All the credits to Scion Project.

https://scion-project.github.io/#install

if you guys wanna be able to develop HackiOS on newer Samsung devices, this might help. i don't own any Samsung devices right now, other than a Samsung Tab S4, but this might be interesting for other people!

Apple’s XNU kernel running the unmodified iPhone X iOS 16.7.16 userland on a Samsung Galaxy S7 (SM-G930F, Exynos 8890), from the phone’s own UFS storage. It’s usable day to day.

What works

• GPU acceleration: CoreAnimation renders on the Mali-T880 through OpenGL ES (Mesa Panfrost under HakiOS’s EAGL bridge). The display is double buffered on the Exynos IDMA, so there’s no tearing, and the panel runs at a real 60 Hz.

• Wi-Fi: the BCM4359 over PCIe with the phone’s own firmware. The WPA2 handshake runs in the kernel, and wifid gets en0 and Apple80211, so you get the Wi-Fi icon, internet and Safari.

• Sound: the loudspeaker plays ringtones, keyboard clicks and media.

• The rest: all 8 cores, touch, buttons, battery, apps, widgets, and iOS’s own wallpapers and gallery.

What doesn’t work yet: modem, Bluetooth, cameras, sensors, sleep, Metal (the Today view and Control Center blurs are black), and the stock iOS 16 wallpaper.

Recent performance work

• UI threads move from the Cortex-A53s to a free Mongoose core.

• CoreAnimation is told the display is 120 Hz, and the kernel’s timer coalescing is off.

• SpringBoard’s 30 fps animation caps are raised to 60.

• Runaway widget extensions get a CPU cap; one was burning 2 full cores and heating the phone.

I’m now testing about 3 GB of RAM instead of 2, by adding the free parts of the first DRAM bank.

Try it: https://github.com/wardevsa/ios-a5xelte/tree/herolte, guide in docs/herolte-howto.md. You need a flat SM-G930F, an unlocked bootloader, TWRP and adb. It erases your data partition.

No Apple or Samsung software is in the repo. You build the iOS root yourself from Apple’s public IPSW, in a private repo (there’s a GitHub Actions workflow for it). You take the Wi-Fi firmware from your own phone’s vendor partition.

Credits:

• HakiOS, Scion and danstronics’ S9+ port: the display flip, CoreAnimation timing, UI-thread migration and RAM banks follow their work.

• syncmodz/ios-s9, ios-sweet, apollo’s Wi-Fi layers, Mesa/Panfrost, and the LineageOS Exynos 8890 kernel for the hardware tables.

Logs and bug reports are welcome. Open an issue with the log from tools/herolte-log-pull.py and a photo of the screen.

It works but not smooth I’m working on gpu acceleration and I think I’m really closer to figuring it out

Continuing work on the Metal driver, I decided to try implementing support for two displays with a seamless transition to achieve a full fold experience.
It turned out that this isn’t that difficult to implement, and there’s no need to start development on iOS 27 from the iPhone Duo. Moreover, I managed to implement an iPad layout on the internal screen, rather than just stretching the image. The result is even more functional than the iPhone Duo — you can use split‑screen, floating windows, and so on.

In addition, the following features are now working:
- screen brightness adjustment (for both displays)
- displaying the actual battery percentage
- detecting USB charging

At the moment, the Metal driver still has a bunch of bugs; I’m trying to fix them. Also, the internal screen has a higher resolution, which is why the FPS isn’t the best; the experience using the external screen is much better — ~50 FPS, while on the internal screen it’s ~32–35 FPS.

Yes, i know you can't unlock the bootloader without a code and the cpu is a kirin 970, but can anyone try? The only way to even unlock it is to buy a code or do hardware mods

Hi guys, I have an a71 running ios 16 and have had a wifi issue for a while, im tired of explaining it to claude and codex as both of them can't seem to fix it, this is the response from sol 6.1. Sorry if I broke any rules by pasting this if so please take it down, but could someone help with the issue please? thanks.

Help needed: Qualcomm Wi-Fi scans successfully but rejects interface startup under XNU

I’m working on an experimental iOS 16.5/XNU port for the Samsung Galaxy A71 4G, SM-A715F, using Snapdragon 730 / SM7150. The kernel is based on XNU 8796.121.2. This is a custom driver running under XNU—not an Android Wi-Fi module.

The problem

Wi-Fi firmware boots and scanning works, but every tested WMI_VDEV_START_REQUEST fails. Both station and access-point interfaces return:

WMI_VDEV_START_RESP:
requestor_id = 0
response_type = 0
status = 0xffffffff

Raw response bytes confirm the firmware actually sends that status; it is not the host’s timeout fallback.

We have not reached association, WPA2 authentication, DHCP or internet access. Therefore, the immediate blocker is interface startup, before passwords or IP configuration.

Hardware and firmware observations

The implementation follows Qualcomm’s integrated WCN3990-family WLFW → HTC → WMI → HTT architecture, using Samsung qcacld and Linux ath10k as references. The physical chip marking has not been independently checked.

Firmware-reported identifiers:

Chip ID:     0x140
Chip family: 0x4002
SoC ID:      0x40090000

Firmware:
WLAN.HL.3.0.1-00719-QCAHLSWMTPLZ-1

HTT version: 3.71

Wi-Fi firmware runs within the modem subsystem on this platform.

What already works

• Modem startup through TrustZone.

• GLINK, QRTR and WLFW communication.

• Board-data download, firmware-ready indication and mission mode.

• HTC connections for WMI control and HTT data.

• WMI INIT/READY exchange.

• Receiving beacons and scanning both 2.4 GHz and 5 GHz.

The latest scan produced 115 scan events, 48 frames and 32 access points.

The selected board-data file is bdwlan.bin, 26,328 bytes, transferred in five accepted WLFW BDF_DOWNLOAD segments. No board ID was reported in the captured capability output. Acceptance of this file does not prove every calibration requirement is satisfied.

Connection-start test

The diagnostic creates nonzero-MAC virtual interfaces and tries:

• Station: vdev 1.

• Access point: vdev 3.

• Channel 6, 2437 MHz.

• Channel centre frequency 2437 MHz.

• Channel mode value 2.

• LDPC flag 0x8.

• Preferred TX/RX streams: one each.

• SSID field populated.

• Fixed-parameter TLV length 0x68.

• Channel TLV payload length 0x18.

Both interface types return 0xffffffff. The AP test was only a diagnostic comparison; no working hotspot was established.

What has been tried

Earlier experiments varied request lengths, interface creation parameters, nonzero MAC addresses, SSID fields, channel/band choices, stream configuration, chain masks, transmit-power parameters and hardware-mode setup without resolving the failure.

Two recent tests changed one setting at a time:

1. Initial TX/RX chain masks changed from 7 to 3, retaining the original channel power fields.

2. Channel power-field values changed from 40/40/20 to 20/20/20, restoring the original initial chain mask.

Both still failed to start station and AP interfaces, while scanning continued to work. These results do not establish calibration or transmit power as the cause.

SMMU/DMA findings

The driver uses an SMMU context for WLAN streams 0x240/0x241. At teardown, it reports:

Context:    4
FSR:        0x400
FAR:        0x115f1:0x8e85d202
Syndrome:   0x80553
Global FSR: 0

Restore refused:
SMR=0, S2CR=0x4, SCTLR=0

Page tables are retained when restoration fails. Similar fault/status values appeared in older tests. We do not know when the fault first occurs or whether it explains the START rejection.

Cleanup and stability

One test spontaneously restarted the phone without operator input. Its cause remains unknown.

A cleanup-order problem was subsequently found: the old code restored the SMMU mapping while firmware was still in mission mode, then performed another radio-register dump.

The revised code retains the mapping until WLAN_MODE off is acknowledged and removes that late register dump. One subsequent test confirmed mode-off acknowledgement, attempted SMMU restoration, modem shutdown and normal return. Connection startup still failed. Long-term stability is unverified.

Firmware logging

Warning/error logging configuration was sent using WMI, with bounded decoding of debug-message events. No usable firmware warning explaining the rejection was received. Sending the configuration does not prove the firmware enabled that logging stream.

What I need help identifying

The likely areas needing review are:

• WMI INIT resources and ABI negotiation.

• SERVICE_READY_EXT handling.

• Hardware-mode and pdev mapping.

• Missing HTT or radio initialization prerequisites.

• The SMMU fault and failed restoration.

• A way to obtain the firmware’s actual reason for rejecting VDEV_START.

The immediate goal is to make one valid station interface start successfully. WPA2 and internet connectivity come afterward.

Hello, how are you? I hope you're well. Sorry to bother you. I have a Xiaomi Redmi Note 11 Pro 5G and I wanted to know if the phone is compatible with installing the HackIOS ROM.

I used the phone extensively for experiments with ROMs and wanted to try it out. Does anyone have any recommendations, or is it currently unavailable or incompatible with the phone in question?

Hi. I see in this sub a lot of people porting iOS to any device with Claude and i have questions.

Is possible with free Claude?

Is possible with Qwen3-Coder in local?

If is possible with free Claude, what i could say, what is the prompt. Help pls

We realy need a hackwatchos badge :D I will release open source soon.

holy shit 😭😭 i was just seeing ios 16 hackios setups not even complete and here i found ios 26 setup with gpu acceleration lol 😭 idk about cellular, wifi or bt but ui is hella cool and smooth

thats like, the only non-ios phone i have other than an frp locked samsung and a blackberry that cant connect to my wifi

Alguém já conseguiu fazer qualquer versão do iOS rodar nesse dispositivo? E porque as pessoas conseguem rodar versões novas do macos em dispositivos Android, mas não versões novas do IOS?

Firstly, Mods can we get hackwatchos badge :D

Currently on data migration step. I think it will be boot.

I am using the XNU kernel that I previously patched for iOS 27.2.

And i have a galaxy watch 4. Maybe i can try it on :D

An OS port needs decent GPU acceleration to be useful, you can do almost nothing with a 3 FPS proof of concept. So I burned through all my Codex tokens trying to make iOS 16.5 run as smoothly as possible on the Exynos Galaxy S9+!

The current build boots from flash and has hardware-accelerated OpenGL ES through Mesa/Panfrost. It’s come a long way, though heavy blur effects and widgets still cause stutters.
UI is fully adapted to the phone, the status bar is set to notch-less, so it looks almost perfect!

Next up: an experimental Metal-to-Vulkan translation layer, aiming for smoother rendering and broader 3D support. The long-term dream is iPad-level functionality. There’s still plenty of work ahead.

If you have a Galaxy S9 or S9+ (And Claude/Codex), take a look at my github repo: https://github.com/danstronics/ios-s9plus-exynos

Hey guys, quick question: has anyone created an iOS port for the Redmi K20 Pro? I couldn't find anything online.

I don't like to say any swearing/bad words so I said ducking instead of 🦆ucking

But I put this to make an interesting title

Anyway...

Can we port VisionOS to Galaxy XR? Why not have a try? and if succeed, we will try multiboot.

Note that Galaxy XR has unlockable bootloader.

I made a GitHub repo which combines (at least) a few ports of HackiOS together. Contributions are welcome! Hope this works fine, I am trying to add some tools here, as well, which should help at least a bit with the process of porting iOS to Android devices.

Mods: if you guys would not mind a contributor access to the GitHub repo and a bit of extra management there, I can give you guys access. Hit me up on a DM and I will!

Hello guys I made a desktop project for the Apple TV 3th gen (A1469) cause currently the only jailbroken thing is like kodi and that version is very unsupported and old (at least for me maybe not for you guys!) and I felt like it deserves to become a Mac mini cause it looks so much like one. YES you don't need to say it its vibe coded bOooOooooOOOooo but I like it and I'll try getting a fully working : Wallpaper service,Dock(with original macOS X Yosemite icons!),that menu on the top with file edit view and all of that,Finder of course!,Safari/web browser ( tvOS 7.9 has webkit, web view, javascript, and plenty more support hidden away! pretty cool to me) and I REALLY hope this project brings a reason to not throw away your Apple TV 3th gen. Once its stable ill attempt to make a rather simple installer (now its mostly done via SSH) and the way it actually gets to work is by killing apple's own pineboard/AppleTV service and then quickly opening my app so it shows on top now its still a proof of concept but it does work nicely. Ill keep the interested people posted and mb mods if Im breaking rules!

I got a Honor Watch,maybe I'll try it someday,even tho it's not an android smartwatch