Building Virtual iPhone Using VPHONE600AP Component of Recently Released PCC Firmware

Building a Virtual iPhone with VPHONE600AP in PCC Firmware: A Detailed Exploration

Introduction

What follows is a detailed narrative inspired by a recent exploration into building a virtual iPhone environment using the VPHONE600AP component of the PCC firmware. The journey blends hardware emulation concepts, firmware patching, virtualization techniques, and a handful of daring tweaks to coax an iPhone-like experience into a macOS-based virtual machine. This article weaves together the motivations, key steps, and noteworthy discoveries, complemented by images that anchor the discussion to concrete visuals from the input material.

Motivation and Context

Around late 2024, Apple highlighted Private Cloud Compute (PCC) as a new horizon for cloud-based AI privacy, signaling a shift toward cloud-centric security and computation. Fast forward to late 2025, and a remarkable development emerged: PCC firmware began incorporating vphone600ap-related components, with cloudOS 26 marking an early integration point. The idea that Apple might distribute a “iPhone Research Environment Virtual Machine” as part of a cloud-based research ecosystem sparked widespread curiosity and cautious skepticism. Was this a strategic platform for researchers to test and refine virtual iPhone environments, or merely a misstep in development?

A visual cue from early public chatter—showing a booting virtual iPhone and associated components—helped crystallize the concept: a self-contained virtual iPhone environment within PCC firmware that could run on capable hardware. The potential for a fast, responsive virtual iPhone with Metal acceleration, if realized, would open opportunities for research, security testing, and education in a way that traditional emulation projects hadn’t fully delivered. The initial spark came with public glimpses of a boot sequence that appeared elegant, smooth, and surprisingly capable on real-time hardware, a marked improvement over prior efforts like QEMUAppleSilicon (Inferno). See the early visual references in the attached image, which captures the vibe of a cloud-backed iPhone research environment.

[Image: iPhone Research Environment Virtual Machine] Content source: the early public post showing a booting virtual iPhone concept. (contents/image.png)

The Core Idea: VPHONE600AP as a Building Block

The focus of the project was to leverage VPHONE600AP components embedded in the PCC firmware as a foundation for a virtual iPhone environment. The aim was to create a virtualized iPhone-like device that could boot, render graphics (potentially with Metal acceleration), and provide a usable shell for research, debugging, and experimentation. The work references a lineage of related projects and tools, including the Virtualization.framework’s private methods and a boot environment inspired by the “VRESEARCH” hardware model concept.

A Snapshot in Time: Evidence and Observations

Two snapshots from late February 2026 illustrate the trajectory:

• A boot-up screenshot showing the virtual iPhone environment starting to come to life, suggesting that the virtualization path was not only conceptual but also executable on real hardware. See the screenshot from February 24, 2026. [Image: Screenshot 2026-02-24 at 7.37.31 PM.png] (contents/Screenshot2026-02-24at7.37.31PM.png)

• A subsequent screenshot showing a more complete boot sequence, hinting at functional acceleration and the possibility of GPU/Metal integration in the virtual stack. [Image: Screenshot 2026-02-24 at 7.46.41 PM.png] (contents/Screenshot2026-02-24at7.46.41PM.png)

Modifying and Booting: The Path from Super-tart to a Virtual iPhone

The work builds on security-pcc (the public-facing name of the project that aligns with the system’s SecurityResearch context) and taps into the underlying architecture of the Virtualization.framework. A few salient points emerge:

• The virtual machine model included explicit hardware descriptors, with ISA, platform version, and board IDs carefully set to align with a vresearch101-style configuration. The bootrom and SEPROM choices were AVPBooter.vresearch1.bin and AVPSEPBooter.vresearch1.bin, respectively, which load a SEPStorage file similar in concept to Apple’s AuxiliaryStorage.
• The boot resolution was deliberately high, with a target resolution set to a 1290x2796 canvas, corresponding to devices like the iPhone 14 Pro Max/15 Pro Max variants, ensuring a crisp viewport for the virtual iPhone.
• The project introduced a customized VZVirtualMachine-based configuration (the VM.swift file in Tart’s ecosystem), where a hardware model is crafted with a vresearch101 platform, a production-mode Mac identifier, and a tailored digital ecosystem for the virtual device. The approach demonstrates how to assemble a macOS-based VM with a bespoke graphics surface, USB keyboard/touch support, auxiliary storage, and a dedicated SEP/ROM topology.

[Image: Screenshot 2026-02-24 at 8.27.01 PM.png] (content: Screenshot 2026-02-24 at 8.27.01 PM.png)

[Image: Screenshot 2026-02-24 at 8.32.08 PM.png] (content: Screenshot 2026-02-24 at 8.32.08 PM.png)

A Look at the Firmware and Patch Strategy

One of the central themes is patching the firmware to permit booting the customized environment. The process highlights several components:

• AVPBooter and AVPSEPBooter serve as the BootROM and SEP boot stage, with configuration files pointing to Private Storage-like structures. This mirrors how Apple’s restoration paths operate in a controlled lab scenario.
• The patch strategy extends to the AVP boot chain, and to the TXM (the Trust Execution Management component) and the kernel cache. Patching aims to bypass certain verification steps (e.g., SSV verification) and to allow loading of non-signed binaries that enable Cryptex-based root filesystem extension and debugging.
• The patching sequence is extensive, with a focus on enabling serial output, DFU-mode access, and GDB-based live debugging. In practice, this means selectively altering boot arguments, bypassing signature checks, and ensuring binary components are acknowledged by the system’s trust mechanisms.

[Image: image.png] (content: image 1.png) This patch image shows steps related to bypassing a verification callback during boot; the visual represents the type of low-level patching that enables custom bootloaders to load in a controlled environment.

The Build Chain: Putting Together Custom Firmware

Building a reproducible custom firmware involves mixing cloudOS components with iPhone-related binaries (iPhone 16-era, vphone-related components, etc.). The high-level idea is to supply a BuildManifest.plist and a Restore.plist that reflect a hybrid model: using iPhone 16 Restore/OS pieces for key services and system volumes while routing other pieces through vphone PCC firmware assets.

Key steps include:

• Modifying the BuildManifest.plist so that during the restore, the system uses SystemVolume, SystemVolumeCanonicalMetadata, OS, StaticTrustCache, RestoreTrustCache, and RestoreRamDisk from the iPhone 16 model (iOS 26.1), while fetching other elements (agx, all_flash, DFU, pmp, and other firmware components) from PCC’s vphone-related files.
• Adjusting Restore.plist to align with device maps or SupportedProductTypes, and changing SystemRestoreImageFileSystems to reflect a repair/restore pathway that supports the hybrid model.
• Consolidating the firmware components into a working Restore directory, and employing scripts such as get_fw.py (partial) to copy kernel caches and firmware image components from cloudOS-derived dumps into the iPhone restore folder.

[Image: image 2.png] (content: image 2.png) This image depicts a typical restore screen scenario during the patching and merging of firmware components—illustrative of the restore flow.

Patching and Transforming Firmware Components

A substantial portion of the work centers on patching critical firmware modules (iBSS, iBEC, LLB, TXM) to bypass signature verification and allow the integration of a Cryptex-based rootfs. The patching strategy uses:

• A Python-based approach to inject patches into specific offsets, targeting the image4validateproperty_callback and related boot-args sections.
• A separate set of patches targeting the LLB boot stage to enable serial console output and compatibility with non-default boot arguments.
• A careful preservation of the PAYP structure in IM4P payloads during conversion between RAW and IM4P formats (using tools like pyimg4, img4tool, and img4lib) to maintain compatibility of the patched components with Apple’s image packaging format.
• Patching the TXM so a binary not registered in the trust cache can still run, which is essential for enabling custom binaries and development work on the virtual iPhone.

[Image: image 3.png] (content: image 3.png) This image shows a sample patch snippet and the concept of altering the boot pipeline to accept custom components.

Restoring Firmware: From DFU to Ramdisk

Restoration is a multi-stage process that begins with DFU-mode entry, followed by reinstalling a customized firmware image stack. The documented approach emphasizes:

• Using libirecovery and idevicerestore tooling to drive the DFU-based restoration flow, enabling the patching of bootloaders and kernel components as part of a controlled restore sequence.
• An iterative process of extracting IM4P payloads from the firmware, patching them, reassembling them into IM4P images, and then signing or re-packaging them for DFU-based deployment.
• A practical challenge encountered during a restore is a runtime panic caused by a missing library (libSystem.B.dylib) on boot, traced to Cryptex partition restoration issues. A workaround involves creating an SSH Ramdisk to adjust the root filesystem and inject necessary files (and patches) to get the system past the initial launch barriers.
• The SSH Ramdisk workflow is a central tactic for expanding space and enabling file-system edits on boot. The Ramdisk is prepared by extracting a Cryptex payload, mounting the Ramdisk image in a macOS environment, expanding it, and re-signing components as needed to boot reliably.

[Image: image 4.png] (content: image 4.png) This screenshot captures a moment in the DFU/restoration narrative, illustrating the boot-time challenges and the need for memory-based workarounds.

An SSH Ramdisk-Based Boot Fix

When the standard boot path fails due to missing dyld or Cryptex contents, the SSH Ramdisk approach provides a lifeline. The sequence involves:

• Extracting a shsh/shsh2 for the target ECID, generating an IM4M for the vphone environment, and crafting IMG4 payloads for iBSS, iBEC, and devicetree.
• Transferring Cryptex SystemOS and Cryptex AppOS to the virtual device via scp, wiring up the Cryptexes into the rootfs, and redirecting dyld caches to Cryptex-based caches to simplify boot-time loader paths.
• Patching seputil and other boot-time utilities to avoid gigalocker errors, and injecting a set of startup daemons (bash, dropbear, trollvnc) so that a remote SSH and VNC-based control surface becomes available immediately after boot.

[Image: image 5.png] (content: image 5.png) This image shows a boot-time failure scenario and hints at the type of adjustments required to bootstrap a working Ramdisk-based solution.

Metal and GPU Acceleration: A Metal-Enabled Dream

One of the more intriguing parts of the exploration involved attempting to enable Metal acceleration inside the virtual iPhone environment. The journey unfolded like this:

• An initial test with a Metal-check program (MetalTest) showed that Metal was not detected on first pass. The test printed a null device handle, indicating the absence of a functional Metal stack in the initial VM image.
• A deeper dive into the host’s iPad and Mac frameworks revealed that the AppleParavirtGPUMetalIOGPUFamily bundle (and the specific dylib libAppleParavirtCompilerPluginIOGPUFamily.dylib) could be used to retrofit Metal support into the virtual iPhone’s environment.
• By grafting the AppleParavirtGPUMetalIOGPUFamily.bundle from the PCC environment into the virtual iPhone’s filesystem (using the SSH Ramdisk), and adjusting the shared cache/dynamic linker, MetalCreateSystemDefaultDevice began to return a valid device, indicating Metal support had been unlocked in the virtualized stack.
• The ioreg exploration confirmed the presence of an AppleParavirtGPU driver in the kernel/driver space, further supporting the feasibility of GPU acceleration in the IVR (in-virtual-environment) context.

[Image: image 7.png] (content: image 7.png) This image documents the ioreg-based discovery of the AppleParavirtGPU driver, a keystone finding in enabling Metal.

[Image: image 8.png] (content: image 8.png) This screenshot highlights the path to the relevant library (AGXMetalA10) in a real iOS device, providing a blueprint for what to replicate in the virtual environment.

[Image: image 9.png] (content: image 9.png) A visual confirmation of the subsequent change: the AppleParavirtGPUMetalIOGPUFamily.bundle has been added to the virtual device, and a new Metal path is being exercised.

[Image: image 10.png] (content: image 10.png) The MetalTest run after the GPU library injection shows a successful Metal device creation, a pivotal moment in animating graphics hardware acceleration in the virtual iPhone.

[Image: image 11.png] (content: image 11.png) A further refinement step, revealing the dylib that supports the AppleParavirt compiler’s integration within the virtual environment’s dyld cache.

Second Boot, Third-Hud, and Home Button Workarounds

With Metal enabled, the second boot cycle reveals a more polished setup screen and a background, signaling that the system’s surface is stable enough for extended interaction. Since the home button interaction was not fully wired into the virtual hardware, a practical workaround was used: control the home button via iproxy and VNC, providing a usable navigational mechanism as the system boots into its first user-level session.

[Image: image 12.png] (content: image 12.png) The second-boot experience, including the setup screen and the background, is captured here.

Compatibility and Limitations

The approach described here is optimized for certain Apple Silicon hosts and specific hardware configurations:

• Compatibility is targeted at Apple Silicon Macs with a path toward broader reach, should the virtualization stack mature. In particular, runs on devices that support PCC-based virtualization (pccvre) and hardware with sufficient memory and graphics capabilities.
• Supported configurations included Apple M3 with 16 GB RAM on Sequoia (26.3-ish) and Apple M1 Pro with 32 GB RAM on Tahoe. Other configurations may work, but success was not guaranteed without adjustments to the hardware model descriptor and the graphics surfaces.
• The approach is advanced and experimental; it leverages private APIs and non-public build-time components. It’s designed for research environments, lab setups, and skilled developers who can navigate the risks and limitations of unreleased or semi-released tooling.

Touch Interaction: Enabling Sequoia’s Capabilities

One notable feature is the enabling of touch interaction in the Sequoia variant of the virtual iPhone, which does not rely solely on the standard VZVirtualMachineView. Instead, the project overrides mouse event handling to simulate touch interactions. The approach involves:

• Intercepting and translating mouse events into touch events understood by the virtual device, enabling a more natural interaction experience without a dedicated touch screen.
• Utilizing a dedicated ScreenSharingVNC component to bridge the user’s input into the iPhone-like environment, combined with a responsive VNC/iproxy loop to bring up the UI and permit control.

[Image: ScreenSharingVNC.swift] (content: contents/ScreenSharingVNC.swift) A code artifact showing how touch interaction could be wired into the virtual machine’s input surface.

Project References and Where This Fits The core project lineage includes:

• The security-pcc repository as the foundational blueprint for the virtualization and vhosted VM. This work relies on private methods from Virtualization.framework, with explicit ISA/PlatformVersion configuration for vresearch101-like hardware models.
• The vma2pwn project, which demonstrates bootstrapping a Mac VM with a modified boot chain, including the bootloader, kernel, and DFU-based restoration logic. This lineage informs the patching strategy and the approach to transforming the firmware into a testable, debuggable environment.
• A set of auxiliary tools for dealing with IM4P/RAW payloads, such as pyimg4, img4tool, and img4lib, used to convert, patch, and reassemble images while preserving payload structure.

[Image: image 13.png] (content: contents/image%2013.png) A visual from the compatibility section illustrating the hardware/software pairing reference for the PCC-driven virtual iPhone.

Closing Thoughts: The Road Ahead

What emerges from this narrative is a carefully engineered path toward a virtual iPhone environment anchored in PCC’s VPHONE600AP components. The project demonstrates that, with deliberate hardware modeling, firmware patching, and a robust restoration workflow (including SSH Ramdisk), it is possible to push a virtual iPhone beyond simple emulation into a functioning research platform with real-time input, a usable graphics stack, and even Metal-level acceleration.

But the journey is not without caveats. The approach leans on non-public tooling, delicate patching, and invasive boot-time modifications. It is best suited for lab environments with controlled hardware and thorough backups, where the risk of bricking a host or creating an unstable VM is an acceptable trade-off for experimental exploration.

If you are drawn to the project’s spirit, the core steps—exploring the VPHONE600AP components, crafting a vresearch101-like hardware model, patching bootloaders and kernel components, and building a hybrid firmware with cloudOS and iPhone elements—offer a compelling blueprint. The result is a virtual iPhone research environment that not only boots but also demonstrates the tantalizing possibility of GPU-accelerated, cloud-enabled iPhone experimentation in a controlled sandbox.

Notable Image Gallery References

• Initial iPhone research environment boot concept:
• contents/image.png
• Early boot sequence and hardware model cues:
• contents/Screenshot2026-02-24at7.37.31PM.png
• contents/Screenshot2026-02-24at7.46.41PM.png
• Hardware configuration and AVR/ROM booting details:
• contents/Screenshot2026-02-24at8.27.01PM.png
• contents/Screenshot2026-02-24at8.32.08PM.png
• contents/Screenshot2026-02-24at8.34.11PM.png
• Patch and patching process visuals:
• contents/image%201.png
• contents/image%202.png
• contents/image%203.png
• contents/image%204.png
• contents/image%205.png
• contents/image%206.png
• contents/image%207.png
• contents/image%208.png
• contents/image%209.png
• contents/image%2010.png
• contents/image%2011.png
• contents/image%2012.png
• contents/image%2013.png

If you’d like, I can tailor this blog draft to emphasize a particular facet—such as the firmware patching details, the VM hardware modeling, or the Metal integration steps—and adjust the length accordingly.