A group calling itself OOSEX GANG has published HackiOS, a project that boots Apple's open-source XNU kernel — specifically xnu-8796.121.2, the kernel underpinning iOS 16.5 — on non-Apple hardware. The target is a POCO X5 Pro 5G running a Snapdragon 778G, plus any Linux machine via QEMU. The entire unmodified iOS 16.5 userspace chain runs on top: launchd, backboardd, SpringBoard, stock apps. Nothing is flashed to the phone; the system lives in RAM, and a reboot returns to Android. The technical architecture is a layered substitution stack. A custom UEFI port (based on Project Silicium / Mu) replaces Apple's boot chain. A bespoke EFI loader stays resident, providing a USB link, watchdog, and kernel log capture. The XNU kernel itself is patched to run on GICv3 interrupt controllers and standard ARM timers instead of Apple's custom silicon. Every closed-source Apple driver — IOSurface, IOMobileFramebuffer, AppleKeyStore, the network stack — gets an open replacement. Wi-Fi runs through Linux's ath11k driver via a FreeBSD-style LinuxKPI compatibility layer. The Adreno 642L GPU renders through Mesa/freedreno. Sound, camera, touchscreen, and haptics all work through custom driver shims pulling firmware from the phone's own Android vendor partition. The result is surprisingly functional. Lock screen, home screen, system gestures, Settings, Safari, Clock, Calendar, Photos, Notes — all running. Wi-Fi connects from Settings at 55-90 Mbit/s. The camera works (front and rear, preview, focus, HEIC capture). Sound plays through speakers. Multitouch and hardware buttons respond. The system boots to lock screen in roughly 20 seconds on hardware, 2-3 minutes in QEMU. Data persistence across reboots is possible via UFS flash writes. Sileo package manager, dpkg, apt, SSH, and jailbreak tweaks all function. What doesn't work yet tells the story of what Apple locks down hardest: cellular radios, Bluetooth, charging under the custom kernel, App Store sign-in (no Secure Enclave, so FairPlay exits), and full Metal GPU support for apps — though 293 of 456 system shaders already compile for Adreno. Video and Live Photo recording are absent. The project frames itself explicitly as a research bench, not a daily-driver ROM: sessions run for a set number of seconds, then the kernel returns control to the loader. The legal architecture is deliberate. No Apple binaries ship in either repository. A fetch script downloads the iOS 16.5 IPSW from Apple's own CDN to the user's machine. The XNU patches are distributed under APSL 2.0, matching Apple's own license for the kernel source. Vendor firmware is pulled from the user's own phone. This is the Hackintosh model applied to iOS — everything proprietary stays on Apple's servers or the user's device; only the glue is open. The generative implications are significant. This is the first public demonstration that iOS userspace can run unmodified on commodity ARM hardware outside Apple's walled garden. It proves that Apple's platform lock is enforced primarily by driver exclusivity and Secure Enclave integration, not by any fundamental architectural incompatibility. For security researchers, jailbreak developers, and anyone studying iOS internals, this is an open, reproducible, non-destructive environment that doesn't require owning an iPhone. The project also surfaces a structural tension Apple has never had to confront at this level: the XNU kernel is open source under APSL 2.0, but Apple's entire business model assumes that open kernel will never run anywhere useful outside Apple hardware. HackiOS demonstrates that assumption is now falsifiable — and the 293/456 shader compilation rate suggests full GPU parity is an engineering problem, not a theoretical barrier.
