/hackios-xnu-kernel/blob/main/.gitignore) .gitignore        (.gitignore) (https://github.com/oosexgang/hackios-xnu-kernel/blob/main/.gitignore) .gitignore              (LICENSE) (https://github.com/oosexgang/hackios-xnu-kernel/blob/main/LICENSE) LICENSE        (LICENSE) (https://github.com/oosexgang/hackios-xnu-kernel/blob/main/LICENSE) LICENSE              (README.md) (https://github.com/oosexgang/hackios-xnu-kernel/blob/main/README.md) README.md        (README.md) (https://github.com/oosexgang/hackios-xnu-kernel/blob/main/README.md) README.md              (mkxnuimg.py) (https://github.com/oosexgang/hackios-xnu-kernel/blob/main/mkxnuimg.py) mkxnuimg.py        (mkxnuimg.py) (https://github.com/oosexgang/hackios-xnu-kernel/blob/main/mkxnuimg.py) mkxnuimg.py              (xl) (https://github.com/oosexgang/hackios-xnu-kernel/blob/main/xl) xl        (xl) (https://github.com/oosexgang/hackios-xnu-kernel/blob/main/xl) xl              (xnu-build.sh) (https://github.com/oosexgang/hackios-xnu-kernel/blob/main/xnu-build.sh) xnu-build.sh        (xnu-build.sh) (https://github.com/oosexgang/hackios-xnu-kernel/blob/main/xnu-build.sh) xnu-build.sh              (xnu-env.sh) (https://github.com/oosexgang/hackios-xnu-kernel/blob/main/xnu-env.sh) xnu-env.sh        (xnu-env.sh) (https://github.com/oosexgang/hackios-xnu-kernel/blob/main/xnu-env.sh) xnu-env.sh            View all files        Repository files navigation  (hackios-xnu-kernel.html#)    README   (hackios-xnu-kernel.html#)    License     Moreitems               HackiOS — XNU kernel (hackios-xnu-kernel.html#hackios--xnu-kernel)     HackiOS boots Apple's open-source XNU kernel (xnu-8796.121.2 , the kernel of iOS 16.5) on Android phone
hardware and runs the unmodified iOS 16.5 user space on top of it: launchd → backboardd → SpringBoard →
apps. Our own EFI loader, our own replacements for Apple's closed drivers, a UEFI port, and a Linux Wi-Fi driver
on a compatibility layer make that possible. It runs in two places: POCO X5 Pro 5G (redwood, Snapdragon 778G) — nothing is flashed: the UEFI is started with fastboot boot ,
the whole system lives in RAM, and after a reboot the phone is back in Android; QEMU (virt , aarch64) — the same thing on any Linux computer, no phone needed.  This repository is half of the project: Repository What   hackios-xnu-kernel (this one) XNU patches, the EFI loader, the UEFI port, Wi-Fi, QEMU scripts, xl , prebuilt kernel/loader/UEFI, common/ scripts  (https://github.com/oosexgang/hackios-xnu-userland) hackios-xnu-userland  our init, injected libraries, launchd jobs, the APFS image builder, the scripts that take iOS out of Apple's IPSW, Metal/Mesa work     No Apple files are in either repository. ios165/fetch.sh downloads the iOS 16.5 IPSW from Apple's own CDN
to your machine and extracts what is needed there. HackiOS is an independent research project by OOSEX GANG and
is not affiliated with, authorised or endorsed by Apple Inc. iOS, iPhone and Apple are trademarks of Apple Inc.  (https://github.com/oosexgang/hackios-xnu-kernel/blob/main/docs/lockscreen.jpg) (Lock screen)  (https://github.com/oosexgang/hackios-xnu-kernel/blob/main/docs/homescreen.jpg) (Home screen)  (https://github.com/oosexgang/hackios-xnu-kernel/blob/main/docs/control-center.jpg) (Control Center)  (https://github.com/oosexgang/hackios-xnu-kernel/blob/main/docs/settings.jpg) (Settings)   Photographed on the phone, the Adreno GPU drawing (gpu=1 ). More in (hackios-xnu-kernel.html#screenshots) Screenshots . What works (hackios-xnu-kernel.html#what-works)     Works Does not work (yet)   Lock screen, swipe to unlock, home screen with all icons (two pages), stock iOS 16 wallpapers Cellular, Bluetooth  System gestures: swipe up (home, app switcher), edge swipe (back), Control Center Charging under our kernel (the phone only discharges)  Apps: Settings, Clock, Calendar, Photos, Notes, Safari and more; widgets (Weather, Calendar) on the phone Metal for apps (in progress: 293 of 456 system shaders already run on the Adreno, see docs/air.md in hackios-xnu-userland)  Phone touchscreen (Goodix GT9916), multitouch, wake on touch; real power and volume keys App Store content and Apple ID sign-in (no Secure Enclave; FairPlay daemon exits)  Up to 8 CPU cores (cpus=8 ), big core at 2.4 GHz, ~20 s to the lock screen Video and Live Photo recording  Adreno 642L GPU through Mesa/freedreno (gpu=1 , OpenGL ES for CoreAnimation)   Wi-Fi (WCN6750, ath11k): join from Settings, Safari over Wi-Fi, 55–90 Mbit/s   Sound (speakers, main microphone), camera in Camera.app (front/rear, preview, focus, HEIC photos)   Data that iOS writes survives a reboot (var_store=1 ufs_write=1 ); iOS root volume on the phone's flash   Sileo + Procursus (dpkg, apt), tweaks, SSH      It is a research bench, not a ROM: a session lasts a given number of seconds, then the kernel returns to the
loader and hands over its log. Quick start: QEMU, no kernel build (hackios-xnu-kernel.html#quick-start-qemu-no-kernel-build)     prebuilt/ holds the kernel, loader and our programs built from these repositories, so all you need is the system
image, which is made on your machine from Apple's IPSW. Needs: Linux x86-64, ~12 GB free disk, 4 GB free RAM. Packages (Arch): sudo pacman -S --needed git python 7zip lz4 gcc qemu-system-aarch64 qemu-ui-gtk edk2-aarch64  (Debian/Ubuntu: git python3 7zip liblz4-dev gcc qemu-system-arm qemu-efi-aarch64 ; 7-Zip must be 23 or newer — it
reads APFS.) git clone https://github.com/oosexgang/hackios-xnu-kernel.git hackios cd hackios
common/setup.sh # brings hackios-xnu-userland into the same tree, checks the host ios165/fetch.sh # downloads 7.4 GB from Apple's CDN and extracts what is needed (5-15 min) common/build.sh qemu-virt # builds the APFS images (and the kernel, if the toolchain is there) common/run.sh qemu-virt # a 20-minute session in a QEMU window   The lock screen appears after 2–3 minutes. Mouse with the left button held = finger. Unlock / leave an app: swipe up from the very bottom edge; back:
swipe from the left edge. Keys: H home, L lock/power, ↑ /↓ volume, F11 (hold) five fingers. From a script: qemu/touch.py swipe 0.5 0.985 0.5 0.3 250 , qemu/touch.py tap 0.615 0.71 , qemu/touch.py key home ; screenshot: qemu/screendump.sh shot.png . Right after SpringBoard appears the system is still registering apps: give it 30–40 s. Debian/Ubuntu UEFI firmware: QEMU_EFI=/usr/share/AAVMF/AAVMF_CODE.fd QEMU_VARS=/usr/share/AAVMF/AAVMF_VARS.fd .  On the phone (POCO X5 Pro 5G) (hackios-xnu-kernel.html#on-the-phone-poco-x5-pro-5g)     You need a POCO X5 Pro 5G (redwood) with an unlocked bootloader, adb and fastboot , and the images from the
section above. Nothing is written to the phone's storage. The phone's own firmware is not in the repository and cannot be: it is the vendor's and is taken from the very
phone it will run on, from its Android: adb pull /vendor/firmware/a660_{gmu.bin,sqe.fw,zap.mdt,zap.b00,zap.b01,zap.b02} fw-gpu/ # GPU (gpu=1) adb pull /vendor/firmware_mnt/image/wpss.{mdt,b02,b03,b04,b05,b06,b07} fw-wifi/ # Wi-Fi (wifi=1) adb pull /vendor/firmware_mnt/image/adsp.{mdt,b02,...,b36} fw-audio/ # sound (adsp=1) adb pull /vendor/firmware/aw8697_haptic.bin fw-haptic/ # haptics   (Put the fw-* directories next to the workspace. Wi-Fi also needs fw-wifi/mac — the radio's address on one
line — and fw-wifi/network — network name and password. userland/build.sh prints which firmware went in.) common/build.sh redwood GL=1 # images + out/redwood-boot.img common/run.sh redwood 900 # loader into RAM, system image into RAM, a 15-minute session   or step by step with xl : ./xl enter # Android -> fastboot -> our loader in RAM (fastboot boot); it brings up its own USB link ./xl ramdisk # upload the system image into the phone's RAM (2.5 GB, ~80 s), once per loader session XL_SECS=900 XL_CMDLINE=" touchscreen=1 cpufreq=1 bootcpu=7 cpus=8 gpu=1 wifi=1 adsp=1"  ./xl run
./xl screenshot shot.png
./xl reboot # back to Android   ./xl with no arguments lists every command (logs, screen and sound recording, camera frames, stop, state...). Prebuilt boot image (hackios-xnu-kernel.html#prebuilt-boot-image)     Every release has hackios-redwood-boot.img attached: the redwood UEFI with our loader inside, ready for fastboot boot . It contains no Apple files; the system image is still made on your machine (above). Building from source (hackios-xnu-kernel.html#building-from-source)     common/build.sh <device> runs every step that this machine can run and uses prebuilt/ for the rest. Kernel — needs (https://theos.dev/docs/installation-linux) theos in ~/theos (cctools and iPhoneOS16.5.sdk ) and clang lld python perl . Details: (https://github.com/oosexgang/hackios-xnu-kernel/blob/main/xnu/README.md) xnu/README.md . xnu/apply.sh && xnu-deps/setup.sh && ./xnu-build.sh -j8 -k   Loader — xnuloader/build.sh (clang + lld-link, an EFI application without EDK2). Images — REST=1 userland/build.sh (variables documented at the top of that file). UEFI — (https://github.com/oosexgang/hackios-xnu-kernel/blob/main/uefi/README.md) uefi/README.md (Project Silicium port); not needed to run, prebuilt/uefi has it. After rebuilding: tools/update-prebuilt.sh refreshes prebuilt/ .  Porting to another device (hackios-xnu-kernel.html#porting-to-another-device)     common/new-device.sh < codename> path/to/device.dtb # profile + loader platform from the phone's device tree   Then follow (https://github.com/oosexgang/hackios-xnu-kernel/blob/main/docs/PORTING.md) docs/PORTING.md : the UEFI port, the loader's platform description, the kernel's
drivers, the firmware. Device profiles live in common/devices/ (redwood.conf , qemu-virt.conf , _template.conf ). How it works (hackios-xnu-kernel.html#how-it-works)     fastboot boot ──► UEFI (Mu-Silicium) ──► xnuloader (EFI application)
                                           │  stays resident: USB link (fastboot protocol),
                                           │  watchdog, receives the kernel's log
                                           ▼
            XNU (BCM2837 config as the base + our platform)
              ├─ GICv3, timer, video console, return to the loader
              ├─ APFS (images in RAM, iOS volume on flash), ramfs (/private/var, /tmp)
              ├─ minicrypto instead of corecrypto, AMFI and Sandbox stand-ins (MAC policies)
              ├─ driver replacements: IOSurface, IOMobileFramebuffer, AppleKeyStore, network stack
              ├─ input: /dev/redwood-touch ◄─ Goodix GT9916 (phone) / virtio-input (QEMU)
              ├─ GPU: Adreno 642L, Wi-Fi: WCN6750 (ath11k via LinuxKPI), sound: ADSP / virtio-sound
              ▼
   iOS 16.5 launchd → logd, notifyd, cfprefsd, runningboardd, backboardd, SpringBoard, apps
              ├─ our libraries are injected into backboardd, SpringBoard and mediaserverd
              │  (virtual HID services, a few ObjC method swaps — in memory only)
              └─ mediaserverd gets our CoreAudio output device (RedwoodAudio.driver)    The iOS programs, frameworks and dyld shared cache are not changed by a single byte: what they miss is done by the
kernel (driver replacements) or by a library the kernel injects with DYLD_INSERT_LIBRARIES (kern.exec_inject ). Layout (hackios-xnu-kernel.html#layout)     Path What   common/  setup.sh (workspace), build.sh / run.sh (per device), new-device.sh , devices/*.conf , ugit   xl  drives the phone over USB: loader, kernel runs, logs, screenshots, screen and sound recording  xnuloader/  the loader: loader.c (UEFI application), mkpayload.py (kernel + images + arguments container)  xnu/  our XNU changes: patch, new files, apply.sh / export.sh   xnu-deps/  everything for building XNU on Linux: setup.sh , tool wrappers, stubs  xnu-build.sh , xnu-env.sh  kernel build  uefi/ , mkxnuimg.py  the UEFI port and packing the boot image for fastboot boot   wifi/lx/  the layer on which Linux's Wi-Fi driver builds for our kernel  qemu/  QEMU runs, touch input, screenshots, stack symbolication  tools/  recording (recording.py , sound.py ), UFS/flash tools, mk-ath11k.sh , new-workspace.sh , host tests  prebuilt/  built kernel, loader and UEFI pieces (NOTICES.md for the third-party code in the kernel)  docs/  screenshots, (https://github.com/oosexgang/hackios-xnu-kernel/blob/main/docs/checks.md) checks.md , (https://github.com/oosexgang/hackios-xnu-kernel/blob/main/docs/PORTING.md) PORTING.md      Debugging (hackios-xnu-kernel.html#debugging)     Session log: QEMU's stdout or logs/HHMMSS-run.log from the phone. RC_JOBS=rc.jobs.tour REST=1 userland/build.sh — an image that unlocks and opens every app of the first page. userabort: in the log is the stack of a process that called abort() ; usertrap: (with systrace=1 ) — crashes. Live stacks (QEMU): qemu/touch.py stacks NAME , then qemu/symstack.py LOG NAME (needs (https://github.com/blacktop/ipsw) ipsw  ). How a check can lie to you: (https://github.com/oosexgang/hackios-xnu-kernel/blob/main/docs/checks.md) docs/checks.md .  Screenshots (hackios-xnu-kernel.html#screenshots)     From the phone's screen, one session (GL=1 REST=1 , gpu=1 ): (https://github.com/oosexgang/hackios-xnu-kernel/blob/main/docs/homescreen-2.jpg) (Home screen, page 2)  (https://github.com/oosexgang/hackios-xnu-kernel/blob/main/docs/search.jpg) (Search)  (https://github.com/oosexgang/hackios-xnu-kernel/blob/main/docs/settings-general.jpg) (Settings > General)  (https://github.com/oosexgang/hackios-xnu-kernel/blob/main/docs/calendar.jpg) (Calendar)  (https://github.com/oosexgang/hackios-xnu-kernel/blob/main/docs/clock.jpg) (Clock)   (https://github.com/oosexgang/hackios-xnu-kernel/blob/main/docs/wallet.jpg) (Wallet)  (https://github.com/oosexgang/hackios-xnu-kernel/blob/main/docs/messages.jpg) (Messages)  (https://github.com/oosexgang/hackios-xnu-kernel/blob/main/docs/music.jpg) (Music)  (https://github.com/oosexgang/hackios-xnu-kernel/blob/main/docs/maps.jpg) (Maps)  (https://github.com/oosexgang/hackios-xnu-kernel/blob/main/docs/appstore-tabs.png) (App Store)   Licenses (hackios-xnu-kernel.html#licenses)     No iOS files are in the repositories: ios165/fetch.sh downloads them from Apple's CDN to your machine. xnu/ is a derivative work of XNU and is distributed under APSL 2.0, like XNU itself; prebuilt/mach.* is the
kernel built from it. It also contains ath11k (BSD-3-Clause-Clear) and FreeBSD LinuxKPI code (BSD-2-Clause):
see (https://github.com/oosexgang/hackios-xnu-kernel/blob/main/prebuilt/NOTICES.md) prebuilt/NOTICES.md . xnu/files/bsd/miscfs/apfs/libzbitmap/ and xnu-deps/build/lzbitmap/ — libzbitmap (Corellium LLC, MIT here); xnu/files/bsd/miscfs/apfs/libdeflate/ — libdeflate 1.24 (Eric Biggers, MIT, COPYING there). ath11k, Linux and FreeBSD sources are not in the repository: tools/mk-ath11k.sh fetches pinned releases. wifi/lx/patches/*.patch are our changes to FreeBSD headers; the rest of wifi/lx/ is ours. uefi/files/Binaries/redwood and prebuilt/uefi/SILICIUM_UEFI.fd contain UEFI drivers from the phone's
Xiaomi firmware, distributed the way Project Silicium distributes them for other devices; prebuilt/uefi/mkbootimg.py — AOSP, Apache-2.0. This repository is licensed under the (https://github.com/oosexgang/hackios-xnu-kernel/blob/main/LICENSE) Apple Public Source License 2.0 : our changes to XNU are a derivative of XNU and must be, and our other code here (loader, scripts) is released under the same license. Third-party code keeps its own license, as listed above.  Team (hackios-xnu-kernel.html#team)     OOSEX GANG — (https://t.me/oodze) @oodze (founder), (https://t.me/netusd) @netusd , (https://t.me/wannqn) @wannqn , (https://t.me/hxfuxyyXD) @hxfuxyyXD . News: (https://t.me/oosexgangdevs) t.me/oosexgangdevs .          About  No description, website, or topics provided.  Resources  (hackios-xnu-kernel.html#readme-ov-file)   Readme   (hackios-xnu-kernel.html#License-1-ov-file)   License   (https://github.com/oosexgang/hackios-xnu-kernel/activity)   Activity   (https://github.com/oosexgang/hackios-xnu-kernel/custom-properties)   Custom properties    Stars    452 stars  Watchers    1 watching  Forks  (https://github.com/oosexgang/hackios-xnu-kernel/forks)   91  forks     (https://github.com/contact/report-content?content_url=https%3A%2F%2Fgithub.com%2Foosexgang%2Fhackios-xnu-kernel&report=oosexgang+%28user%29) Report repository    Releases     Packages    Contributors    Languages                            Footer (https://github.com)    © 2026 GitHub, Inc.   Footer navigation (https://docs.github.com/site-policy/github-terms/github-terms-of-service) Terms  (https://docs.github.com/site-policy/privacy-policies/github-privacy-statement) Privacy  (https://github.com/security) Security  (https://www.githubstatus.com/) Status  (https://github.community/) Community  (https://docs.github.com/) Docs  (https://support.github.com?tags=dotcom-footer) Contact  Manage cookies    Do not share my personal information              You can’t perform that action at this time.