News for hackers. Stuff that matters.

A comment on Almost booting an iOS kernel in QEMU.

Re:Almost booting an iOS kernel in QEMU by w0utert on Tuesday July 17, 2018 @04:42AM (#17548240)
In a way, it seems strange nobody made a full-blown iPhone/iPad iOS emulator yet. Not a simulator like the one Apple makes, but an emulator like for game systems. I would guess the amount of information available about iPhone hardware and software would make it much easier to emulate than e.g. a gamecube, Wii, PS3, etc, especially for older models. Such an emulator could obviously be used for piracy, but could also be an intersting tool for a homebrew scene (custom firmware, developing iOS apps on Linux & Windows, etc.

Is there a practical reason why this would be hard or impossible? Or is it just for fear of Apple's lawyers?

[ Parent | on HN ]
Re:Almost booting an iOS kernel in QEMU by KenanSulayman on Tuesday July 17, 2018 @05:25AM (#17548406)
It seems Corellium (linked to from the blogpost) has done that. That said, it seems they only run iPhone 6, et al., which was jailbroken (untethered), so it's significantly easier to emulate than trying to run the only unencrypted file (kernel cache) targeting an undocumented CPU with Qemu of an iOS beta that was released a few days ago.
[ Parent | on HN ]
Re:Almost booting an iOS kernel in QEMU by willstrafach on Thursday July 19, 2018 @04:45PM (#17570097)
Corellium can run up to iPhone X, and certainly can run iOS 12 (Option is given for jailbroken or not jailbroken too).

Only limit which you may be thinking of is that it only supports 64-bit ARM, so no emulation of the older devices.

[ Parent | on HN ]
Re:Almost booting an iOS kernel in QEMU by rjvbk on Tuesday July 17, 2018 @04:53AM (#17548280)
It seems strange to me that there are no Chinese OEMs selling mobiles with iOS. I mean, I understand it's hard, but is it THAT hard?
[ Parent | on HN ]
Re:Almost booting an iOS kernel in QEMU by mschuster91 on Tuesday July 17, 2018 @05:01AM (#17548317)
Yeah it is because the CPU and GPU are customized for Apple. You'd have to recreate them (which probably would require a F500 company like Amazon or Google) or write a translation layer similar to WINE (which would need a couple dozen expert coders). Not worth the effort for knockoff phones.
[ Parent | on HN ]
Re:Almost booting an iOS kernel in QEMU by rjvbk on Tuesday July 17, 2018 @05:38AM (#17548459)
Knockoff iPhones would sell like hot bread.
[ Parent | on HN ]
Re:Almost booting an iOS kernel in QEMU by TomMarius on Tuesday July 17, 2018 @05:52AM (#17548510)
You can buy them at "the market" in Shenzen. You can even put in original Apple logic board and run iOS - and have crazy things like double storage, memory cards, 3.5mm output, etc. You have to build it from parts though, no one is selling a complete product AFAIK.
[ Parent | on HN ]
Re:Almost booting an iOS kernel in QEMU by deoxxa on Tuesday July 17, 2018 @07:18AM (#17548832)
I would be fiercely interested in any more details around this. I'm sure many of us have seen Scotty from Strange Parts doing his headphone socket project, and the franken-phone built from spare parts, but it sounds like you're suggesting something even more than that.

Citations, please!

[ Parent | on HN ]
Re:Almost booting an iOS kernel in QEMU by TomMarius on Tuesday July 17, 2018 @09:14AM (#17549473)
Sorry, that's personal anecdote, not something I got from youtube or articles that could be cited. See my other reply: I'm not really suggesting anything more than what you can see on Youtube, just that knock-off iPhone parts that are easy to manufacture (body, battery electronics etc) exist - not the logic board though.
[ Parent | on HN ]
Re:Almost booting an iOS kernel in QEMU by blacksoil on Tuesday July 17, 2018 @06:53AM (#17548723)
Afaik, those are not really knockoff as in a Gameboy replica. They're still using the proprietary Apple mainboard and all for the most part. What they did to double the storage was to desolder and solder back in a different storage with different capacity with the image from the original storage cloned onto, a process which kinda costly amd very risky as the components aren't designed to be plug and play like desktop components

Ref: Youtube channel "Strange Parts"

[ Parent | on HN ]
Re:Almost booting an iOS kernel in QEMU by TomMarius on Tuesday July 17, 2018 @09:12AM (#17549464)
There are stores selling knock-off easy to manufacture parts like body, some basic electronic components etc, and yes, as I said, the logic board itself needs to be original.
[ Parent | on HN ]
Re:Almost booting an iOS kernel in QEMU by p0peax on Tuesday July 17, 2018 @06:17AM (#17548598)
They still can't run iOS apps from the App Store. They are encrypted when downloaded and only decrypted at runtime. Decrypted apps can be offloaded from a jailbroken phone and then re-uploaded to a pirate store though.
[ Parent | on HN ]
Re:Almost booting an iOS kernel in QEMU by pvinis on Tuesday July 17, 2018 @11:19AM (#17550275)
Same like Hackintoshes, right?
[ Parent | on HN ]
Re:Almost booting an iOS kernel in QEMU by ofrzeta on Tuesday July 17, 2018 @04:54AM (#17548288)
You would probably need to hack the OS to disable updates etc to prevent Apple from remotely bricking your device.
[ Parent | on HN ]
Re:Almost booting an iOS kernel in QEMU by MaxBarraclough on Tuesday July 17, 2018 @05:15AM (#17548370)
Wrapping it with a firewall would be the easy part.
[ Parent | on HN ]
Re:Almost booting an iOS kernel in QEMU by earenndil on Tuesday July 17, 2018 @07:59PM (#17554576)
That's be the easiest part. You can just grep the binary for apple domains and replace them with your own.
[ Parent | on HN ]