Thanks for the amazing work, I thought about this a while back when I saw WINE Hangover for Android but this is even better (in some ways, at least). Sadly, the iPadOS/iOS 13.3.1 issue is a headache and the certain jailbreak tools which usually get around IPA signing aren't working either.

Whilst most people are saying it's a bug on Apple's side I'm worried it's more than that. The removal of signed iPadOS/iOS 13.3 from their servers, along with the returned ability of flashing static lib'ed packages after all being blocked for a while seems more "on purpose" from Apple rather than "by accident". We gotta just wait and see, I guess.

I think the jailbreak IPA signing isn’t working because it needs the `get-task-allow` entitlement which idk if every tool is aware of. This entitlement is only given out in development profiles and not any distribution profiles so I can’t upload to TestFlight either. If Apple locks down what you can do with `get-task-allow` in the future then a jailbreak would be required to run this.

Curious what you use that for. My previous exposure for "get task" on Darwin/XNU is it's useful for reading or writing the memory of another process and suspending or resuming its threads, as in writing a debugger.

The app pretends to debug itself, which tricks the kernel into allowing it to flip the permissions of pages between write and execute. To do this it needs the get_task_allow entitlement.

Ah ok. So everything with a JIT will need this. I think I might even have read that somewhere long ago.

This is a weird thing by the way. It seems to me like you should be able to debug or do VM syscalls against yourself because there is no escalation of privilege. Debugging another process makes much more sense to block. But maybe my opinion is invalid because I also happen to think disallowing jit with kernel permissions is very silly. (Maybe dropping ability to do this in the style of openbsd's pledge(2) would be appropriate, but only for a process that really wants extra security.)

> So everything with a JIT will need this.

Actual JITs (ones blessed by Apple, not hacks like these) possess the dynamic-codesigning entitlement, and can just make RWX pages.

> But maybe my opinion is invalid because I also happen to think disallowing jit with kernel permissions is very silly.

Your opinion isn't invalid, but it goes against Apple's security model of iOS (namely: apps should not be able to modify themselves).

> Your opinion isn't invalid, but it goes against Apple's security model of iOS (namely: apps should not be able to modify themselves).

And my position is this is a silly approach, or, maybe is ok but should be opt-in, or perhaps opt-out with third parties being automatically trusted to decide they want to use JIT without hoops.

W^X is good default policy but Apple's policy is unreasonable and paranoid.

I can’t remember weather it was ish or some JS thing but you can do a kind of JIT without RWX by setting up chains of functions that tailcall eachother.

iSH has a threaded interpreter that works like that, yes.

Would you by any chance consider TestFlight to distribute UTM? iSH (a usermode Linux "terminal" emulator) has been for quite some time, and I can't see why you shouldn't be able to.

> This entitlement is only given out in development profiles and not any distribution profiles so I can’t upload to TestFlight either.

Ah sorry, my bad, I skipped over that. Here's an idea - you could start a "fundraising" of sorts and if you get enough you could purchase a developer profile to publish to TestFlight.

The problem here is not that they can't obtain a development certificate. The problem is that you cannot use a development certificate to distribute an app on TestFlight or the App Store to other people.

There are two types of certificate – development certificates, which allow get-task-allow for debugging purposes and can be installed directly to a device; and distribution certificates, which do not allow get-task-allow and can be distributed through ad-hoc means, Test Flight, or the App Store.

If this app requires get-task-allow, then it needs to be signed with a development certificate to run. If it's signed with a development certificate, then it can't be distributed to other people.

You can’t purchase such a profile. Apple doesn’t ever give them out.

I thought this would be part of their $99/year subscription, well that's unfortunate. Thanks again for your project.

iSH works differently. It’s not running “Linux” and it isn’t virtualizing hardware either. Anything you run has to be compiled already and the syscalls are emulated, there is no Linux kernel in iSH.

iSH actually uses a semi-JIT to emulate an x86 CPU — it doesn't run ARM64 code. It basically creates an arrray of function pointers to snippets of pre-translated code. It's not a full JIT like UTM, but it's an interesting workaround for iOS' restrictions.

Official description: https://github.com/tbodt/ish#a-note-on-the-jit

A more accurate term for it would be threaded interpretation.

I said it was a 'usermode Linux "terminal" emulator', never said it was a VM or anything like that. IIRC the dev said he also wasn't allowed to publish it to the App Store and I assume it falls under the same catagory of "not allowed" in Apple's eyes as UTM would've had.

> I said it was a 'usermode Linux "terminal" emulator', never said it was a VM or anything like that.

It's a full x86 emulator.

> IIRC the dev said he also wasn't allowed to publish it to the App Store

He didn't, it's just never been tested whether it could be on the store or not.

Actually, someone compiled it, added ads, and put it on the App Store. Not sure if it is still there, but it got through approval.

Oh, that happens all the time. The real test is when the official app gets approved and stays on the App Store.

> Anything you run has to be compiled already

You can compile binaries on iSH and they'll run on the emulator just as all the other code does.

Compile using what? It’s form of emulation has never been complete enough to run a compiler (heck even interpreters like Python have been very brittle) in my experience as a user since the beginning, so I’m curious what you’ve seen success with.

GCC works reasonably well.

Interesting, thx for the reply. I haven’t tried GCC in the last few updates, so will try again.

Edit: just tried it and indeed you are right, it works in a few cases now. Clang also works for basic test cases.

Thank you very much for sharing this with us. I am about to test it. I have already installed it successfully and it opens without crashing (iPad Air 2, iOS 13.3, unc0ver jailbreak) - so far so good ;-)

I will report back when I tried to install Win XP/7 (I desperately want to play Age of Empires 1 while on vacation since I saw this awesome app :D).

So here is my journey with UTM:

1. Install UTM

- harder than I thought now because of Apple enforcing very strict app signing rules etc. (why can't they just let us run our own code without paying or hacking? Ò.ó)

- jailbreak with checkra1n -> install AppCake -> trust certificates with help of "Apple Configurator" (device management was not in the iOS general settings until I accessed profile settings with the configurator) -> sign UTM with AppCake (Filza -> Open IPA with AppCake)

2. Setup VM with Windows XP

- copied ISO (WinXP SP3) to iPad with VLC "Sharing via WiFi" (awesome tool!)

- created a VM with a 5GB hdd and a CD/DVD with path set to the ISO

- could boot from the ISO and start installation but it crashed after the reboot. I tried again and again by opening UTM again, opening the VM settings (not doing so would instantly crash UTM when I tried to start the VM again)

- finally I realized assigning 1GB of RAM to the VM (iPad Air 2 has only 2GB total) was too much and I changed it to 512MB (default setting) which let me finish the installation of Win XP! :-D

No I will try to install Age of Empires 1 and when I get hands on adapter + keyboard + mouse I will try those with UTM as well.

Installing AoE worked but I am afraid I could not start it :-/

It demands graphics with directdraw and will not start.

How did you get Halflife running?

First of all, huge TY! I used iBochs on a first gen iPad and successfully ran Linux, Windows 95, and DOS on it. I’ve tried a few times to modernize that code for current iOS releases, but was unsuccessful. I did spend a bunch of time back in the day building a nice UI for iBochs so would be game to help do that for UTM. My contact info is in my profile if you are still looking for folks!

Thanks! If you’re interested please fork the project on github and make a PR when you’re ready. I want this project eventually to be community run so I’m not going to be “in charge” of anything.

Question then: why are you investing time in something that Apple will never allow in the app store? Isn't it better to spend your effort on a more open platform?

Note: i use an iPhone and iPads. I do my hacking/customizing elsewhere.

Because it’s fun to do and it’s cool to play with. I want to run a Linux development machine on my iPad. I couldn’t care less about making money or growth hacking or starting a side hussle or one of the dozen other reasons why people here believe they must do to have their free time be seen as “optimal”. I just want to have fun with it.

HOW DARE YOU

Another reason is that even though right now they don’t allow it, what if they do start allowing it in the future? Pythonista app is a perfect example of this. It was originally not allowed but they eventually changed their rules to start allowing it back in ios 11 I believe. Maybe the same would happen with this if this becomes decently useful. IPad is already going in a more mainstream direction.

Yes, it's okay if you think along the "i bought the hardware, i do whatever i want with it" line.

There's that nagging feeling you're giving Apple too much mind share though.

Because it's useful even if it's not allowed in the App Store? There's tons of useful open-source software for iOS which will never make it to the App Store.

This includes the real Firefox.

Please explain...

Using the Gecko/Servo like desktop Firefox, not WebKit like Safari.

Ah I see. For a moment I thought you meant someone had made some side-loadable full Firefox and I was going to be so happy.

I have a 4th generation iPad. Would it work on that as well? Since Apple dropped support for it, it's stuck with iOS 10 and effectively useless. I would love to run Linux on it...

Unfortunately UTM requires iOS 11. Perhaps someone might be able to backport it?

How long did it take you to make this?

Most of the development was done on my free time in a span of three months. Then I got bored and didn’t touch it for half a year and decided to polish it up a little last week and release it.