dipa-studio/ios-sweet

Maintainer? Show your league in your README

Card: your league's emblem, from Copper to Legendary

[![bestofgithub](https://bestofgithub.dev/badge/dipa-studio/ios-sweet.svg?style=card)](https://bestofgithub.dev/repo/dipa-studio/ios-sweet)

Flat: fits beside your other badges

[![bestofgithub](https://bestofgithub.dev/badge/dipa-studio/ios-sweet.svg)](https://bestofgithub.dev/repo/dipa-studio/ios-sweet)

Loading README…

Area	State
Boot	Stock Xiaomi bootloader → `fastboot boot` of our shim → XNU. Nothing is flashed to the boot partitions
CPU	6 of the 8 cores (the six Cortex-A55s) via PSCI, 16K pages, GICv3 interrupts, timers
Memory	About 3.95 GiB of the upper DDR bank
Storage	Own UFS host driver; the iOS root is a journaled HFS+ volume in `userdata`, read/write
iOS userland	Real iPhone X 16.7.16 root filesystem and shared cache; launchd and the system daemons run
Display	Kernel IOSurface + IOMobileFramebuffer (`AppleCLCD`) services; CoreAnimation renders in software; frames are copied into the bootloader's framebuffer. Presented to iOS as an iPhone X panel (1125×2436)
GUI	backboardd, SpringBoard, lock screen, home screen, Control Center, notification center, Settings
Touch	Goodix GT9896 over I²C (GENI), rail enabled through RPMh, delivered as HID digitizer events
Buttons	Power, volume up/down (PMIC through SPMI) as HID consumer keys; lock/wake works
Battery	IOPMPowerSource service (static 100 %, charging icon; real fuel-gauge readout prepared)
Device identity	iPhone X (`iPhone10,3` / `D22AP`): no Home button, gesture UI
Activation	Native "Hactivation" path of mobileactivationd, chosen through device-tree security status. No Apple servers involved

Boot-arg	Effect
`rd=ufsroot0 ufsrw=1 rootrw=1`	Root on the `userdata` partition, writable
`cpus=6`	Start the six A55 cores; `cpus=1` is the safe fallback
`launchd_unsecure_cache=1`	launchd accepts its job cache without AMFI
`wdt=-1 wdt_test=no_user_checkin`	No hardware watchdog
`sweetfb_noconsole=1`	Stop drawing kernel text over the GUI. It still goes to the persistent log; panics are drawn
`sweetfb_hz=30`	Panel refresh rate of the CPU copy
`sweettouch=0`, `sweetkeys=0`	Disable the touch or button driver

Path	What
`shim/`	Bare-metal boot shim (C + asm) packed as an Android boot.img v2
`xnu/patches/`	The XNU patch series (applied in order by CI), plus staging scripts for libpthread, HFS and BearSSL
`.github/workflows/xnu.yml`	Kernel CI build
`tools/mkadt.py`	Generates the Apple Device Tree from sweet's MMIO layout and the iPhone X identity
`tools/mkpayload.py`	Packs kernel + ADT + boot-args into the shim payload
`tools/mkiosroot.sh`	Builds the HFS+ iOS root from the IPSW images
`tools/sweet-root-tweaks.py`	Bring-up changes to the root (Setup skip, activation, daemons)
`tools/sweet-log-pull.sh`, `sweet-log.py`	Read the persistent kernel log from recovery
`tools/sweet-crash.py`	Symbolicate console crash reports
`tools/xnu-cc.py`	Local single-file compile check from a CI log
`tools/qemu-sweet.py`	QEMU test boots with framebuffer text decoding
`tools/adt.py`, `remotezip.py`, `unpack_bootv2.py`, `sparsediff.py`	Helpers
`NOTES.md`	Detailed engineering log: every boot, crash and decision, plus hardware facts

#	What
0001–0009	Toolchain compatibility, SWEET machine config, non-PAC arm64, stubs for Apple-internal pieces
0010–0018	Early framebuffer console, physmap fix, PRNG without corecrypto, device-tree platform expert, timer PPI, boot CPU driver
0019–0020	Apple open-source libpthread kernel provider; BearSSL AES
0021–0027	RAM-disk root, mockfs, SHA-256, minimal AMFI, Apple open-source HFS+, MD5
0028–0034	UFS host driver and root device, read/write root, DMA above 4 GiB
0035–0045	Entitlements, bindfs, AppleKeyStore stub, IOWatchdog, console crash reports
0046	IOSurface (IOCoreSurfaceRoot) and IOMobileFramebuffer (AppleCLCD) services
0047–0055	Diagnostics: persistent log, /dev/null tee, IOKit trace, heap strings and user stack sampler on crash; permissive Sandbox policy; HFS rename-swap; AppleKeyStore selectors
0056–0057	Throttled panel copy; no external identity resolver
0058	HID event services. Apple's IOHIDFamily-1915.140.3 user client and event queue, matching the iOS 16.7 userland
0059	iPhone X identity (`hw.product` / `hw.target` from the device tree)
0060	Power and volume keys over SPMI; touch over GENI I²C
0061	Present the display as 1125×2436
0062	RPMh regulator vote for the touch rail; battery power source
0063	GENI FIFO packing fix and the Goodix GT9896 protocol
0064	Grant PRIV_WORK_INTERVAL (UIKit's CoreAnimation work interval)
0065	SMP: secondary A55 cores via PSCI CPU_ON
0066–0067	Fault-region crash info; console mute
0068	IOSurface lookup semantics for already-mapped surfaces
0069	Batched persistent-log flushes

dipa-studio/ios-sweet

ios-sweet

What works

What does not work (yet)

How it boots

How to do it yourself

0. Back up the phone

1. Build the kernel

2. Build the iOS root image

3. Build the boot image

4. Flash the root and boot

5. Read the kernel log

QEMU

Repository layout

Kernel patches

Key hardware facts

Credits