DOCSEARCHbyAlgolia
Submit Docs

super-tart vphone writeup

repository·main·Indexed 22 days ago

https://github.com/wh1te4ever/super-tart-vphone-writeup

A writeup and implementation guide for building a virtual iPhone environment using super-tart, Apple's Private Cloud Compute (PCC) firmware, and the VPHONE600AP component. It covers modifying VM.swift for hardware descriptors, building custom firmware by mixing cloudOS and iOS components, generating IMG4 files, and configuring virtual display and input for iPhone 14 Pro Max/15/16 series.

Tokens
10.3K
Snippets
24
Records
38
Agent score
28%

What's inside super-tart-vphone-writeup

  1. Automate services (bash, dropbear, trollvnc) on boot

    main

    To ensure services like bash, dropbear, and trollvnc start automatically, you must:

    1. Copy their respective .plist files to /System/Library/LaunchDaemons on the device.
    2. Inject these services into the main /System/Library/xpc/launchd.plist file.
    3. Patch launchd_cache_loader to allow loading the modified launchd.plist by setting launchd_unsecure_cache=1 (patching offset 0xB58 with 0xd503201f).
    # Patching launchd_cache_loader
fp = open("custom_26.1/launchd_cache_loader", "r+b")
patch(0xB58, 0xd503201f)
fp.close()

# Injecting into launchd.plist using plistlib
target_data.setdefault('LaunchDaemons', {})['/System/Library/LaunchDaemons/bash.plist'] = source_data

  2. Modify the APFS root filesystem snapshot

    main

    To modify the root filesystem, you must mount the APFS partition and switch to the original filesystem snapshot using snaputil.

    1. Mount the partition: mount_apfs -o rw /dev/disk1s1 /mnt1.
    2. List snapshots: snaputil -l /mnt1.
    3. Switch to the target snapshot: snaputil -n <com.apple.os.update-hash> orig-fs /mnt1.
    4. Unmount: umount /mnt1.
    # Mount APFS
mount_apfs -o rw /dev/disk1s1 /mnt1

# List snapshots to find the hash
snaputil -l /mnt1

# Switch to the original filesystem snapshot
snaputil -n <com.apple.os.update-hash> orig-fs /mnt1

umount /mnt1

  3. Create a custom firmware by mixing cloudOS and iOS components

    main

    To build a custom firmware for a virtual iPhone, you must mix components from cloudOS 26.1 (23B85) and iOS 26.1 (iPhone17,3; 23B85).

    Key modification requirements:

    • BuildManifest.plist: Modify the Manifest dictionary elements so that during restoration, the following keys use the iPhone 16 (iOS 26.1) model: SystemVolume, SystemVolumeCanonicalMetadata, OS, StaticTrustCache, RestoreTrustCache, and RestoreRamDisk. Other elements should point to the PCC firmware's vphone-related files.
    • Restore.plist: Add or modify DeviceMap properties and SupportedProductTypes, and update the SystemRestoreImageFileSystems element.
    # Example of importing components into a restore directory
# kernelcache
cp 399b664dd623358c3de118ffc114e42dcd51c9309e751d43bc949b98f4e31349_extracted/kernelcache.* iPhone17,3_26.1_23B85_Restore

# Firmware components (agx, all_flash, ane, dfu, pmp...)
cp 399b664dd623358c3de118ffc114e42dcd51c9309e751d43bc949b98f4e31349_extracted/Firmware/agx/* iPhone17,3_26.1_23B85_Restore/Firmware/agx
# ... (repeat for other firmware directories)

# Import modified plist files
sudo cp custom_26.1/BuildManifest.plist iPhone17,3_26.1_23B85_Restore
sudo cp custom_26.1/Restore.plist iPhone17,3_26.1_23B85_Restore

  4. Boot components using irecovery

    main

    Once the IMG4 files (iBSS, iBEC, SPTM, TXM, trustcache, ramdisk, DeviceTree, SEP, and kernelcache) are generated and placed in a Ramdisk/ directory, use the following sequence with irecovery to boot the virtual iPhone.

    Note: The order of commands and the specific -c (command) flags are critical for the boot process.

    #!/bin/zsh
irecovery -f Ramdisk/iBSS.vresearch101.RELEASE.img4
irecovery -f Ramdisk/iBEC.vresearch101.RELEASE.img4
irecovery -c go

sleep 1;
irecovery -f Ramdisk/sptm.vresearch1.release.img4
irecovery -c firmware

irecovery -f Ramdisk/txm.img4
irecovery -c firmware

irecovery -f Ramdisk/trustcache.img4
irecovery -c firmware
irecovery -f Ramdisk/ramdisk.img4
irecovery -c ramdisk
irecovery -f Ramdisk/DeviceTree.vphone600ap.img4
irecovery -c devicetree
irecovery -f Ramdisk/sep-firmware.vresearch101.RELEASE.img4
irecovery -c firmware
irecovery -f Ramdisk/krnl.img4
irecovery -c bootx

  6. Patch AVPBooter.vresearch1.bin to allow custom bootloaders

    main

    To load a custom bootloader, you must patch image4_validate_property_callback in AVPBooter.vresearch1.bin.

    Steps:

    1. Open the file in IDA Pro.
    2. Use the Text-search feature to find the string 0x4447 (Note: this is a slow search).
    3. Locate the epilogue of the image4_validate_property_callback function.
    4. Patch the function to always return 0.

  7. Implement Metal support in the virtual iPhone

    main

    If the virtual iPhone boots to a black setup screen or fails to progress, it may be due to missing Metal support. Even if ioreg -l shows AppleParavirtGPU is recognized by the kernel, MTLCreateSystemDefaultDevice() may return null if the necessary user-space libraries are missing.

    To resolve this, you must provide the GPU/Metal related libraries used by the PCC (Private Cloud Compute) virtual machine.

    1. Locate /System/Library/Extensions/AppleParavirtGPUMetalIOGPUFamily.bundle within the PCC environment.
    2. Copy this bundle to the virtual iPhone's /System/Library/Extensions/ directory (using SSH Ramdisk).
    3. Note: You may need to reverse engineer and implement missing .dylib files if they do not exist in the target device's DSC (Data Store Container). Specifically, check for: /System/Library/Extensions/AppleParavirtGPUMetalIOGPUFamily.bundle/libAppleParavirtCompilerPluginIOGPUFamily.dylib.
    import <stdio.h>
import <Metal/Metal.h>
import <Foundation/Foundation.h>

int main(int argc, char *argv[], char *envp[]) {
    id<MTLDevice> device = MTLCreateSystemDefaultDevice();
    NSLog(@"device: %@", device);

    if (device) {
        NSLog(@"Metal Device Create Success: %@", [device name]);
    } else {
        NSLog(@"Metal Not Supported!");
    }

    return 0;
}

  8. Install Cryptexes (SystemOS and AppOS)

    main

    Cryptexes are installed by decrypting the AEA files, mounting the resulting DMG files, and copying the contents to the virtual machine's /System/Cryptexes/ directories via SCP.

    Steps:

    1. Decrypt SystemOS AEA using ipsw to get the key, then use aea decrypt.
    2. Mount both CryptexSystemOS.dmg and CryptexAppOS.dmg.
    3. Prepare the target directories on the device: /mnt1/System/Cryptexes/App and /mnt1/System/Cryptexes/OS.
    4. Copy files using scp with sshpass.
    5. Create symbolic links in /mnt1/System/Library/Caches/com.apple.dyld and /mnt1/System/DriverKit/System/Library/dyld pointing to the new Cryptex locations.
    # 1. Decrypt SystemOS
key=$(ipsw fw aea --key iPhone17,3_26.1_23B85_Restore/043-54303-126.dmg.aea)
aea decrypt -i iPhone17,3_26.1_23B85_Restore/043-54303-126.dmg.aea -o CryptexSystemOS.dmg -key-value "$key"

# 2. Copy to device (example for OS)
sshpass -p 'alpine' scp -r -o StrictHostKeyChecking=no -P 2222 CryptexSystemOS/. root@127.0.0.1:/mnt1/System/Cryptexes/OS

# 3. Link dyld (example)
ln -sf ../../../System/Cryptexes/OS/System/Library/Caches/com.apple.dyld /mnt1/System/Library/Caches/com.apple.dyld

  9. Restore the firmware

    main

    Once the environment is prepared, attempt to restore the virtual machine by putting it into DFU mode.

    Note on SEP Configuration: If the SEP (Secure Enclave Processor) is not configured correctly, the system will encounter a panic. Ensure SEP settings are properly applied before proceeding to avoid boot failures.

    After the restoration process completes, the system will automatically reboot.

  10. Access the virtual iPhone shell via SSH

    main

    After a successful boot, if the System Information app shows "iPhone Research ..." in the USB menu, you can access the shell using iproxy to tunnel the connection.

    1. Run iproxy 2222 22 & to map the device's port 22 to local port 2222.
    2. Connect via SSH: ssh root@127.0.0.1 -p 2222 (Password: alpine).
    # Tunnel port 22 to 2222
iproxy 2222 22 &

# Connect via SSH
ssh root@127.0.0.1 -p 2222

  11. Modify super-tart to boot a virtual iPhone

    main

    To boot a virtual iPhone using super-tart, you must modify the VM.swift file to use specific hardware descriptors, bootloaders, and SEP configurations derived from the vrevm binary (part of Apple's security-pcc).

    Key modifications include:

    • Hardware Model: Use a custom vzHardwareModel_VRESEARCH101 function that sets PlatformVersion to 3 (.appleInternal4), BoardID to 0x90, and ISA to 2.
    • Bootloader: Use AVPBooter.vresearch1.bin as the ROM URL.
    • SEP Configuration: Use AVPSEPBooter.vresearch1.bin and provide a SEPStorage file.
    • Machine Identifier: Set a specific serial number (e.g., AAAAAA1337) and ECID.
    • Display: Configure the resolution to match iPhone 14 Pro Max/15/16 series (e.g., 1179x2556 at 460 PPI).
    • Input: Enable multi-touch devices using _VZUSBTouchScreenConfiguration.
    // Example hardware model configuration for vresearch101
static private func vzHardwareModel_VRESEARCH101() throws -> VZMacHardwareModel {
  var hw_model: VZMacHardwareModel
  guard let hw_descriptor = _VZMacHardwareModelDescriptor() else { 
    fatalError("Failed to create hardware descriptor") 
  }
  hw_descriptor.setPlatformVersion(3) // .appleInternal4 = 3
  hw_descriptor.setBoardID(0x90)
  hw_descriptor.setISA(2)
  hw_model = VZMacHardwareModel._hardwareModel(withDescriptor: hw_descriptor)
  return hw_model
}

  12. Install Cryptex (SystemOS and AppOS) to the device

    main

    Cryptex files are decrypted and transferred to the virtual device to provide necessary system and app components.

    1. Decrypt the SystemOS AEA using ipsw to get the key.
    2. Decrypt the AEA file using aea tool.
    3. Mount both CryptexSystemOS.dmg and CryptexAppOS.dmg locally.
    4. Prepare the remote device by removing existing Cryptex directories in /mnt1/System/Cryptexes/.
    5. Transfer files via scp using sshpass.
    6. Create symbolic links in /mnt1/System/Library/Caches/com.apple.dyld and /mnt1/System/DriverKit/System/Library/dyld pointing to the new Cryptex locations.
    # 1. Get decryption key
key=$(ipsw fw aea --key iPhone17,3_26.1_23B85_Restore/043-54303-126.dmg.aea)

# 2. Decrypt SystemOS
aea decrypt -i iPhone17,3_26.1_23B85_Restore/043-54303-126.dmg.aea -o CryptexSystemOS.dmg -key-value '$key'

# 3. Transfer to device (example for SystemOS)
sshpass -p 'alpine' scp -r CryptexSystemOS/. root@127.0.0.1:/mnt1/System/Cryptexes/OS

# 4. Create symlinks on device
remote_cmd("ln -sf ../../../System/Cryptexes/OS/System/Library/Caches/com.apple.dyld /mnt1/System/Library/Caches/com.apple.dyld")