For the past few months, I've been building support for running the latest SPTM-based versions of iOS and macOS into qemu. The idea is to create a lightweight barebones environment for playing around with / debugging XNU and low-level Darwin internals, kind of like a tiny busybox Linux system except running Darwin, and using an emulated Apple Silicon CPU (custom instructions/ privilege levels and all).

With darwin-vm, you can directly boot the system using just an iOS/ macOS kernel and minimal ramdisk; no gigantic 40GB macOS VM disk images or downloading 10GB+ IPSW files like you need to for regular macOS VMs. It also works for iOS! And of course, since this is a VM you can use a debugger to debug anything in the system: SPTM, TXM, XNU, all kexts, launchd, dyld, and all user programs can be modified/ patched/ debugged. You can also run your own custom programs inside the VM as root.

Getting this to work required reverse engineering the SPTM boot protocol and implementing it in qemu, eg. how SPTM expects the trusted execution monitor, boot kernelcache, ramdisk, trustcache, device tree, boot args, etc. to be laid out in physmem. I also had to add support for Apple's GXF instructions and guarded exception levels, which are parallel privilege levels that live next to your classical EL2 and EL0, and are used by SPTM and TXM respectively. Not to mention all of the random undocumented system registers and device tree manipulation the system expects the bootloader to take care of, as well as getting MTE to work for the latest hardware.

The darwin-vm repository contains scripts that automate downloading just the files you need from an iOS or macOS update file, installing a root shell daemon into the ramdisk, and signing a trustcache for you so you don't have to deal with/ care about any of that. The hope is it's as "plug and play" as possible: you give me an iOS/ macOS update file, I give you a root shell inside a VM running that OS.

I've tested this booting the very latest iOS and macOS betas on virtual iPhone 17, 16, 15, 14, 13, and 12, as well as M1-M5 virtual Mac Minis and Macbook Airs. Since it's all Qemu TCG, you can run this anywhere Qemu runs; no need for an ARM host. You do need a Mac to set up the VM files though since the setup scripts mess around with APFS images and code signing.

I also included instructions in the readme for how to customize the kernel/ swap in a development kernel from a Kernel Debug Kit and get symbolic kernel debugging working in the VM via lldb, as well as how to compile and run your own programs in your iOS or macOS VM.

Let me know what you think!