--- title: Show HN: Run full iOS 16.5 firmware on Android Devices description: HackiOS boots Apple's open-source XNU kernel from iOS 16.5 on Android phone hardware, running the unmodified iOS 16.5 user space on top. It works on a POCO X5... canonical: https://daily.dev/posts/show-hn-run-full-ios-16-5-firmware-on-android-devices-1xbviab3j twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Show HN: Run full iOS 16.5 firmware on Android Devices | daily.dev og:description: HackiOS boots Apple's open-source XNU kernel from iOS 16.5 on Android phone hardware, running the unmodified iOS 16.5 user space on top. It works on a POCO X5... og:url: https://daily.dev/posts/show-hn-run-full-ios-16-5-firmware-on-android-devices-1xbviab3j og:image: https://api.daily.dev/og/posts/1XbViaB3j.png og:image:alt: Show HN: Run full iOS 16.5 firmware on Android Devices og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Show HN: Run full iOS 16.5 firmware on Android Devices **[Hacker News](https://daily.dev/sources/hn)** · 10 min read · 0 upvotes · 0 comments ## Summary HackiOS boots Apple's open-source XNU kernel from iOS 16.5 on Android phone hardware, running the unmodified iOS 16.5 user space on top. It works on a POCO X5 Pro 5G (Snapdragon 778G) via `fastboot boot`, with nothing flashed to storage, or in QEMU on any Linux machine. The lock screen, home screen, Wi-Fi (WCN6750 over ath11k, 55 to 90 Mbit/s), sound, camera and up to 8 CPU cores all work. Cellular and Bluetooth do not work, the phone only discharges under our kernel, and Metal for apps is in progress. No Apple files are redistributed; the iOS 16.5 IPSW is fetched from Apple's own CDN at setup time. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Is it possible to run iOS user space on non-Apple hardware like an Android phone? Yes. The HackiOS project boots Apple's open-source XNU kernel (version xnu-8796.121.2, from iOS 16.5) on a POCO X5 Pro 5G (Snapdragon 778G) using a custom EFI loader, replacement drivers, a UEFI port, and a Linux Wi-Fi compatibility layer, running the unmodified iOS 16.5 user space including SpringBoard and stock apps entirely in RAM via `fastboot boot`, with no flashing involved. _Developers exploring kernel portability and iOS internals can track projects like this on daily.dev._ ### What hardware features work and don't work when running iOS 16.5 on the POCO X5 Pro 5G under HackiOS? Working features include the lock screen, home screen, system gestures, Settings/Clock/Calendar/Photos/Notes/Safari apps, the touchscreen, up to 8 CPU cores at 2.4 GHz, the Adreno 642L GPU via Mesa/freedreno, Wi-Fi (WCN6750/ath11k at 55 to 90 Mbit/s), sound, and camera. Cellular, Bluetooth, charging under the custom kernel, full Metal app support, and video/Live Photo recording do not yet work. _Anyone evaluating how far a hobbyist kernel port can go can follow progress like this on daily.dev._ ### How do you get the iOS system image needed to run HackiOS without redistributing Apple's files? No Apple files ship in either HackiOS repository. Running the project's `ios165/fetch.sh` script downloads the iOS 16.5 IPSW (about 7.4 GB) directly from Apple's own CDN onto your own machine, then extracts what is needed locally, keeping the project itself free of Apple's copyrighted files. _Developers navigating licensing constraints around proprietary firmware can find similar setups on daily.dev._ ## Community take How the wider developer community reacted, aggregated from 1 discussion and 88 comments across hackernews (as of 2026-10-22). **TL;DR:** Reactions are mostly amazed at the technical feat of booting iOS's XNU kernel on cheap Android hardware, but many question the practical value given missing cellular, charging, App Store/FairPlay access, and raise suspicion it's an AI-assisted ('vibe coded') project with an odd crypto funding model. **Sentiment:** 35% positive · 40% mixed · 25% skeptical **The case for** - Impressive reverse-engineering/porting feat that works on QEMU and multiple real devices. - Seen as a potential path to a fully jailbroken, tweakable iOS kernel. - Could appeal to people who like Apple's software but prefer cheaper or more diverse Android hardware. - Viewed as a meaningful research step even if not daily-usable. **The pushback** - No Secure Enclave means App Store, Apple ID sign-in, and FairPlay-gated services won't work, which many see as a dealbreaker. - Device only discharges (no charging) and lacks cellular/Bluetooth, making it impractical as a daily driver. - Many default and third-party apps likely fail due to backend device attestation checks. - Some suspect it's largely AI ('vibe coded') generated work rather than from-scratch reverse engineering, diminishing its credit. - Concern about a suspicious crypto token funding model attached to the project. - Worry that similar hype projects could carry malware or enable more convincing fake iPhone clones. **By community** - hackernews (mixed): Commenters are split between genuine admiration for the engineering achievement and skepticism about its practicality, legitimacy of authorship, and odd funding setup. **Hottest debate:** Whether this represents genuine, admirable reverse-engineering work or is largely AI-assisted ('vibe coded') and thus less impressive than it appears. **Open questions** - Why was iOS 16.5 specifically chosen over newer versions, and what security changes in later iOS make porting harder? - Can device attestation and FairPlay/Secure Enclave limitations ever be worked around to enable App Store and iCloud access? - What exactly causes the session time limit that returns control to the loader after a set duration? - Is this project (or similar AI-assisted ports) at risk of containing malware given how quickly it went viral? **Highlights** > >I imagine official support for 3rd party app stores might open up some options for easily installing apps Given you own the OS, that's not an issue. You can make it pre-jailbroken and load whatever third party app store if you want. The bigger issue is that no app store = no "normie" apps like uber or google maps. I suspect most of the stock apps won't work either because they enforce device attestation on the backend endpoints, so it'll be miserable to use. Note in the maps screenshot, there's nothing behind the modal. It's just blank, suggesting it can't load the map tiles. You'd be better off using an android skinned as ios (possibly vibedcoded) than using this mess. > — [gruez on hackernews](https://news.ycombinator.com/item?id=50198119) > > I hope that continued advancements in AI make it impossible for outfits like Apple to maintain closed systems that lock the device owner out of having any control over their own hardware. Formally verified bootloaders and Secure Boot will make this all but impossible without hardware mods that do voltage glitching. It took 8 years for the checkm8 and usbliter8 exploits to be found, and I think that especially Apple has invested so much money, time and resources into securing their boot chain that the "best" thing we can hope for is a tethered jailbreak allowing a boot into another kernel. > — [mschuster91 on hackernews](https://news.ycombinator.com/item?id=50198554) > It has an, uh, interesting funding model: “$HACKIOS ON BNB CHAIN The project has its own community token, live on flap.sh. Each trade carries a 1% fee that supports the team and funds development.” > — [jrmg on hackernews](https://news.ycombinator.com/item?id=50199094) > I'm getting exhausted from all these AI vibe coded projects. Like this is cool, sure, but it's less cool than if someone had figured out how to do it themselves instead of having Claude do it. It's like chasing the dragon but for coding projects. > — [LetsGetTechnicl on hackernews · 3 comments](https://news.ycombinator.com/item?id=50199723) > There is one, uh, minor drawback: > Does not work (yet) > > Charging under our kernel (the phone only discharges) > — [1f60c on hackernews · 2 comments](https://news.ycombinator.com/item?id=50198249) **Source threads** - [hackernews](https://news.ycombinator.com/item?id=50196718) · 226 points · 88 comments ## Similar posts on daily.dev - [Open-Source Project Brings Full iOS 27 Virtualization to Apple Silicon](https://daily.dev/posts/open-source-project-brings-full-ios-27-virtualization-to-apple-silicon-wbnjdgctf) · InfoQ · 0 upvotes · 0 comments - [A new unpatchable flaw in Apple chips opens the door to an iPhone jailbreak](https://daily.dev/posts/a-new-unpatchable-flaw-in-apple-chips-opens-the-door-to-an-iphone-jailbreak-qqrtgimnp) · TechCrunch · 0 upvotes · 0 comments - [The NX bit is not just about security](https://daily.dev/posts/the-nx-bit-is-not-just-about-security-jhrbfxkss) · Lobsters · 0 upvotes · 0 comments - [Apple M3 Booting On Linux After Three Years Plus Other SoC Updates In Linux 7.2](https://daily.dev/posts/apple-m3-booting-on-linux-after-three-years-plus-other-soc-updates-in-linux-7-2-kuu7wpalj) · Phoronix · 0 upvotes · 0 comments - [Trying To Get Linux Running On A Nokia E6](https://daily.dev/posts/trying-to-get-linux-running-on-a-nokia-e6-euw7iu2ep) · Hackaday · 0 upvotes · 0 comments --- Tags: [#ios](https://daily.dev/tags/ios), [#c](https://daily.dev/tags/c), [#reverse-engineering](https://daily.dev/tags/reverse-engineering), [#kernel-development](https://daily.dev/tags/kernel-development) [View this post on daily.dev](https://daily.dev/posts/show-hn-run-full-ios-16-5-firmware-on-android-devices-1xbviab3j) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Show HN: Run full iOS 16.5 firmware on Android Devices","url":"https://daily.dev/posts/show-hn-run-full-ios-16-5-firmware-on-android-devices-1xbviab3j","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/show-hn-run-full-ios-16-5-firmware-on-android-devices-1xbviab3j"},"datePublished":"2026-10-22T16:46:11.219Z","dateModified":"2026-10-22T21:18:01.597Z","description":"HackiOS boots Apple's open-source XNU kernel from iOS 16.5 on Android phone hardware, running the unmodified iOS 16.5 user space on top. It works on a POCO X5...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/51143e8b477ffc5781d1356ccf1d5d27?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/51143e8b477ffc5781d1356ccf1d5d27?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Hacker News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Hacker News","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/hn","url":"https://daily.dev/sources/hn"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/show-hn-run-full-ios-16-5-firmware-on-android-devices-1xbviab3j","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"ios,c,reverse-engineering,kernel-development","timeRequired":"PT10M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Hacker News","item":"https://daily.dev/sources/hn"},{"@type":"ListItem","position":3,"name":"Show HN: Run full iOS 16.5 firmware on Android Devices"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/show-hn-run-full-ios-16-5-firmware-on-android-devices-1xbviab3j#faq","mainEntity":[{"@type":"Question","name":"Is it possible to run iOS user space on non-Apple hardware like an Android phone?","acceptedAnswer":{"@type":"Answer","text":"Yes. The HackiOS project boots Apple's open-source XNU kernel (version xnu-8796.121.2, from iOS 16.5) on a POCO X5 Pro 5G (Snapdragon 778G) using a custom EFI loader, replacement drivers, a UEFI port, and a Linux Wi-Fi compatibility layer, running the unmodified iOS 16.5 user space including SpringBoard and stock apps entirely in RAM via `fastboot boot`, with no flashing involved. Developers exploring kernel portability and iOS internals can track projects like this on daily.dev."}},{"@type":"Question","name":"What hardware features work and don't work when running iOS 16.5 on the POCO X5 Pro 5G under HackiOS?","acceptedAnswer":{"@type":"Answer","text":"Working features include the lock screen, home screen, system gestures, Settings/Clock/Calendar/Photos/Notes/Safari apps, the touchscreen, up to 8 CPU cores at 2.4 GHz, the Adreno 642L GPU via Mesa/freedreno, Wi-Fi (WCN6750/ath11k at 55 to 90 Mbit/s), sound, and camera. Cellular, Bluetooth, charging under the custom kernel, full Metal app support, and video/Live Photo recording do not yet work. Anyone evaluating how far a hobbyist kernel port can go can follow progress like this on daily.dev."}},{"@type":"Question","name":"How do you get the iOS system image needed to run HackiOS without redistributing Apple's files?","acceptedAnswer":{"@type":"Answer","text":"No Apple files ship in either HackiOS repository. Running the project's `ios165/fetch.sh` script downloads the iOS 16.5 IPSW (about 7.4 GB) directly from Apple's own CDN onto your own machine, then extracts what is needed locally, keeping the project itself free of Apple's copyrighted files. Developers navigating licensing constraints around proprietary firmware can find similar setups on daily.dev."}}]} ```