Nyxian

A full native IDE and a userspace microkernel for building and running iOS apps entirely on-device. offline, unjailbroken, iOS 18.4 through iOS 27 Beta 4

What is it?

Nyxian is an iOS app that empowers developers with a full toolchain they can use while even being offline for iOS development on iPhone. It supports Swift, C, Objective-C, C++ and Objective-C++. It’s a powerful IDE that made the impossible possible, a fully on-device iOS IDE that doesn’t even need a cloud and can even be used with airplane mode enabled after it downloaded the SDK and resources from our server. It supports officially iOS 18.4 all the way up to the latest iOS version (iOS/iPadOS 27 Beta 4 tested). You can compile and run iOS apps on the go with ease, using the entire iOS 26.5 SDK.

Installation

To start using Nyxian view the Installation Guide.

Todo

• IDE
  • Compiling code
    • C support
    • Objective-C support
    • C++ support
    • Objective-C++ support
    • Swift support
  • Typechecking
    • C support
    • Objective-C support
    • C++ support (limited)
    • Objective-C++ support (dead without indexing)
    • Swift support
  • Linking objects to MachO
  • Indexing
• Offline Code Execution
  • Code execution (via NSExtension)
  • Micro Kernel (ksurface)
    • radix trees
    • object API
    • process object
    • privelege model
    • custom entitlement blob (you can also sign apps like CocoaTop on your desktop using nxtool)
    • Syscall handling
      • Mach IPC syscall server
      • Task port handoff (usually they are guarded we bypass that by moving a receive right after the send right has been set as exception port to the host and then executing a __builtin_trap which then causes the host to get a ÌKOT_TASK which is a control task port which can be reference retained and boom we got our redistributable unguarded task port)
      • Memory copy in/out of guests (yep out of the iOS processes and into them without assistance, this is not a typo lol)
    • Subprocess Patches
      • posix_spawn/posix_spawnp fix
      • vfork fix
      • sysctl fix
      • tty support on iPhone and the necessary ioctl fix (tho not entirely yet, it only works when NXWindowSessionTerminal creates it, but it is already progress)
      • libproc fix
      • task_for_pid/task_name_for_pid fix (you heard right, that is not a typo)
      • patches to credential syscalls like setuid or setgid
  • Signing executables
  • CS bypass without exploit (by resigning and then dlopen)
  • Overwriting NSBundle/CFBundle without wasting 2000 branches like Duy Tran (a little side joke we laugh about at emexLabs "Yk how Duy Tran wasted 2000 branches to replace 2 pointers in memory")
  • Actually making new main NSBundle think it is loaded as a binary
  • Actually make iOS apps and binaries use the version as DYLD version they have been made for
  • hook svc #0x80 somehow without using JIT (not possible, for now)
  • load dylib from fd