HackiOS boots real iOS 16.5 on a POCO X5 Pro from RAM, and a reboot puts Android back

The phone is a POCO X5 Pro 5G, codename redwood, with a Snapdragon 778G inside. The software on its screen is the lock screen you’d see on an iPhone running iOS 16: swipe up, two pages of icons, stock iOS 16 wallpapers, Control Center.

HackiOS gets there by booting Apple’s open-source XNU kernel, version xnu-8796.121.2, which the README calls “the kernel of iOS 16.5.” On top of it runs the “unmodified iOS 16.5 user space,” launchd to backboardd to SpringBoard to apps.

Unmodified means unmodified. “The iOS programs, frameworks and dyld shared cache are not changed by a single byte,” the team writes. Whatever iOS expects from iPhone hardware, the kernel fakes with replacement drivers, or a library gets injected into a few system processes in memory.

Nothing gets flashed. Per the README, “the UEFI is started with fastboot boot, the whole system lives in RAM, and after a reboot the phone is back in Android.” Getting to the lock screen takes about 20 seconds.

The list of what works is longer than you’d guess. Settings, Clock, Calendar, Photos, Notes and Safari open. The touchscreen does multitouch. Wi-Fi joins from Settings and pulls 55 to 90 Mbit/s. The speakers, microphone and both cameras work in Camera.app, down to HEIC photos. Sileo and Procursus are there for the tweak crowd, along with SSH.

The list of what doesn’t is shorter and funnier. No cellular, no Bluetooth, no App Store or Apple ID sign-in, because there’s no Secure Enclave and “FairPlay daemon exits.” And the one that makes it a lab toy: “Charging under our kernel (the phone only discharges).” Metal for apps is still in progress, with 293 of 456 system shaders already running on the Adreno GPU. That work lives in the userland repo, the half that builds the iOS images and holds the Mesa patches.

Why it matters

Apple handed out half the puzzle years ago. XNU’s source is public, and HackiOS ships under the Apple Public Source License 2.0 because its kernel changes are derivative of it. Everything Apple keeps closed, the drivers above all, this team rewrote from scratch, or borrowed a Linux driver for, as with Wi-Fi.

No Apple files change hands. The repos carry none. A script, ios165/fetch.sh, downloads the 7.4 GB iOS 16.5 IPSW from “Apple’s own CDN to your machine” and pulls what it needs there. The README also says the project “is not affiliated with, authorised or endorsed by Apple Inc.”

You don’t need the phone. The same build runs in QEMU on “any Linux computer, no phone needed,” with about 12 GB of disk and 4 GB of RAM. The lock screen shows up after two to three minutes, and holding the left mouse button stands in for your finger.

It’s a bench by design. “It is a research bench, not a ROM,” the README says. A session runs for a set number of seconds, then the kernel hands its log back to the loader, which is how you’d build a test rig, never a daily phone.

The team also ships common/new-device.sh, which builds a starting profile from another phone’s device tree, plus a porting guide that walks through the UEFI port, loader, drivers and firmware. The redwood is one phone. The tooling assumes there will be others.

That’s the piece to watch. The gaps left are the hard ones: charging, cellular, and anything that wants a Secure Enclave. Each new device that boots shrinks the list of hardware-specific excuses, and puts more pressure on the parts only Apple’s own silicon can answer.

More Hacks & Builds