macOS AMFI Bypass: ObjC Runtime Swizzle in Practice

Background vphone-cli boots a real iOS 26 virtual machine on Apple Silicon Macs. It is not the Xcode Simulator (which compiles iOS apps for the host architecture); it uses Apple’s private Virtualization.framework PV=3 (Platform Version 3) APIs — the same infrastructure Apple built for Private Cloud Compute (PCC) security research VMs. Under the hood, vphone-cli patches the entire iOS boot chain — AVPBooter, iBSS, iBEC, LLB, TXM, and the kernelcache — to bypass signature verification and allow a custom firmware to boot inside the VM. The jailbreak variant applies 127 binary patches across the boot chain and CFW installation, enabling full root/SSH/Sileo/TrollStore on the guest. ...

March 16, 2026 · 13 min · Xin

How to build a PWN environment on Mac

Download UTM and install it. You can use command brew install --cask utm Download the image form https://releases.ubuntu.com/22.04/ and install it. Then install gdb server by running the command sudo apt install gdbserver if you wan to debug some executable file for 32 bit, then you must run the command: sudo dpkg --add-architecture i386 sudo apt update sudo apt install libc6:i386 libncurses5:i386 libstdc++6:i386 After the environment setup, you could use ...

April 15, 2025 · 3 min · Xin