Boot a virtual iPhone via Apple’s Virtualization.framework using PCC research VM infrastructure.
One command creates a VM end-to-end (download → patch → DFU restore → CFW install → first boot):
vphone-cli vm createruns the whole pipeline; the individual steps below let you drive it manually or re-run one stage.
Update to a newer iOS by pointingfw prepareat an IPSW:–iphone-source /path/to.ipsw –cloudos-source /path/to.ipsw.
Five patch variants with increasing security bypass — pass one to–variant:
Seeresearch/0_binary_patch_comparison.mdfor the per-component breakdown.
Everything vphone-cli creates lives under~/.vphone/— kept outside the repo and the.appso the signed bundle stays portable. Redirect the whole tree with$VPHONE_ROOT:
Precedence: the per-item overrides ($VPHONE_LIBRARY_ROOT,$VPHONE_VENV_DIR) win over$VPHONE_ROOT, which wins over the~/.vphonedefault. Theipsws/,tools/, anddebs/caches always sit directly under whichever root is active.
Option A — fully disable SIP, then disable AMFI via boot-arg (most permissive).
In Recovery (long-press power → Terminal):
Then reboot into macOS and set the AMFI boot-arg (needs SIP fully off to take effect):
Option B — keep SIP on (debug-only relaxed), then allowlist the binary with amfidont(leaves AMFI enabled system-wide).