Highlights
🚀 No-root iOS 17+ tunnel via --userspace
This release lands an optional, no-root tunnel for iOS 17+ devices. Pass --userspace
(or set PYMOBILEDEVICE3_USERSPACE=1) and the RemoteServiceDiscovery tunnel is established
in-process with a pure-Python PyTCP stack — no sudo, no admin, no privileged remote tunneld
daemon, and no kernel utun interface.
- No elevated privileges required. The whole TCP/IP stack runs in userspace, so you can reach
iOS 17+ developer services as an unprivileged user. - Works on Python 3.9+, backed by the new
pmd-pytcp
dependency (added automatically). - Throughput: device→host downloads (e.g.
fetch-symbols) run at roughly the kernel tunnel's
rate; host→device transfers (DDI mounts, file pushes) are slower, since send segments are kept
small for reliable delivery through the pure-Python path. - Device-initiated AV is supported over the userspace tunnel —
developer dvt simulate-location
anddisplay serve-webmedia terminate on the PyTCP stack rather than an unreachable host socket. - One caveat:
debugserveris not reachable over a userspace tunnel (lldb needs the kernel
tunnel address); the CLI now refuses it with a clear message instead of printing an unreachable
address. Use a privileged kernel tunnel for on-device debugging.
Also, huge thanks to @renegadelink for providing the initial POC!
Heads up — coming next: I'm planning to make
--userspacethe default fallback (instead of
--tunnel) when anInvalidServiceErroris raised, so the no-root path becomes the automatic
choice for iOS 17+ services.
What's Changed
- dffcb40 usbmux: honor USBMUXD_SOCKET_ADDRESS at the socket layer
- c3b436f remote: add the pmd-pytcp dependency for the userspace tunnel
- 51665ac remote: select the tunnel interface via a create_tun_device() factory
- 5ef96b3 remote: optional no-root iOS 17+ RSD tunnel via a pure-Python userspace stack
- 42e0e29 remote: drain the kernel tun via add_reader to cut tunneld relay latency
- 4155130 remote: serve device-initiated AV (display serve-web) over the userspace tunnel
- d63f1aa developer: refuse debugserver over a userspace tunnel instead of printing an unreachable address
- 1249301 docs: document the no-root --userspace tunnel for iOS 17+
- 7de21f0 remote: enable the no-root userspace tunnel on Python 3.9+
Full Changelog: v9.29.1...v9.30.0