Other Apple (Apple Ecosystem): open-source projects that exist because someone reverse engineered a closed product, sorted by GitHub stars.
Run macOS on QEMU/KVM
Open-source Apple-compatible boot loader built from macOS boot RE
Windows Precision Touchpad driver for Apple trackpads
iOS Objective-C headers, including private frameworks, derived from runtime introspection
Open AirPlay mirroring server for the Raspberry Pi
Use AirPlay to stream to UPnP and Chromecast devices
AirPods battery and ear-detection support for Windows and Linux via BLE advertisements
Pure Python implementation of iOS device protocols
Node.js implementation of the HomeKit Accessory Protocol
AirPlay 2 receiver implementation in Python
iPhone 11 emulated on QEMU
Scripts that decode Apple BLE advertisements
Restore and update iOS device firmware without iTunes
Converts Apple's NeuralHash CSAM detection model to ONNX
xnu-qemu-arm64
Headers for private frameworks and undocumented interfaces of iPhoneOS 3.x
Open-source reimplementation of Apple's closed SwiftUI framework
An improved nm + Objective-C & Swift class-dump
Python client for Apple TV and AirPlay devices using reverse-engineered protocols
Animoji app built on Apple's private AvatarKit framework
Converts iOS Simulator app bundles into unsupported iOSMac (Marzipan) apps
Reverse-engineered Apple's macOS aerial video wallpaper system to set custom video wallpapers
Windows app that shows AirPods status and controls noise modes over Bluetooth
Precision Touchpad driver for Apple Magic Trackpad 2 on Windows 11
An open source implementation of Apple's Wi-Fi Password Sharing protocol in Python.
Reverse-engineered Apple Continuity protocol docs and Wireshark dissectors
Python implementation of the HomeKit Accessory Protocol
Reverse-engineered Apple Maps Flyover 3D satellite data format and API
Class-dump any Mach-o file without extracting it from dyld_shared_cache
Port Linux to the iPhone
Maintained class-dump of macOS headers, including private frameworks
tvOS web browser built on private UIWebView API
Backport of Apple Liquid Glass UI for iOS 13-18 and reimplementation for iOS 26+
Reverse engineering Rosetta 2 on M1 Mac
iPhone battery, charging and thermal instrument built on private iOS APIs
Reverse engineered C headers from various private iOS frameworks
Animoji generator using private AvatarKit APIs
Patched Linux hid-apple driver to remap Fn/Ctrl and tune Apple keyboards
Reverse-engineered Apple Enhanced Contactless Polling (ECP) NFC frames
Running UIKit apps on macOS via private Marzipan frameworks
Restores access to the private MediaRemote framework (now-playing info and control) on all macOS versions
Linux driver for MacBook SPI keyboard, touchpad and Touch Bar
Replacement for the macOS VPN status menu using private APIs
Reversing the Apple sandbox
Clickwheel iPod emulator
Macintosh SE/30 logic board recreation
Linux USB gadget emulating an iPod for car audio playback
Objective-C runtime headers for Apple's iOS, macOS, tvOS and watchOS frameworks
AirPods battery and listening mode in the Omarchy Linux bar via BLE
Linux driver for the first-generation Siri Remote, from its reconstructed Bluetooth reports
Adds Touch Bar buttons to the Control Strip using private macOS API
Collection of private CoreGraphics and SkyLight routines
HomeKit Accessory Protocol implemented from reverse engineering before Apple published it
Python HomeKit controller and accessory implementation
Extracts dynamic libraries from the macOS dyld_shared_cache
Extracts data from Xcode Instruments .trace documents
rvictl for Linux and Windows: capture packets sent/received by iOS devices
Exposes hidden SwiftUI APIs
xnu-qemu-arm64-tools
Instant three-finger space switching on macOS via private APIs
Interprocess dlsym() for OS X and iOS
Research on the Apple VAS NFC loyalty pass protocol
Reverse-engineered tvOS parallax image format library
Showcase of private NSUserNotification APIs on OS X
Reverse engineering of Apple's Content Caching service protocol
Reverse engineering of OS X gesture and multitouch frameworks
TrollStore app showing iOS cellular information via private APIs
Inspecting Apple's new predictive text model in macOS Sonoma
Hand decompilation of macOS Hypervisor.framework
Run and hot-reload Flutter iOS apps from Linux without Xcode or macOS
Reverse-engineered Apple Liquid Glass icon format and extracted icons
Brings Apple's Liquid Glass effect to Qt6 apps using undocumented macOS APIs
CLI for managing AirPods, Beats and Galaxy Buds over their Bluetooth protocols
Beacon firmware implementing Apple's iBeacon via reverse engineering
Patch Thunderbolt firmware through TI PD interface
A parser for Unified logging tracev3 files
Unofficial documentation of the JavaScript API of the macOS sips tool
Non-jailbroken code snippets using reverse engineered iOS private APIs
Reverse engineered headers for Apple's private CoreSymbolication framework
Python reimplementation of Apple's ibtool for compiling iOS Interface Builder files
Unofficial AirPlay protocol specification
Turn a 3rd-gen Apple TV Siri Remote into a programmable macOS controller
Documentation of private Apple APIs
Reverse engineered Apple Lisa PCB designs
Asyncio HomeKit controller library
Dumps files from 'rkos' ftab firmware images found in Apple micro-devices.
Reverse engineering of Apple's geolocation services and database scraper
Patch for Apple's pam_tid adding Apple Watch sudo authentication
Control Linux with an Apple TV Siri Remote over BLE
Reverse engineering Apple GymKit
AirPlay receiver for Linux
Parse and disassemble Apple .metallib files in the browser
Reverse engineering Apple's Stickies.app
Interact with trustcaches
Tools to recreate Apple's Liquid Glass effects from reverse engineering
Hammerspoon modules using undocumented macOS APIs
Core Animation and Core Graphics private API/SPI headers
CLI tool for Grabbing the AirPods Battery Status
Wireshark dissectors for Apple accessory protocols such as AAP
SEP firmware splitter, made in rust.
A Gnome Shell Extension to display the battery levels of your Airpods (and case) in the top bar.
SMC utility for modifying and examining Apple's SMC payloads.
Command-line tool to dump the contents of dyld shared cache files
Class-dumped headers of macOS private frameworks
Deconstruction of macOS 26 Liquid Glass effects
Live iPhone charging watts read through private APIs
Android client for iCloud Notes with reverse-engineered CRDT write path
Go bindings for Apple frameworks, including a package for undocumented private APIs
Xcode template for custom Quartz Composer patches via the unofficial API
Apple Watch watchOS kernel read/write and live process memory dumping
Reverse-engineered Apple's circular App Clip Code format; generator
A Windows Service for reading Airpods Battery and some other informations.
Reverse-engineered Macintosh 68k ROM source
airpods battery viewer for Windows
Check AirPods battery instantly
Firmware validation of Apple T1 and prior Macs
A Linux CLI utility for checking the AirPods battery level
Tool for managing Image4 files.
Structures, function definitions, and code reversed from old iBoot
Python library for handling Apple Wireless Diagnostics file formats
apple_net_recovery
libibackup
Reverse-engineered struct layouts for Apple's ld-prime and ld64 linkers
Apple Integrity Formats (img4, chunklist, trustcache, etc)
Python bindings for libimobiledevice
Linux Kernel Mode Driver for Apple USB Target Disk Mode
Reverse engineering the Apple Newton 2x00 ROM
Static analysis tool for iOS and macOS firmware files
Server implementation of Apple's reverse-engineered PhotoStream protocol
Apple Silicon to Apple Silicon VDM utility
Reverse-engineered macOS Summary Service / SearchKit SKSummary
Dims MacBook keyboard backlight below the macOS minimum using private CoreBrightness APIs and IORegistry
Open reimplementation of Apple's derq utility
Clean open reimplementation of Apple's intentbuilderc tool