HackiOS runs unmodified iOS 16.5 on Android hardware using Apple's open XNU kernel

What HackiOS does

A project called HackiOS, published on GitHub by a group named OOSEX GANG and highlighted on Hacker News on October 22, boots Apple's open-source XNU kernel on Android phone hardware and runs the unmodified iOS 16.5 user space on top of it. According to the project's README, the full iOS startup chain comes up — launchd, backboardd, SpringBoard and the stock apps — on a POCO X5 Pro 5G (codename redwood, Snapdragon 778G).

Nothing is written to the phone's storage: a UEFI environment is started through fastboot boot, the whole system lives in RAM, and rebooting returns the device to Android. The same stack also runs in QEMU on an aarch64 virtual machine, so no phone is required.

The kernel is xnu-8796.121.2, the version Apple shipped in iOS 16.5. Apple has published XNU's source for years, but getting it to run on third-party phone silicon — with the iOS user space intact — took a large amount of original engineering: a custom EFI loader, a UEFI port, replacements for Apple's closed drivers and a Linux Wi-Fi driver running on a compatibility layer.

How it works

The boot sequence, as described in the repository, goes from fastboot boot into a UEFI port (Mu-Silicium, based on Project Silicium's work), which starts the project's own EFI application, xnuloader. The loader stays resident after handing off, maintaining a USB link, a watchdog and a channel for the kernel's log. The patched XNU kernel uses the BCM2837 configuration as its base, extended with the project's platform code: GICv3 interrupt handling, timers, a video console and a path back to the loader.

Apple's closed pieces are replaced rather than recreated: minicrypto stands in for corecrypto, there are stand-ins for the AMFI and Sandbox policy components, and the team wrote its own IOSurface, IOMobileFramebuffer, AppleKeyStore and network stack drivers. Graphics run through Mesa and freedreno on the Adreno 642L GPU, with OpenGL ES backing CoreAnimation, and Wi-Fi uses Linux's ath11k driver via the compatibility layer.

What works, and what does not

The working list is long. Lock screen with swipe to unlock, a two-page home screen with the stock iOS 16 wallpapers, gestures including Control Center, and apps such as Settings, Clock, Calendar, Photos, Notes and Safari all run, along with widgets on the phone. The Goodix GT9916 touchscreen supports multitouch and wake on touch, the physical power and volume keys work, and the system can use eight CPU cores with the big core at 2.4 GHz, reaching the lock screen in about 20 seconds.

Wi-Fi on the WCN6750 radio joins networks from Settings and reaches 55–90 Mbit/s. Speakers, the microphone and the Camera app work, including HEIC stills. Data written by iOS can survive a reboot when stored to the phone's flash, and Sileo with the Procursus distribution, tweaks and SSH all function.

Still missing are cellular, Bluetooth and charging under the custom kernel — the phone only discharges. Metal rendering for apps is in progress, with 293 of 456 system shaders already running on the Adreno. App Store content and Apple ID sign-in fail because there is no Secure Enclave and the FairPlay daemon exits, and video and Live Photo recording are not yet working.

The developers describe the result as a research bench rather than a ROM: each session runs for a configured number of seconds, after which the kernel returns to the loader and passes back its log.

Availability and legal posture

The work is split across two repositories, hackios-xnu-kernel and hackios-xnu-userland, and neither contains Apple files. A fetch script downloads the 7.4 GB iOS 16.5 IPSW from Apple's own CDN to the user's machine and extracts what is needed there, while vendor firmware for the GPU, Wi-Fi and audio is pulled from the user's own handset via adb. The project states it is independent research with no affiliation to, or endorsement from, Apple.

Running it in QEMU requires a Linux x86-64 host with about 12 GB of free disk and 4 GB of free RAM; prebuilt kernel, loader and UEFI binaries are supplied, and the lock screen appears after two to three minutes. A porting path for other devices starts with a script that generates a device profile from a phone's device tree.

Why it matters

Booting an unmodified iOS user space on commodity Android silicon is a rare reverse-engineering result. It shows how much of iOS becomes portable once the kernel is patched and a handful of proprietary drivers are re-implemented, and the reuse of Linux drivers — ath11k for Wi-Fi, freedreno for graphics — suggests a route to porting the stack to further hardware. For researchers, it offers a scriptable, inspectable iOS environment with SSH and a package manager, with no Apple hardware required, while the Secure Enclave gap neatly marks where software re-implementation runs into hardware-locked boundaries.