darwin-vm

darwin-vm boots iOS and macOS inside QEMU on ordinary hardware. It emulates A14 through A19 iPhones and M1 through M5 Macs, drops you at a root shell in seconds, and lets you compile and run your own command line programs without jailbreaking anything.

Be clear about the scope, because the author is. There is no screen, no WiFi, no Bluetooth, no graphics, no GUI apps, and no SpringBoard. This boots Darwin to a barebones root shell and nothing more. That is not a limitation somebody forgot to fix, it is the entire design.

What it buys you is a kernel you can debug and patch, on a platform that normally makes both nearly impossible. Security researchers and anyone reverse engineering Apple internals get an iteration loop measured in seconds rather than device reflashes. It supports SPTM based kernels and MIE capable CPUs, which is where current Apple security work is happening. MIT licensed and free.

The catch is the setup path. You need a Mac to prepare the firmware files, plus Python, jq, wget, and the ipsw tooling, and then QEMU build dependencies to compile. It is also a two month solo project rather than a maintained platform, so treat it as a sharp research instrument, not infrastructure.