iOS Internals · Inside iOS · Lesson 1 of 5

How iOS Is Built

Meet the layers inside an iPhone and the chain of trust that starts it up.

A phone in layers

An iPhone looks like one smooth object, but inside it works like a stack of layers. Each layer does one job and relies on the layer below it. Knowing the layers makes the rest of this track much easier to follow.

• Hardware is the physical part. At its heart is Apple's A-series chip, a system on a chip (SoC), which means the processor, graphics and other parts share one piece of silicon.
• The kernel is the core of the operating system. It decides which program runs when, hands out memory and enforces the rules that keep apps apart. iOS uses a kernel called XNU. XNU and the low-level parts around it make up Darwin, the same foundation under macOS, iPadOS and watchOS. Apple publishes much of Darwin's source code for anyone to read.
• Frameworks are ready-made toolkits from Apple for drawing screens, using the camera, sending notifications or showing maps. Apps call frameworks instead of touching hardware directly.
• Apps sit on top, both Apple's own and the ones you install. They can only do what the layers below allow.

Here's how that plays out. When a photo app takes a picture, it doesn't talk to the camera hardware itself. It asks a camera framework, and the operating system checks whether that app has permission before anything reaches the camera.

Apple designs its own chips, and it designs them together with the software. That lets it build security features straight into the silicon. The best-known example is the Secure Enclave, a separate, isolated security processor inside the chip of every iPhone since the iPhone 5s. It has its own protected memory and its own startup code. It guards your Face ID or Touch ID data and the keys that encrypt your files, and Apple designed it to keep them safe even if the main kernel were taken over. Course 2 of this track goes deep on it.

A chain of trust at startup

Every layer from the last task trusts the one beneath it. So what makes sure the bottom layer is genuine? The answer is a chain of trust, built fresh every time an iPhone starts up.

It begins with a small piece of code written into the main chip when the chip is made, stored in ROM (read-only memory). This code is the Boot ROM. It can't be changed afterward, not even by Apple. Because it never changes, Apple calls it the hardware root of trust. It holds Apple's public key, a kind of digital stamp checker. It can confirm that something was signed by Apple, but it can't be used to sign anything.

Startup then goes step by step, and each step checks the next one before handing over control:

• The first stage checks that the bootloader, called iBoot, carries Apple's signature. On older chips, up to the A9, there's an extra small step in between called the Low-Level Bootloader.
• iBoot checks the iOS kernel, then starts it.
• The kernel then insists that every app and program be signed too. You'll see how in the next module.

Think of a relay race where each runner checks the next runner's ID before passing the baton. If any ID is fake, the race stops.

What happens when a check fails? The iPhone refuses to keep starting up. Depending on which stage failed, it goes into Recovery mode or, at the lowest level, DFU mode (Device Firmware Upgrade). Either way it has to be connected to a computer and restored with genuine Apple software. A tampered iPhone doesn't quietly run tampered code. It stops.

The design has one built-in weakness. Since that first stage can never change, a bug in it can never be fixed by a software update. You'll meet a famous example in module 4.