Run iOS on Apple Silicon Macs for security research and debugging
You can run iOS on a Mac screen without a physical iPhone, explore apps and files, and take screenshots. This tool combines Apple's Virtualization.framework with a PCC research virtual machine to run iOS. It is designed for security research, reverse engineering, and debugging.
Basic features of the virtual iPhone
You can interact directly with the virtual iPhone's screen on your Mac, explore apps and files, and capture screenshots or screen recordings. The system is provided with patches pre-applied, and you can install the package environment. Exporting, importing, and duplicating the virtual machine (VM) are supported, making backup and replication easy. You can optionally use an automation API through local HTTP and WebSocket interfaces. No additional dependencies such as Xcode, Python, or Homebrew are required at runtime.
Host environment setup and requirements
A physical Apple Silicon Mac running macOS 15 or later is required. It does not work in a macOS virtual machine. Each VM uses a 64GB virtual disk by default, and additional space is needed for firmware. A network connection is essential because signed tickets are fetched online during system restoration. You must boot into macOS Recovery Mode and run the csrutil enable --without debug and csrutil allow-research-guests enable commands in the terminal. During this process, SIP remains enabled, and only debugging restrictions are relaxed.
Open-source boot ROM adoption
Newly created VMs start from two open-source ROMs, OpenAVB and OpenSEP, instead of the closed ROM from Virtualization.framework. OpenAVB replaces the boot ROM AVPBooter and does not require patching, so it remains unchanged during the fw patch process. OpenSEP replaces the SEP boot ROM AVPSEPBooter. Using these two ROMs ensures that no code written by Apple runs before iBoot and SEPOS execute. Existing VMs retain Apple's ROM but can be switched to open-source ROMs by changing settings at the next startup. Restoring an OpenAVB booting VM requires version 2.10.1 or later of VPhone.bundle.
Using coding agents and the command-line interface
If you use coding agents like Claude Code or Codex, pasting the provided prompt allows the agent to perform setup automatically. The agent reads the vphone skill, checks already configured items, installs Launchpad and VPhone.bundle, and stops at steps requiring user intervention, such as entering an administrator password or making changes in macOS Recovery Mode. You can manage VMs via the vphone-cli command in the terminal. To enable the automation API, add the --api-listen 127.0.0.1:8765 option at launch and use the output token.
Pre-use checks and precautions
This tool is intended for security research, reverse engineering, and debugging, and is not a general-purpose iOS emulator for regular users. The project does not issue or accept cryptocurrencies or tokens, and any cryptocurrency issued under this project's name is a scam. macOS 15 or later and a physical Apple Silicon Mac are mandatory, and it cannot be used in virtual environments. VM creation may fail if disk space is insufficient, so ensure at least 64GB of free space. Firmware restoration may fail to download signed tickets if the network connection is unstable. You must modify host security settings (SIP, AMFI), so proceed only after fully understanding the impact of these changes on your system.
