37C3 - Breathing Life into Legacy: An Open-Source Emulator of Legacy Apple Devices

Breathing life into legacy Apple devices, Matijn presents his open-source emulator for iPod Touch 1G and 2G, showcasing the boot ROM, iBoot, and kernel emulation, as well as his experiences with reverse-engineering and script-based conversions.

Key takeaways
  • The talk is about an open-source emulator for legacy Apple devices, focusing on the iPod Touch 1G and 2G.
  • The frame consists of three layers: boot ROM, iBoot, and the kernel.
  • The kernel is responsible for setting up the CPU, tasks, and peripherals.
  • The boot ROM contains the low-level bootloader that loads the main bootloader, iBoot.
  • Matijn’s project is a QEMU-based emulator that aims to emulate the iOS kernel and run third-party apps.
  • He uses a device tree to understand the hardware components and peripherals.
  • He reverse-engineered the iPod Classic and other older iPod devices using Ghidra.
  • He implemented a QEMU iOS emulator, which is compatible with the iPod Touch 1G and 2G.
  • The emulator currently has support for the SPI controller, MMIO, and persistent memory.
  • Matijn is working on stabilizing the emulator and adding support for more peripherals.
  • He uses the OpeniBoot bootloader and QEMU to emulate the device.
  • The project also includes script-based conversions of raw file systems and images.
  • Matijn shares his experiences and challenges in reverse-engineering the iOS kernel and boot process.
  • He provides examples of his work, including the SPI controller and interrupt controller.
  • His project is an effort to preserve the functionality of legacy Apple devices and keep them usable into the future.
  • He demonstrates his emulator, showing the home screen and ability to interact with the device.