Is there a way to directly run iOS binaries on M1 MacBooks?

user_4584387 0
Viewed 678

Since M1 MacBooks can run iOS apps directly, I wonder if there's a way to run iOS binaries directly, instead of only being able to run those from App Store?

I'm developing iOS apps with C without Xcode, my current workflow is:

  • build with xcrun -sdk iphonesimulator clang
  • pack into an iOS .app bundle
  • use xcrun simctl commands to copy & run on a simulator

it works good but it'll be real nice if I can directly run the built binary somehow, if i just run it directly it just says

% file app
app: Mach-O universal binary with 2 architectures: [arm_v7:Mach-O executable arm_v7] [arm64:Mach-O 64-bit executable arm64]
app (for architecture armv7):   Mach-O executable arm_v7
app (for architecture arm64):   Mach-O 64-bit executable arm64

% ./app
zsh: killed     ./app

which i honestly don't know what's up with it

the runnable iOS .app from App Store seem to have this structure:

iOSapp.app
├── WrappedBundle -> Wrapper/iOSapp.app
└── Wrapper
    ├── BundleMetadata.plist
    ├── iTunesMetadata.plist
    └── iOSapp.app

but I have no idea if any of these contribute to it being runnable, and couldn't find docs on these

apple-m1 apple-silicon macos-big-sur macos ios
1 Answers

Yes, Google P0 just found a way to do this:

As such, the full steps necessary to launch an iOS binary on macOS are:

Use the posix_spawnattr_set_platform_np API to set the target platform to PLATFORM_IOS

Execute the new process via posix_spawn(2) and start it suspended

Patch dyld to allow library interposing

In the interposed library, claim to possess the com.apple.security.cs.debugger entitlement by replacing xpc_copy_entitlements_for_self

Continue the process by sending it SIGCONT

The full link is https://googleprojectzero.blogspot.com/2021/05/fuzzing-ios-code-on-macos-at-native.html

user_159900420
Related