vphone-cli Boots iOS in a Mac VM Using Apple's Private Cloud Compute Research Machines

Apple opened the door itself. In October 2024 the company published a Virtual Research Environment so outside researchers could inspect Private Cloud Compute, the servers behind Apple Intelligence’s cloud requests. “For the first time ever, we’ve created a Virtual Research Environment (VRE) for an Apple platform,” Apple wrote, adding that “the VRE includes a virtual Secure Enclave Processor (SEP), enabling security research in this component for the first time.”

vphone-cli walked through that door with iPhone firmware instead. The README says it “runs iOS with Apple’s Virtualization.framework and PCC research virtual machines, for security research, reverse engineering, and debugging.” You get the phone’s screen in a window on your Mac, a pre-patched system, VM export and cloning, and an optional local HTTP and WebSocket API for automation. Setup is mostly clicking: “Launchpad downloads the firmware, patches it, restores the system, and boots the VM.”

The hardware bar is plain. You need “a physical Apple Silicon Mac running macOS 15 or newer. It does not work in a macOS VM.” Budget disk space too, since “each VM has a 64 GB virtual disk by default, and firmware takes more.”

The security bar is the part worth slowing down on. The README tells you to boot into macOS Recovery and run two commands:

csrutil enable --without debug
csrutil allow-research-guests enable

“SIP stays enabled, with only the debugging restrictions relaxed,” the README says. Apple’s own VRE setup page describes what the second command trades away: it “allows additional access to hardware features, which in turn might expose additional attack surface.” Apple also says the VRE tooling is for research under its license, and “commercial use is not permitted.”

The project’s host setup guide goes further for anyone building from source. One path turns SIP off completely with csrutil disable and sets boot arguments that tell AMFI, the macOS code-signing enforcer, to get out of the way; the guide calls it “the more permissive host configuration.” The other keeps SIP partly on and uses a helper that “enables amfid to consult the requirement by changing one byte in its heap,” with a warning to “repeat the allow command after every build.”

The boot chain changed recently too. “New VMs start from two open-source ROMs instead of the closed ones in Virtualization.framework,” the README says: OpenAVB replaces Apple’s AVPBooter, and OpenSEP replaces the SEP boot ROM. “With both, nothing Apple wrote runs before iBoot and SEPOS.” Older VMs keep Apple’s ROMs and can switch either way from their next start.

Version 2.14.0, published October 29, made the iPhone Duo usable as a guest (“iPhone19,4, iOS 27.1”), with the cover screen booting at 1398×2034 and the inner display filling the panel when it’s open. The release notes list test runs on six Mac mini M4 hosts covering iPhone, iPad, Apple TV, HomePod mini and Apple Watch firmware. Apple’s VRE pages describe the research VMs only in terms of Private Cloud Compute, and Apple hasn’t said anything on those pages about anyone booting a phone in them.

Apple built the VRE to earn trust for its cloud: let researchers poke at the servers and publish what they find. Tools built on top of an official research door inherit both its access and its risks, and a door built for one purpose tends to get used for others. vphone-cli’s README is careful about the second half of that, even warning readers that any cryptocurrency token using the project’s name is a scam. Turning those settings back on afterward is still up to the person at the keyboard.