Virtual iOS 26 Now Running on Apple Silicon Macs
A new method allows a fully working virtual version of iOS 26 to run on Apple Silicon hardware through PCC firmware. This breakthrough provides security researchers and developers an alternative to services like Corellium for deep hardware and software analysis. A public setup guide has been released, enabling broader access to iOS virtualization for testing and optimization.
- The primary commercial service for iOS virtualization, Corellium, was notably acquired by the digital forensics firm Cellebrite in late 2025. This followed a lengthy copyright lawsuit filed by Apple in 2019, which ultimately ended in a settlement after courts ruled Corellium's work constituted "fair use" for security research. - This virtualization method leverages Apple's native Virtualization framework, a high-level API introduced with Apple Silicon to facilitate the creation of virtual machines for macOS and Linux. The framework utilizes hardware features in Apple's M-series chips, eliminating the need for third-party kernel extensions. - The breakthrough appears to be linked to components Apple itself added to its Private Cloud Compute (PCC) firmware. Starting with cloudOS 26, firmware analysis revealed "vphone600ap" components, suggesting an internal "iPhone Research Environment Virtual Machine" may have been in development. - The public guide utilizes a modified version of an open-source virtual machine called "super-tart". This enhanced tool provides low-level control necessary for security research, including features like a custom bootrom, DFU mode, and GDB debugging capabilities. - Unlike simulators, which only mimic the iOS software environment, this method achieves full hardware virtualization. This allows security teams to run the actual iOS kernel code on virtualized ARM processors, granting the deep access required for comprehensive vulnerability and malware analysis. - The project's source code indicates it uses private methods within Apple's own Virtualization.framework and explicitly sets the virtual machine's resolution to 1290x2796, a specification corresponding to the iPhone 14 Pro Max and subsequent Pro models. - Corellium's virtualization platform, against which this new free method competes, is used by government agencies and enterprise clients for mobile app penetration testing, malware analysis, and digital forensics. Before its acquisition, Apple had reportedly attempted to purchase Corellium for approximately $23 million in 2018.
