Docker-eyeOS – Debug the iPhone’s XNU Kernel on GNU/Linux!

Docker-eyeOS is an iOS Kernel Debugging platform based on the following projects by Aleph Security

Visit the Docker-eyeOS repo here

https://github.com/alephsecurity/xnu-qemu-arm64

https://github.com/alephsecurity/xnu-qemu-arm64-tools

Run the iPhone’s xnu-qemu-arm64 (iOS) in a Docker container

Supports KVM + GDB kernel debugging! Run armv8-A in a Docker! Works on ANY device!

Features

• qemu-system-aarch64 boot into iOS!
• Runs on ANY device
• FULL iOS armv8-A GDB Kernel debugging support (step thru & debug the iOS kernel on Linux!)
• X11 Forwarding (future Display)
• SSH on localhost:2222 or container.ip:2222
• GDB on localhost:1234 or container.ip:1234
• QEMU Full xnu-qemu-Virtualization
• Container host Arch

• Sick.Codes Team @sickcodes
• https://twitter.com/sickcodes
• https://sick.codes/
• https://github.com/sickcodes

Pull from the Docker Hub

https://hub.docker.com/r/sickcodes/docker-eyeos

mkdir -p images
cd images

wget https://images.sick.codes/hfs.sec.zst
wget https://images.sick.codes/hfs.main.zst

# decompress images, uses about 15GB
zstd -d hfs.main.zst
zstd -d hfs.sec.zst

docker pull sickcodes/docker-eyeos:latest

docker run -it --privileged \
    --device /dev/kvm \
    -e RAM=6 \
    -e HFS_MAIN=./images/hfs.main \
    -e HFS_SEC=./images/hfs.sec \
    -p 2222:2222 \
    -v "$PWD:/home/arch/docker-eyeos/images" \
    -e "DISPLAY=${DISPLAY:-:0.0}" \
    -v /tmp/.X11-unix:/tmp/.X11-unix \
    sickcodes/docker-eyeos:latest


ssh root@localhost -p 2222

# -----> Try to SSH about 4 times
# -----> also needs to HIT ENTER a few times in the terminal to kick it along

Supported by:

• Aleph Security @AlephSecurity
• Vera Mens @v3rochka GitHub && @v3rochka Twitter
• Jonathan Afek @jonyafek GitHub && @JonathanAfek Twitter
• Lev Aronsky @aronsky GitHub && @levaronsky Twitter

TCP Tunnel for Linux rework:

• MCApollo @MCApollo GitHub

Use the Docker-eyeOS image build script to create research block devices.