oosexgang/hackios-xnu-kernel

The problem

Running full iOS user space on non-Apple hardware has always been limited by Apple's closed drivers and boot chain. HackiOS takes Apple's open-source XNU (xnu-8796.121.2, the iOS 16.5 kernel) and rebuilds everything underneath it: an EFI loader, a UEFI port, driver replacements, and a Linux Wi-Fi driver on a compatibility layer. The result boots launchd through SpringBoard and stock apps on a POCO X5 Pro 5G or in QEMU — without modifying a single byte of the iOS programs.

What's different

The usual approach to iOS research is jailbreaking a real iPhone or emulating iOS in a container; both keep Apple's kernel and drivers. HackiOS inverts that: it uses the public kernel source and writes the missing platform layer itself, so the closed pieces are replaced rather than patched. Two capabilities stand out: it runs entirely in RAM via fastboot boot with nothing flashed, and the same image runs in QEMU on any Linux machine, so the barrier to trying it is a download, not a device.

Who it's for

Aimed at kernel, firmware and reverse-engineering researchers who want a reproducible XNU-on-ARM bench and are comfortable with device trees, UEFI and driver bring-up. It is also useful for people studying how much of iOS is kernel-versus-userland. Not for anyone wanting a daily-driver iOS-on-Android setup: cellular, Bluetooth and charging do not work, App Store and Apple ID are blocked by the missing Secure Enclave, and sessions end by design.

Cost of adoption

QEMU needs Linux x86-64, roughly 12 GB of disk and 4 GB of RAM, and a 7.4 GB IPSW download from Apple's CDN that the scripts fetch to your machine. Phone use requires a POCO X5 Pro 5G with an unlocked bootloader plus firmware pulled from that same phone's Android vendor partition. Building XNU from source needs theos with the iOS 16.5 SDK plus clang, lld and perl; prebuilt binaries cover the QEMU path. The license is NOASSERTION and the README carries an explicit non-affiliation disclaimer, so legal review is on you.

Verdict

This is a two-day-old repository, so there is no track record to lean on; the 1,270 stars and a 528-point Hacker News thread reflect a single launch spike, not sustained momentum. The engineering described is substantial and unusually transparent about what does not work, which is a good sign. Treat it as an experimental research artifact that may be abandoned or reworked, not infrastructure. Worth a clone for kernel and firmware researchers; everyone else should wait for a second release before investing time.