vphone-cli brings virtualized iOS to Apple Silicon Macs

Developer Lakr233 has released vphone-cli, a tool that enables users to boot a virtual iPhone on Apple Silicon Macs. By leveraging Apple's Virtualization.framework and PCC research VM infrastructure, the project creates a complete VM pipeline for iOS, a feat previously restricted by Apple's tight hardware and software locks.

The tool automates a highly complex technical sequence, including the downloading of IPSW files, patching the boot chain, performing DFU restoration, and installing Custom Firmware (CFW). To function, vphone-cli requires a Mac with Apple Silicon running macOS 15 (Sequoia). Users must also relax System Integrity Protection (SIP) and Apple Mobile File Integrity (AMFI) to permit the use of private PV=3 entitlements.

The Technical Hurdle

While Apple's Virtualization.framework provides high-performance virtualization for macOS and Linux, iOS is not officially supported. Running the mobile OS on a Mac requires bypassing several significant security mitigations, including AMFI, Signed System Volume (SSV), and Img4. vphone-cli builds upon previous research, such as super-tart-vphone, to consolidate these requirements into a streamlined command-line interface.

Customization and Control

To cater to different user needs, the project supports five distinct firmware variants. These range from 'less,' which uses minimal patches, to 'regular' and 'dev' versions. For power users and researchers, the 'jb' variant provides a full jailbreak equipped with Sileo and TrollStore, while the 'exp' variant includes specific research patches designed to bypass anti-VM detection mechanisms used by some apps.

Connectivity is handled via standard protocols, with SSH available on port 22222 and VNC on port 5901. Additionally, the project includes a host control socket that allows for programmatic control of touch, swipes, and screenshots. According to the project documentation, this functionality can be further extended via an MCP server known as vphone-mcp.

Why It Matters

This development is significant for the security and development communities, as it allows for deep security research and app testing without the need for a vast array of physical hardware. The ability to run a virtualized iOS environment—particularly one with anti-VM detection bypasses—provides a sandbox for analyzing app behavior and vulnerabilities that would otherwise be difficult to trigger on physical devices.

What's Next

As the project evolves, the focus remains on refining the boot pipeline and expanding the capabilities of the custom firmware. While the tool is currently functional for those willing to modify their system security settings, the long-term viability of such tools depends on the stability of the underlying Virtualization.framework and Apple's ongoing updates to macOS Sequoia.