Mastering vphone-cli (Part 2): Configuring the Jailbroken iOS 26.1 Virtual iPhone for Mobile Application Security Testing

In the Mastering vphone-cli (Part 1): Building a Jailbroken iOS 26 Virtual iPhone on Apple Silicon, of this series, we explored the architecture behind VPhone-CLI, how Apple’s Virtualization Framework makes it possible to run an iOS virtual iPhone on Apple Silicon, and how to build and boot a jailbroken iOS 26.1 research environment.

At the end of Part 1, we successfully booted a jailbroken iOS 26.1 virtual iPhone. However, a freshly booted VM is only the beginning. To transform it into a fully functional mobile security testing platform, several repositories, jailbreak utilities, reverse engineering tools, and runtime instrumentation frameworks must be installed. Without these components, performing dynamic analysis, bypassing application protections, inspecting local storage, dumping memory, intercepting HTTPS traffic, or interacting with applications using Frida becomes difficult.

In this article, I’ll walk through the exact setup that I currently use while performing iOS application security assessments.

By the end of this guide, you’ll have a research-ready iOS 26.1 virtual iPhone capable of:

1. Installing essential Sileo repositories
2. Installing pentest tools and jailbreak essentials
3. Connecting to the Virtual iPhone using SSH
4. Installing Frida and Objection
5. Keychain dump with Objection
6. Memory dump with fridump3.1
7. Intercepting HTTPS Traffic Using Burp Suite

Let’s begin.

1. Installing Essential Sileo Repositories

• Launch Sileo from the Home Screen.
• Navigate to:

Sources → + (Add Repository)

• Add the following repositories one by one.

http://apt.thebigboss.org/repofiles/cydia/
https://ellekit.space/
https://build.frida.re/
https://havoc.app/  --> default
https://ios.jjolano.me/
https://repo.misty.moe/apt/
https://opa334.github.io
https://apt.procurs.us/ --> default

Note: Havoc and Procursus are generally available by default, but verify they are present before proceeding.

After adding all repositories, allow Sileo to refresh package indexes.

2. Installing pentest tools and jailbreak essentials

Once the repositories have been added successfully, install the following packages from Sileo.

Simply launch Sileo and search for each package individually and install them:

• lldb
• odcctools
• Shadow
• SSL Kill Switch 3
• Filza
• OpenSSH
• NewTerm
• Choicy
• ElleKit
• Apple File Conduit “2”
• NewTerm 3 Beta
• wget

If Sileo prompts you to upgrade packages after installation, navigate to Packages and install all available updates before continuing.

These packages provide everything required for application testing, filesystem exploration, runtime instrumentation, SSH connectivity, debugging, and SSL pinning bypass.

3. Connecting to the Virtual iPhone using SSH

One of the first things we’ll want to configure is SSH access.

• Open Terminal on your Mac and connect using either the VM IP address or localhost.
• Using the VM IP:

ssh -p 2222 mobile@<IP_ADDRESS_OF_THE_VPHONE>

or

ssh -p 2222 mobile@127.0.0.1

Default password:

alpine

• After successful authentication, you’ll obtain a shell inside the virtual iOS device.

Having SSH access makes it significantly easier to install packages, transfer files, run Frida server, perform scripting, and automate repetitive tasks.

4. Installing Frida and Objection

At the time of writing this article, the latest Frida release (17.15.3) was not functioning correctly inside my vphone environment. After testing several versions, I found the following combination to be stable.

Install Frida Server on the Device:

• Connect to the device over SSH.
• Switch to the root user.

sudo su

• Navigate to the directory mentioned below:

cd
cd /tmp

• Enter the following command to download and install frida-server in the VM:

wget https://github.com/frida/frida/releases/download/17.9.0/frida_17.9.0_iphoneos-arm64.deb
chmod +x frida_17.9.0_iphoneos-arm64.deb
dpkg -i frida_17.9.0_iphoneos-arm64.deb

• Start Frida Server (it launches the Frida server as a background daemon.)

frida-server -D

Install Frida Tools on macOS:

• Create a virtual environment and activate it.

python -m venv venv
source venv/bin/activate

• Remove any existing installation.

pip uninstall frida frida-tools objection -y

• Install the compatible versions.

pip install frida==17.9.0 frida-tools==14.8.0 objection==1.12.4

• Launch an application on the virtual iPhone (for example DVIA-v2) and verify connectivity.

frida-ps -Ua

• If the running applications are listed successfully, your Frida setup is complete.

5. Keychain Dump Using Objection

• To demonstrate Keychain extraction, we’ll use DVIA-v2.
• Launch and follow the below functional path:

DVIA-V2 -> Local Data Storage -> Keychain

• Enter any sample value and save it.
• Next, launch Objection.

objection -n com.highaltitudehacks.DVIAswiftv2 start

• Inside the objection shell, execute:

ios keychain dump

• The saved value should now appear in the dumped keychain entries.

• This confirms that the virtual iPhone is fully capable of performing Keychain analysis during mobile application assessments.

6. Memory Dump Using fridump 3.1

The original Fridump project currently has compatibility issues with Frida 17+. Fortunately, Fridump3.1 resolves these issues.

Get Akash Katare’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Repository:

https://github.com/Xenorf/fridump3.1

• On the macbook, launch the terminal and enter the following command to install the fridump3 tool:

pip install fridump3

• Find the target process.

frida-ps -Ua

• Perform the dump.

fridump3 -u -s <PID>

• The application memory will be dumped locally, allowing you to inspect sensitive information, decrypted strings, authentication tokens, cryptographic material, or other runtime artifacts.

7. Intercepting HTTPS Traffic using Burp Suite

• On the MacBook, launch the terminal and determine Mac’s IP address.

ifconfig

• On the MacBook, launch open Burp Suite and select the ‘Options’ tab under the ‘Proxy’ tab.
• Click ‘Add’ under ‘Proxy Listeners’.
• Ensure that the ‘Binding’ tab is selected.
• Type ‘8080’ under ‘Bind to port’.
• Select the IP address that you discovered in step 1 under ‘Specific address’ or select All interfaces.

• On the virtual iPhone, configure the proxy.
• Go to the device’s settings.
• Tap on ‘Ethernet’.
• Tap on ‘Ethernet’.
• Under ‘HTTP PROXY’, click on Configure Proxy and select ‘Manual’.

• Under ‘Server’, enter your MacBook IP address.
• Under ‘Port’, enter the port number that you configured for the Burp Listener (probably 8080).

Install Burp’s CA Certificate

• Launch Safari on the virtual iPhone and browse to:
• Open ‘Safari’ on the device.
• Go to http://burp/cert.
• Tap on ‘Install’ in the ‘Install Profile’ window.
• Tap on ‘Install’ again in the warning dialog you receive.
• Tap on ‘Done’.

• Then navigate to:

Settings -> General -> About -> Certificate Trust Settings

• Enable trust for the PortSwigger CA certificate.

Verify Traffic Interception

• Open Safari and browse to any website.
• The HTTP/HTTPS requests should now appear inside Burp Suite.
• To verify application traffic, launch DVIA-v2.
• Navigate to:

Network Layer Security

• Enter any sample values and perform the request.

• You should now observe the application’s network traffic inside Burp Suite, confirming that HTTPS interception has been configured successfully.
• Further to bypass certificate pinning, you can make use of frida scripts or Objection as well.

Conclusion

With the repositories, jailbreak utilities, Frida, Objection, SSH, Burp Suite, and supporting tools configured, the vphone iOS 26.1 virtual iPhone is now ready for real-world mobile application security testing.