The open-source project vphone-cli runs a full iOS 27 system as a virtual machine on Apple Silicon, utilizing Apple’s native Virtualization.framework instead of traditional emulation to streamline firmware downloading, boot chain patching, and DFU restores for developers and security researchers.
How vphone-cli Runs iOS Firmware on Apple Silicon
Building on previous work by wh1te4ever to run a virtual iPhone without emulation, vphone-cli automates the entire setup process. According to project documentation, this spans from fetching firmware and patching the boot chain to executing a DFU restore and handling the first boot.
The resulting virtual iPhone supplies SSH access with root privileges alongside VNC access to its graphical interface. Apple has never officially provided an iOS VM for developers or security researchers. However, the technology developed for Private Cloud Compute (PCC) to facilitate security research through a Virtual Research Environment included an “iPhone Research Environment Virtual Machine.” The vphone-cli project brings those components together to automate a working iPhone VM.
Did you know? While Xcode includes an iPhone simulator running a subset of userspace components natively on macOS, it uses a different SDK target from physical hardware. This can introduce subtle behavioral differences, according to developer discussions.
Comparing vphone-cli to the Xcode iOS Simulator
Developers face distinct limitations when relying solely on the standard Xcode simulator. The simulator restricts support for features like camera access, Bluetooth, Metal, App Store app installation, and iCloud.
Discussing the project on Hacker News, user kridsdale1 summarized the architectural difference:
“The iOS simulator is and always has been, simply iOS frameworks running fully natively on macOS. It’s best to think of it as an alternative window managers but the apps are native Mac processes. They can be seen and debugged via the terminal using top and ps and lldb alongside all other processes. They just present gui via the Simulator Mac app container.”
In the same thread, user landr0id noted that vphone-cli is “useful for security research since you can do kernel debugging and inspection of the device not possible in the simulator.” User afavour highlighted the gap in real-world testing, stating that “the difference doesn’t matter until it does, and then it’s infuriating to work out what’s going on.”
Implications for Mobile Security Research and Low-Level Debugging
On LinkedIn, senior iOS engineer Daniyar Kurmanbayev noted that “being able to boot real iOS firmware, SSH in, and reproduce the environment could make security and low-level debugging much more practical.”
Kareem Hesham added context regarding the shift in accessibility:
“Utilizing the Virtualization.framework for a full iOS boot is a significant shift in accessibility for mobile security research. It bridges the gap between hardware-locked environments and scalable automation, though it also raises interesting questions about how much of the ‘walled garden’ is maintained by policy rather than technical barriers.” Kareem Hesham
Apple does not officially support using its iOS firmware in this manner. Consequently, it remains unclear whether future releases of the PCC Virtual Research Environment will continue to include the components required to run an iOS VM.
Pro Tip: When evaluating testing environments for low-level mobile applications, always verify whether your target APIs rely on hardware-locked features like Metal or Bluetooth that standard simulators cannot fully replicate.
Frequently Asked Questions
What is vphone-cli?
An open-source project that enables a full iOS system to run as a virtual machine on Apple Silicon by leveraging Apple’s Virtualization.framework.
How does vphone-cli differ from the Xcode iOS simulator?
The Xcode simulator runs iOS frameworks natively as macOS processes with window management, whereas vphone-cli boots real iOS firmware, allowing for kernel debugging and low-level inspection.
Does Apple officially support vphone-cli?
No. Apple does not officially support running iOS firmware in this manner, and future software updates may alter the availability of required components.
Join the Conversation
What are your thoughts on running iOS virtual machines for development and security testing? Drop a comment below or share this article with your engineering team.
Keep reading