Apple services compatibility

[felipejfc]

Opening a thread for us to discuss how to/if its possible to have apple services working, e.g. AppStore, iMessage etc

These do work reliably on hackintoshes when properly patched/configured, so I wonder if we can make it in an iPhone VM too.

Any thoughts?

[intver11]

when I built my iOS VM using Supertart, Apple services were working fine. now they are not (both supertart/vphone-cli), and I don't know why or whether this is only happening to me.

[k12lol]

I feel like apple silently blocked this vm from being able to do just that

[ejkarne]

I'm curious if all VMs are now locked out of Apple services or if supertart/vphone-cli are specifically being targeted.

On internal releases of macOS they use sumac2 for creating and running VMs but I have no way of verifying if Apple services still work on that since the copy I have is meant for Sonoma and doesn't run properly on 26.3.1 (dyld[9686]: Symbol not found: _OBJC_CLASS_$__VZMacKeyboardConfiguration).

If anyone has a spare mac lying around that can run Sonoma then I would recommend grabbing one of NonUI builds that includes sumac2 and seeing if they can get it running so we can better know where the issue with supertart/vphone-cli lies.

[OnlyBMan]

I have a spare M1, will check

[k12lol]

any update on this?

[OnlyBMan]

any update on this?

Still experimenting, the above referenced issue with sumac2 is not an issue with Tahoe vs Sonoma, it's because the symbol is only seen in the NonUI builds of Virtualization.framework (in retail it's called _VZMacKeyboardConfiguration), and even once that's solved that doesn't necessarily indicate it will even work

[Arbifoxx]

I’ve been looking at sumac2 as well. With current tools, it’s impossible to get a working Virtualization.framework out of the Sonoma NonUI’s shared cache… it’s a road block. Not to say that it’s not possible, there’s just no way right now afaik.

[hugeBlack]

I've been investigating this issue and here's my investigation:

1. Apple services check sysctl kern.hv_vmm_present on-device. If it's 1 they refuse to work without even contacting Apple's server.
2. After patching this parameter out from the kernel, it does allow you to login, you can even receive 2fa codes and see the vm will be listed in your account as a trusted device. But then to complete the authentication you need to have a legit UCRT (signed by Apple, and with its private key stored in SEP) to pass device Attestation

https://github.com/EthanArbuckle/iPhone18-3_26.1_23B85_Restore/blob/90aa0cfe59d9682b4265e1354c8b19ec3c7823ab/usr/libexec/mobileactivationd/mobileactivationd_10.mm#L3233

https://github.com/EthanArbuckle/iPhone18-3_26.1_23B85_Restore/blob/90aa0cfe59d9682b4265e1354c8b19ec3c7823ab/usr/libexec/mobileactivationd/mobileactivationd_13.mm#L1213

otherwise Apple's server will reject the authentication request.

From my pov the only way to properly use Apple's service is by legitimately activating the vm (or maybe stealing identity a real device? not quite possible since its private key is stored in SEP storage )

[moha-abdi]

I dont know if even possible but cant the host Mac be used to pass attestation checks for the vm and also how can the vm be legitimately activated?

[hugeBlack]

An Apple Internal library is required for attestation passthrough

[felipejfc]

I tried patching vmm_present using devicetree patch but it caused restore fail

[seifhatem]

I have patched the kernel by renaming the 7 instances but watchdogd is panicking, can you share what needs to be patched with watchdogd?

[D4rkTT]

Just search and replace all hv_vmm_present in kernel and watchdogd

are u facing any black screen issues? after patching kernel and watchdogd i successfully booted but the screen is black and i had to access it using another VNC viewer but its so slow and icons not rendering :(

[Arbifoxx]

Do we think this is even possible? I've been going back and forth with claude code to no avail lately.