Bad Apple

Mainline Linux on the Apple A12 (T8020), tested on the iPhone XS Max.

The boot is tethered and reads nothing off the NAND, so the NAND can hold ext4. Hardware notes are in docs.

Written with assistance from an LLM, including the reverse engineering of Apple firmware and binaries, so this is not clean-room work. Human reviewed, and tested on real hardware.

Boot chain

SecureROM, pwned by usbliter8
  -> patched iBSS
  -> device tree and an empty trustcache
  -> m1n1, in place of a restore kernelcache
  -> Linux, 16K pages, initramfs

Dependencies

Host	For
clang, ld.lld	kernel and m1n1
Rust with rust-src	m1n1
dtc, cpp	make check
python3	tools/
git, curl, unzip	make deps, make initramfs
ipsw	the IPSW and img4
irecovery	recovery mode
usbliter8ra1n-patch	pwned DFU

And an iPhone11,6 IPSW.

Build

make deps     # clone the trees and apply patches/
make images IPSW=/path/to/unpacked/ipsw IPSW_FILE=/path/to.ipsw
make boot     # builds the rest and boots

make images runs once. IPSW_FILE is the .ipsw itself, since the wifi firmware is in its root image.

For the GPU coprocessor, run make ticket TICKET_IPSW=/path/to/signed.ipsw with the phone in DFU before make images. It fetches a ticket for your phone, which iBoot needs to load coprocessor firmware.

Run

Pwn the phone, then run make boot. It shows up as 05ac:4142 with telnet on 172.16.42.1. tools/tsh.py "cmd" runs one command. The first USB attach often fails and the phone retries, so give it a minute.

postmarketOS

Phosh on the NVMe, with our kernel and Mesa. Needs pmbootstrap and sudo.

make rootfs && tools/pmos/build.sh
make bootbin BOOTARGS="earlycon console=tty0 ignore_loglevel cma=64M hl_rd=nvme"

Then boot the plain ramdisk with make boot, serve the repo with python3 -m http.server 8003 --bind 172.16.42.2, and run:

tools/tsh.py "wget -qO- http://172.16.42.2:8003/tools/pmos/install.sh | sh"

It erases nvme0n1p2 and puts boot.bin on the FAT partition. To boot pmOS, pwn the phone again and run:

tools/iboot-boot.sh build/iboot/kernelcache-chainload.img4

That kernelcache is m1n1 alone, about 420 KB. It boots the newest .bin on the FAT partition, which holds m1n1 and Linux. Hold volume down at boot for a menu of them: the volume buttons move, the side button boots.

The user is user, password 147147.

Status

Display	Touch	USB	Storage	SMP	cpufreq	Wifi	Bluetooth	Audio	Cellular	GPU
✅	✅	✅	✅	✅	✅	✅	✅	❌	❌	🚧

Full list in docs.

License

GPL-2.0+ OR MIT, see LICENSE. patches/linux-* are GPL-2.0, patches/m1n1-* MIT. Dependencies are in NOTICES.md.