Enthusiast boots iOS 16 on Redmi Note 12 — a proof of concept that rewrites the rules of mobile hacking

Enthusiast boots iOS 16 on Redmi Note 12 — a proof of concept that rewrites the rules of mobile hacking

An independent developer has managed to boot an unmodified copy of iOS 16 on a budget Android smartphone — the Redmi Note 12. As reported by Kod.ru, the device reaches the lock screen, but cellular connectivity and GPU acceleration remain non-functional. The project is a pure proof of concept, yet it demonstrates how far the open-source ecosystem for Apple’s XNU kernel has come.

How it works under the hood

The Redmi Note 12 is powered by a Qualcomm Snapdragon 685 chipset — an ARM-based SoC with no official Apple compatibility. To run iOS, the enthusiast had to port the XNU kernel (the core of iOS and macOS) to the Snapdragon’s architecture. This involves rewriting low-level drivers for memory management, interrupts, and timers, while keeping the iOS userspace completely untouched.

The boot process goes through several stages:

• Bootloader bypass: The Qualcomm bootloader is tricked into loading a custom kernel image.
• XNU initialization: The kernel sets up virtual memory, threads, and the I/O Kit framework.
• iOS launch: The unmodified iOS 16 ramdisk is loaded, showing the Apple logo and eventually the lock screen.

Because the GPU (Adreno 610) drivers are proprietary and not written for Apple’s Metal API, the graphics stack fails — hence no smooth animations or touch response beyond basic UI rendering via CPU fallback.

Why this matters for the community

This is not the first time iOS has been booted on non-Apple hardware — similar experiments were done with the Nokia N900 and later with Raspberry Pi. However, running iOS 16 on a modern Snapdragon device is a significant step. It proves that Apple’s kernel is portable enough to run on commodity ARM hardware, at least in a limited form.

For developers working on jailbreaks or custom iOS tools, this opens up new debugging possibilities: you can test kernel-level exploits on cheap Android hardware instead of expensive iPhones. For the average user, it remains a curiosity — but one that highlights the growing convergence of mobile platforms.

“Running iOS on a $200 Android phone is like putting a Ferrari engine in a bicycle. It’s absurd, but it teaches you a lot about both.” — comment from the developer community.

What this means for privacy and security

Projects like these often raise questions about locked-down ecosystems. If an enthusiast can boot iOS on unsupported hardware, what stops malicious actors from running modified iOS versions on stolen devices? The answer is the Secure Enclave and SEP (Secure Enclave Processor) — Apple’s hardware security module, which is tightly coupled to the iPhone’s custom silicon. Without it, Face ID, Apple Pay, and iCloud Keychain remain inaccessible.

Still, the ability to run iOS on non-Apple hardware could be used to reverse-engineer system protections, find vulnerabilities, or even create custom iOS-based tools for penetration testing.

Practical takeaways for the reader

If you’re a developer or a security researcher, this project is a reminder that the boundaries between mobile OSes are blurring. Tools like CherryOS and Corellium already allow virtual iOS emulation, but native booting gives you real hardware access. For everyone else, it’s a fascinating glimpse into the underground world of mobile hacking.

And if your ISP throttles your connection or blocks certain services while you explore such projects, a reliable multi-key VPN for just 5 ₽ per day with white-list bypass is available in @yavpn_robot.