hackmate tl

running unmodified apple silicon macos on intel. thats the whole goal.

its basically rosetta 2 in reverse. rosetta runs x86 apps on apple silicon. this runs the entire arm64 os on intel, by translating arm64 into x86 underneath the macos kernel.

uefi
 └─ opencore (or plain ovmf for testing)
     └─ hackmate tl core   <- this repo
         ├─ tiny freestanding x86 core (its own gdt/idt/paging/allocator)
         ├─ arm64 -> x86 translator (interpreter + w^x jit)
         ├─ guest ram + guest memory mapping
         └─ the real unmodified apple silicon macos kernelcache

status: super early. does NOT boot macos yet. rn it boots a tiny core, takes over the machine after uefi, runs its own paging, and actually executes real macos kernel startup instructions (pulled from the real kernelcache) through both an interpreter and a jit that agree byte for byte. thats it so far. long way to go. see the table below.

companion to hackmate. hackmate makes old macos boot on non-apple hardware. this one asks if the new apple-silicon-only macos can too.

why this isnt totally crazy

apple ships a virtual apple silicon machine (VirtualMac2,1) that their own kernel boots on. and it mostly uses normal virtual hardware, gicv3, pl011 uart, psci, virtio disk. graphics is a paravirtual metal stream, not a real apple gpu. the kernel only touches ~12 apple specific system registers. so the hard part isnt faking a whole m-series chip, its translating arm64 fast enough and providing that smallish platform. full evidence-graded writeup is in docs/.

build / run / test

need clang + lld, qemu + ovmf, and ipsw for the provenance check. on mac: brew install lld qemu ipsw

./scripts/build.sh    # builds the efi payload (loader + core, one PE)
./scripts/run.sh      # boots it in qemu and checks the serial output
./scripts/test.sh     # host tests + checks the xnu bytes match the real kernelcache

run.sh only passes if every checkpoint shows up and the core exits clean. timeouts and crashes dont get swallowed.

where its at

step	what	done
1.0	loader + core survive ExitBootServices	yes
1.1	core owns its stack + cr3, full exception handling	yes
1.2	dynamic paging, guest ram, w^x code cache, first fake arm64 block	yes
1.3-1.5	run real macos kernel startup blocks (interp == jit)	yes
1.6	auto-verify the xnu bytes against the shipping kernelcache	yes
m1	run from the proven entrypoint with a real boot context	not yet
…	mount root, userland, windowserver, desktop	not yet

every real macos byte it runs gets diffed against the actual kernelcache (sha256 + per instruction), so the "its running real code" claim cant quietly drift into fake.

whats in here

• loader/ the uefi side
• core/ the freestanding core: paging, guest memory, w^x jit, arm64 translator (a64.c)
• shared/ abis, memory layout, the xnu provenance fixtures
• tests/ host tests
• scripts/ build / run / test / provenance
• docs/ step by step reports, serial transcripts, the feasibility analysis

honesty

hard rule: this does not claim to boot macos until it actually does. "real kernel instructions run" is not "macos boots" and the docs never pretend otherwise. if somethings unproven it says so.

legal

interop + research. no apple binaries in here. the xnu instruction fixtures are just measured facts about a kernelcache anyone can download, each one recorded with its file offset + disassembly and checked against the original at test time. apple, macos, apple silicon and rosetta are apple trademarks. not affiliated with apple.