IOS Emulation - Revision history

Onny: /* Starting restore */ Add steps for companion VM

2025-08-23T17:24:06Z

Starting restore: Add steps for companion VM

@@ Line 38: / Line 38: @@
 ==== Starting restore ====
-Prepare and run the companion VM, required for the restore process
+Prepare and run the companion VM, required for the restore process. Create the file <code>configuration.nix</code><syntaxhighlight lang="nix">
-To be done, preparing the companion VM, see [https://github.com/ChefKissInc/QEMUAppleSilicon/wiki/Companion-VM-Setup upstream documentation].<syntaxhighlight lang="bash">
-qemu-system-x86_64 -m 2024 -nic user -hda alpine.qcow2 -nographic -usb -device usb-ehci,id=ehci -device usb-tcp-remote,conn-type=ipv4,conn-addr=127.0.0.1,conn-port=8030,bus=ehci.0 -nic user,model=virtio-net-pci,hostfwd=tcp::32222-:22
+  imports = [ <nixpkgs/nixos/modules/virtualisation/qemu-vm.nix> ];
 </syntaxhighlight>
-The companion VM must always be started before the emulated iPhone otherwise no USB connection is established.
+Some parts in this documentation is missing, so please consult [https://github.com/ChefKissInc/QEMUAppleSilicon/wiki/Running-&-Restoring upstream documentation].The companion VM must always be started before the emulated iPhone otherwise no USB connection is established.
 Now run the iOS emulator on your host<syntaxhighlight lang="bash">

Onny: Add page description and meta

2025-08-23T17:10:16Z

Add page description and meta

← Older revision		Revision as of 17:10, 23 August 2025
Line 1:		Line 1:
			Following guide describes how to setup iOS emulation using the project [https://github.com/ChefKissInc/QEMUAppleSilicon QEMU-AppleSilicon]. Currently emulation iPhone 11 with iOS 14.0 beta 5 is supported.

	== Setup ==		== Setup ==
	{{Security Warning\|Do not share any IVs, keys or files, such as pre-made modified or unmodified images or decrypted, patched, modified or unmodified firmware, etc. That all surely violates Apple's EULA. EULA violations or any of the aforementioned actions may be a crime in your jurisdiction.}}{{Warning\|Most parts of this guide are not yet supported by the latest stable NixOS release. It should be available with the next 25.11 release.}}		{{Security Warning\|Do not share any IVs, keys or files, such as pre-made modified or unmodified images or decrypted, patched, modified or unmodified firmware, etc. That all surely violates Apple's EULA. EULA violations or any of the aforementioned actions may be a crime in your jurisdiction.}}{{Warning\|Most parts of this guide are not yet supported by the latest stable NixOS release. It should be available with the next 25.11 release.}}
Line 84:		Line 86:
	-display gtk,zoom-to-fit=on,show-cursor=on		-display gtk,zoom-to-fit=on,show-cursor=on
	</syntaxhighlight>		</syntaxhighlight>

			[[Category:Virtualization]]

Onny: /* Starting restore */

2025-08-23T17:05:38Z

Starting restore

← Older revision		Revision as of 17:05, 23 August 2025
Line 36:		Line 36:

	==== Starting restore ====		==== Starting restore ====
	Prepare and run the companion VM, required for the restore process<syntaxhighlight lang="bash">		Prepare and run the companion VM, required for the restore process

			To be done, preparing the companion VM, see [https://github.com/ChefKissInc/QEMUAppleSilicon/wiki/Companion-VM-Setup upstream documentation].<syntaxhighlight lang="bash">
	qemu-system-x86_64 -m 2024 -nic user -hda alpine.qcow2 -nographic -usb -device usb-ehci,id=ehci -device usb-tcp-remote,conn-type=ipv4,conn-addr=127.0.0.1,conn-port=8030,bus=ehci.0 -nic user,model=virtio-net-pci,hostfwd=tcp::32222-:22		qemu-system-x86_64 -m 2024 -nic user -hda alpine.qcow2 -nographic -usb -device usb-ehci,id=ehci -device usb-tcp-remote,conn-type=ipv4,conn-addr=127.0.0.1,conn-port=8030,bus=ehci.0 -nic user,model=virtio-net-pci,hostfwd=tcp::32222-:22
	</syntaxhighlight>		</syntaxhighlight>

Onny: /* Starting restore */ Add further steps

2025-08-23T17:03:55Z

Starting restore: Add further steps

← Older revision		Revision as of 17:03, 23 August 2025
Line 36:		Line 36:

	==== Starting restore ====		==== Starting restore ====
	~~Before iOS can be used~~, ~~it has to be~~ "~~installed~~" ~~via restore process~~. ~~First~~, run the iOS emulator on your host.<syntaxhighlight lang="bash">		Prepare and run the companion VM, required for the restore process<syntaxhighlight lang="bash">
			qemu-system-x86_64 -m 2024 -nic user -hda alpine.qcow2 -nographic -usb -device usb-ehci,id=ehci -device usb-tcp-remote,conn-type=ipv4,conn-addr=127.0.0.1,conn-port=8030,bus=ehci.0 -nic user,model=virtio-net-pci,hostfwd=tcp::32222-:22
			</syntaxhighlight>
			The companion VM must always be started before the emulated iPhone otherwise no USB connection is established.

			Now run the iOS emulator on your host<syntaxhighlight lang="bash">
	qemu-system-aarch64 -M t8030,trustcache=iPhone11_8_iPhone12_1_14.0_18A5351d_Restore/Firmware/038-44135-124.dmg.trustcache,ticket=root_ticket.der,sep-fw=sep-firmware.n104.RELEASE.new.img4,sep-rom=AppleSEPROM-Cebu-B1,kaslr-off=true \		qemu-system-aarch64 -M t8030,trustcache=iPhone11_8_iPhone12_1_14.0_18A5351d_Restore/Firmware/038-44135-124.dmg.trustcache,ticket=root_ticket.der,sep-fw=sep-firmware.n104.RELEASE.new.img4,sep-rom=AppleSEPROM-Cebu-B1,kaslr-off=true \
	-kernel iPhone11_8_iPhone12_1_14.0_18A5351d_Restore/kernelcache.research.iphone12b -dtb iPhone11_8_iPhone12_1_14.0_18A5351d_Restore/Firmware/all_flash/DeviceTree.n104ap.im4p \		-kernel iPhone11_8_iPhone12_1_14.0_18A5351d_Restore/kernelcache.research.iphone12b -dtb iPhone11_8_iPhone12_1_14.0_18A5351d_Restore/Firmware/all_flash/DeviceTree.n104ap.im4p \
Line 51:		Line 56:
	-drive file=panic_log,format=raw,if=none,id=panic_log -device nvme-ns,drive=panic_log,bus=nvme-bus.0,nsid=7,nstype=8,logical_block_size=4096,physical_block_size=4096 \		-drive file=panic_log,format=raw,if=none,id=panic_log -device nvme-ns,drive=panic_log,bus=nvme-bus.0,nsid=7,nstype=8,logical_block_size=4096,physical_block_size=4096 \
	-initrd iPhone11_8_iPhone12_1_14.0_18A5351d_Restore/038-44135-124.dmg \		-initrd iPhone11_8_iPhone12_1_14.0_18A5351d_Restore/038-44135-124.dmg \
			-M t8030,usb-conn-type=ipv4,usb-conn-addr=127.0.0.1,usb-conn-port=8030 \
	-display gtk,zoom-to-fit=on,show-cursor=on		-display gtk,zoom-to-fit=on,show-cursor=on
	</syntaxhighlight>On the companion VM, start recovery with following command as soon the iOS device is ready to receive images<syntaxhighlight lang="bash">		</syntaxhighlight>On the companion VM, start recovery with following command as soon the iOS device is ready to receive images<syntaxhighlight lang="bash">

Onny: Add further steps

2025-08-23T16:57:10Z

Add further steps

@@ Line 55: / Line 55: @@
 idevicerestore --erase --restore-mode -i 0x1122334455667788 iPhone11,8,iPhone12,1_14.0_18A5351d_Restore.ipsw -T root_ticket.der
 </syntaxhighlight>To complete data migration, the iOS VM must currently be closed after first stage restore is complete, and have filesystem patches applied. You must close it in time to ensure data migration will be able to finish properly with the workarounds applied. You will know that restore has been completed from idevicerestore finishing and the screen of the iOS VM going blank.
 == Usage ==

Onny: Added further steps

2025-08-23T16:48:09Z

Added further steps

@@ Line 1: / Line 1: @@
 == Setup ==
-{{Security Warning|Do not share any files, such as pre-made modified or unmodified images or decrypted, patched, modified or unmodified firmware, etc.
+{{Security Warning|Do not share any IVs, keys or files, such as pre-made modified or unmodified images or decrypted, patched, modified or unmodified firmware, etc. That all surely violates Apple's EULA. EULA violations or any of the aforementioned actions may be a crime in your jurisdiction.}}{{Warning|Most parts of this guide are not yet supported by the latest stable NixOS release. It should be available with the next 25.11 release.}}
 Add <code>qemu-applesilicon</code> package to your <code>environment.systemPackages</code> set and apply it.<syntaxhighlight lang="nix">
 environment.systemPackages = with pkgs; [
@@ Line 12: / Line 6: @@
    qemu-applesilicon
 ];
-</syntaxhighlight>Run following command to create required disks<syntaxhighlight lang="bash">
+</syntaxhighlight>
 qemu-img create -f raw root 16G
 qemu-img create -f raw firmware 8M
@@ Line 22: / Line 19: @@
 qemu-img create -f raw sep_nvram 2K
 qemu-img create -f raw sep_ssc 128K
-</syntaxhighlight>Download iOS 14.0 beta 5 ipsw firmware file for <code>iPhone12,1</code> and extract required files<syntaxhighlight lang="bash">
+</syntaxhighlight>
 wget https://updates.cdn-apple.com/2020SummerSeed/fullrestores/001-35886/5FE9BE2E-17F8-41C8-96BB-B76E2B225888/iPhone11,8,iPhone12,1_14.0_18A5351d_Restore.ipsw
 mkdir iPhone11_8_iPhone12_1_14.0_18A5351d_Restore
@@ Line 34: / Line 34: @@
 img4 -A -F -o sep-firmware.n104.RELEASE.new.img4 -i sep-firmware.n104.RELEASE -M sep_root_ticket.der -T rsep -V ff86cbb5e06c820266308202621604696d706c31820258ff87a3e8e0730e300c1604747a3073020407d98000ff868bc9da730e300c160461726d73020400d20000ff87a389da7382010e3082010a160474626d730482010039643535663434646630353239653731343134656461653733396135313135323233363864626361653434386632333132313634356261323237326537366136633434643037386439313434626564383530616136353131343863663363356365343365656536653566326364636666336664313532316232623062376464353461303436633165366432643436623534323537666531623633326661653738313933326562383838366339313537623963613863366331653137373730336531373735616663613265313637626365353435626635346366653432356432653134653734336232303661386337373234386661323534663439643532636435ff87a389da7282010e3082010a160474626d720482010064643434643762663039626238333965353763383037303431326562353636343131643837386536383635343337613861303266363464383431346664343764383634336530313335633135396531393062656535643435333133363838653063323535373435333533326563303163363530386265383236333738353065623761333036343162353464313236306663313434306562663862343063306632646262616437343964643461656339376534656238646532346330663265613432346161613438366664663631363961613865616331313865383839383566343138643263366437363364303434363063393531386164353766316235636664
 </syntaxhighlight>You can find the keys by googling "iOS firmware keys".
 == Usage ==

Onny: Add further steps

2025-08-23T16:36:49Z

Add further steps

← Older revision		Revision as of 16:36, 23 August 2025
Line 1:		Line 1:
	== Setup ==		== Setup ==
	{{Warning\|Most parts of this guide are not yet supported by the latest stable NixOS release. It should be available with the next 25.11 release.}}		{{Security Warning\|Do not share any files, such as pre-made modified or unmodified images or decrypted, patched, modified or unmodified firmware, etc.

			Do not share any IVs or keys.

			Do not automate the download, setup, patching, or anything related or similar of images, firmware, and any other files.

			That all surely violates Apple's EULA. EULA violations or any of the aforementioned actions may be a crime in your jurisdiction.}}{{Warning\|Most parts of this guide are not yet supported by the latest stable NixOS release. It should be available with the next 25.11 release.}}
	Add <code>qemu-applesilicon</code> package to your <code>environment.systemPackages</code> set and apply it.<syntaxhighlight lang="nix">		Add <code>qemu-applesilicon</code> package to your <code>environment.systemPackages</code> set and apply it.<syntaxhighlight lang="nix">
	environment.systemPackages = [ ~~pkgs.~~qemu-applesilicon ];		environment.systemPackages = with pkgs; [
			img4
			qemu-applesilicon
			];
	</syntaxhighlight>Run following command to create required disks<syntaxhighlight lang="bash">		</syntaxhighlight>Run following command to create required disks<syntaxhighlight lang="bash">
	qemu-img create -f raw root 16G		qemu-img create -f raw root 16G
Line 20:		Line 29:
	wget https://github.com/ChefKissInc/QEMUAppleSiliconTools/raw/refs/heads/master/ticket.shsh2		wget https://github.com/ChefKissInc/QEMUAppleSiliconTools/raw/refs/heads/master/ticket.shsh2
	create_apticket n104ap iPhone11_8_iPhone12_1_14.0_18A5351d_Restore/BuildManifest.plist ticket.shsh2 root_ticket.der		create_apticket n104ap iPhone11_8_iPhone12_1_14.0_18A5351d_Restore/BuildManifest.plist ticket.shsh2 root_ticket.der
	</syntaxhighlight>		</syntaxhighlight>For preparing the SEP firmware, run following commands<syntaxhighlight lang="bash">
			create_septicket n104ap iPhone11_8_iPhone12_1_14.0_18A5351d_Restore/BuildManifest.plist ticket.shsh2 sep_root_ticket.der
			img4 -i iPhone11_8_iPhone12_1_14.0_18A5351d_Restore/Firmware/all_flash/sep-firmware.n104.RELEASE.im4p -o sep-firmware.n104.RELEASE -k THE_SEP_FW_IV_AND_THE_SEP_FW_KEY_CONCATENATED
			img4 -A -F -o sep-firmware.n104.RELEASE.new.img4 -i sep-firmware.n104.RELEASE -M sep_root_ticket.der -T rsep -V ff86cbb5e06c820266308202621604696d706c31820258ff87a3e8e0730e300c1604747a3073020407d98000ff868bc9da730e300c160461726d73020400d20000ff87a389da7382010e3082010a160474626d730482010039643535663434646630353239653731343134656461653733396135313135323233363864626361653434386632333132313634356261323237326537366136633434643037386439313434626564383530616136353131343863663363356365343365656536653566326364636666336664313532316232623062376464353461303436633165366432643436623534323537666531623633326661653738313933326562383838366339313537623963613863366331653137373730336531373735616663613265313637626365353435626635346366653432356432653134653734336232303661386337373234386661323534663439643532636435ff87a389da7282010e3082010a160474626d720482010064643434643762663039626238333965353763383037303431326562353636343131643837386536383635343337613861303266363464383431346664343764383634336530313335633135396531393062656535643435333133363838653063323535373435333533326563303163363530386265383236333738353065623761333036343162353464313236306663313434306562663862343063306632646262616437343964643461656339376534656238646532346330663265613432346161613438366664663631363961613865616331313865383839383566343138643263366437363364303434363063393531386164353766316235636664
			</syntaxhighlight>You can find the keys by googling "iOS firmware keys".

	== Usage ==		== Usage ==

Onny: Added further steps

2025-08-23T16:32:44Z

Added further steps

← Older revision		Revision as of 16:32, 23 August 2025
Line 17:		Line 17:
	mkdir iPhone11_8_iPhone12_1_14.0_18A5351d_Restore		mkdir iPhone11_8_iPhone12_1_14.0_18A5351d_Restore
	unzip iPhone11,8,iPhone12,1_14.0_18A5351d_Restore.ipsw -d iPhone11_8_iPhone12_1_14.0_18A5351d_Restore/		unzip iPhone11,8,iPhone12,1_14.0_18A5351d_Restore.ipsw -d iPhone11_8_iPhone12_1_14.0_18A5351d_Restore/
			</syntaxhighlight>Forge a ticket since the iOS version we're using is not signed<syntaxhighlight lang="bash">
			wget https://github.com/ChefKissInc/QEMUAppleSiliconTools/raw/refs/heads/master/ticket.shsh2
			create_apticket n104ap iPhone11_8_iPhone12_1_14.0_18A5351d_Restore/BuildManifest.plist ticket.shsh2 root_ticket.der
	</syntaxhighlight>		</syntaxhighlight>

	== Usage ==		== Usage ==

Onny: Initial page

2025-08-23T16:28:53Z

Initial page

New page

== Setup ==
{{Warning|Most parts of this guide are not yet supported by the latest stable NixOS release. It should be available with the next 25.11 release.}}
Add <code>qemu-applesilicon</code> package to your <code>environment.systemPackages</code> set and apply it.<syntaxhighlight lang="nix">
environment.systemPackages = [ pkgs.qemu-applesilicon ];
</syntaxhighlight>Run following command to create required disks<syntaxhighlight lang="bash">
qemu-img create -f raw root 16G
qemu-img create -f raw firmware 8M
qemu-img create -f raw syscfg 128K
qemu-img create -f raw ctrl_bits 8K
qemu-img create -f raw nvram 8K
qemu-img create -f raw effaceable 4K
qemu-img create -f raw panic_log 1M
qemu-img create -f raw sep_nvram 2K
qemu-img create -f raw sep_ssc 128K
</syntaxhighlight>Download iOS 14.0 beta 5 ipsw firmware file for <code>iPhone12,1</code> and extract required files<syntaxhighlight lang="bash">
wget https://updates.cdn-apple.com/2020SummerSeed/fullrestores/001-35886/5FE9BE2E-17F8-41C8-96BB-B76E2B225888/iPhone11,8,iPhone12,1_14.0_18A5351d_Restore.ipsw
mkdir iPhone11_8_iPhone12_1_14.0_18A5351d_Restore
unzip iPhone11,8,iPhone12,1_14.0_18A5351d_Restore.ipsw -d iPhone11_8_iPhone12_1_14.0_18A5351d_Restore/
</syntaxhighlight>

== Usage ==