iOS Developer Toolkit (Swift)

A native macOS app for working with iPhones, iPads, and simulators — device information, live logs, location simulation, app installs, backups, packet capture, readiness checks, and documented evidence collection.

iOS Developer Toolkit is written in Swift and SwiftUI. It talks to devices through macOS's own device service (usbmuxd and lockdown), Xcode's CoreDevice service (devicectl), simctl, and Instruments. It needs no Python, no Homebrew packages, and no administrator rights.

Scope. This is a tool for devices you own or are authorized to examine. It does not jailbreak iOS, bypass a passcode, disable the sandbox, defeat code signing, decrypt protected traffic, or provide unrestricted file-system access.

The demo screenshots use the built-in Demo Mode (a clearly labelled simulated iPhone) or a real iOS simulator. They contain no real device data.

Readiness Check	Device details (simulator)

Live Logs (simulator)	Location Lab

Actions	Apps

Backup	Evidence Capture

More: Install App · External Tools · Scope & Safety

Many features use only macOS's built-in device service and work on a Mac without Xcode. Features that use Xcode's developer tools need Xcode installed (open it once to finish setup):

The Command Line Tools alone are not enough for the Xcode column: devicectl, simctl, and xctrace ship with Xcode.app.

1. Download iOS-Developer-Toolkit-Swift-VERSION-macOS-universal.zip and SHA256SUMS.txt from the latest release.

2. Verify the download:

   Terminal

   shasum -a 256 -c SHA256SUMS.txt --ignore-missing

   Optionally verify GitHub's build attestation:

   Terminal

   gh attestation verify iOS-Developer-Toolkit-Swift-VERSION-macOS-universal.zip --repo hideouts-io/iOS-Developer-Toolkit-Swift

3. Unzip it and move iOS Developer Toolkit (Swift).app to /Applications.

4. Release builds are ad-hoc signed and not notarized, so macOS asks for confirmation the first time. Control-click the app, choose Open, and confirm. If there is no Open button, go to System Settings › Privacy & Security and choose Open Anyway. Do not disable Gatekeeper.

Nothing else needs to be installed. The release also contains idt, the command-line tool, at iOS Developer Toolkit (Swift).app/Contents/MacOS/idt.

See Build from source.

1. Connect and trust. Connect the iPhone or iPad with a USB cable, unlock it, and tap Trust. Enter the passcode on the device — never in this app.
2. Choose the target. Use the device menu at the left of the toolbar. Physical devices and simulators are listed separately, and every page shows which one it acts on.
3. Run the Readiness Check. It tells you exactly what works and what to fix next.
4. Turn on Developer Mode if needed (iOS 16+): Settings › Privacy & Security › Developer Mode, then restart and confirm. Device › Developer Mode Guide walks through it.
5. Mount the developer image for screenshots, location simulation, and launching apps: the Developer Image page (in the sidebar, under Device) shows its state; click Mount Developer Image. See Developer images.
6. Clean up when finished: stop streams and clear simulated locations. Quitting the app clears a location this session simulated.

No device handy? Turn on Device › Demo Mode to explore every workspace with a simulated iPhone.

• Overview — status of the selected device, a suggested next step, and entry points.
• Device — identity and status with explanations, a summary of the developer image, Apple developer tool handoffs (open a project in Xcode, open an .xcresult or .trace, list Remote Virtual Interfaces), simulator controls, raw records, and connection diagnostics.
• Developer Image — the developer image on the selected device (state, details, mount, unmount), how to mount it (automatic, Xcode's device service, or the built-in client), the images on this Mac and folders you add, and what is mounted on the device.
• Firmware — the device and its mode (normal, recovery, or DFU), Apple's firmware for it and its signing status, downloads, the IPSW library (add, check signing, verify, show in Finder, move to the Trash), and installation.
• Readiness Check — the read-only prerequisite check, a copyable report, and a local history of tested devices that can be exported as sanitized JSON or Markdown.
• Apps — installed apps with search, sort, sizes, launch, and confirmed removal.
• Install App — inspect an .ipa (or choose a simulator .app), see whether the device is in the provisioning profile, then install.
• Location Lab — coordinates, map, saved places (stored only on this Mac), routes, GPX playback. Location events are appended to ~/Documents/iOS Developer Toolkit (Swift) Location Logs/location-events.jsonl.
• Live Logs — several concurrent streams; pop out any stream into its own window.
• Actions — the guided action catalog and Advanced Mode.
• Backup — encryption status and setup, full or incremental backups.
• Evidence Capture — optional guided case intake (title, purpose, authorization), collection, and a summary of every step.
• External Tools — MVT, UFADE, and idb Companion.
• Session Activity, Tool Reference, Scope & Safety — history, built-in tool help, and the app's boundaries.

Press ⌘K for the command palette, ⌘R to refresh devices, ⇧⌘R to run the Readiness Check, ⌘1–⌘9 to switch workspaces, and ⌥⌘← / ⌥⌘→ for the previous or next workspace. Help › Keyboard Shortcuts (⌘/) lists them all.

Because the code comes from the target's UDID, a confirmation can never apply to a different device. Each operation also captures its target when it starts, and lockdown sessions verify that the device answering is the one you selected.

Screenshots, location simulation, launching apps, and Instruments need Apple's developer image (Developer Disk Image) mounted on the device. The Developer Image page (sidebar, under Device) checks it automatically and shows one of these states; the Device page shows a summary:

The details list the iOS version and build, model, architecture, chip and board used to choose the image, where it is mounted, and which image on this Mac would be used.

iOS 17 and later use a personalized image. Xcode installs it in /Library/Developer/DeveloperDiskImages/iOS_DDI. Mounting picks the build identity for the device's chip and board and, unless the device already holds a personalization for that image, asks Apple's signing server (gs.apple.com) for one — sending the device's chip, board, and ECID with a one-time nonce, exactly as Xcode does. The confirmation says so before anything is sent.

iOS 16 and earlier use DeveloperDiskImage.dmg and its .signature for the exact iOS major.minor version. Current Xcode versions no longer include them; add a folder that contains them (for example an older Xcode's Platforms/iPhoneOS.platform/DeviceSupport/16.4) with Add Image Folder… on the Developer Image page.

How it mounts (Developer Image › How to mount): Automatic uses Xcode's device service (devicectl) when it can reach the device on iOS 17 and later, and otherwise the built-in client, which talks to the device's image-mounter service over USB and works without Xcode's device service. The app never downloads images from third parties.

The Firmware page (sidebar, under Device) installs iPhone and iPad firmware (IPSW files) the way Finder does, using idevicerestore and irecovery from the libimobiledevice project, bundled with the app as separate programs (see THIRD_PARTY_NOTICES.md).

• Device and mode. The selected iPhone or iPad, or a device in recovery or DFU mode (found every few seconds while the page is open). Enter Recovery Mode and Exit Recovery Mode, and step-by-step DFU instructions.
• Apple's firmware. Apple's firmware list (itunes.apple.com/check/version, the one Finder uses) gives the current firmware for the model, with Apple's SHA-1. Check Signing asks Apple's signing server whether it still signs that build — reading only the build manifest from Apple's server, and sending a random device ID, never the device's. Download saves the IPSW to the library, continues an interrupted download where it stopped, and keeps the file only if its SHA-1 matches Apple's.
• Library. IPSW files in ~/Library/Application Support/iOS Developer Toolkit (Swift)/Firmware. Add your own, check signing, verify (SHA-1 and SHA-256), show in Finder, or move to the Trash.
• Install. Choose an IPSW and Update (keeps apps and data) or Restore (erases the device). Check Before Installing confirms the firmware is for this model, has the right install type, is signed by Apple, and that the installer finds the device — without changing anything. Update needs the typed RUN confirmation; Restore is high impact. Progress is shown step by step; Stop works until the system starts being written, after which the install always finishes, since stopping then would leave the device unusable. Logs are kept in the library's Logs folder.

During an install, Apple's signing server receives the device's chip, board, and ECID to sign the firmware for it, as with Finder. Firmware that Apple no longer signs cannot be installed. The app does not offer jailbreak-style exploits or downgrades.

idt provides the automation-friendly parts of the app:

idt devices --simulators                      # list devices and simulators
idt readiness --udid <UDID>                   # read-only readiness check
idt inspect-ipa App.ipa [--json]              # inspect a package
idt collect --udid <UDID> --output-root ~/Cases --duration 120 --include-unified-logs
idt ddi status --udid <UDID> [--json]         # developer image state (exit 0 mounted, 2 mountable)
idt ddi mount --udid <UDID> --confirm "RUN ABC123" [--mechanism automatic|core-device|native]
idt ddi unmount --udid <UDID> --confirm "RUN ABC123"
idt toolchain                                 # check the installed Xcode

--include-oslog-archive adds the device's saved Unified Log history for the last hour (log collect); --include-dvt-logs records os_log through Instruments (DVT) for the stream duration. --include-oslog, the 0.3.x flag for the DVT OSLog stream, is still accepted and selects DVT logging.

idt collect exits with 0 when complete, 2 when finished with coverage gaps, and 1 when the device could not be identified.

• Least privilege. No administrator rights and no sudo. The app never reads /var/db/lockdown, never creates pairing records, and never restarts system services. Pairing material is requested from macOS's device service and kept only in memory.
• Verified connections. Lockdown sessions use TLS with this Mac's pairing certificate, pin the device certificate from the pairing record, and confirm the device's UDID before any request.
• No shell. External tools run from fixed paths with an argument vector and a minimal environment; nothing is interpreted by a shell. All process launches go through one audited runner with timeouts and cancellation.
• Untrusted input. Device responses, backup file paths, IPA archives, GPX files, and workspace profiles are validated; path traversal, symbolic links, encrypted or oversized archive entries, and XML entities are rejected.
• Local only. Nothing is uploaded, with one confirmed exception: mounting a developer image on iOS 17 and later asks Apple's signing server (gs.apple.com) to personalize it, sending the device's chip, board, and ECID with a one-time nonce — as Xcode does. Installing firmware sends the same kind of request, as Finder does; checking whether Apple signs a firmware uses a random device ID. The Firmware page reads Apple's firmware list and downloads IPSWs from Apple. Captures, backups, cases, and reports are written with owner-only permissions. The app's own log records outcomes rather than device content, and marks identifiers as private.
• Sanitized sharing. iOS Developer Toolkit › Create Support Bundle… and the readiness report exports remove names, identifiers, paths, and addresses. Review them before sharing.
• Hardened runtime, no App Sandbox: the app must reach the system's device service socket and run Xcode's tools. See SECURITY.md to report a vulnerability.

More detail: docs/troubleshooting.md.

Requirements: macOS 14+, Xcode 16 or later (Swift 6).

git clone https://github.com/hideouts-io/iOS-Developer-Toolkit-Swift.git
cd iOS-Developer-Toolkit

swift test                                    # unit and integration tests
swift build -c release --product idt          # the command-line tool

xcodebuild -project iOSDeveloperToolkit.xcodeproj -scheme iOSDeveloperToolkit \
  -configuration Release -destination 'platform=macOS' build

scripts/build-release.sh                      # universal, ad-hoc-signed release ZIP, SBOM, checksums in build-output/release/

The release includes the firmware helpers, which scripts/build-release.sh builds with scripts/build-restore-helpers.sh from pinned sources. That needs brew install autoconf automake libtool pkg-config cmake. To try the Firmware page from a development build, build the helpers once and point the app at them:

scripts/build-restore-helpers.sh
open --env IDT_RESTORE_HELPERS="$PWD/build-output/restore-helpers/out/bin" "iOS Developer Toolkit (Swift).app"

The app icon and logo come from one image, docs/brand/logo-source.png: xcrun swift scripts/generate-icons.swift writes the app icon at every size, the in-app logo, and docs/brand/ (icon-1024.png, iOSDeveloperToolkitSwift.icns, logo-1024.png, logo-512.png, logo.svg, and the repository's social-preview.png).

The Xcode project is generated from project.yml with XcodeGen and committed, so you only need XcodeGen when you change the project structure (xcodegen generate).

Optional test suites:

IDT_SIMULATOR_TESTS=1 swift test --filter RealSimulator   # boots a simulator end to end
IDT_NETWORK_TESTS=1 IDT_RESTORE_HELPERS="$PWD/build-output/restore-helpers/out/bin" \
  swift test --filter RealFirmware                        # Apple's firmware list, signing, the helpers
xcodebuild -project iOSDeveloperToolkit.xcodeproj -scheme iOSDeveloperToolkit \
  -destination 'platform=macOS' test                      # UI tests (macOS asks to allow automation)

Documentation screenshots are produced by the app itself:

"iOS Developer Toolkit (Swift).app/Contents/MacOS/iOS Developer Toolkit (Swift)" \
  -demo-mode YES -populate-demo YES -window-size 1180x700 -capture-screenshots ~/Desktop/shots

Layout: Sources/ToolkitCore (process runner, errors, logging, secure files), Sources/DeviceKit (usbmuxd, lockdown and its services, CoreDevice, simctl, discovery), Sources/ToolkitFeatures (Location Lab, IPA inspection, logs, actions, readiness, evidence, external tools), Sources/idt (CLI), App/ (SwiftUI app and UI tests), Tests/. See docs/architecture.md.

Version 1.0 is a native rewrite of the Python/PySide6 app (iOS Developer Toolkit, 0.3.x), which depends on pymobiledevice3. See MIGRATION.md for the feature-by-feature mapping. Workspace profiles exported by 0.3.x can be imported in Settings › Profiles; the preview explains how each setting carries over.

Firmware installation (Update, Restore, recovery and DFU mode) has been tested against Apple's servers and with the bundled helpers, but not yet by installing firmware on a device; see MIGRATION.md.

The Python/PySide6 app, iOS Developer Toolkit, is maintained separately in hideouts-io/iOS-Developer-Toolkit, with its releases. It uses pymobiledevice3 and Python; this app needs neither. The two install side by side and keep their data in separate folders, and this app imports workspace profiles exported by the Python app.

• The native lockdown services (logs, packet capture, backup, diagnostics, app installation over USB, developer-image checking and mounting including Apple personalization) are tested end to end against a protocol-accurate simulated device and against macOS's real device service. Their read-only protocol layer has been checked on one iPhone (iOS 26, Developer Mode off); mounting, location, installation, backup, and the app's pages have not yet been tested on physical iPhones or iPads. Please report results using the physical-device test protocol.
• Not available in 1.0: the developer-service file listing. Details and alternatives are in MIGRATION.md.
• Release builds are ad-hoc signed and not notarized.
• Release builds are universal (Apple silicon and Intel). If the Intel half is run under Rosetta on an Apple silicon Mac, macOS warns that the app includes a component that will not open in macOS 28; the Apple silicon half, which runs by default, is not affected.

• CONTRIBUTING.md — setup, design rules, and checks.
• SUPPORT.md — where to ask questions.
• SECURITY.md — private vulnerability reporting.
• THIRD_PARTY_NOTICES.md and SOURCE_AVAILABILITY.md.

iOS Developer Toolkit is released under the MIT License. The bundled world map uses public-domain Natural Earth data. iPhone, iPad, Xcode, and macOS are trademarks of Apple Inc.; this project is not affiliated with Apple.