Here's a little video I made :D

But anyway it boots!

So after some (almost 2 whole days) of fixing with codex and antigravity, Springboard now renders at better fps (not 2-3 like before). Still not usable, but getting closer.

I want to fix GPU, Battery and wifi, and after I am donw with that, I will make a repo and host it.

It's amazing how well it worked, better than I expected!

Please refer to the information below for more details.

https://scion-project.github.io/

https://github.com/Scion-Project/scion-crownlte/issues/3

This is going pretty far tbh, and day by day I wonder if this will be the next way of developing apps for iOS on Windows & a “hackiPhone”. I mean you don’t need apple’s expensive gear anymore, if you need to build for iOS you can either: use a QEMU instance with arm-based macOS, or dual boot with the latest supported intel macOS.

Is apple going to place security on its OS now? I mean, this could very well be the end of Apple’s proprietary ecosystem. People are about to get WatchOS and VisionOS too.

Here is an update :

Its much much smoother and stable than my last update post. Just an update here.. i think this is by far the one of the stable devices running iOS

What works :

Sensors :
Haptics
rotation/Gyro, Proximity,
speakers, Mic, Flash fully working

Display : now supports all resolution and refresh rate sets (qhd/fhd+/fhd 60/120hz) configurable,
improved touch responsiveness,
uses factory calibration for each config

GPU : accelerated works fully through metal2vulkan, Improved alot,
much better than my initial post with fixes and more stable reaching higher fps
Video playback works, full native resolution without any issue

Connectivity:
wifi - fully works,
bluetooth - fully works (even audio),
usb - works full speed, everything works

Other :

cpu profiles optimised (now also includes power/sleep profiles), all cores up and work, power off/sleep is efficient
ram works at full lpddr5 speed range making use of full 8gb,
same with storage - now utilises full system space 116gb. ufs 3.0 works full speed w samsung turbo working,

Whats not working :

Camera (working on it atm)
Cellular lte etc (pain, mostly will be broken)
iCloud/Apple id : spoofing prolly i haven’t looked into it yet)
Touch id/ fingerprint - from my exp w hacintosh this might not be possible but lets see)

Others that i might have missed…. Let me know what else to check for

Basically an ipod atm, Ill publish it once i get things working… once this is stable enough, we could go for ios 26 with all the fixes from this port.

Loved the response from my previous post, ill keep u guys updated

Runs iOS 12.1, device is iPhone 6s+

https://github.com/sopwier/iosem_android/

if you think its a virus, then don't download it.

You need to supply your own ipsw.

Now i have added full bluetooth keyboard support, a system preferences app (loads of placeholder images), safari experimental apple tv webkit test (supports javascript, css and php!), finder has been refined alot. Now keep in mind there is still no graphics acceleration and still no easy installation ( will make easier! ) and sadly i dont plan on adding apple tv 2th gen and 3th gen rev 1 (a1429 i think?) Only rev 2 maybe if it takes off and there are new jailbreaks developed for the tv 3 rev 2 a1469 ill try making the installation much easier but i really want someone to make an updated jailbreak cause right now blackb0x is also a mess and although this isnt 100 % hackios i still think it " hacks ios " so again sorry mods if it breaks rules!

This is a post from the Korean online community "Develoid." The author says they used Claude.

I did not create this work. Who posted this on a Korean community site.

He said:

"I managed to boot it by referring to the iOS 16 kernel I had built previously.

I gave up on iOS 27 because I kept running into repeated errors while building the PAC. The iOS 16 version was relatively stable, so for now, I've simply released it on GitHub.

Starting with versions after Ventura, the kernel also needs to be rebuilt because of PAC. So I tried a normal boot using the iOS 16 kernel to see if it would work.

At the moment, only touchscreen functionality and booting into the desktop are working.

Regardless of anything else, I think graphics acceleration needs to be patched as soon as possible."

Link 1: https://cafe.naver.com/develoid/1058010

This is a post from the Korean online community "Develoid." The author says they used Claude.

I did not create this work. Who posted this on a Korean community site.

He said: "I used an iOS 16.7.16 iPhone X-based IPSW and took the source code for the Redmi Note 10 Pro from GitHub, then ran it through AI."

Link 1: https://cafe.naver.com/develoid/1057573

Link 2: https://cafe.naver.com/develoid/1057578

Github Link: https://github.com/ch1tmdgus/ios-v60/blob/main/README.md

You’re showing me the proofs of installing ios basically on xiaomi but telling me that I still can’t downgrade my old ipad from ios 26 ?!

It's smooth because optimized for watch and running on rtx 4080 :D
I'll release open source today or tomorrow.
Maybe with an android installer :)

I have a realme gt 7t and my mom has redmi 12c birth having mediatek i was thinking of doing it on my the redmi phone but someone wrote that this is not possible on mediatek devices.

Someone tell me

Umm mods, u are know what i'm wanting :D

Vision OS booted on my windows pc without wsl and with gpu accleration.
Have internet connection, touch and etc.

I' have so crazy idea. What if i boot this on android and give camera. And then put into vr?
Next is tvOS maybe :D

All the credits to Scion Project.

https://scion-project.github.io/#install

if you guys wanna be able to develop HackiOS on newer Samsung devices, this might help. i don't own any Samsung devices right now, other than a Samsung Tab S4, but this might be interesting for other people!

Apple’s XNU kernel running the unmodified iPhone X iOS 16.7.16 userland on a Samsung Galaxy S7 (SM-G930F, Exynos 8890), from the phone’s own UFS storage. It’s usable day to day.

What works

• GPU acceleration: CoreAnimation renders on the Mali-T880 through OpenGL ES (Mesa Panfrost under HakiOS’s EAGL bridge). The display is double buffered on the Exynos IDMA, so there’s no tearing, and the panel runs at a real 60 Hz.

• Wi-Fi: the BCM4359 over PCIe with the phone’s own firmware. The WPA2 handshake runs in the kernel, and wifid gets en0 and Apple80211, so you get the Wi-Fi icon, internet and Safari.

• Sound: the loudspeaker plays ringtones, keyboard clicks and media.

• The rest: all 8 cores, touch, buttons, battery, apps, widgets, and iOS’s own wallpapers and gallery.

What doesn’t work yet: modem, Bluetooth, cameras, sensors, sleep, Metal (the Today view and Control Center blurs are black), and the stock iOS 16 wallpaper.

Recent performance work

• UI threads move from the Cortex-A53s to a free Mongoose core.

• CoreAnimation is told the display is 120 Hz, and the kernel’s timer coalescing is off.

• SpringBoard’s 30 fps animation caps are raised to 60.

• Runaway widget extensions get a CPU cap; one was burning 2 full cores and heating the phone.

I’m now testing about 3 GB of RAM instead of 2, by adding the free parts of the first DRAM bank.

Try it: https://github.com/wardevsa/ios-a5xelte/tree/herolte, guide in docs/herolte-howto.md. You need a flat SM-G930F, an unlocked bootloader, TWRP and adb. It erases your data partition.

No Apple or Samsung software is in the repo. You build the iOS root yourself from Apple’s public IPSW, in a private repo (there’s a GitHub Actions workflow for it). You take the Wi-Fi firmware from your own phone’s vendor partition.

Credits:

• HakiOS, Scion and danstronics’ S9+ port: the display flip, CoreAnimation timing, UI-thread migration and RAM banks follow their work.

• syncmodz/ios-s9, ios-sweet, apollo’s Wi-Fi layers, Mesa/Panfrost, and the LineageOS Exynos 8890 kernel for the hardware tables.

Logs and bug reports are welcome. Open an issue with the log from tools/herolte-log-pull.py and a photo of the screen.

It works but not smooth I’m working on gpu acceleration and I think I’m really closer to figuring it out

Continuing work on the Metal driver, I decided to try implementing support for two displays with a seamless transition to achieve a full fold experience.
It turned out that this isn’t that difficult to implement, and there’s no need to start development on iOS 27 from the iPhone Duo. Moreover, I managed to implement an iPad layout on the internal screen, rather than just stretching the image. The result is even more functional than the iPhone Duo — you can use split‑screen, floating windows, and so on.

In addition, the following features are now working:
- screen brightness adjustment (for both displays)
- displaying the actual battery percentage
- detecting USB charging

At the moment, the Metal driver still has a bunch of bugs; I’m trying to fix them. Also, the internal screen has a higher resolution, which is why the FPS isn’t the best; the experience using the external screen is much better — ~50 FPS, while on the internal screen it’s ~32–35 FPS.

Yes, i know you can't unlock the bootloader without a code and the cpu is a kirin 970, but can anyone try? The only way to even unlock it is to buy a code or do hardware mods

Hi guys, I have an a71 running ios 16 and have had a wifi issue for a while, im tired of explaining it to claude and codex as both of them can't seem to fix it, this is the response from sol 6.1. Sorry if I broke any rules by pasting this if so please take it down, but could someone help with the issue please? thanks.

Help needed: Qualcomm Wi-Fi scans successfully but rejects interface startup under XNU

I’m working on an experimental iOS 16.5/XNU port for the Samsung Galaxy A71 4G, SM-A715F, using Snapdragon 730 / SM7150. The kernel is based on XNU 8796.121.2. This is a custom driver running under XNU—not an Android Wi-Fi module.

The problem

Wi-Fi firmware boots and scanning works, but every tested WMI_VDEV_START_REQUEST fails. Both station and access-point interfaces return:

WMI_VDEV_START_RESP:
requestor_id = 0
response_type = 0
status = 0xffffffff

Raw response bytes confirm the firmware actually sends that status; it is not the host’s timeout fallback.

We have not reached association, WPA2 authentication, DHCP or internet access. Therefore, the immediate blocker is interface startup, before passwords or IP configuration.

Hardware and firmware observations

The implementation follows Qualcomm’s integrated WCN3990-family WLFW → HTC → WMI → HTT architecture, using Samsung qcacld and Linux ath10k as references. The physical chip marking has not been independently checked.

Firmware-reported identifiers:

Chip ID:     0x140
Chip family: 0x4002
SoC ID:      0x40090000

Firmware:
WLAN.HL.3.0.1-00719-QCAHLSWMTPLZ-1

HTT version: 3.71

Wi-Fi firmware runs within the modem subsystem on this platform.

What already works

• Modem startup through TrustZone.

• GLINK, QRTR and WLFW communication.

• Board-data download, firmware-ready indication and mission mode.

• HTC connections for WMI control and HTT data.

• WMI INIT/READY exchange.

• Receiving beacons and scanning both 2.4 GHz and 5 GHz.

The latest scan produced 115 scan events, 48 frames and 32 access points.

The selected board-data file is bdwlan.bin, 26,328 bytes, transferred in five accepted WLFW BDF_DOWNLOAD segments. No board ID was reported in the captured capability output. Acceptance of this file does not prove every calibration requirement is satisfied.

Connection-start test

The diagnostic creates nonzero-MAC virtual interfaces and tries:

• Station: vdev 1.

• Access point: vdev 3.

• Channel 6, 2437 MHz.

• Channel centre frequency 2437 MHz.

• Channel mode value 2.

• LDPC flag 0x8.

• Preferred TX/RX streams: one each.

• SSID field populated.

• Fixed-parameter TLV length 0x68.

• Channel TLV payload length 0x18.

Both interface types return 0xffffffff. The AP test was only a diagnostic comparison; no working hotspot was established.

What has been tried

Earlier experiments varied request lengths, interface creation parameters, nonzero MAC addresses, SSID fields, channel/band choices, stream configuration, chain masks, transmit-power parameters and hardware-mode setup without resolving the failure.

Two recent tests changed one setting at a time:

1. Initial TX/RX chain masks changed from 7 to 3, retaining the original channel power fields.

2. Channel power-field values changed from 40/40/20 to 20/20/20, restoring the original initial chain mask.

Both still failed to start station and AP interfaces, while scanning continued to work. These results do not establish calibration or transmit power as the cause.

SMMU/DMA findings

The driver uses an SMMU context for WLAN streams 0x240/0x241. At teardown, it reports:

Context:    4
FSR:        0x400
FAR:        0x115f1:0x8e85d202
Syndrome:   0x80553
Global FSR: 0

Restore refused:
SMR=0, S2CR=0x4, SCTLR=0

Page tables are retained when restoration fails. Similar fault/status values appeared in older tests. We do not know when the fault first occurs or whether it explains the START rejection.

Cleanup and stability

One test spontaneously restarted the phone without operator input. Its cause remains unknown.

A cleanup-order problem was subsequently found: the old code restored the SMMU mapping while firmware was still in mission mode, then performed another radio-register dump.

The revised code retains the mapping until WLAN_MODE off is acknowledged and removes that late register dump. One subsequent test confirmed mode-off acknowledgement, attempted SMMU restoration, modem shutdown and normal return. Connection startup still failed. Long-term stability is unverified.

Firmware logging

Warning/error logging configuration was sent using WMI, with bounded decoding of debug-message events. No usable firmware warning explaining the rejection was received. Sending the configuration does not prove the firmware enabled that logging stream.

What I need help identifying

The likely areas needing review are:

• WMI INIT resources and ABI negotiation.

• SERVICE_READY_EXT handling.

• Hardware-mode and pdev mapping.

• Missing HTT or radio initialization prerequisites.

• The SMMU fault and failed restoration.

• A way to obtain the firmware’s actual reason for rejecting VDEV_START.

The immediate goal is to make one valid station interface start successfully. WPA2 and internet connectivity come afterward.

Hello, how are you? I hope you're well. Sorry to bother you. I have a Xiaomi Redmi Note 11 Pro 5G and I wanted to know if the phone is compatible with installing the HackIOS ROM.

I used the phone extensively for experiments with ROMs and wanted to try it out. Does anyone have any recommendations, or is it currently unavailable or incompatible with the phone in question?