Apple Silicon Maclarda virtual iPhone: vphone-cli Virtualization.framework dan qanday foydalanyapti

Apple Silicon Maclarda iOS ilovalarini sinab ko'rish uchun hali yaqinda simulator yagona yechim edi. Leekin simulator haqiqiy iOS emas — u macOS ustida ishlaydigan qisqartirilgan versiya. Endi vphone-cli loyihasi Apple o'zining Virtualization.framework ni qanday ishlatganini ko'rsatib, haqiqiy iOS ni virtual mashina sifatida ishga tushirish yo'lini ochdi. Bu faqat oddiy vosita emas, Apple o'zining virtualizatsiya texnologiyasining chetlab o'tilmagan chegarasini sinovdan o'tkazuvchi kuchli qurilma.

Nima uchun bu muhim?

Yillar davomida iOS xavfsizlik tadqiqotchilari va kernel dasturchilari haqiqiy iOS qurilmasi kerak bo'lganda faqat fizika iPhone va Mac arasida o'tishlari kerak edi. Apple o'zining Virtualization.framework (macOS 11 dan boshlab) va PV=3 (Protected Virtualization) rejimi bilan virtualizatsiya imkonini bergan edi, lekin bu faqat macOS va Linux mehmonlari uchun. iOS mehmonini ishga tushirish uchun maxsus entitlements (huquqlari), imzolangan binary va AMFI (Apple Mobile File Integrity) cheklovlarini oldini olish kerak bo'lardi. vphone-cli shu barcha murakkab oqimni avtomatlashtirib, bitta buyruqqa aylantiradi.

Qanday ishlaydi: texnik arxitektura

vphone-cli quyidagi qatlamlardan iborat:

brew install python@3.13 aria2 wget gnu-tar openssl@3 ldid-procursus sshpass keystone cmake libusb ipsw zstd

• Virtualization.framework — Apple'ning macOS 11+ da kiritgan rasmiy virtualizatsiya API si. Bu hypervisor darajasida ishlaydi va PV=3 rejimini qo'llab-quvvatlaydi.
• vphoned (mehmon daemon) — iOS ichida ishlaydigan, Xcode va iOS SDK yordamida cross-compile qilingan kichik daemon. Bu mehmon OS bilan host o'rtasidagi aloqa, fayl tizimi almashinuvi va boshqaruvni ta'minlaydi.
• IPSW tayyorlash va yamalash — iPhone va CloudOS IPSW fayllari yuklab olinadi, birlashtiriladi va tanlangan --variant ga ko'ra boot chain (iBSS, iBEC, kernelcache, dyld_shared_cache) yamalanadi.
• DFU restore — Yamlangan firmware DFU (Device Firmware Upgrade) rejimi orqali virtual qurilmaga o'rnatiladi. Bu haqiqiy iPhone yangilash jarayonining aynan nusxasi.
• CFW (Custom Firmware) o'rnatish — Host tizimidan sudo bilan APFS seal-volume artifactlari yuklab, mehmon fayl tizimiga jailbreak komponentlari (Sileo, TrollStore) va SSH server o'rnatiladi.

Bezovta variantlari: qaysi darajaga yetishingiz kerak?

Loyiha besh xil yamalash variantini taklif qiladi, har biri oldingisiga qo'shimcha xavfsizlik mexanizmlarini o'chirib yuboradi:

brew install zqxwce/tap/vphone-cli

• less — 4 ta yama, 2 bosqich. iOS himoyalari (AMFI, SSV, TXM) faol qoladi. Faqat tadqiqot uchun minimal o'zgarish.
• regular — 42 ta yama, 10 bosqich. AMFI, SSV, Img4, TXM bypass. Kernel debugging va unsigned kod ishga tushirish imkonini beradi.
• dev — 53 ta yama, 12 bosqich. regular ga TXM entitlement/debug bypass qo'shilgan. Kernel extension va task_for_pid cheklovlari yo'q.
• jb — 113 ta yama, 14 bosqich. To'liq jailbreak: Sileo, TrollStore, SSH (mobile/alpine) avtomatik o'rnatiladi. Birinchi boot da tayyor jailbreak qurilma.
• exp — 141 ta yama, 18 bosqich. jb superset + anti-VM-detection tadqiqot yamalari. Xavfsizlik tadqiqotchilari uchun eng keng variant.

Har bir variant research/0_binary_patch_comparison.md faylida komponentlar bo'yicha batafsil taqqoslangan.

git clone --recurse-submodules https://github.com/Lakr233/vphone-cli.git

./scripts/setup_tools.sh      # install deps, build toolchain submodules, create the Python venv
./scripts/build.sh            # build + sign vphone-cli, bundle the .app, cross-compile vphoned

cd .build/vphone-cli.app/Contents/MacOS/
vphone-cli --help

Talablar va o'rnatish murakkabligi

Bu oddiy brew install emas. Quyidagilar shart:

vphone-cli vm create myphone -V jb        # -V / --variant

vphone-cli vm launch myphone

• Apple Silicon Mac (Intel emas)
• macOS 15+ (Sequoia)
• Xcode + iOS SDK (vphoned cross-compile uchun)
• SIP (System Integrity Protection) va AMFI ni yumshtirish — ikki yo'l:

Variant A: SIP ni butunlay o'chirish + csrutil allow-research-guests enable + nvram boot-args="amfi_get_out_of_my_way=1". Bu eng keng imkoniyat beradi lekin tizim xavfsizligini kamaytiradi.

vphone-cli vm list                         # list VMs (--json for scripting)
vphone-cli vm info myphone                  # show one VM
vphone-cli vm new myphone                   # create an empty bundle (cpu/mem/disk options)
vphone-cli vm config myphone --cpu 8 --memory 8192
vphone-cli vm clone myphone myphone-2       # fast APFS clone, fresh device identity
vphone-cli vm export myphone --out myphone.tzst   # zstd fast by default (--max = xz -9); --out may be a dir (auto-names <vm>.tzst/.txz); skips restore dir + staging files
vphone-cli vm import myphone.tzst --name restored
vphone-cli vm rename myphone iphone16
vphone-cli vm delete iphone16

Variant B: SIP ni --without debug bilan yoqilgan holda qoldirish + csrutil allow-research-guests enable + vphone-amfidont vositasi orqali faqat vphone-cli binary sini AMFI dan chetlab o'tkazish. Bu tizim butunligida AMFI ni saqlaydi.

vphone-cli vm new myphone                              # 1. empty bundle
vphone-cli fw prepare myphone --iphone-version 26.1     # 2. download + merge IPSWs
vphone-cli fw patch myphone --variant jb                # 3. patch the boot chain

vphone-cli vm launch myphone --dfu &                    # 4. boot into DFU (background)
vphone-cli restore myphone --get-shsh                   #    fetch SHSH
vphone-cli restore myphone                              #    DFU restore
vphone-cli vm stop myphone                              #    stop the DFU boot

vphone-cli cfw install myphone --variant jb             # 5. install CFW (host-mount; asks for sudo)
vphone-cli vm launch myphone                            # 6. first boot

O'rnatish: brew install zqxwce/tap/vphone-cli yoki manba kodidan ./scripts/setup_tools.sh va ./scripts/build.sh orqali. Barcha ma'lumotlar ~/.vphone/ papkasida saqlanadi (VMlar, IPSW kesh, debs, Python venv). $VPHONE_ROOT muhit o'zgaruvchisi bilan joylashuv o'zgartirilishi mumkin.

csrutil disable
csrutil allow-research-guests enable

Moslik matritsasi: qaysi versiyalar ishlaydi?

Loyiha host macOS, iPhone IPSW va CloudOS IPSW o'rtasiga qat'iy moslik talab qiladi. Misol uchun:

• macOS 26.3 (Mac16,12) + iPhone 17,3_26.3_23B85 + CloudOS 26.1-23B85 — ishlaydi
• macOS 27.0b2 (Mac16,11) + iPhone 17,3_27.0_24A5424a + CloudOS 26.4-23E5207q — ishlaydi

Noto'g'ri kombinatsiya "zsh: killed" xatosi yoki "Virtualization is not available" xatosiga olib keladi. Oxirgisi nested virtualization (Mac o'zi VM bo'lganda) da yuzaga keladi — PV=3 mehmon ichma-ich joylashmaydi.

Kimga va nima uchun kerak?

• Xavfsizlik tadqiqotchilari: Kernel exploitlari, PAC (Pointer Authentication Codes) va PPL (Protected Page Layer) bypasslarini haqiqiy iOS da, fizika qurilma yo'qotmasdan sinash.
• Kernel/driver dasturchilari: task_for_pid, kernel memory o'qish/yozish, KDK (Kernel Debug Kit) bilan integratsiya.
• Jailbreak ishlab chiquvchilari: Tweak, thema va kernel extension larni tezkor test qilish (clone, export/import, snapshot imkoniyatlari bilan).
• iOS ichki mexanizmlarini o'rganuvchilar: Boot chain, DFU restore, APFS seal-volume, dyld_shared_cache kabi tarkibiy qismlarni qulay muhitda kuzatish.

Cheklovlar va ochiq savollar

• Nested virtualizatsiya yo'q: Agar Mac o'zi VM da bo'lsa (masalan, UTM, Parallels, VMware ichida) — ishlamaydi. Juda aniq: "Virtualization is not available on this hardware".
• SIP/AMFI talabi: Hali ham macOS tizim xavfsizligini qisman yoqish kerak. Bu korporativ muhitlarda yoki oddiy foydalanuvchilar uchun to'sqinlik yaratadi.
• Grafik tezlashtirish: VNC (port 5901) orqali interfeys beriladi, lekin Metal/GPU virtualizatsiya hali cheklangan. O'yin va grafik og'ir ilovalar tezligi haqiqiy qurilmadan past.
• iOS versiyasi cheklovi: Faqat moslik jadvalidagi versiyalar. Yangi iOS beta chiqqanda IPSW larni qo'lda ko'rsatish kerak: --iphone-source va --cloudos-source.
• Qonuniy tomoni: Bu vosita xavfsizlik tadqiqoti uchun mo'ljallangan. Apple shartnomasi va DMCA 1201 bo'yicha jailbreak va firmware modifikatsiyasi ba'zi yurisdiktsiyalarda cheklangan bo'lishi mumkin.

Kelajak va rivojlanish yo'nalishi

Loyiha hali ham faol rivojlanmoqda. Asosiy yo'nalishlar: grafik virtualizatsiya (virtio-gpu / Apple Paravirtualized Graphics) qo'llab-quvvatlash, nested virtualizatsiya uchun PV=3 ni o'tkazish mexanizmlari, va CloudOS (watchOS/tvOS/HomePod OS) mehmonlari qo'shishi. vphone-amfidont vositasi ham SIP ni butunlay o'chirmasdan AMFI ni chetlab o'tishni soddalashtirib borayotgan.

Apple Silicon Mac egasi bo'lgan har bir iOS dasturchi va xavfsizlik mutaxassisi uchun vphone-cli — bu simulator emas, haqiqiy iOS yadrosi bilan ishlash imkoniyati. Agar sizda kerakli aparatura va SIP ni yumshtirishga tayyorlik bo'lsa, bu hozirgi kunda eng yaqin "Mac ichida iPhone" tajribasi.

Asl manba: github.com