待翻译：Show HN: Darwin-VM – run the latest iOS and macOS in QEMU

AI 服务暂时不可用，以下为来源正文，待恢复后补全翻译。

Notifications You must be signed in to change notification settings Fork 14 Star 202 BranchesTags Open more actions menu Latest commit History 1 Commit 1 Commit Folders and files NameName Last commit message Last commit date launchdaemons launchdaemons qemu-sptm @ 006cc6b qemu-sptm @ 006cc6b .gitmodules .gitmodules LICENSE LICENSE README.md README.md build_tc.py build_tc.py dt_fixup.py dt_fixup.py fix_perms.sh fix_perms.sh get_files.sh get_files.sh nvram.bin nvram.bin run.sh run.sh Repository files navigation Run iOS/ macOS in Qemu. Supports emulating iPhone 17, 16, 15, 14, 13, and 12 (A19-A14) and M5-M1 Macs (tested with Macbook Air and Mac Mini). You can debug the kernel, edit the root filesystem, and run a root shell + custom programs. Features: Runs a lightweight debuggable iOS/ macOS (Darwin) system with custom filesystem. Boots you directly into a root shell in just a few seconds. Compile and run your own programs as root in the VM, no jailbreak or kernel patches required. Runs anywhere qemu runs (ARM host not required). Supports emulating A19-A14 (iOS) and M5-M1 (macOS) CPUs. Supports SPTM based kernels and CPUs with MIE. Can debug / patch the kernel, SPTM, TXM, dyld, launchd, and userspace programs. Automated setup to get going in just a few minutes. $ ./run.sh Darwin Kernel Version 27.0.0: Tue Aug 11 22:05:33 PDT 2026; root:xnu-13432.1.9~3/RELEASE_ARM64_T8142 pmap_startup() init/release time: 893478 microsec vm_page_bootstrap: 463555 free pages, 25917 wired pages VM bootstrap: 73 maps, 256 entries and 64 nodes available ptr-packing max: compressor:0x page:0x vmn:0xfffffeffffffff00 vme:0x zone_map_range: min:0x max:0x0, vm-size:0x5cc000000 ro-size:0x29e000000, vm_min:0x ro_min:0x vm: "vm_compressor_mode" is 4 VM bootstrap done: 71 maps, 224 entries and 59 nodes left standard timeslicing quantum is 10000 us standard background quantum is 2500 us Long logs support configured: size: 16384 Firehose configured: 16 chunks, 8 io pages Log queues configured: slot count: 90, per-slot size: 32768, total size: 2949120 OSLog stream configured: stream: 8192 bytes, cache: 2112 bytes [trap_telemetry] trap_telemetry_init mig_table_max_displ = 91 mach_kobj_count = 390 debug_log_init: Error!! gPanicBase is still not initialized libTXM_KernelVersion: 12 libTXM_Image4Version: 1 TXM [Log]: setup logging: 32768 bytes (256 | 128) TXM [Log]: system supports DIT feature TXM [Log]: setup device tree range TXM [Log]: unable to find esdm-fuses property in /chosen TXM [Log]: resolved system platform identity: 0 TXM [Log]: Code Signing Monitor Image4 Module Version 7.0.0: Mon Aug 10 00:10:03 PDT 2026; root:AppleImage4_txm-374~7048/libima ... Darwin Ignition Sequence Version 1.0.0: Tue Aug 11 21:44:28 PDT 2026; root:libignition-64~19270/libignition_core/RELEASE_ARM64E libignition: 1: arguments : libignition: 1: ignition level : 0x5 libignition: 1: force dylib root : 0x0 libignition: 1: halt after stage : n/a ... com.apple.xpc.launchd|1970-01-01 00:00:29.466851 : Darwin Bootstrapper Version 7.0.0: Mon Aug 10 01:06:09 PDT 2026; root:libxpc_executables-3298.1.1~29/launchd/RELEASE_ARM64E com.apple.xpc.launchd|1970-01-01 00:00:29.484709 : boot-args = rd=md0 serial=3 -v -noprogress wdt=-1 wlan-olyhal-abort com.apple.xpc.launchd|1970-01-01 00:00:29.486795 : Restore environment starting. com.apple.xpc.launchd|1970-01-01 00:00:29.487770 : System Integrity Protection is engaged. com.apple.xpc.launchd|1970-01-01 00:00:29.904447 (system/com.jprx.bash) : internal event: WILL_SPAWN, code = 0 com.apple.xpc.launchd|1970-01-01 00:00:29.905070 (system/com.jprx.bash) : service state: spawn scheduled com.apple.xpc.launchd|1970-01-01 00:00:29.905166 (system/com.jprx.bash) : service state: spawning com.apple.xpc.launchd|1970-01-01 00:00:29.922055 (system/com.jprx.bash) : launching: speculative bash-3.2# uname -v Darwin Kernel Version 27.0.0: Tue Aug 11 22:05:33 PDT 2026; root:xnu-13432.1.9~3/RELEASE_ARM64_T8142 bash-3.2# whoami root bash-3.2# ls .fseventsd mnt1 mnt3 mnt8 usr System mnt10 mnt4 mnt9 var bin mnt11 mnt5 private dev mnt12 mnt6 sbin etc mnt2 mnt7 tmp (some kernel messages were removed from the above log to make it easier to read) What this is not This is not a full iPhone/ Mac emulator. Don't expect the screen, wifi, bluetooth, graphics, GUI apps, or full springboard to work. This just boots iOS / macOS to a barebones root shell so you can run custom command line programs, debug the kernel, and mess around with low-level Darwin internals. If you've ever compiled Linux + busybox and booted in qemu (with -kernel and -initrd) for kernel development, this is like that but for Darwin systems. Tested Configurations darwin-vm has been tested with the following systems: Device devname CPU name iOS 27.0 beta 7 iOS 26.6 iPhone 17 (A19) iPhone18,3 t8150 ✅ ✅ iPhone 16 (A18) iPhone17,3 t8140 ✅ ✅ iPhone 15 (A16) iPhone15,4 t8120 ✅ ✅ iPhone 14 (A15) iPhone14,7 t8110 ✅ ✅ iPhone 13 (A15) iPhone14,5 t8110 ✅ ✅ iPhone 12 (A14) iPhone13,2 t8101 ✅ ✅ Device devname CPU name macOS 27.0 beta 7 macOS 26.6 M5 Macbook Air Mac17,4 t8142 ✅ ✅ M4 Mac Mini Mac16,10 t8132 ✅ ✅ M3 Macbook Air Mac15,13 t8122 ✅ ✅ M2 Mac Mini Mac14,3 t8112 ✅ ✅ M1 Mac Mini Macmini9,1 t8103 ✅ ❌ ✅ = boots to root shell and can run commands ❌ = panics before launchd / shell Notes: If you don't need MIE, use something without it, as emulating MIE can be slow. Occasionally the system can randomly crash during early boot; if you see a kernel panic before launchd, just restart and try again (potentially a few times). This problem primarily affects t8110 devices. Setup You'll need a few things: Access to a Mac with python, jq, wget, and ipsw. A machine to build and run qemu on - this can be different to the first machine. (optional) The URL of the IPSW (iOS or macOS) you want to use. You don't need to download the IPSW, you just need the URL. If you don't care which version you boot, we provide a default one. Note The ipsw tool can help find the URLs for IPSW files. Quickstart How to get this running as fast as possible. See below sections for explanations of what these commands do/ how to customize things. Install dependencies: brew install jq wget ipsw Clone this repo: git clone https://github.com/jprx/darwin-vm.git cd darwin-vm Download iOS files. Must run this on a Mac (see step 1 below to customize which iOS/ macOS version we install): ./get_files.sh ./fix_perms.sh firmware/ramdisk.dmg Build qemu: git submodule update --init cd qemu-sptm mkdir build cd build ../configure --target-list=aarch64-softmmu make -j cd ../.. Launch the VM: ./run.sh Your VM should boot to a root shell! Use ctrl+A followed by x in the terminal to quit Qemu. 1. Preparing Files get_files.sh will download and patch the files we need from the remote IPSW URL. Important This step requires a Mac. Run get_files.sh with no arguments to load a known working version of iOS. If you do have a specific IPSW you want to use: DEVNAME="your_device_name" URL="your_ipsw_url" ./get_files.sh Example: $ DEVNAME="iPhone17,3" URL="https://updates.cdn-apple.com/2026SpringSeed/ad5a4f9d-f005-466b-bbcf-3b466040074b/iPhone17,3_27.0_24A5424a_Restore.ipsw" ./get_files.sh iPhone17,3 board name: d47ap kernel ext: iphone17 chip name: t8140 os sdk: iphoneos • Extracting files matching pattern "kernelcache.release.iphone17" • Extracting Payload path=firmware/bootkc • Extracting files matching pattern "sptm.t8140.release" • Extracting Payload path=firmware/sptm • Extracting files matching pattern "txm.iphoneos.release" • Extracting Payload path=firmware/txm • Extracting files matching pattern "DeviceTree.d47ap" • Extracting Payload path=firmware/dtree • Extracting DMG • Extracting Payload path=firmware/ramdisk.dmg Patching firmware/ramdisk.dmg /dev/disk7 /dev/disk8 EF57347C-0000-11AA-AA11-0030654 /dev/disk8s1 41504653-0000-11AA-AA11-0030654 /private/var/folders/bn/mbs4rq1j2wnc3mkz3lv70hr80000gn/T/tmp.4UAV9eVIrO mounted firmware/ramdisk.dmg on /var/folders/bn/mbs4rq1j2wnc3mkz3lv70hr80000gn/T/tmp.4UAV9eVIrO --2026-08-27 16:55:40-- https://raw.githubusercontent.com/jprx/ios-cli-tools/refs/heads/main/prebuilt.tar.gz Resolving raw.githubusercontent.com (raw.githubusercontent.com)... Connecting to raw.githubusercontent.com (raw.githubusercontent.com)... connected. HTTP request sent, awaiting response... 200 OK Length: 4513811 (4.3M) [application/octet-stream] Saving to: ‘sysroot.tar.gz’ sysroot.tar.gz 100%[===================>] 4.30M 26.1MB/s in 0.2s 2026-08-27 16:55:40 (26.1 MB/s) - ‘sysroot.tar.gz’ saved [4513811/4513811] signing binaries... building trustcache... done! "disk7" ejected. 2. Fixing Permissions Important This step requires a Mac. firmware/ramdisk.dmg holds the filesystem our VM is going to use. get_files.sh modified it to make the virtual machine immediately boot a root shell; however, the files on the disk currently aren't owned by root, which we need for the VM to boot. Fix permissions with: ./fix_perms.sh firmware/ramdisk.dmg Example: $ ./fix_perms.sh firmware/ramdisk.dmg /dev/disk5 /dev/disk7 EF57347C-0000-11AA-AA11-0030654 /dev/disk7s1 41504653-0000-11AA-AA11-0030654 /private/var/folders/bn/mbs4rq1j2wnc3mkz3lv70hr80000gn/T/tmp.iGnHuTRtjs mounted firmware/ramdisk.dmg on /var/folders/bn/mbs4rq1j2wnc3mkz3lv70hr80000gn/T/tmp.iGnHuTRtjs This will run: sudo chown -R root:wheel /var/folders/bn/mbs4rq1j2wnc3mkz3lv70hr80000gn/T/tmp.iGnHuTRtjs/bin /var/folders/bn/mbs4rq1j2wnc3mkz3lv70hr80000gn/T/tmp.iGnHuTRtjs/System /var/folders/bn/mbs4rq1j2wnc3mkz3lv70hr80000gn/T/tmp.iGnHuTRtjs/libexec Are you sure? (y/n) y y done! "disk5" ejected. You will now have a firmware directory with everything we need to run the VM in it. 3. Build qemu-sptm qemu-sptm is a fork of Qemu that adds support for running Apple Silicon machines with SPTM/ TXM. It's provided in this repo as a submodule. To boot our VM, we need to compile the qemu-sptm submodule. First, make sure you have the Qemu build dependencies installed. Then, build qemu-sptm: git submodule update --init cd qemu-sptm mkdir build cd build ../configure --target-list=aarch64-softmmu make -j cd ../.. Qemu will be located at qemu-sptm/build/qemu-system-aarch64. 4. Run the VM The run.sh script boots qemu using the files in the firmware directory. It takes no arguments: ./run.sh Use ctrl+A followed by x in the terminal to quit Qemu. 5. Add custom programs to the VM Important This step requires a Mac with Xcode. Let's say you want to run the following (in hello.c): #include int main() { printf("hello, xnu!\n"); } Build it with xcrun, where ${YOUR_SDK} is iphoneos (iOS VM) or macosx (macOS VM): xcrun -sdk ${YOUR_SDK} clang hello.c -o hello Sign it: codesign -s - hello Copy it into the ramdisk (by mounting firmware/ramdisk.dmg): mkdir mnt hdiutil attach -owners on -mountpoint mnt firmware/ramdisk.dmg sudo cp hello mnt/bin/hello hdiutil detach mnt rmdir mnt Get the CDHash of the binary: codesign -d -vvv hello look for the field that says CDHash=..., that 40-character hash is your CDHash. Open firmware/all_hashes and add the CDHash as a new line at the top of the file. Then, run the following: ./build_tc.py firmware/all_hashes firmware/ramdisk.tc Reboot the VM and run your program: bash-3.2# hello hello, xnu! 6. Running a custom / development kernel Important This step requires a Mac. Apple ships development flavors of the kernel via Kernel Debug Kits for macOS. You can also try to compile XNU yourself. Using development kernels is nice because they have extra features and symbols. We can boot these with darwin-vm too. To boot a development kernel, we need to create a new kernelcache combining the kernel we want to use plus all the kexts for the system we're targeting. 1. Select a Mac and macOS version. You need to know The device name of the Mac y [truncated for AI cost control]