{
    "archive_path": "archive/1792706707.175385",
    "base_url": "github.com/oosexgang/hackios-xnu-kernel",
    "basename": "hackios-xnu-kernel",
    "bookmarked_date": "2026-10-22 22:05",
    "canonical": {
        "archive_org_path": "https://web.archive.org/web/github.com/oosexgang/hackios-xnu-kernel",
        "dom_path": "output.html",
        "favicon_path": "favicon.ico",
        "git_path": "git/",
        "google_favicon_path": "https://www.google.com/s2/favicons?domain=github.com",
        "headers_path": "headers.json",
        "htmltotext_path": "htmltotext.txt",
        "index_path": "index.html",
        "media_path": "media/",
        "mercury_path": "mercury/content.html",
        "pdf_path": "output.pdf",
        "readability_path": "readability/content.html",
        "screenshot_path": "screenshot.png",
        "singlefile_path": "singlefile.html",
        "warc_path": "warc/",
        "wget_path": "github.com/oosexgang/hackios-xnu-kernel.html"
    },
    "domain": "github.com",
    "extension": "",
    "hash": "1VB7DJ36308JE90SMKNJ",
    "history": {
        "archive_org": [],
        "dom": [],
        "favicon": [
            {
                "cmd": [
                    "curl",
                    "--silent",
                    "--location",
                    "--compressed",
                    "--max-time",
                    "120",
                    "--output",
                    "favicon.ico",
                    "--user-agent",
                    "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36 ArchiveBox/0.7.4 (+https://github.com/ArchiveBox/ArchiveBox/) curl/curl 8.14.1 (x86_64-pc-linux-gnu)",
                    "https://www.google.com/s2/favicons?domain=github.com"
                ],
                "cmd_version": "curl 8.14.1 (x86_64-pc-linux-gnu)",
                "end_ts": "2026-10-22T22:05:50.598504+00:00",
                "index_texts": null,
                "output": "favicon.ico",
                "pwd": "/data/archive/1792706707.175385",
                "schema": "ArchiveResult",
                "start_ts": "2026-10-22T22:05:50.109774+00:00",
                "status": "succeeded"
            }
        ],
        "git": [],
        "headers": [
            {
                "cmd": [
                    "curl",
                    "--silent",
                    "--location",
                    "--compressed",
                    "--head",
                    "--max-time",
                    "120",
                    "--user-agent",
                    "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36 ArchiveBox/0.7.4 (+https://github.com/ArchiveBox/ArchiveBox/) curl/curl 8.14.1 (x86_64-pc-linux-gnu)",
                    "https://github.com/oosexgang/hackios-xnu-kernel"
                ],
                "cmd_version": "curl 8.14.1 (x86_64-pc-linux-gnu)",
                "end_ts": "2026-10-22T22:05:50.931733+00:00",
                "index_texts": null,
                "output": "headers.json",
                "pwd": "/data/archive/1792706707.175385",
                "schema": "ArchiveResult",
                "start_ts": "2026-10-22T22:05:50.608825+00:00",
                "status": "succeeded"
            }
        ],
        "htmltotext": [],
        "media": [],
        "mercury": [
            {
                "cmd": [
                    "/app/node_modules/@postlight/parser/cli.js",
                    "https://github.com/oosexgang/hackios-xnu-kernel"
                ],
                "cmd_version": "1.0.0",
                "end_ts": "2026-10-22T22:06:14.528454+00:00",
                "index_texts": null,
                "output": "mercury",
                "pwd": "/data/archive/1792706707.175385",
                "schema": "ArchiveResult",
                "start_ts": "2026-10-22T22:06:08.713614+00:00",
                "status": "succeeded"
            }
        ],
        "pdf": [],
        "readability": [
            {
                "cmd": [
                    "/app/node_modules/readability-extractor/readability-extractor",
                    "/tmp/tmprjnd46h4",
                    "https://github.com/oosexgang/hackios-xnu-kernel"
                ],
                "cmd_version": "0.0.11",
                "end_ts": "2026-10-22T22:06:08.702307+00:00",
                "index_texts": [
                    "HackiOS \u2014 XNU kernel\nHackiOS boots Apple's open-source XNU kernel (xnu-8796.121.2, the kernel of iOS 16.5) on Android phone\nhardware and runs the unmodified iOS 16.5 user space on top of it: launchd \u2192 backboardd \u2192 SpringBoard \u2192\napps. Our own EFI loader, our own replacements for Apple's closed drivers, a UEFI port, and a Linux Wi-Fi driver\non a compatibility layer make that possible.\nIt runs in two places:\n\nPOCO X5 Pro 5G (redwood, Snapdragon 778G) \u2014 nothing is flashed: the UEFI is started with fastboot boot,\nthe whole system lives in RAM, and after a reboot the phone is back in Android;\nQEMU (virt, aarch64) \u2014 the same thing on any Linux computer, no phone needed.\n\nThis repository is half of the project:\n\n\n\nRepository\nWhat\n\n\n\n\nhackios-xnu-kernel (this one)\nXNU patches, the EFI loader, the UEFI port, Wi-Fi, QEMU scripts, xl, prebuilt kernel/loader/UEFI, common/ scripts\n\n\nhackios-xnu-userland\nour init, injected libraries, launchd jobs, the APFS image builder, the scripts that take iOS out of Apple's IPSW, Metal/Mesa work\n\n\n\n\nNo Apple files are in either repository. ios165/fetch.sh downloads the iOS 16.5 IPSW from Apple's own CDN\nto your machine and extracts what is needed there. HackiOS is an independent research project by OOSEX GANG and\nis not affiliated with, authorised or endorsed by Apple Inc. iOS, iPhone and Apple are trademarks of Apple Inc.\n\n\n\n\n\n\n\nPhotographed on the phone, the Adreno GPU drawing (gpu=1). More in Screenshots.\nWhat works\n\n\n\nWorks\nDoes not work (yet)\n\n\n\n\nLock screen, swipe to unlock, home screen with all icons (two pages), stock iOS 16 wallpapers\nCellular, Bluetooth\n\n\nSystem gestures: swipe up (home, app switcher), edge swipe (back), Control Center\nCharging under our kernel (the phone only discharges)\n\n\nApps: Settings, Clock, Calendar, Photos, Notes, Safari and more; widgets (Weather, Calendar) on the phone\nMetal for apps (in progress: 293 of 456 system shaders already run on the Adreno, see docs/air.md in hackios-xnu-userland)\n\n\nPhone touchscreen (Goodix GT9916), multitouch, wake on touch; real power and volume keys\nApp Store content and Apple ID sign-in (no Secure Enclave; FairPlay daemon exits)\n\n\nUp to 8 CPU cores (cpus=8), big core at 2.4 GHz, ~20 s to the lock screen\nVideo and Live Photo recording\n\n\nAdreno 642L GPU through Mesa/freedreno (gpu=1, OpenGL ES for CoreAnimation)\n\n\n\nWi-Fi (WCN6750, ath11k): join from Settings, Safari over Wi-Fi, 55\u201390 Mbit/s\n\n\n\nSound (speakers, main microphone), camera in Camera.app (front/rear, preview, focus, HEIC photos)\n\n\n\nData that iOS writes survives a reboot (var_store=1 ufs_write=1); iOS root volume on the phone's flash\n\n\n\nSileo + Procursus (dpkg, apt), tweaks, SSH\n\n\n\n\nIt is a research bench, not a ROM: a session lasts a given number of seconds, then the kernel returns to the\nloader and hands over its log.\nQuick start: QEMU, no kernel build\nprebuilt/ holds the kernel, loader and our programs built from these repositories, so all you need is the system\nimage, which is made on your machine from Apple's IPSW.\nNeeds: Linux x86-64, ~12 GB free disk, 4 GB free RAM. Packages (Arch):\nsudo pacman -S --needed git python 7zip lz4 gcc qemu-system-aarch64 qemu-ui-gtk edk2-aarch64\n(Debian/Ubuntu: git python3 7zip liblz4-dev gcc qemu-system-arm qemu-efi-aarch64; 7-Zip must be 23 or newer \u2014 it\nreads APFS.)\ngit clone https://github.com/oosexgang/hackios-xnu-kernel.git hackios\ncd hackios\ncommon/setup.sh               # brings hackios-xnu-userland into the same tree, checks the host\nios165/fetch.sh               # downloads 7.4 GB from Apple's CDN and extracts what is needed (5-15 min)\ncommon/build.sh qemu-virt     # builds the APFS images (and the kernel, if the toolchain is there)\ncommon/run.sh qemu-virt       # a 20-minute session in a QEMU window\nThe lock screen appears after 2\u20133 minutes.\n\nMouse with the left button held = finger. Unlock / leave an app: swipe up from the very bottom edge; back:\nswipe from the left edge.\nKeys: H home, L lock/power, \u2191/\u2193 volume, F11 (hold) five fingers.\nFrom a script: qemu/touch.py swipe 0.5 0.985 0.5 0.3 250, qemu/touch.py tap 0.615 0.71,\nqemu/touch.py key home; screenshot: qemu/screendump.sh shot.png.\nRight after SpringBoard appears the system is still registering apps: give it 30\u201340 s.\nDebian/Ubuntu UEFI firmware: QEMU_EFI=/usr/share/AAVMF/AAVMF_CODE.fd QEMU_VARS=/usr/share/AAVMF/AAVMF_VARS.fd.\n\nOn the phone (POCO X5 Pro 5G)\nYou need a POCO X5 Pro 5G (redwood) with an unlocked bootloader, adb and fastboot, and the images from the\nsection above. Nothing is written to the phone's storage.\nThe phone's own firmware is not in the repository and cannot be: it is the vendor's and is taken from the very\nphone it will run on, from its Android:\nadb pull /vendor/firmware/a660_{gmu.bin,sqe.fw,zap.mdt,zap.b00,zap.b01,zap.b02} fw-gpu/      # GPU (gpu=1)\nadb pull /vendor/firmware_mnt/image/wpss.{mdt,b02,b03,b04,b05,b06,b07} fw-wifi/              # Wi-Fi (wifi=1)\nadb pull /vendor/firmware_mnt/image/adsp.{mdt,b02,...,b36} fw-audio/                         # sound (adsp=1)\nadb pull /vendor/firmware/aw8697_haptic.bin fw-haptic/                                       # haptics\n(Put the fw-* directories next to the workspace. Wi-Fi also needs fw-wifi/mac \u2014 the radio's address on one\nline \u2014 and fw-wifi/network \u2014 network name and password. userland/build.sh prints which firmware went in.)\ncommon/build.sh redwood GL=1          # images + out/redwood-boot.img\ncommon/run.sh redwood 900             # loader into RAM, system image into RAM, a 15-minute session\nor step by step with xl:\n./xl enter            # Android -> fastboot -> our loader in RAM (fastboot boot); it brings up its own USB link\n./xl ramdisk          # upload the system image into the phone's RAM (2.5 GB, ~80 s), once per loader session\nXL_SECS=900 XL_CMDLINE=\"touchscreen=1 cpufreq=1 bootcpu=7 cpus=8 gpu=1 wifi=1 adsp=1\" ./xl run\n./xl screenshot shot.png\n./xl reboot           # back to Android\n./xl with no arguments lists every command (logs, screen and sound recording, camera frames, stop, state...).\nPrebuilt boot image\nEvery release has hackios-redwood-boot.img attached: the redwood UEFI with our loader inside, ready for\nfastboot boot. It contains no Apple files; the system image is still made on your machine (above).\nBuilding from source\ncommon/build.sh <device> runs every step that this machine can run and uses prebuilt/ for the rest.\n\nKernel \u2014 needs theos in ~/theos (cctools and\niPhoneOS16.5.sdk) and clang lld python perl. Details: xnu/README.md.\nxnu/apply.sh && xnu-deps/setup.sh && ./xnu-build.sh -j8 -k\n\nLoader \u2014 xnuloader/build.sh (clang + lld-link, an EFI application without EDK2).\nImages \u2014 REST=1 userland/build.sh (variables documented at the top of that file).\nUEFI \u2014 uefi/README.md (Project Silicium port); not needed to run, prebuilt/uefi has it.\nAfter rebuilding: tools/update-prebuilt.sh refreshes prebuilt/.\n\nPorting to another device\ncommon/new-device.sh <codename> path/to/device.dtb   # profile + loader platform from the phone's device tree\nThen follow docs/PORTING.md: the UEFI port, the loader's platform description, the kernel's\ndrivers, the firmware. Device profiles live in common/devices/ (redwood.conf, qemu-virt.conf, _template.conf).\nHow it works\nfastboot boot \u2500\u2500\u25ba UEFI (Mu-Silicium) \u2500\u2500\u25ba xnuloader (EFI application)\n                                           \u2502  stays resident: USB link (fastboot protocol),\n                                           \u2502  watchdog, receives the kernel's log\n                                           \u25bc\n            XNU (BCM2837 config as the base + our platform)\n              \u251c\u2500 GICv3, timer, video console, return to the loader\n              \u251c\u2500 APFS (images in RAM, iOS volume on flash), ramfs (/private/var, /tmp)\n              \u251c\u2500 minicrypto instead of corecrypto, AMFI and Sandbox stand-ins (MAC policies)\n              \u251c\u2500 driver replacements: IOSurface, IOMobileFramebuffer, AppleKeyStore, network stack\n              \u251c\u2500 input: /dev/redwood-touch \u25c4\u2500 Goodix GT9916 (phone) / virtio-input (QEMU)\n              \u251c\u2500 GPU: Adreno 642L, Wi-Fi: WCN6750 (ath11k via LinuxKPI), sound: ADSP / virtio-sound\n              \u25bc\n   iOS 16.5 launchd \u2192 logd, notifyd, cfprefsd, runningboardd, backboardd, SpringBoard, apps\n              \u251c\u2500 our libraries are injected into backboardd, SpringBoard and mediaserverd\n              \u2502  (virtual HID services, a few ObjC method swaps \u2014 in memory only)\n              \u2514\u2500 mediaserverd gets our CoreAudio output device (RedwoodAudio.driver)\n\nThe iOS programs, frameworks and dyld shared cache are not changed by a single byte: what they miss is done by the\nkernel (driver replacements) or by a library the kernel injects with DYLD_INSERT_LIBRARIES (kern.exec_inject).\nLayout\n\n\n\nPath\nWhat\n\n\n\n\ncommon/\nsetup.sh (workspace), build.sh / run.sh (per device), new-device.sh, devices/*.conf, ugit\n\n\nxl\ndrives the phone over USB: loader, kernel runs, logs, screenshots, screen and sound recording\n\n\nxnuloader/\nthe loader: loader.c (UEFI application), mkpayload.py (kernel + images + arguments container)\n\n\nxnu/\nour XNU changes: patch, new files, apply.sh / export.sh\n\n\nxnu-deps/\neverything for building XNU on Linux: setup.sh, tool wrappers, stubs\n\n\nxnu-build.sh, xnu-env.sh\nkernel build\n\n\nuefi/, mkxnuimg.py\nthe UEFI port and packing the boot image for fastboot boot\n\n\nwifi/lx/\nthe layer on which Linux's Wi-Fi driver builds for our kernel\n\n\nqemu/\nQEMU runs, touch input, screenshots, stack symbolication\n\n\ntools/\nrecording (recording.py, sound.py), UFS/flash tools, mk-ath11k.sh, new-workspace.sh, host tests\n\n\nprebuilt/\nbuilt kernel, loader and UEFI pieces (NOTICES.md for the third-party code in the kernel)\n\n\ndocs/\nscreenshots, checks.md, PORTING.md\n\n\n\nDebugging\n\nSession log: QEMU's stdout or logs/HHMMSS-run.log from the phone.\nRC_JOBS=rc.jobs.tour REST=1 userland/build.sh \u2014 an image that unlocks and opens every app of the first page.\nuserabort: in the log is the stack of a process that called abort(); usertrap: (with systrace=1) \u2014 crashes.\nLive stacks (QEMU): qemu/touch.py stacks NAME, then qemu/symstack.py LOG NAME\n(needs ipsw).\nHow a check can lie to you: docs/checks.md.\n\nScreenshots\nFrom the phone's screen, one session (GL=1 REST=1, gpu=1):\n\n\n\n\n\n\n\n\n\n\n\n\n\n\nLicenses\n\nNo iOS files are in the repositories: ios165/fetch.sh downloads them from Apple's CDN to your machine.\nxnu/ is a derivative work of XNU and is distributed under APSL 2.0, like XNU itself; prebuilt/mach.* is the\nkernel built from it. It also contains ath11k (BSD-3-Clause-Clear) and FreeBSD LinuxKPI code (BSD-2-Clause):\nsee prebuilt/NOTICES.md.\nxnu/files/bsd/miscfs/apfs/libzbitmap/ and xnu-deps/build/lzbitmap/ \u2014 libzbitmap (Corellium LLC, MIT here);\nxnu/files/bsd/miscfs/apfs/libdeflate/ \u2014 libdeflate 1.24 (Eric Biggers, MIT, COPYING there).\nath11k, Linux and FreeBSD sources are not in the repository: tools/mk-ath11k.sh fetches pinned releases.\nwifi/lx/patches/*.patch are our changes to FreeBSD headers; the rest of wifi/lx/ is ours.\nuefi/files/Binaries/redwood and prebuilt/uefi/SILICIUM_UEFI.fd contain UEFI drivers from the phone's\nXiaomi firmware, distributed the way Project Silicium distributes them for other devices;\nprebuilt/uefi/mkbootimg.py \u2014 AOSP, Apache-2.0.\nThis repository is licensed under the Apple Public Source License 2.0: our changes to XNU are a derivative of XNU and must be, and our other code here (loader, scripts) is released under the same license. Third-party code keeps its own license, as listed above.\n\nTeam\nOOSEX GANG \u2014 @oodze (founder), @netusd, @wannqn,\n@hxfuxyyXD. News: t.me/oosexgangdevs."
                ],
                "output": "readability",
                "pwd": "/data/archive/1792706707.175385",
                "schema": "ArchiveResult",
                "start_ts": "2026-10-22T22:06:04.639320+00:00",
                "status": "succeeded"
            }
        ],
        "screenshot": [],
        "singlefile": [],
        "title": [
            {
                "cmd": [
                    "curl",
                    "--silent",
                    "--location",
                    "--compressed",
                    "--max-time",
                    "120",
                    "--user-agent",
                    "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36 ArchiveBox/0.7.4 (+https://github.com/ArchiveBox/ArchiveBox/) curl/curl 8.14.1 (x86_64-pc-linux-gnu)",
                    "https://github.com/oosexgang/hackios-xnu-kernel"
                ],
                "cmd_version": "curl 8.14.1 (x86_64-pc-linux-gnu)",
                "end_ts": "2026-10-22T22:06:04.628954+00:00",
                "index_texts": null,
                "output": "GitHub - oosexgang/hackios-xnu-kernel \u00b7 GitHub",
                "pwd": "/data/archive/1792706707.175385",
                "schema": "ArchiveResult",
                "start_ts": "2026-10-22T22:06:04.505444+00:00",
                "status": "succeeded"
            }
        ],
        "wget": [
            {
                "cmd": [
                    "wget",
                    "--no-verbose",
                    "--adjust-extension",
                    "--convert-links",
                    "--force-directories",
                    "--span-hosts",
                    "--no-parent",
                    "-e",
                    "robots=off",
                    "--reject=js,mjs,woff,woff2,ttf,otf,eot,mp4,m4v,mov,webm,ogv,mkv,avi,flv",
                    "--timeout=120",
                    "--restrict-file-names=windows",
                    "--page-requisites",
                    "--user-agent=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36 ArchiveBox/0.7.4 (+https://github.com/ArchiveBox/ArchiveBox/) wget/GNU Wget 1.21.3",
                    "--compression=auto",
                    "--timestamping",
                    "https://github.com/oosexgang/hackios-xnu-kernel"
                ],
                "cmd_version": "GNU Wget 1.21.3",
                "end_ts": "2026-10-22T22:06:04.495289+00:00",
                "index_texts": null,
                "output": "github.com/oosexgang/hackios-xnu-kernel.html",
                "pwd": "/data/archive/1792706707.175385",
                "schema": "ArchiveResult",
                "start_ts": "2026-10-22T22:05:50.945011+00:00",
                "status": "succeeded"
            }
        ]
    },
    "icons": null,
    "is_archived": true,
    "is_static": false,
    "latest": {
        "archive_org": null,
        "dom": null,
        "favicon": "favicon.ico",
        "git": null,
        "media": null,
        "pdf": null,
        "screenshot": null,
        "singlefile": null,
        "title": "GitHub - oosexgang/hackios-xnu-kernel \u00b7 GitHub",
        "warc": null,
        "wget": "github.com/oosexgang/hackios-xnu-kernel.html"
    },
    "link_dir": "/data/archive/1792706707.175385",
    "newest_archive_date": "2026-10-22T22:06:08.713614+00:00",
    "num_failures": 0,
    "num_outputs": 6,
    "oldest_archive_date": "2026-10-22T22:05:50.109774+00:00",
    "path": "/oosexgang/hackios-xnu-kernel",
    "schema": "Link",
    "scheme": "https",
    "snapshot_id": "23c6040c-2f3c-4152-8597-b8cb268fe01a",
    "sources": [
        "/data/sources/1792706707-import.txt"
    ],
    "tags": null,
    "tags_str": "",
    "timestamp": "1792706707.175385",
    "title": "GitHub - oosexgang/hackios-xnu-kernel \u00b7 GitHub",
    "updated": "2026-10-22T22:05:50.107940+00:00",
    "updated_date": "2026-10-22 22:05",
    "url": "https://github.com/oosexgang/hackios-xnu-kernel"
}