jprx/darwin-vm

What it solves

darwin-vm allows developers and security researchers to run a lightweight, debuggable version of iOS and macOS (Darwin) within Qemu. It removes the need for physical hardware or complex jailbreaks to test custom command-line programs, debug the XNU kernel, or explore low-level system internals.

How it works

The project uses a specialized fork of Qemu (qemu-sptm) that adds support for Apple Silicon's SPTM and TXM. It boots a modified recovery image (ramdisk) from an IPSW file, bypassing the GUI and booting directly into a root shell. Users can compile custom binaries using Xcode, sign them, and inject them into the virtual filesystem to run as root.

Who it’s for

It is designed for kernel developers, security researchers, and low-level system enthusiasts who want to analyze Darwin internals, patch the kernel, or run custom code on Apple's operating systems without needing a physical device.

Highlights

• Broad Hardware Emulation: Supports emulating a wide range of Apple Silicon CPUs, including A19-A14 for iOS and M5-M1 for macOS.
• Root Access by Default: Boots directly into a root shell in seconds, requiring no jailbreak or kernel patches.
• Kernel Debugging: Integrates with GDB/LLDB to allow patching and debugging of the kernel, SPTM, TXM, and userspace programs.
• Custom Binary Execution: Provides a workflow to compile, sign, and add custom programs to the VM's ramdisk.
• Development Kernel Support: Supports booting custom or development kernels (KDK) for enhanced symbol access and debugging features.