dipa-studio/ios-sweet

A research bring-up, not a daily driver: this is for people interested in ARM platform porting and running Apple's userland on non-Apple hardware. It boots an iPhone X iOS 16.7.16 userland on a Snapdragon 732G phone, but several core subsystems are stubbed and installing it wipes the phone's user data.

The problem

Getting an Apple userland onto a non-Apple phone normally requires a working kernel underneath: CPU bring-up, interrupts, timers, storage and a boot chain that the device's bootloader will accept. Hobbyists who want to experiment with this must otherwise assemble a kernel patch set, a device tree, a storage driver and an iOS root image themselves. This project packages that path for one specific device: a shim loaded via fastboot boot hands control to a patched XNU, which mounts an HFS+ iOS root from userdata and starts launchd, daemons and SpringBoard. The result is a phone that reaches the home screen instead of a setup that stops at an early console.

What's different

The unusual part is how much of the stack is replaced or generated rather than written from scratch. The stock Xiaomi bootloader is left intact; a small shim reads the live device tree, loads a Mach-O kernel plus a generated Apple Device Tree, and boots XNU with a long list of boot arguments. The kernel uses a custom UFS host driver and mounts the iOS root from the userdata partition. On top, it runs an unmodified iPhone X 16.7.16 root filesystem and shared cache, so launchd, backboardd and SpringBoard are the real Apple binaries.

The practical benefit is that you can observe real iOS system software starting on a Qualcomm board and get crash logs with backtraces symbolicated against the shared cache. The trade-off is that most of the interesting work happens in the boot arguments and patch series: rendering is entirely CPU-side at roughly 20–30 fps, only six of eight cores are brought up, and daemons for Wi-Fi, Bluetooth, cellular, audio, camera, sensors, GPS and Face ID fail or relaunch. The README states that Apple's security model is mostly switched off. For kernel iteration without a phone, tools/qemu-sweet.py boots the same kernel under QEMU with a test RAM-disk root.

Who should try it

A good fit is someone with a spare sweet device who is curious about XNU and ARM bring-up and is content with a phone that can unlock, show Settings and open Control Center but not leave an app. The log-pull and symbolication scripts are the most useful payoff here. A poor fit is anyone who wants a usable second phone or an app platform: there is no App Store, no Apple ID, no GPU driver, and the home gesture does not work. The QEMU path helps people who want to touch kernel code without a device, but the home-screen result described here depends on the phone.

Requirements and limitations

The documented path needs a Redmi Note 10 Pro in the global or Indian variant (SM7150), an unlocked bootloader, and a Linux PC; see the project instructions. The kernel builds on GitHub's macOS runners via a forked workflow with blacktop/darwin-xnu-build, and the root image is assembled from Apple's iPhone X IPSW with apfs-fuse, hfsprogs and sudo. Installing the root erases all userdata content; the README tells you to back up persist, modemst1, modemst2, fsg, fsc, boot, dtbo and vbmeta first because they hold per-device calibration data. First boot takes about 4–5 minutes at the Apple logo, and flashing the root image takes about 7 minutes. Other variants or firmware may need changes.

HotRepo's take

HotRepo's only observation is a NEW-REPOSITORY board (新项目榜) entry for Python at #24, with 1,027 total stars on 2026-10-25; that is a single snapshot, not a daily growth series. The project was created on 2026-10-14, and the README's own status line is dated 2026-10-18. With no comparable daily-board history, persistence cannot yet be judged. Before investing a spare phone, verify that your exact sweet variant and firmware are covered by the documented build path.