vphone-cli boots a virtual iPhone on Apple Silicon using PCC research VM tech

A new open-source tool, vphone-cli, spins up a fully virtualized iPhone on Apple Silicon Macs by tapping the same Virtualization.framework path that underpins Apple’s Private Cloud Compute research VMs. A single command runs the entire pipeline—downloading and merging IPSWs, patching the boot chain, performing a DFU restore, installing custom firmware, and booting the guest—while individual subcommands let users drive each stage manually. VMs can be cloned via fast APFS snapshots, exported and imported as compressed bundles, and reconfigured for CPU, memory, and disk.

The catch is host hardening: booting a guest with the private PV=3 entitlement requires relaxing macOS security, either by fully disabling SIP and setting the amfi_get_out_of_my_way boot-arg, or by keeping SIP in debug-relaxed mode and allowlisting the unsigned binary through an amfidont helper. Guests run cross-compiled daemons, expose SSH and VNC, and ship in five patch variants offering escalating security bypasses—including jailbreak profiles reachable over SSH with the classic alpine password.

Beyond hobbyist tinkering, the project is aimed at automated iOS testing and research: a host control socket exposes screenshots, touch, swipes, hardware keys, and clipboard access, each returning an inline screenshot, and a companion MCP server wraps it for AI-driven end-to-end testing. It’s a notable demonstration of how Apple’s own research virtualization infrastructure can be repurposed to run iOS in software, though the required SIP/AMFI teardown makes it strictly a lab-only setup.