The open-Source project vphone-cli enables a full iOS 27 system to run as a virtual machine on Apple Silicon. Built on Apple's own Virtualization.framework rather than traditional emulation, the project opens up new possibilities for security research, reverse engineering, and automated iOS testing.

Building on previous work by wh1te4ever to run a virtual iPhone without using emulation, vphone-cli automates the entire process. This goes from downloading the firmware and patching the boot chain to performing a DFU restore and completing the first boot. The resulting virtual iPhone provides SSH access with root privileges, as well as VNC access to its graphical interface.

Apple has never officially provided an iOS VM for developers or security researchers. However, the technology it developed for Private Cloud Compute (PCC) to facilitate security research on the platform through a Virtual Research Environment, included an "iPhone Research Environment Virtual Machine". The vphone-cli project essentially brings those components together and streamlines the process of turning them into a working iPhone VM.

Xcode already includes an iPhone simulator which runs a subset of iOS userspace components adapted to run on macOS hardware. However, the simulator has several limitations, including restricted support for features such as camera access, Bluetooth, Metal, App Store app installation, and iCloud. It also uses a different SDK target from a physical iPhone, which can introduce subtle behavioral differences and means that testing in the Simulator does not always fully reflect how an app behaves on real hardware.

Discussing the project on Hacker News, user kridsdale1 provides a useful summary of the difference between the iOS simulator and vphone-cli:

The iOS simulator is and always has been, simply iOS frameworks running fully natively on macOS. It's best to think of it as an alternative window managers but the apps are native Mac processes. They can be seen and debugged via the terminal using top and ps and lldb alongside all other processes. They just present gui via the Simulator Mac app container.

In the same thread, user landr0id noted that vphone-cli is "useful for security research since you can do kernel debugging and inspection of the device not possible in the simulator". User afavour similarly highlighted the distinction between testing on the simulator and on real ahrdware, aptly summarizing it as: "the difference doesn't matter until it does, and then it's infuriating to work out what's going on".

On LinkedIn, senior iOS engineer Daniyar Kurmanbayev noted that "being able to boot real iOS firmware, SSH in, and reproduce the environment could make security and low-level debugging much more practical". On a similar note, Kareem Hesham added:

Utilizing the Virtualization.framework for a full iOS boot is a significant shift in accessibility for mobile security research. It bridges the gap between hardware-locked environments and scalable automation, though it also raises interesting questions about how much of the "walled garden" is maintained by policy rather than technical barriers.

As a final observation, Apple does not officially support using its iOS firmware in this manner, so it remains unclear whether future releases of the PCC Virtual Research Environment will continue to include the components required to run an iOS VM.