Scion

The iPhone's kernel,
grafted onto Android hardware.

Scion boots Apple's open-source XNU kernel directly on the Galaxy S9: no emulator and no Android underneath, with drivers written from scratch. iOS 16.5 runs on top, built on your own machine from your own IPSW.

Try it on an S9 Read the source

scion /ˈsaɪ.ən/: a cutting grafted onto another plant's rootstock.

8CPU cores, A55 + Exynos M3
25+drivers written for XNU
0bytes of Apple code in the repos
3Exynos 9810 phones targeted

Devices

Galaxy S9 SM-G960F · starlte · Exynos 9810

Daily-usable

iOS 16.5 from the phone's own flash, through the kernel's own UFS driver, with /private/var kept between boots.

All eight cores, load- and touch-driven DVFS
3.2 GB of RAM for iOS, up from 2 GB
Passcode lock in Settings and on the lock screen
Full-screen display in the panel's own shape
Kernel crypto on the CPU's AES/SHA instructions
GPU: Mali-G72 via Mesa Panfrost
AMOLED display, hardware scaling, zero-copy
Brightness slider
Touch, buttons, haptics
Battery, charger, thermal limits, RTC
Native UFS storage, persistent data
Wi-Fi joined from Settings (WPA2)
Speakers and system sounds
Front camera in the stock Camera app
USB log and console
Hardware video: H.264 and HEVC through the MFC block
Keychain encryption keyed to your passcode
Bluetooth audio: pairing fix in test
Sensors: orientation, proximity
Microphone into iOS
Face ID and fingerprint: research, secure OS now starts
Cellular modem
Rear cameras
Apple services (not a goal)

scion-starlte →

Galaxy S9+ SM-G965F · star2lte

Testers wanted

Same SoC; written but never run. Its first image boots a minimal configuration and returns to TWRP after 120 s with a log. Send us that log.

scion-star2lte →

Galaxy Note9 SM-N960F · crownlte

Testers wanted

Same as the S9+: the device repo is written, nobody has booted it yet. Your first run is the first.

scion-crownlte →

Pixel 10 Tensor G5 · frankel

Virtualised

A different route: XNU as a guest on Android's own hypervisor (AVF / pKVM), reaching the home screen in about 80 s, or fully emulated with Pyre, a Tensor-tuned fork of ChefKiss's Inferno. Both run from the Scion app.

scion → scion-avf → pyre →

How it boots

No Android, no Linux, nothing emulated. Each stage hands the hardware to the next.

  1. S-BootSamsung's bootloader, unlocked. Loads our boot image from BOOT.
  2. UEFIProject Silicium's open starltePkg, with Carbon Hypervisor at EL2 handling PSCI.
  3. xnuloaderOur loader: moves the payload, fences off modem and DSP memory, and builds the device tree.
  4. XNUApple's open-source kernel with our patch and drivers, on GIC-400 and six cores.
  5. iOS 16.5launchd, then SpringBoard, from the system image on SYSTEM.

Install on a Galaxy S9

Why there's no download button. The installer contains iOS's own files, taken from an IPSW. We can't distribute those and neither can you, so you build the installer yourself. It's yours: don't share it.

You need

  • Galaxy S9 / S9+ / Note9, Exynos (G960F, G965F, N960F, FD models OK)
  • Unlocked bootloader and TWRP
  • A Mac (or Linux) with about 20 GB free, to build
  • The iOS 16.5 IPSW for iPhone10,3/10,6 (20F66), downloaded yourself from Apple

Not supported

  • Snapdragon and Korean (N) models
  • Apple ID, iCloud, App Store, iMessage
  • Anything that makes the phone pass as an iPhone to Apple

Steps

  1. Back up. In TWRP, back up Boot, System and EFS, and copy the backup off the phone. EFS holds your IMEI.
  2. Build on your computer, in one command (about 20 minutes and 20 GB of free disk): 
    git clone https://github.com/Scion-Project/scion-installer
cd scion-installer
./build-installer.sh --ipsw /path/to/iPhone10,3,iPhone10,6_16.5_20F66_Restore.ipsw
    Add --device star2lte, crownlte or all for the S9+ and Note9. It checks your IPSW, lists any missing tools with the command to install them (macOS: Xcode command-line tools + brew install sevenzip lld llvm bison meson ninja), and writes the zip and its SHA-256 to ./out. It downloads nothing from Apple. Details and troubleshooting.
  3. Flash. Copy the zip to a microSD card or to /sdcard with adb push (adb sideload can't take a zip over 2 GB), then in TWRP go to Install, pick the zip and swipe. It checks the model, writes SYSTEM and BOOT, and verifies both by SHA-256. It refuses to touch EFS, the modem or recovery.
  4. Reboot to System.

Leaving: hold five fingers on the screen for 1.5 s to restart into TWRP with the log, or force-restart with Vol Down + Power. Restore your Boot and System backups to get Android back.

Source

scion-kernelXNU port, drivers, loader, tools · APSL 2.0 / MIT scion-starlteGalaxy S9: UEFI, configs, porting record scion-installerTWRP installers, tooling only scion-recoveryTWRP with APFS / HFS+ tools and log capture android_kernel_samsung_exynos9810The BSP the drivers' facts come from scionThe Pixel 10 app

Exynos 9810 drivers

Written fresh for XNU from the hardware facts in Samsung's GPL BSP. No Linux code copied in.

Display & GPU

exynos_dpus6e3ha8malibacklight

CPU & SoC

exynos_m3exynos_acpmexynos_cpufreqexynos_tmuexynos_hsi2cexynos_spi

Storage

ufshcext4

Input & sensors

s6sy761exynos_keysssp

Power

max77705s2mps18_rtc

USB

dwc3exynos_usb

Wi-Fi

exynos_pciebrcmfmacsta

Bluetooth

bcm4361_btbt

Audio

exynos_aboxmax98512cs47l93

Camera

exynos_cameras2mpb02_torch

Deep dives: Wi-Fi · Audio · Camera · GPU · Bluetooth · Sensors

Progress

FAQ

Is this an emulator?

No. On the S9 the XNU kernel runs directly on the phone's CPU cores, with drivers for its real hardware. Only the Pixel 10 route uses a hypervisor or emulator.

Can I use the App Store, iCloud or iMessage?

No, and that isn't a goal. Nothing here makes a phone pass as an iPhone to Apple's servers.

Why can't I just download an image?

An image contains iOS's own files, which only Apple may distribute. You build yours from an IPSW you get yourself, and it stays yours.

Can I go back to Android?

Yes: restore the Boot and System backups you took in TWRP. The installer never touches EFS, the modem or recovery.

Is the passcode real security?

Not yet. Partly. On the S9, keychain items are now encrypted under a key derived from your passcode, and forgetting the passcode loses them. Files aren't encrypted, there's no hardware-bound key yet so a short code can be guessed offline from a flash dump, and an unlocked bootloader lets anyone with the phone flash a modified kernel. Don't rely on it to protect serious secrets.

Does it work on the Snapdragon S9?

No. Only the Exynos 9810 models (G960F, G965F, N960F, and FD variants).

How can I help?

If you have an S9+ or a Note9, run the first test image and send us the log. Code, docs and driver reviews are welcome on GitHub.

Built on

HakiOSthe original XNU-on-Android port ChefKissInferno, the Apple-silicon QEMU Project SiliciumMu-Silicium UEFI and Carbon Hypervisor ExyHyperBrick & LineageOSthe Exynos 9810 BSP MesaPanfrost, for the Mali GPU