What stands in for Apple hardware
What iOS expects from an iPhone X, and what answers in its place.
The iOS user space is the iPhone X’s (D22AP). It asks the platform questions an iPhone answers from Apple silicon and
iBoot. On a phone with no Apple silicon, each question is answered by the device tree the build writes, or by
a kernel driver of ours. This page lists them; the reasons are the comments in mkadt.py. The kernel’s own stand-ins for Apple’s security components are on the
Architecture page.
What iBoot did
| Apple | Here |
|---|---|
iBoot loads the kernel, builds the device tree and boot_args | the shim (payload) copies the kernel, places the ADT and builds boot_args revision 2 |
the boot manifest’s SHA-384 (/sbin/mount -P 1 exits without it) | /chosen boot-manifest-hash, a fixed stand-in |
libimg4 (cryptexd aborts without it) | /chosen crypto-hash-method sha2-384 |
the board’s identity (hw.model, hw.machine) | / compatible starting D22AP and model iPhone10,3; /product from your IPSW’s device tree |
| the chip’s ECID and ID | a synthetic unique-chip-id (SPAC + 1 on spaced) and chip-id 0x8015; XNU derives IOPlatformUUID from them, so preferences by host work |
| the phone’s serial number | a placeholder the shim overwrites with LK’s serial at each boot |
| Wi-Fi and Bluetooth addresses | synthetic, locally administered MACs derived from the ECID |
| local boot policy | /chosen/asmb lp-sip0 0x6f and lp-sip1 1: SIP relaxed like csrutil disable, with an unsealed root; the shared cache is in no trust cache |
What Apple silicon provided
| Apple | Here |
|---|---|
| SEP, effaceable storage | none: /defaults no-effaceable-storage, so keybagd reads systembag.kb as a plain plist |
| security and production status | /chosen values of a dev-fused, undemoted board: mobileactivationd then activates without a record (no SEP, no baseband here) |
| the PMU and its watchdog | /arm-io/wdt no-pmu: watchdogd crashes setting the PMU boot stage without it |
| the Home button | /buttons home-button-type 2: no Home button |
display (AppleCLCD, IOMobileFramebuffer) | /arm-io/disp0 (mapple,display, a canvas of the iPhone X’s size by default) and MappleFramebuffer.cpp over LK’s framebuffer (/mapple-fbcon) |
| the interrupt controller | MappleGIC.cpp for the GIC, MTKEINT.cpp for external interrupts |
| the platform expert | MapplePlatformExpert.cpp |
| the GPU | MappleGPU.cpp and a Metal driver over Panfrost, started by mp_gpu |
| the touch controller | hid/ILI7807S.cpp, fed by mtkloader’s firmware upload |
| buttons | hid/MTKKeypad.cpp (volume down) and hid/MT6358Keys.cpp (power, volume up through the PMIC wrapper MTKPwrap.cpp) |
| Wi-Fi | MT6631WLAN.cpp in the registry, over the CONNSYS driver mt6631_wifi.c; wifid starts only when a node named wlan exists |
| storage | mtk_ufs.c drives the UFS host LK leaves running (/mapple-ufs) |
What MobileGestalt reports on top of this (the screen class, the home-button-less interface, artwork, the product name) comes from the
identity above and the display node, which is why display-scale is 3 and the product name is the phone’s.
Source: tools/mkadt.py of mapple_build at f7431bb; the kernel files above at 76b737c (iokit/Kernel/arm/, bsd/dev/).
Applies to realme 8i (spaced), release 1 · Updated 15 November 2026