v2.10.1

vphone 2.10.1

Core Bundle

• Open-source boot ROMs. New machines start from OpenAVB instead of Virtualization.framework's AVPBooter, and start their SEP from OpenSEP instead of AVPSEPBooter. Nothing Apple wrote runs before iBoot and SEPOS.
  • Both ROMs ship prebuilt in the bundle from pinned upstream commits. Build/UpdateOpenAVB.sh and Build/UpdateOpenSEP.sh rebuild them and check them byte for byte.
  • fw patch patches no ROM on these machines. vphone-cli restore describes iBSS to OpenAVB before sending it.
  • Machines created before this release keep Apple's ROMs. vphone-cli vm config <vm> --rom openavb|apple --seprom opensep|apple switches in either direction without a restore, and vm info shows which ROMs a machine uses. (#687, #688)
• iPhone 18 Pro (iPhone19,2) guests, which use ARM64E_X1. iOS 27.0.1 (24A446) paired with cloudOS 26.4 boots on hosts without native X1 support. On those hosts the standard preset lowers the unsupported instructions, which weakens PC-bound pointer authentication. The details are in Compatibility. (#678)
• The cloudOS restore seal patch now applies only when the SystemVolume's root hash calls for it. SHA-256 images stay pristine, plans and receipts leave out the image-specific patch, and the selected preset is kept. (#684)
• GET /v1/host/screen serves the VM display as HEVC or H.264 video, encoded by vphone-vm, instead of guest screenshots. On an iPad guest at 60 fps the stream adds about a quarter of the CPU load the screenshot path added. (#677)
• iPad guests scroll and hover natively. vphoned adds input.pointer and input.scroll through a virtual pointing device (capability pointer_scroll). The VM window uses them, so a trackpad swipe carries on as far as it would in a Mac app. (#685)

Launchpad 2.10.1

• Reads the patch status that changed in #684, so it requires VPhone.bundle 2.10.0 or newer. (#684)
• Helper build 17. Launchpad installs the new helper once, which asks for an administrator password.

Upgrading

Launchpad 2.10.x works only with VPhone.bundle 2.10.x.

1. Download vphone-launchpad-2.10.1-notarized.zip and use it to replace Launchpad 2.9.x.
2. In Core Bundle, install VPhone.bundle 2.10.1.
3. Machines bound to a 2.9.x bundle do not start in Launchpad 2.10. Stop each one, choose Change Core Bundle…, select 2.10.1 and turn on Update guest environment. No restore is needed.

Moved machines keep Apple's ROMs. To switch a stopped machine to OpenAVB and OpenSEP, run vphone-cli vm config <vm> --rom openavb --seprom opensep.

The vphone-launchpad-2.10.1.zip built by CI is unsigned.

v2.9.5

vphone 2.9.5

Core Bundle

• Apple TV guests. The Apple TV HD (AppleTV5,3) runs tvOS 26.6 (23L773), or 26.4 beta 1 from a manually chosen IPSW, paired with cloudOS 26.4, and reaches TVSetup, Settings and the home screen at 1080p. New tvos preset: standard without the iOS payloads tvOS has no port of. vm create gives TV guests that preset and refuses templates and slimming. vphoned runs on tvOS as vphoned-tvos with icli 0.8.6. Escape is Back/Menu; holding the titlebar Home button, fn-← or Device ▸ Control Center (⌘⇧T) sends the TV button. Details, the exact pairings and known limits are in Research/Firmware/tvos_support.md. (#669, #670)
• Apple TV 4K (AppleTV14,1), prototype, behind the tvos-4k preset. It has no IPSW: fw prepare --device AppleTV14,1 stages its OTA, and cfw install lays the OTA's arm64e userland over the HD 26.6 image with the paravirtual GPU driver. It boots at 2160p on tvOS 26.6 and 27.0 (24J361). The screen can stop updating after a while; see the open issue in the guide. (#670, #673)
• Unity games no longer draw scrambled meshes on the cloudOS 26.4 GPU driver. The new guest patch system-paravirt_gpu-cfw-heap_index_offset, on in standard, makes the driver send every indexed draw with 64-bit offsets; an index buffer 64 KiB or more into a heap used to be read from the wrong address. (#668)
• cfw install on an external volume that reports 0 bytes available through the resource keys falls back to statfs, instead of failing with "Less than 50 GiB". (#672)
• A template's setup boot whose first-boot app expansion stalls for 180 s is rebooted once in the settle step, after logging installd's and DataMigrator's state and a spindump excerpt. It used to wait out the full 600 s and fail the creation. (#674)
• fw catalog --json gives an OTA pairing's build and the cache files it needs. (#673)

Launchpad 2.9.5

• The New Machine sheet offers Apple TV guests with the tvOS preset, without template or slimming. Machines on tvOS show it, and the IPSW cache lists Apple TV IPSWs under their own family. (#670)
• An Apple TV 4K OTA pairing shows its build and is marked downloaded once the OTA and its base IPSW are both in the cache. (#673)

The vphone-launchpad-2.9.5.zip built by CI is unsigned.

Upgrading

Launchpad 2.9.x works with any VPhone.bundle 2.9.x and installs this one from Core Bundle. To move a machine, stop it and choose Change Core Bundle… with 2.9.5 and Update guest environment turned on. The GPU index-offset patch reaches the guest that way. No restore is needed. An Apple TV guest is a new machine, created from Launchpad 2.9.5's New Machine sheet or vphone-cli vm create.

v2.9.4

vphone 2.9.4

Core Bundle

• On a guest whose RootHide bootstrap vphoned installed, device.snapshot, device.info and the Device Info panel report the RootHide layout and root (source: vphoned bootstrap) instead of "Not Detected". (#665)
• vphoned uses icli 0.8.5. On such a guest, device.environment finds the bootstrap and packages.list and packages.status read its dpkg database; they used to report no bootstrap and fail looking for /var/lib/dpkg/status. A refresh with nothing to do takes 0.03 s instead of 0.53 s. A native-resolution screenshot taken while SpringBoard is not running (the boot logo, the respring spinner) has its real size. On an iPad's Home Screen, apps.foreground no longer names the Dock's folder stack, and apps.launch no longer waits for an app that is already in front. (#666)
• On iOS 27 guests that present their board, such as iPadOS 27 on iPad16,1, services that the setup profile or the OTA block disables stay off. iOS 27 force-enabled 17 of them, so a slimmed iPad template failed its setup boot. Update guest environment removes iOS 27's DisableAllowed = false entries from the jetsam properties, keeping a .bak of each file. (#664)
• On iOS 27 guests, Xcode can prepare device support and LLDB reads system libraries from it. An app launched under the debugger, which includes every Flutter debug run, no longer stays on a black screen for about two minutes. The dyld cache patch now re-signs the header page it changes, and Update guest environment applies the fix to an existing guest. (#662)
• The small screen image attached to replies on vphone.sock (tap, swipe, key, type, screenshot, and rpc with "screen": true) is in color. It used to be gray. (#663)
• fw prepare gives the temporary cloudOS machine it restores to read the GPU driver no network device, so the Mac's shared network and DHCP service no longer start for it. (#661)

Launchpad

• No changes. Keep using the notarized Launchpad 2.9.2. The vphone-launchpad-2.9.4.zip built by CI is the same app, unsigned, and still reports version 2.9.2.

Upgrading

Launchpad 2.9.x works with any VPhone.bundle 2.9.x and installs this one from Core Bundle. To move a machine, stop it and choose Change Core Bundle… with 2.9.4 and Update guest environment turned on. The vphoned, jetsam-properties and dyld cache changes reach the guest that way. No restore is needed.

v2.9.3

vphone 2.9.3

Core Bundle

• On RootHide, Install Bootstrap now creates Irisin's data folder in the environment's own /var/mobile/Documents, which is Irisin's home. It used to create an empty, unused folder in the system's /var/mobile/Documents.
• vphoned uses icli 0.8.0. Registering or refreshing an app no longer stalls and fails with "did not record the plug-ins" when its PlugIns folder holds something that is not an app extension (a .bundle, a .framework, or an .appex without NSExtension). The fallback screenshot path no longer returns a black image.
• The guest clock keeps the Mac's time. A guest that had been switched off, or whose NTP traffic could not get out, used to stay hours behind. vphone-vm now sends the Mac's time when it connects, every minute, when the Mac wakes, and when the Mac's clock is changed. vphoned gains time.clock. (#659)
• iPhones that present their own board, such as iPhone18,2, get Camera Control and the Action Button. (#657)
• The virtual camera now also serves apps that ask for the front camera. Video frames come at the session's preset size, orientation and mirroring, and can be recorded with AVAssetWriter. (#654)
• The guest display can show roll, pitch and yaw dials, attached to the window, from the motion panel. (#656)

Launchpad

• No changes. Keep using the notarized Launchpad 2.9.2. The vphone-launchpad-2.9.3.zip built by CI is the same app, unsigned, and still reports version 2.9.2.

Upgrading

Launchpad 2.9.x works with any VPhone.bundle 2.9.x and installs this one from Core Bundle. To move a machine, stop it and choose Change Core Bundle… with 2.9.3 and Update guest environment turned on. The device-tree, camera and vphoned changes reach the guest that way. No restore is needed. An environment you already installed keeps working.

A RootHide guest that had its bootstrap installed before 2.9.3 may have an empty /var/mobile/Documents/wiki.qaq.irisin folder. Nothing uses it, and you can delete it.

v2.9.2

vphone 2.9.2

Core Bundle

• vm import no longer aborts when whoever reads its output goes away. Quitting Launchpad during an import used to crash every import under way and leave a partly unpacked .import-* folder in the library; the import now finishes.
• vm import stops cleanly on Ctrl-C (SIGINT) or SIGTERM and removes what it had unpacked.

Launchpad

• An import shows as a row in the machine list with its own progress bar, and the inspector shows the archive with a Stop Importing button. Several imports queue and run one at a time. When one finishes, the imported machine is selected.
• Quitting while an import or export runs asks first, then stops them and waits for each to remove what it wrote before quitting.

Upgrading

Launchpad 2.9.2 works with VPhone.bundle 2.9.x and keeps helper build 16. Download the notarized vphone-launchpad-2.9.2-notarized.zip, then install VPhone.bundle 2.9.2 from Core Bundle; the import fix is in its vphone-cli, so imports need 2.9.2 as the default bundle. No machine needs to move or update its guest environment. The vphone-launchpad-2.9.2.zip built by CI is unsigned.

A crashed import from 2.9.1 or earlier may have left .import-* folders in your machine library (~/.vphone/machines by default). They are not machines and can be deleted.

v2.9.1

vphone 2.9.1

Core Bundle

• Template creation no longer fails on slower Macs: the setup boot waits out first-boot data migration with progress, and skips Setup Assistant without restarting SpringBoard. iOS 26 templates get their own trimmed service list, and a template's crash reports from its own boots are cleared before it is frozen. (#643)
• Guest idle wakeups are cut: vphoned polls device state only while an event socket is open, the camera, gyroscope and speaker stop their timers when idle. (#643)
• Device attitude simulation no longer resprings or deadlocks SpringBoard. (#647)
• vphoned sees clipboard changes made by guest apps. (#640)
• A right click is the secondary click instead of Home. (#641)
• The standard preset turns ProMotion on. (#645)
• vm export no longer fails on a stopped machine: the vphone.sock its last run left behind is skipped instead of refusing the archive.

Launchpad

• New Machine is one page with Advanced Options. It suggests a free name, marks downloaded firmware, keeps system apps by default, and has a Use Specified Firmware switch for your own IPSWs. Slimming works with or without a template. (#649)
• A Machine menu in the menu bar follows the selection, with shortcuts: Start ⌘↩, Start Headless ⌥⌘↩, Stop ⇧⌘., Settings ⌘I, Snapshots ⇧⌘S, Export ⌘E, Show in Finder ⇧⌘R. Rename and Clone (⌘D) are in Edit, the Delete key deletes the selection, and View has Refresh ⌘R and Recent Commands ⇧⌘L.
• The machine menu is regrouped, with Maintenance and Logs submenus and a Terminate item that force stops a hung guest.
• Export goes straight to the save panel and writes a .vpea archive without the restore IPSWs. Exported archives and IPSWs can be dropped on the window.
• Templates is one line per template with preset, disk and slimming columns. Downloaded Firmware gets a Device column and deletes any IPSW, saying what the deletion breaks. A deleted machine no longer keeps its IPSWs claimed.
• A created machine's patches open read-only. The inspector shows a running creation's step once and names what a progress bar measures.
• Log, Templates and Downloaded Firmware sheets are wide; every table sorts by each column and selects several rows.

Upgrading

Launchpad 2.9.1 works with VPhone.bundle 2.9.x and keeps helper build 16. Download the notarized vphone-launchpad-2.9.1-notarized.zip, then install VPhone.bundle 2.9.1 from Core Bundle and move your machines to it with Change Core Bundle…; turn on Update guest environment for the vphoned and guest component fixes. Templates built with 2.9.0 stay usable. The vphone-launchpad-2.9.1.zip built by CI is unsigned.

v2.9.0

vphone 2.9.0

Core Bundle

• vm create now makes each machine as a clone of a template: one per IPSW, device, preset and slimming choice, trimmed and set up once. A machine costs about 0.6 GB instead of about 20 GB, and creating one from an existing template takes under a second plus its first boot. Templates live in <library>/.templates and never boot as machines. vm template list|show|adopt|delete|trim|setup drive the steps, and --no-template keeps the old independent restore. Machines cloned from one template share its SEP root secret and Data-volume keys; use --no-template for a machine that needs its own. (#633)
• Template setup trims about 1.2 GB from the System volume, deletes the orig-fs snapshot, skips Setup, removes 10 default system apps (Camera and Phone stay) and applies a launchd service profile that disables 141 jobs. vphoned adds services.profile, setup.settle, apps.remove_system / apps.restore_system and apfs.snapshots / apfs.snapshot.delete, and a refused RPC carries vphoned's whole error object through vphone.sock. (#633)
• vm rebase <vm> --onto <base> shares identical disk blocks between machines that already exist. Only the disk image changes, and both machines must be stopped. (#617)
• Gyroscope and device attitude simulation, with live controls under Features › Motion Sensors in the VM window. (#635)
• fw prepare downloads IPSWs over four connections; --download-connections <1-16> sets the count. (#626)
• CFW keeps its scratch files beside the VM when the VM is on an external volume. cfw install, update-environment and update-kernel take --work-parent. (#632)
• Disk images are attached, ejected and converted with diskutil instead of the deprecated hdiutil. (#630)
• iOS 27 locationd no longer crashes or hangs on cohort queues as it starts. (#636)
• Flutter AOT callbacks run again where vm_remap lost RX protection. (#627)
• apps.install takes IPAs that expand to 8 GiB or hold 400,000 entries. (#637)
• cfw install and cfw update-kernel no longer fail on the work folder in an optimized build. (#628)
• vm clone, vm snapshot and vm revert no longer crash on macOS 27, whose devfs device number does not fit a signed 32-bit value.

Launchpad

• New Machine has a Slim System switch and a Template page: trim tier, kept languages, service profile, Apple Account and the apps to remove. Without a matching template, Launchpad builds one first and then clones the machine from it. (#633)
• File › Templates… lists each template's size, the machines that use it and whether it is current, and deletes templates. (#633)
• Guest System… switches a running machine's service profile and restores removed apps. (#633)
• The Machines table and the inspector show each machine's exclusive disk use. (#633)
• vphone-launchpad-cli vm create takes the template and slimming switches. (#633)
• CFW installs and updates on a machine on an external volume keep their scratch files there. (#632)
• The helper is build 16 and accepts VPhone.bundle 2.9.0 or later. Launchpad reinstalls it on the next start.

Upgrading

Launchpad 2.9.0 needs VPhone.bundle 2.9.x, because the helper passes --work-parent to the CFW commands and New Machine and Templates run vm template and vm create --template. Download the notarized vphone-launchpad-2.9.0-notarized.zip, then install VPhone.bundle 2.9.0 from Core Bundle and move your machines to it with Change Core Bundle…. Turn on Update guest environment to get the locationd fix and the Flutter remap repair. Keep Launchpad and VPhone.bundle in the same series. The vphone-launchpad-2.9.0.zip built by CI is unsigned.

v2.8.0

vphone 2.8.0

Core Bundle

• Sync Host Location is now a per-machine setting that reaches the guest. Set it with vm config <name> --sync-host-location on|off, at Location › Sync Host Location in the VM window, or in Launchpad. It is off by default, and a headless launch syncs only when the machine is set to. When the guest's own Location Services switch is off, the VM window says so once instead of failing silently; turn it on in the guest's Settings. Machines on different bundles can now sync at the same time. (#616)
• vphoned restarts a locationd that deadlocks as it starts on iOS 27.0, which left Maps and every location request hanging. (#616)
• The guest's device name is the VM's name. Xcode, devicectl and Finder show it, the guest refuses renames, and vm rename applies at the next connect. A VM name that cannot be a device name leaves the guest's own name. (#609)
• A DeviceHub stream that splits frames into bands no longer deadlocks the host GPU. (#624)
• Xcode can install apps on iOS 27 guests again. The new standard patch system-installcoordination_proxy-cfw-persona_lookup lets only the CoreDevice installation proxy look up UserManager. (#614)
• Apps installed by a package (through Irisin, apt or dpkg) are registered on iOS 27, where uicache cannot. App registration and refresh build the same record uicache does. (#619, #621)
• While a bootstrap is installed, spawned processes get three times their jetsam memory limit. (#618)
• Two guest libraries for a signed-out guest: libsigninfix makes Apple Account, iCloud, store and Game Center sign-in sheets inert, and libprefsfix hides the follow-up suggestion groups in Settings. (#620)
• vphone-vm no longer writes NVRAM boot-args the guest never reads. Guest boot-args come from the iBoot patch applied by cfw install. (#613)

Launchpad

• A machine's Settings have a Location section for Sync Host Location. (#616)
• CFW installs and updates run on different machines side by side; only one runs per machine at a time. Cancel stops only that machine's operation. (#611)
• A machine can be deleted when its own Core Bundle is missing or from another series. (#610)
• File › Downloaded IPSWs… lists the IPSW cache with the machines that use each file, and deletes IPSWs no unfinished creation needs. (#623)
• iPad guests show iPadOS in the Machines table and the inspector. (#622)
• The Chinese strings say 创建快照 for taking a snapshot.
• The helper is build 15 and accepts VPhone.bundle 2.8.0 or later. Launchpad reinstalls it on the next start.

Upgrading

Launchpad 2.8.0 needs VPhone.bundle 2.8.x, because a machine's Settings pass vm config --sync-host-location. Download the notarized vphone-launchpad-2.8.0-notarized.zip, then install VPhone.bundle 2.8.0 from Core Bundle and move your machines to it with Change Core Bundle…. Turn on Update guest environment to get the device name, the locationd restart, the banded-stream fix, app registration and, on iOS 27 guests, the Xcode install fix. Keep Launchpad and VPhone.bundle in the same series. The vphone-launchpad-2.8.0.zip built by CI is unsigned.

v2.7.0

vphone 2.7.0

Core Bundle

• Xcode 27's DeviceHub shows a guest's live screen on iOS 26, iPadOS 26 and iOS 27. It used to spin forever. A new guest library, libdevicehubfix, lets the Developer Disk Image mount on iOS 27, gets dtremotedisplayd to offer the stream, and gives iPhone guests the bezel mask so the screen stays inside the frame. On iOS 27 the display patch dyld-boot-iomfb_force_kern now sends only the main display through the kernel, so DeviceHub's own display is no longer black. An installed iOS 27 guest gets the new patch on its next guest environment update. (#604)
• Known issue: with several VMs streaming, or while the Mac restores or downloads, the DeviceHub view can freeze for a few seconds or fall up to a couple of seconds behind. The VM window is not affected, and starting a new stream clears the delay. iPadOS 27 guests refuse pairing, so DeviceHub is untested there. (#604)
• vm clone --new-identity gives the copy its own ECID, UDID and MAC without a restore, so it can run beside its source. It also clears a fixed IPv4 address, port forwards and a hand-chosen mDNS name. The clone shares most of its disk blocks with the source on APFS. Every vm clone now refuses while the source is running. (#605)
• vm snapshot create|list|revert|delete saves a stopped machine's disk, SEP storage and NVRAM as APFS clones and puts them back. Settings and device identity are not part of a snapshot, and vm export and vm clone leave snapshots behind. See Documents/Guides/snapshots.md. (#605)
• Quitting a VM shuts the guest down first. Closing its window, ⌘Q, vm stop and Control-C in vm launch ask the guest to shut down, and turn the VM off only when the guest has not halted after 15 seconds or cannot be asked. (#608)
• Two opt-in patches hide Settings rows on iOS 27.0 (24A435): system-preferences-exp-root_rows hides Apple Account, Game Center, iCloud and Wallet & Apple Pay, and dyld-exp-settings_software_update_row hides General › Software Update. Both are off in the standard preset and refuse other builds. (#606)

Launchpad

• Clone has a New device identity switch, on by default. (#605)
• Snapshots… opens a machine's snapshots, where you can take, revert and delete them while the machine is stopped. Launchpad keeps its record of the machine with each snapshot, so a revert also restores the guest environment and boot chain it shows. After a revert to a snapshot taken with the CLI, both show as Unknown. (#605)
• Host Setup's free disk space follows the volume while Launchpad is open, instead of updating only at launch and on Recheck. (#607)
• A guest that prints a lot to its console no longer slows Launchpad down. (#602)
• The Chinese strings call the privileged helper "Helper". (#601)
• The helper is build 14 and accepts VPhone.bundle 2.7.0 or later. Launchpad reinstalls it on the next start.

Upgrading

Launchpad 2.7.0 needs VPhone.bundle 2.7.x, because Clone passes vm clone --new-identity and the Snapshots sheet runs vm snapshot. Download the notarized vphone-launchpad-2.7.0-notarized.zip, then install VPhone.bundle 2.7.0 from Core Bundle and move your machines to it with Change Core Bundle…. Turn on Update guest environment to get DeviceHub screen viewing; on an iOS 27 guest the same update replaces the display patch. Keep Launchpad and VPhone.bundle in the same series. The vphone-launchpad-2.7.0.zip built by CI is unsigned.

v2.6.1

vphone 2.6.1

Core Bundle

• iPhone18,1 and iPhone18,2 (iPhone 17 Pro and 17 Pro Max) boot iOS 27. Their iOS 27 dyld cache is larger than the cloudOS 26.4 guest kernel's 6 GiB shared region, so it could not map and launchd panicked on first boot. The new kernel patch kernel-boot-shared_region_size widens the region to 7 GiB. It is boot-essential for iOS 27 and reaches an existing machine through cfw update-kernel followed by cfw install. (#599, #596)
• cfw install refuses a dyld cache that does not fit the guest kernel's shared region, and names both sizes, instead of finishing a guest that panics on first boot. (#599)
• Opening the camera no longer freezes the VM. The virtual camera's code patcher now stops cameracaptured's other threads while it rewrites a page, so its XPC threads no longer crash on a page that is briefly not executable. (#598)
• Compiler warnings are fixed. (#597)

Launchpad

• No changes. Keep using the notarized Launchpad 2.6.0; the vphone-launchpad-2.6.1.zip built by CI is the same app, unsigned.

Upgrading

Launchpad 2.6.0 works with any VPhone.bundle 2.6.x and installs this one from Core Bundle. Move your machines to it with Change Core Bundle…. For an iPhone18,1 or iPhone18,2 machine on iOS 27 that did not boot, stop it, choose Update Kernel in the inspector's Patches section, then Change Core Bundle… with Update guest environment on.