HackiOS runs full iOS 16.5 firmware on Android devices and QEMU

HackiOS boots iOS 16.5 on Android and QEMU

Takeaway: The HackiOS project successfully runs Apple’s open‑source XNU kernel (version xnu‑8796.121.2, iOS 16.5) on a Snapdragon 778G Android phone and on aarch64 QEMU, providing a fully functional iOS 16.5 user space without flashing the device.

What the project achieves

  • Full iOS 16.5 stack: The XNU kernel launches launchd → backboardd → SpringBoard → apps, reproducing the complete iOS experience.
  • No Apple files in the repo: All iOS binaries are fetched from Apple’s CDN at build time (ios165/fetch.sh).
  • Two deployment modes:
    1. POCO X5 Pro 5G (redwood, Snapdragon 778G) – booted via fastboot boot; everything runs in RAM and the phone returns to Android on reboot.
    2. QEMU virt aarch64 – runs on any Linux host, no phone required.
  • Research‑grade, not a ROM: Sessions are time‑bounded; the kernel returns control to the loader after a configurable period.

Functional highlights

Works Not yet functional
Lock screen, swipe‑to‑unlock, home screen with icons, iOS 16 wallpapers Cellular, Bluetooth
System gestures (home, app switcher, back), Control Center Charging under the custom kernel (phone discharges)
Core apps (Settings, Safari, Photos, etc.) and widgets Metal rendering for most apps (293/456 shaders working)
Touchscreen (Goodix GT9916), multitouch, power/volume keys App Store content, Apple ID sign‑in (Secure Enclave missing)
Up to 8 CPU cores, ~20 s to lock screen Video/Live Photo capture
Adreno 642L GPU via Mesa/freedreno (OpenGL ES for CoreAnimation) –
Wi‑Fi (WCN6750, ath11k) – 55–90 Mbit/s –
Audio, microphone, front/rear camera (HEIC photos) –
Persistent iOS data (var_store=1 ufs_write=1) –
Sileo + Procursus package manager, SSH, tweaks –

Quick start on QEMU (no kernel build required)

# Install dependencies (Arch example)
sudo pacman -S --needed git python 7zip lz4 gcc qemu-system-aarch64 qemu-ui-gtk edk2-aarch64

# Clone the repo and set up the workspace
git clone https://github.com/oosexgang/hackios-xnu-kernel.git hackios
cd hackios
common/setup.sh               # pulls hackios-xnu-userland, checks host
ios165/fetch.sh               # downloads ~7.4 GB IPSW, extracts needed parts
common/build.sh qemu-virt     # builds APFS images (kernel prebuilt is used)
common/run.sh qemu-virt       # launches a ~20‑minute QEMU session
  • The lock screen appears after 2–3 minutes.
  • Mouse left‑button held simulates a finger; H = Home, L = Lock, arrow keys = volume, F11 (hold) = five‑finger gesture.
  • Scripted input examples:
    qemu/touch.py swipe 0.5 0.985 0.5 0.3 250
qemu/touch.py tap 0.615 0.71
qemu/touch.py key home
qemu/screendump.sh shot.png
  • Use the host’s UEFI firmware: QEMU_EFI=/usr/share/AAVMF/AAVMF_CODE.fd QEMU_VARS=/usr/share/AAVMF/AAVMF_VARS.fd.

Running on a POCO X5 Pro 5G (redwood)

  1. Unlock the bootloader and install adb/fastboot.
  2. Pull vendor firmware from the phone (GPU, Wi‑Fi, audio, haptics) as described in the README and place the fw-* directories next to the workspace.
  3. Build the boot image and run:
    common/build.sh redwood GL=1          # produces out/redwood-boot.img
common/run.sh redwood 900             # 15‑minute session
  4. Or use the xl helper for fine‑grained control:
    ./xl enter            # fastboot boot the custom UEFI loader
./xl ramdisk          # upload the 2.5 GB iOS system image to RAM
XL_SECS=900 XL_CMDLINE="touchscreen=1 cpufreq=1 bootcpu=7 cpus=8 gpu=1 wifi=1 adsp=1" ./xl run
./xl screenshot shot.png
./xl reboot           # returns to Android
    The loader runs entirely in RAM; no persistent changes are made to the phone’s storage.

Pre‑built boot image

Each release ships hackios-redwood-boot.img, a ready‑to‑boot UEFI image containing the custom loader. It contains no Apple binaries; you still need to generate the iOS system image locally with ios165/fetch.sh.

Building the kernel and loader from source

  • Kernel: Requires theos (~/theos), cctools, iPhoneOS16.5.sdk, clang, lld, python, perl. Follow xnu/README.md and run xnu-build.sh.
  • Loader: Built with xnuloader/build.sh (plain clang + lld‑link, no EDK2).
  • UEFI: Ported from Project Silicium; prebuilt binaries are in prebuilt/uefi.
  • Images: REST=1 userland/build.sh creates the APFS containers and rootfs.
  • After any rebuild, run tools/update-prebuilt.sh to refresh the prebuilt/ directory.

Porting to other Android devices

  1. Generate a device profile: common/new-device.sh <codename> path/to/device.dtb.
  2. Edit the resulting common/devices/<codename>.conf to describe the UEFI platform, loader parameters, and driver replacements.
  3. Follow the detailed steps in docs/PORTING.md (UEFI port, kernel driver patches, firmware extraction).

How HackiOS works under the hood

fastboot boot → UEFI (Mu‑Silicium) → xnuloader (EFI app)
   │ stays resident, provides USB link, watchdog, kernel log
   ▼
XNU (based on BCM2837 config, patched for redwood/QEMU)
   ├─ GICv3, timers, video console, return‑to‑loader path
   ├─ APFS images in RAM, ramfs for /private/var and /tmp
   ├─ Mini‑crypto, AMFI & Sandbox stubs (MAC policies)
   ├─ Driver replacements: IOSurface, IOMobileFramebuffer, AppleKeyStore, network stack
   ├─ Input: /dev/redwood-touch (Goodix GT9916) or virtio‑input
   ├─ GPU: Adreno 642L via Mesa/freedreno, Wi‑Fi: ath11k (LinuxKPI), sound: ADSP/virtio‑sound
   ▼
launchd → logd, notifyd, cfprefsd, runningboardd, backboardd, SpringBoard, apps
   └─ Libraries injected with DYLD_INSERT_LIBRARIES provide virtual HID services and ObjC method swaps.

The iOS binaries are untouched; missing functionality is supplied either by kernel driver shims or by injected user‑space libraries.

Debugging and development workflow

  • Session logs: QEMU stdout or logs/HHMMSS-run.log on the phone.
  • Automated app launch: RC_JOBS=rc.jobs.tour REST=1 userland/build.sh builds an image that opens every first‑page app.
  • Crash diagnostics: Look for userabort: (process called abort()) or usertrap: (with systrace=1).
  • Live stack traces (QEMU): qemu/touch.py stacks NAME then qemu/symstack.py LOG NAME (requires the ipsw tool).
  • Check reliability: See docs/checks.md for known false‑positives.

Community reaction (Hacker News comments)

"I found the website to be quite nauseating to look at, so I decided to use the GitHub link instead. But it's quite impressive that it works on QEMU, POCO X5 Pro 5G and some Xiaomi devices too." – aghuang

"Can you make a GSI to run on any Android Phone?" – Velocifyer

"Someone finally did this, wow! 2026 just keeps getting more crazy." – pmkary

"Why do these demonstrations all stop at iOS 16? What changed with iOS 17?" – bigwheels

"Great work. This is neat, kind of like the old Hackintosh for macOS. With this do you have access to the App Store? I think there is a unique identifier that Android will lack for it to work." – dj_io

The comments highlight excitement, curiosity about broader device support, and questions about App Store access and future iOS versions.

Licensing

  • The repository itself is under the Apple Public Source License 2.0 (APSL 2.0) because it contains derivative work of XNU.
  • Third‑party components retain their original licenses (BSD‑3‑Clause‑Clear for ath11k, BSD‑2‑Clause for FreeBSD LinuxKPI, MIT for libzbitmap and libdeflate, Apache‑2.0 for AOSP UEFI helpers).
  • No iOS binaries are distributed; ios165/fetch.sh downloads them directly from Apple’s CDN.

Where to find more information

Bottom line

HackiOS demonstrates that the iOS 16.5 kernel and user space can be run on non‑Apple hardware by replacing closed‑source drivers with open‑source equivalents and booting via a custom UEFI loader. While still a research prototype—lacking cellular, Bluetooth, full Metal support, and App Store functionality—it opens a new frontier for iOS experimentation, cross‑platform testing, and security research.

Sources