pymobiledevice3 developer¶
Developer tooling for iOS devices (requires Developer Mode + mounted DeveloperDiskImage).
These commands require the DeveloperDiskImage.dmg to be mounted on the device prior to execution. You can achieve this using:
pymobiledevice3 mounter mount
Also, starting at iOS 17.0, a tunnel must be created to the device for the services
to be accessible. Therefore, every CLI command is retried with a --tunnel option
for implicitly accessing tunneld when necessary
shell¶
Open an IPython shell connected to a developer service (for exploration/R&D).
Arguments:
| Argument | Description |
|---|---|
service |
[required] |
Options:
| Option | Description |
|---|---|
-r, --remove-ssl-context |
Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.
screenshot¶
Capture a PNG screenshot (Depcrecated API).
Arguments:
| Argument | Description |
|---|---|
out |
[required] |
Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.
dvt¶
Drive DVT instrumentation APIs (process control, metrics, traces).
dvt proclist¶
Show processes (with start times) via DVT.
Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.
dvt is-running-pid¶
Check if a PID is currently running.
Arguments:
| Argument | Description |
|---|---|
pid |
[required] |
Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.
dvt memlimitoff¶
Disable jetsam memory limit for a PID.
Arguments:
| Argument | Description |
|---|---|
pid |
[required] |
Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.
dvt applist¶
List installed applications via DVT.
Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.
dvt signal¶
Send a signal to a PID (choose numeric SIG or --signal-name).
Arguments:
| Argument | Description |
|---|---|
pid |
[required] |
sig |
Options:
| Option | Description |
|---|---|
-s, --signal-name <str> |
Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.
dvt kill¶
Kill a process by PID.
Arguments:
| Argument | Description |
|---|---|
pid |
[required] |
Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.
dvt process-id-for-bundle-id¶
Get PID of a bundle identifier (only returns a valid value if its running).
Arguments:
| Argument | Description |
|---|---|
app_bundle_identifier |
[required] |
Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.
dvt pkill¶
Kill all processes containing each expression in their name.
Arguments:
| Argument | Description |
|---|---|
expressions... |
One or more process-name (or bundle id) expressions to match. [required] |
Options:
| Option | Description |
|---|---|
--bundle / --no-bundle |
Treat given expressions as bundle-identifiers instead of process names [default: no-bundle] |
Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.
dvt launch¶
Launch a process.
Arguments:
| Argument | Description |
|---|---|
arguments |
[required] |
Options:
| Option | Description |
|---|---|
--kill-existing / --no-kill-existing |
Whether to kill an existing instance of this process [default: kill-existing] |
--suspended / --no-suspended |
Same as WaitForDebugger [default: no-suspended] |
--env <str> |
Environment variable to pass to process given as key=value (can be specified multiple times) |
--stream / --no-stream |
[default: no-stream] |
Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.
dvt shell¶
Launch developer shell (used for pymobiledevice3 R&D)
Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.
dvt ls¶
List directory
Arguments:
| Argument | Description |
|---|---|
path |
[required] |
Options:
| Option | Description |
|---|---|
-r, --recursive |
Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.
dvt device-information¶
Print system information
Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.
dvt netstat¶
Print information about current network activity.
Options:
| Option | Description |
|---|---|
--format <text\|json> |
Output format. 'json' emits one JSON object per line (NDJSON) on stdout. [default: text] |
Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.
dvt screenshot¶
Take device screenshot
Arguments:
| Argument | Description |
|---|---|
out |
[required] |
Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.
dvt xcuitest¶
Start XCUITest
Usage example: python3 -m pymobiledevice3 developer dvt xcuitest com.facebook.WebDriverAgentRunner.xctrunner
Arguments:
| Argument | Description |
|---|---|
bundle_id |
Bundle identifier of the XCTest runner (e.g. com.apple.test.WebDriverAgentRunner.xctrunner) [required] |
Options:
| Option | Description |
|---|---|
--target-bundle-id <str> |
Bundle identifier of the target app (if different from runner, e.g. for testing app extensions) |
--output-log <path> |
log debug output file location ( default to python logger ) |
--timeout <float> |
maximum execution time, in seconds |
--env <str> |
Environment variable to pass to process given as key=value (can be specified multiple times) |
Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.
dvt trace-codes¶
Print KDebug trace codes.
Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.
dvt name-for-uid¶
Print the assiciated username for the given uid.
Arguments:
| Argument | Description |
|---|---|
uid |
[required] |
Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.
dvt name-for-gid¶
Print the assiciated group name for the given gid.
Arguments:
| Argument | Description |
|---|---|
gid |
[required] |
Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.
dvt oslog¶
Sniff device oslog (not very stable, but includes more data and normal syslog)
Options:
| Option | Description |
|---|---|
--pid <int> |
|
--format <text\|json> |
Output format. 'json' emits one JSON object per line (NDJSON) on stdout. [default: text] |
Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.
dvt energy¶
Monitor the energy consumption for given PIDs
Arguments:
| Argument | Description |
|---|---|
pid_list... |
[required] |
Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.
dvt notifications¶
Monitor memory and app notifications
Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.
dvt graphics¶
Monitor graphics-related information
Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.
dvt har¶
Enable har-logging
For more information, please read: https://github.com/doronz88/harlogger?tab=readme-ov-file#enable-http-instrumentation-method
Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.
dvt sysmon¶
System monitor options.
dvt sysmon system¶
show current system stats.
Options:
| Option | Description |
|---|---|
-f, --fields <str> |
field names separated by ",". |
Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.
dvt sysmon process¶
Process monitor options.
dvt sysmon process single¶
show a single snapshot of currently running processes.
Options:
| Option | Description |
|---|---|
-f, --filter <str> |
Filter processes by key=value. Can be specified multiple times. |
-k, --key <str> |
Show only selected process keys for each emitted record. Can be specified multiple times. |
--human |
Format known byte-count fields such as physFootprint using human-readable units, and nanosecond fields such as cpuTotalUser as durations. |
-o, --output <path> |
Output file path for JSONL format (optional, defaults to stdout) |
Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.
dvt sysmon process monitor¶
Continuously stream process metrics.
dvt sysmon process monitor threshold¶
Continuously monitor processes above a cpuUsage threshold.
Arguments:
| Argument | Description |
|---|---|
threshold |
Minimum cpuUsage value to emit [required] |
Options:
| Option | Description |
|---|---|
-k, --key <str> |
Show only selected process keys for each emitted record. Can be specified multiple times. |
-d, --duration <int> |
Maximum duration in milliseconds to run monitoring (optional) |
--human |
Format known byte-count fields such as physFootprint using human-readable units, and nanosecond fields such as cpuTotalUser as durations. |
-o, --output <path> |
Output file path for JSONL format (optional, defaults to stdout) |
Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.
dvt sysmon process monitor process¶
Continuously monitor one process selected from the current snapshot by key=value filters.
Options:
| Option | Description |
|---|---|
-f, --filter <str> |
Filter processes by key=value. Can be specified multiple times. |
-k, --key <str> |
Show only selected process keys for each emitted record. Can be specified multiple times. |
--choose <prompt\|first\|last> |
How to resolve multiple matching processes: "prompt" asks interactively; "first" selects the oldest matching process; "last" selects the newest matching process. Automatic ordering is by startAbsTime, then pid, then name. [default: prompt] |
-i, --interval <int> |
Minimum interval in milliseconds between outputs (optional) [default: 500] |
-d, --duration <int> |
Maximum duration in milliseconds to run monitoring (optional) |
--human |
Format known byte-count fields such as physFootprint using human-readable units, and nanosecond fields such as cpuTotalUser as durations. |
-o, --output <path> |
Output file path for JSONL format (optional, defaults to stdout) |
Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.
dvt core-profile-session¶
Access tailspin features
dvt core-profile-session live¶
Print kevents received from the device in real time.
Options:
| Option | Description |
|---|---|
-c, --count <int> |
Number of events to print. Omit to endless sniff. [default: -1] |
--bsc / --no-bsc |
Whether to print BSC events or not. [default: no-bsc] |
-cf, --class-filters <based_int> |
Events class filter. Omit for all. Can be specified multiple times. |
-sf, --subclass-filters <based_int> |
Events subclass filter. Omit for all. Can be specified multiple times. |
--tid <int> |
Thread ID to filter. Omit for all. |
--timestamp / --no-timestamp |
Whether to print timestamp or not. [default: timestamp] |
--event-name / --no-event-name |
Whether to print event name or not. [default: event-name] |
--func-qual / --no-func-qual |
Whether to print function qualifier or not. [default: func-qual] |
--show-tid / --no-show-tid |
Whether to print thread ID or not. [default: show-tid] |
--process-name / --no-process-name |
Whether to print process name or not. [default: process-name] |
--args / --no-args |
Whether to print event arguments or not. [default: args] |
Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.
dvt core-profile-session save¶
Dump core profiling information.
Arguments:
| Argument | Description |
|---|---|
out |
[required] |
Options:
| Option | Description |
|---|---|
--bsc / --no-bsc |
Whether to print BSC events or not. [default: no-bsc] |
-cf, --class-filters <based_int> |
Events class filter. Omit for all. Can be specified multiple times. |
-sf, --subclass-filters <based_int> |
Events subclass filter. Omit for all. Can be specified multiple times. |
Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.
dvt core-profile-session stackshot¶
Dump stackshot information.
Options:
| Option | Description |
|---|---|
--out <path> |
Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.
dvt core-profile-session parse-live¶
Print traces (syscalls, thread events, etc.) received from the device in real time.
Options:
| Option | Description |
|---|---|
-c, --count <int> |
Number of events to print. Omit to endless sniff. |
--bsc / --no-bsc |
Whether to print BSC events or not. [default: no-bsc] |
-cf, --class-filters <based_int> |
Events class filter. Omit for all. Can be specified multiple times. |
-sf, --subclass-filters <based_int> |
Events subclass filter. Omit for all. Can be specified multiple times. |
--tid <int> |
Thread ID to filter. Omit for all. |
--show-tid / --no-show-tid |
Whether to print thread ID or not. [default: no-show-tid] |
--process <str> |
Process ID / name to filter. Omit for all. |
--color-mode <fast\|rich> |
Trace color style. 'fast' uses low-overhead ANSI coloring, 'rich' uses syntax highlighting. [default: fast] |
Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.
dvt core-profile-session callstacks-live¶
Print callstacks received from the device in real time.
Options:
| Option | Description |
|---|---|
-c, --count <int> |
Number of events to print. Omit to endless sniff. [default: -1] |
--process <str> |
Process ID / name to filter. Omit for all. |
--tid <int> |
Thread ID to filter. Omit for all. |
--show-tid / --no-show-tid |
Whether to print thread ID or not. [default: no-show-tid] |
Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.
dvt simulate-location¶
Simulate device location through DVT on iOS 17 and newer.
dvt simulate-location clear¶
Clear the currently simulated location on iOS 17 and newer.
Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.
dvt simulate-location set¶
Set a simulated location through DVT on iOS 17 and newer.
For example: ... set -- 40.690008 -74.045843 for liberty island
Arguments:
| Argument | Description |
|---|---|
latitude |
[required] |
longitude |
[required] |
Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.
dvt simulate-location play¶
Replay a GPX route through DVT on iOS 17 and newer.
Arguments:
| Argument | Description |
|---|---|
filename |
[required] |
Options:
| Option | Description |
|---|---|
--timing-randomness-range <int> |
[default: 0] |
--disable-sleep / --no-disable-sleep |
[default: no-disable-sleep] |
Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.
dvt condition¶
Force predefined device conditions (network, thermal, battery) via DVT.
dvt condition list¶
List available condition profiles.
Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.
dvt condition clear¶
Clear any active induced condition.
Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.
dvt condition set¶
Apply a specific condition profile by identifier.
Arguments:
| Argument | Description |
|---|---|
profile_identifier |
[required] |
Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.
fetch-symbols¶
Download the DSC (and dyld) from the device
fetch-symbols list¶
list of files to be downloaded
Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.
fetch-symbols download¶
Fetches symbols from the given device and saves them into Xcode DeviceSupport directory.
This command downloads symbol data. Optionally, the user can specify an output directory where the data will be stored. If no output directory is provided, the symbols will be downloaded into the Xcode directory directly (DeviceSupport).
Arguments:
| Argument | Description |
|---|---|
out |
Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.
simulate-location¶
Simulate GPS location on iOS versions below 17 (set, clear, or replay GPX routes).
simulate-location clear¶
Stop location simulation and resume real GPS on iOS versions below 17.
Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.
simulate-location set¶
Set a fixed simulated location on iOS versions below 17 (latitude, longitude).
Example: set 40.690008 -74.045843 (Liberty Island).
Arguments:
| Argument | Description |
|---|---|
latitude |
[required] |
longitude |
[required] |
Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.
simulate-location play¶
Replay a GPX route on iOS versions below 17; optionally disable sleeps and add timing jitter.
Arguments:
| Argument | Description |
|---|---|
filename |
[required] |
timing_randomness_range |
[required] |
Options:
| Option | Description |
|---|---|
--disable-sleep / --no-disable-sleep |
[default: no-disable-sleep] |
Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.
accessibility¶
Interact with accessibility-related features
accessibility run-audit¶
runs accessibility audit tests
Arguments:
| Argument | Description |
|---|---|
test_types... |
[required] |
Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.
accessibility supported-audit-types¶
lists supported accessibility audit test types
Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.
accessibility capabilities¶
display accessibility capabilities
Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.
accessibility shell¶
start and ipython accessibility shell
Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.
accessibility notifications¶
show notifications
Options:
| Option | Description |
|---|---|
--format <text\|json> |
Output format. 'json' emits one JSON object per line (NDJSON) on stdout. [default: text] |
Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.
accessibility list-items¶
List elements available in the currently shown menu.
Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.
accessibility settings¶
accessibility settings
accessibility settings show¶
show current settings
Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.
accessibility settings set¶
change current settings
in order to list all available use the "show" command
Arguments:
| Argument | Description |
|---|---|
setting |
[required] |
value |
[required] |
Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.
accessibility settings reset¶
reset accessibility settings to default
Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.
debugserver¶
Start and drive debugserver sessions (RSD for iOS 17+, usbmux for older).
debugserver applist¶
Print the debugserver applist XML for the device.
Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.
debugserver start-server¶
Start debugserver and print the LLDB connect string.
- For iOS < 17, you must forward to a local port (--local-port).
- For iOS >= 17, if connected over RSD, the remote host:port is printed for LLDB. Connect quickly with your own LLDB client using the printed steps.
Options:
| Option | Description |
|---|---|
--local-port <int> |
|
--host <str> |
Address to bind the local port to. [default: 127.0.0.1] |
Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.
debugserver lldb¶
Automate lldb launch for a given xcodeproj, IPA, or installed bundle identifier.
This will: - Build the given xcodeproj (if provided) - Extract the given IPA (if provided) - Install it (for xcodeproj/IPA inputs) - Start a debugserver attached to it - Place breakpoints if given any - Launch the application if requested - Execute any additional commands if requested - Switch to lldb shell
Arguments:
| Argument | Description |
|---|---|
project_or_ipa_or_bundle_id |
Path to .xcodeproj/.ipa or an installed app bundle identifier [required] |
Options:
| Option | Description |
|---|---|
--configuration <str> |
Build configuration to invoke (e.g., Debug or Release). [default: Debug] |
--lldb-command <str> |
Path to the lldb executable to run. [default: lldb] |
--launch / --no-launch |
Automatically launch the app after attaching. [default: no-launch] |
-b, --break <str> |
Add multiple startup breakpoints |
-c, --command <str> |
Additional commands to run at startup |
Accepts the connection options: --rsd, --tunnel, --userspace.
arbitration¶
Mark/unmark a device as "in-use" to avoid conflicts with other tools.
arbitration version¶
Show arbitration protocol version.
Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.
arbitration check-in¶
Check-in as owner (marks device as in-use; use --force to override).
Arguments:
| Argument | Description |
|---|---|
hostname |
[required] |
Options:
| Option | Description |
|---|---|
-f, --force |
Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.
arbitration check-out¶
Release ownership and allow other tools to use the device.
Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.
core-device¶
Access DeveloperDiskImage services (files, processes, app launch, diagnostics).
core-device list-directory¶
List directory contents for a given domain/path.
pymobiledevice3 developer core-device list-directory [OPTIONS] {domain}:<appDataContainer|appGroupDataContainer|temporary|systemCrashLogs> {path}
Arguments:
| Argument | Description |
|---|---|
domain:<appDataContainer\|appGroupDataContainer\|temporary\|systemCrashLogs> |
[required] |
path |
[required] |
Options:
| Option | Description |
|---|---|
--identifier <str> |
Accepts the connection options: --rsd, --tunnel, --userspace.
core-device read-file¶
Read a file from a domain/path to stdout or --output.
pymobiledevice3 developer core-device read-file [OPTIONS] {domain}:<appDataContainer|appGroupDataContainer|temporary|systemCrashLogs> {path}
Arguments:
| Argument | Description |
|---|---|
domain:<appDataContainer\|appGroupDataContainer\|temporary\|systemCrashLogs> |
[required] |
path |
[required] |
Options:
| Option | Description |
|---|---|
--identifier <str> |
|
-o, --output <path> |
[required] |
Accepts the connection options: --rsd, --tunnel, --userspace.
core-device propose-empty-file¶
Create an empty file at the given domain/path with custom permissions/owner/timestamps.
pymobiledevice3 developer core-device propose-empty-file [OPTIONS] {domain}:<appDataContainer|appGroupDataContainer|temporary|systemCrashLogs> {path}
Arguments:
| Argument | Description |
|---|---|
domain:<appDataContainer\|appGroupDataContainer\|temporary\|systemCrashLogs> |
[required] |
path |
[required] |
Options:
| Option | Description |
|---|---|
--identifier <str> |
|
--file-permissions <int> |
[default: 420] |
--uid <int> |
[default: 501] |
--gid <int> |
[default: 501] |
--creation-time <int> |
|
--last-modification-time <int> |
Accepts the connection options: --rsd, --tunnel, --userspace.
core-device launch-application¶
Launch an app; optionally kill existing, wait for debugger, or set env vars.
pymobiledevice3 developer core-device launch-application [OPTIONS] {bundle_identifier} {argument}...
Arguments:
| Argument | Description |
|---|---|
bundle_identifier |
[required] |
argument... |
[required] |
Options:
| Option | Description |
|---|---|
--kill-existing / --no-kill-existing |
Whether to kill an existing instance of this process [default: kill-existing] |
--suspended / --no-suspended |
Same as WaitForDebugger [default: no-suspended] |
--env <str> |
Environment variable to pass to process given as key=value (can be specified multiple times) |
Accepts the connection options: --rsd, --tunnel, --userspace.
core-device list-processes¶
List running processes via CoreDevice.
Accepts the connection options: --rsd, --tunnel, --userspace.
core-device uninstall¶
Uninstall an app by bundle identifier via CoreDevice.
Arguments:
| Argument | Description |
|---|---|
bundle_identifier |
[required] |
Accepts the connection options: --rsd, --tunnel, --userspace.
core-device send-signal-to-process¶
Send signal to process
Arguments:
| Argument | Description |
|---|---|
pid |
[required] |
signal |
[required] |
Accepts the connection options: --rsd, --tunnel, --userspace.
core-device get-device-info¶
Get device information
Accepts the connection options: --rsd, --tunnel, --userspace.
core-device get-display-info¶
Get display information
Accepts the connection options: --rsd, --tunnel, --userspace.
core-device query-mobilegestalt¶
Query MobileGestalt
Arguments:
| Argument | Description |
|---|---|
key... |
[required] |
Accepts the connection options: --rsd, --tunnel, --userspace.
core-device get-lockstate¶
Get lockstate
Accepts the connection options: --rsd, --tunnel, --userspace.
core-device paste¶
Paste device pasteboard contents to stdout (text by default, --raw for the full snapshot).
Options:
| Option | Description |
|---|---|
--raw |
Print the full snapshot JSON instead of UTF-8 text. |
--pasteboard <str> |
Named pasteboard to read from. [default: general] |
Accepts the connection options: --rsd, --tunnel, --userspace.
core-device copy¶
Copy text onto the device pasteboard (UTF-8). Reads from stdin if no argument is given.
Arguments:
| Argument | Description |
|---|---|
text |
Text to copy. If omitted, read UTF-8 from stdin. |
Options:
| Option | Description |
|---|---|
--pasteboard <str> |
Named pasteboard to write to. [default: general] |
Accepts the connection options: --rsd, --tunnel, --userspace.
core-device rotate¶
Rotate the device 90 degrees. Four consecutive 'left' calls cycle a full turn.
Arguments:
| Argument | Description |
|---|---|
direction:<left\|right> |
Rotate 90 degrees: 'left' = CCW, 'right' = CW. [default: left] |
Accepts the connection options: --rsd, --tunnel, --userspace.
core-device user-interface-style¶
Get the active user-interface style; pass dark/light to set it.
Arguments:
| Argument | Description |
|---|---|
style:<dark\|light> |
Accepts the connection options: --rsd, --tunnel, --userspace.
core-device list-apps¶
Get application list
Accepts the connection options: --rsd, --tunnel, --userspace.
core-device fetch-app-icon¶
Fetch an application's icon as a PNG (com.apple.coredevice.iconservice).
Arguments:
| Argument | Description |
|---|---|
bundle_identifier |
[required] |
output |
[required] |
Options:
| Option | Description |
|---|---|
--width <float> |
[default: 60.0] |
--height <float> |
[default: 60.0] |
--scale <float> |
[default: 2.0] |
--no-placeholder |
Accepts the connection options: --rsd, --tunnel, --userspace.
core-device stream-processes¶
Stream the running process list via CoreDevice.
Accepts the connection options: --rsd, --tunnel, --userspace.
core-device sysdiagnose¶
Execute sysdiagnose and fetch the output file
Arguments:
| Argument | Description |
|---|---|
output |
[required] |
Accepts the connection options: --rsd, --tunnel, --userspace.
core-device screen-capture¶
Capture content from the device's screen (com.apple.coredevice.screencaptureservice).
core-device screen-capture screenshot¶
Capture a PNG screenshot of the device's screen.
Arguments:
| Argument | Description |
|---|---|
output |
[required] |
Options:
| Option | Description |
|---|---|
--display-unique-id <str> |
Accepts the connection options: --rsd, --tunnel, --userspace.
core-device hid¶
Send HID button events (com.apple.coredevice.hid.indigo).
core-device hid button¶
Press a named iOS hardware button (home / power / volume-up / etc.).
pymobiledevice3 developer core-device hid button [OPTIONS] {name}:<home|lock|volume-up|volume-down|mute|siri> [state]:<press|down|up|canceled>
Arguments:
| Argument | Description |
|---|---|
name:<home\|lock\|volume-up\|volume-down\|mute\|siri> |
Named hardware button (home, power, volume-up, ...) [required] |
state:<press\|down\|up\|canceled> |
press = send down+up; otherwise send a single state event [default: press] |
Accepts the connection options: --rsd, --tunnel, --userspace.
core-device hid raw-button¶
Send a HID button event by raw usage page/code (for buttons not in the named list).
pymobiledevice3 developer core-device hid raw-button [OPTIONS] {usage_page} {usage_code} [state]:<press|down|up|canceled>
Arguments:
| Argument | Description |
|---|---|
usage_page |
HID usage page (decimal or 0xHEX), e.g. 0x0C for Consumer [required] |
usage_code |
HID usage code (decimal or 0xHEX) [required] |
state:<press\|down\|up\|canceled> |
press = send down+up; otherwise send a single state event [default: press] |
Accepts the connection options: --rsd, --tunnel, --userspace.
core-device universal-hid-service¶
Register/inspect virtual HID services (com.apple.coredevice.hid.universalhidservice).
core-device universal-hid-service list-connected¶
List currently connected virtual HID services.
Accepts the connection options: --rsd, --tunnel, --userspace.
core-device universal-hid-service send-report¶
Send a raw HID report to a connected HID surface.
Use list-connected to discover ServiceIDs. Touch goes via 257
(mainTouchscreen, true digitizer) or 1281 (touchscreenGesture, trackpad-like
pointer). Report bytes are surface-specific — capture devicectl traffic with
misc/remotexpc_sniffer.py to learn the layout.
pymobiledevice3 developer core-device universal-hid-service send-report [OPTIONS] {service_id} {report_hex}
Arguments:
| Argument | Description |
|---|---|
service_id |
Target _ServiceID (from list-connected; decimal or 0xHEX) [required] |
report_hex |
Raw HID report bytes as hex (first byte is the report ID) [required] |
Accepts the connection options: --rsd, --tunnel, --userspace.
core-device universal-hid-service tap¶
Tap at (X, Y) — one mainTouchscreen CONTACT + RELEASE pair.
X/Y are 0..65535 normalised across the device's screen — see the
coordinate-system comment at the top of this section, or
developer core-device get-display-info for pixel dimensions.
Auto-opens a media stream so the touch reaches UIKit.
Arguments:
| Argument | Description |
|---|---|
x |
X (0..65535, 0=left, 65535=right) [required] |
y |
Y (0..65535, 0=top, 65535=bottom) [required] |
Options:
| Option | Description |
|---|---|
--touch-service-id <str> |
mainTouchscreen _ServiceID [default: 257] |
Accepts the connection options: --rsd, --tunnel, --userspace.
core-device universal-hid-service drag¶
Drag from (X1, Y1) to (X2, Y2) — streaming CONTACT reports, then RELEASE.
X/Y are 0..65535 normalised across the device's screen. Use
developer core-device get-display-info to look up the device's
pixel dimensions if you need to convert from pixel coordinates.
Arguments:
| Argument | Description |
|---|---|
x1 |
Start X (0..65535, screen-normalised) [required] |
y1 |
Start Y (0..65535, screen-normalised) [required] |
x2 |
End X (0..65535) [required] |
y2 |
End Y (0..65535) [required] |
Options:
| Option | Description |
|---|---|
--steps <int> |
[default: 30] |
--duration <float> |
Drag time, seconds [default: 0.6] |
--touch-service-id <str> |
mainTouchscreen _ServiceID [default: 257] |
Accepts the connection options: --rsd, --tunnel, --userspace.
core-device universal-hid-service swipe¶
Pure pointer-motion gesture — moves the cursor without a contact event.
Arguments:
| Argument | Description |
|---|---|
x1 |
Start X (Int32) [required] |
y1 |
Start Y (Int32) [required] |
x2 |
End X (Int32) [required] |
y2 |
End Y (Int32) [required] |
Options:
| Option | Description |
|---|---|
--steps <int> |
Interpolated frames [default: 30] |
--duration <float> |
Swipe time, seconds [default: 0.3] |
--service-id <str> |
Gesture surface _ServiceID; default 1281 = touchscreenGesture [default: 1281] |
Accepts the connection options: --rsd, --tunnel, --userspace.
core-device universal-hid-service session¶
Run a sequence of gestures inside ONE auth-gated media stream.
Avoids stream-churn timeouts when firing many tap/drag calls back-to-back — the stream is opened once for the whole batch.
Recognised commands (whitespace-separated; # and blank lines ignored)::
tap X Y # CONTACT + RELEASE
drag X1 Y1 X2 Y2 [STEPS [DURATION]] # continuous contact with motion
swipe X1 Y1 X2 Y2 [STEPS [DURATION]] # pure pointer motion (no contact)
move X Y # one gesture-surface sample
sleep SECONDS
Example::
printf 'tap 30000 40000\nsleep 0.3\ndrag 30000 8000 30000 60000\n' | \
pymobiledevice3 developer core-device universal-hid-service session
Options:
| Option | Description |
|---|---|
--script <path> |
Read gesture lines from this file (default: stdin) |
--gesture-service-id <str> |
Gesture surface _ServiceID (for move/swipe) [default: 1281] |
--touch-service-id <str> |
mainTouchscreen _ServiceID (for tap/drag) [default: 257] |
Accepts the connection options: --rsd, --tunnel, --userspace.
core-device universal-hid-service type¶
Type TEXT on the device via a host-registered virtual keyboard.
Auto-opens a media stream (the dtuhidd auth gate) and registers a
virtual keyboard surface, then emits one down/up HID Keyboard
report pair per character. Capital letters and shifted symbols
synthesise the matching Left-Shift bit in the bitmap.
Arguments:
| Argument | Description |
|---|---|
text |
Text to type (printable ASCII) [required] |
Options:
| Option | Description |
|---|---|
--char-delay <float> |
Seconds between key down and key up [default: 0.04] |
--inter-delay <float> |
Seconds between characters [default: 0.02] |
Accepts the connection options: --rsd, --tunnel, --userspace.
core-device display¶
Query media-stream capabilities (com.apple.coredevice.displayservice).
core-device display get-media-support-info¶
Return the device's supported media-stream features and AVC framework version.
Accepts the connection options: --rsd, --tunnel, --userspace.
core-device display get-media-stream-server-status¶
Return the media-stream server's running state and active sessions.
Accepts the connection options: --rsd, --tunnel, --userspace.
core-device display start-video-stream¶
Capture raw RTP/HEVC packets from a display into a file.
Each packet is written as [4-byte BE length][packet bytes]. Use
misc/rtp_dump.py to depacketize into an Annex-B .h265 bitstream.
Arguments:
| Argument | Description |
|---|---|
output |
Write received RTP packet bytes to this file [required] |
Options:
| Option | Description |
|---|---|
--display-id <int> |
[default: 1] |
--duration <float> |
Seconds to capture [default: 5.0] |
--port <int> |
[default: 0] |
Accepts the connection options: --rsd, --tunnel, --userspace.
core-device display start-audio-stream¶
Capture raw RTP audio packets from the device's system-audio output.
Each packet is written as [4-byte BE length][packet bytes]. The
device advertises RxPayloadType=101 and AudioStreamMode=8 —
inspect the captured payloads to identify the codec before building
browser playback.
Arguments:
| Argument | Description |
|---|---|
output |
Write received RTP packet bytes to this file [required] |
Options:
| Option | Description |
|---|---|
--duration <float> |
Seconds to capture [default: 10.0] |
--port <int> |
[default: 0] |
Accepts the connection options: --rsd, --tunnel, --userspace.
core-device display serve-web¶
Serve the device's screen via HTTP — view in any modern browser.
Pipeline (no external executables):
device → asyncio UDP receive → RFC 7798 RTP/HEVC depacketize
→ HTTP chunked stream → browser WebCodecs decoder → canvas
Open http://<bind>:<http_port>/ in Safari or Chrome (macOS Chrome needs
HEVC support — recent versions enable it by default if the OS supports it).
Pass --https when connecting from another LAN host (browsers gate
WebCodecs on a secure context; only loopback origins bypass that).
Options:
| Option | Description |
|---|---|
--display-id <int> |
[default: 1] |
--bind <str> |
Host to bind the webserver on. Defaults to 0.0.0.0 so the viewer is reachable from any device on the LAN. The /touch / /button / /key endpoints have no auth, so anyone reaching this port can both watch and control the iPhone -- pass 127.0.0.1 if that's not what you want. [default: 0.0.0.0] |
--http-port <int> |
Port for the webserver [default: 8080] |
--no-audio |
Don't auto-enable sound in the viewer (user can still click Enable Sound). |
--ltrp |
Opt into LTRP (long-term reference pictures). LEAVE OFF for browser viewing. LTRP lowers the encoder's QP under motion (sharper bitstream — ffmpeg decodes it cleanly), BUT the browsers' real-time VideoToolbox/WebCodecs decoder mishandles the long-term references and renders a mosaic of displaced blocks during rapid motion. Verified on-device: identical hard swipes are clean with LTRP off and tear with it on, while the same captured bitstream is clean in ffmpeg either way — i.e. the tear is a live-decode artifact, not in the stream. The encoder QP win (≈19 vs ≈23-31) is not worth the mosaic. |
--rtcp-fb |
Negotiate allowRTCPFB=True in the mediaBlob. No observable effect in streamConfig but may influence internal encoder behaviour. |
--https |
Serve over HTTPS using an ephemeral self-signed certificate. Required for WebCodecs when accessing the viewer from a non-loopback origin: the browser's secure-context policy refuses WebCodecs over plain http:// from any LAN IP. The browser will warn on first visit -- accept the cert and the viewer works normally afterwards. |
--rctl / --no-rctl |
Run the AVConference RCTL receiver-feedback loop (RTCP APP + per-frame receipts), reversed byte-exact from Xcode's mirror -- the closed-loop rate control Xcode uses. OFF by default: it does NOT prevent the motion resolution-collapse (that's a device encoder decision at the ~6 Mbps cap), and a wrong OWRD or non-per-frame receipt makes the device throttle framerate. Kept as the correct closed-loop base for further research. [default: no-rctl] |
--max-bitrate <int> |
Encoder bitrate cap in kbps, advertised to the device over the RCTL loop (the device honours it). The uncapped encoder can ramp past ~5.5 Mbps under sustained motion and stall; lowering this (e.g. 5000) keeps the stream steadier at some cost to peak quality. Requires --rctl. [default: 60000] |
--motion-idr / --no-motion-idr |
Force a keyframe ~1x/second WHILE the screen is moving (ON by default). Under rapid motion the device drops capture resolution into a top-left corner of the frame ('screen shrinks while swiping'); these keyframes snap it back to full resolution fast, and the viewer stretches the shrunk region to fill the canvas so the brief window is hidden. Trade-off: the keyframe pressure can stall the ~6 Mbps-capped encoder under sustained motion. --no-motion-idr drops it for a stall-free but slower-recovering stream (relies on the viewer stretch + settle keyframe alone). NOTE: combining --motion-idr with --rctl throttles fps hard -- the default keeps RCTL off so the IDR stays fast. [default: motion-idr] |
--compensate / --no-compensate |
Viewer-side resolution-collapse compensation (ON by default). When the device shrinks the captured screen into the top-left corner + gray padding under motion, the browser detects that content rectangle per frame and stretches it back to fill the canvas, turning the hard corner-shrink into a softer momentary resolution dip. --no-compensate shows the raw device output (useful for seeing the collapse / research). [default: compensate] |
Accepts the connection options: --rsd, --tunnel, --userspace.
core-device display serve-vnc¶
Serve the device's screen as a VNC (RFB 3.8) server.
Connect from any VNC client. macOS Finder: Cmd+K -> enter
vnc://<bind>:<port> (default vnc://127.0.0.1:5901; port
5900 is owned by macOS's own Screen Sharing daemon). No browser
involved -- the OS's native screen-sharing renders the framebuffer
directly.
Pipeline: device HEVC -> VideoToolbox (macOS) or libav (cross-platform) decode (BGRA output) -> RFB Raw framebuffer updates. No JPEG round-trip; the bytes that came out of the decoder go straight onto the wire. Mouse clicks in the screen-sharing window translate to HID touch events on the device.
Audio: pass --audio to decode the device's AAC-ELD audio
stream and play it through the host Mac's speakers (RFB has no
audio of its own, so the playback is host-local).
Options:
| Option | Description |
|---|---|
--display-id <int> |
[default: 1] |
--bind <str> |
Host to bind the VNC listener on. Defaults to 0.0.0.0 so any device on the LAN can connect. The VNC server has no password, so anyone reaching this port can watch AND control the iPhone -- pass 127.0.0.1 if that's not acceptable. [default: 0.0.0.0] |
--port <int> |
TCP port for the VNC listener [default: 5901] |
--audio |
Play device audio out the host Mac's speakers (off by default). |
--decoder <str> |
HEVC decoder: 'auto' (VideoToolbox on macOS, libav elsewhere), 'vt' (force VideoToolbox -- macOS only), or 'av' (force libav / PyAV). Forcing 'av' on macOS comes with audio choppiness from GIL contention. [default: auto] |
--ltrp |
Opt back into LTRP (off by default; see serve-web for context). |
--rtcp-fb |
Negotiate allowRTCPFB=True in the mediaBlob (experimental). |
Accepts the connection options: --rsd, --tunnel, --userspace.
core-device location¶
Simulate the device's location (com.apple.coredevice.locationservice).
core-device location available-scenarios¶
List the device's built-in simulation scenarios.
Accepts the connection options: --rsd, --tunnel, --userspace.
wda¶
Interact with WebDriverAgent (launch apps and tap elements).
wda launch¶
Launch an app by starting a WDA session and print the session id.
Arguments:
| Argument | Description |
|---|---|
bundle_id |
[required] |
Options:
| Option | Description |
|---|---|
--port <int> |
WDA device port to connect to. [default: 8100] |
--timeout <float> |
HTTP timeout in seconds. [default: 10.0] |
-xc, --xctrunner <str> |
Bundle id of an XCUITest runner to start (e.g. com.facebook.WebDriverAgentRunner.xctrunner). |
Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.
wda tap¶
Tap an element (typically a button) using a WDA selector.
Arguments:
| Argument | Description |
|---|---|
selector |
[required] |
Options:
| Option | Description |
|---|---|
--port <int> |
WDA device port to connect to. [default: 8100] |
--timeout <float> |
HTTP timeout in seconds. [default: 10.0] |
-xc, --xctrunner <str> |
Bundle id of an XCUITest runner to start (e.g. com.facebook.WebDriverAgentRunner.xctrunner). |
-u, --using <str> |
Element lookup strategy (e.g. 'accessibility id', 'name', 'label', 'xpath'). [default: accessibility id] |
-s, --session-id <str> |
Existing WDA session id (omit to create a new session). |
--bundle-id <str> |
Bundle id to launch if a new session is created. |
Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.
wda press¶
Press one or more device buttons (e.g. home, volumeup, volumedown, lock).
Arguments:
| Argument | Description |
|---|---|
names... |
One or more device buttons to press in order (e.g. home lock volumeup). [required] |
Options:
| Option | Description |
|---|---|
--port <int> |
WDA device port to connect to. [default: 8100] |
--timeout <float> |
HTTP timeout in seconds. [default: 10.0] |
-xc, --xctrunner <str> |
Bundle id of an XCUITest runner to start (e.g. com.facebook.WebDriverAgentRunner.xctrunner). |
-s, --session-id <str> |
Existing WDA session id (optional; some servers require it). |
Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.
wda unlock¶
Unlock the device.
Options:
| Option | Description |
|---|---|
--port <int> |
WDA device port to connect to. [default: 8100] |
--timeout <float> |
HTTP timeout in seconds. [default: 10.0] |
-xc, --xctrunner <str> |
Bundle id of an XCUITest runner to start (e.g. com.facebook.WebDriverAgentRunner.xctrunner). |
-s, --session-id <str> |
Existing WDA session id (optional; used for session-scoped unlock endpoints). |
Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.
wda list-items¶
Show tappable WDA elements (use with 'tap' selectors).
Options:
| Option | Description |
|---|---|
--port <int> |
WDA device port to connect to. [default: 8100] |
--timeout <float> |
HTTP timeout in seconds. [default: 10.0] |
-xc, --xctrunner <str> |
Bundle id of an XCUITest runner to start (e.g. com.facebook.WebDriverAgentRunner.xctrunner). |
-s, --session-id <str> |
Existing WDA session id (optional). |
--hittable-only |
Show only elements marked hittable by WDA. |
--clickable |
Filter by a clickable type allowlist + visible/enabled. |
--types <str> |
Comma-separated element type allowlist (e.g. Icon,Button,Cell). |
--with-rect |
Include element bounds (x,y,width,height) if present. |
Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.
wda screenshot¶
Save a screenshot via WDA.
Arguments:
| Argument | Description |
|---|---|
out |
[required] |
Options:
| Option | Description |
|---|---|
--port <int> |
WDA device port to connect to. [default: 8100] |
--timeout <float> |
HTTP timeout in seconds. [default: 10.0] |
-xc, --xctrunner <str> |
Bundle id of an XCUITest runner to start (e.g. com.facebook.WebDriverAgentRunner.xctrunner). |
-s, --session-id <str> |
Existing WDA session id (optional). |
Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.
wda status¶
Show WDA status.
Options:
| Option | Description |
|---|---|
--port <int> |
WDA device port to connect to. [default: 8100] |
--timeout <float> |
HTTP timeout in seconds. [default: 10.0] |
-xc, --xctrunner <str> |
Bundle id of an XCUITest runner to start (e.g. com.facebook.WebDriverAgentRunner.xctrunner). |
Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.
wda type¶
Type text into the focused element.
Arguments:
| Argument | Description |
|---|---|
text |
[required] |
Options:
| Option | Description |
|---|---|
--port <int> |
WDA device port to connect to. [default: 8100] |
--timeout <float> |
HTTP timeout in seconds. [default: 10.0] |
-xc, --xctrunner <str> |
Bundle id of an XCUITest runner to start (e.g. com.facebook.WebDriverAgentRunner.xctrunner). |
-s, --session-id <str> |
Existing WDA session id (omit to create a new session). |
--bundle-id <str> |
Bundle id to launch if a new session is created. |
Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.
wda swipe¶
Swipe from one coordinate to another.
Arguments:
| Argument | Description |
|---|---|
start_x |
[required] |
start_y |
[required] |
end_x |
[required] |
end_y |
[required] |
Options:
| Option | Description |
|---|---|
--port <int> |
WDA device port to connect to. [default: 8100] |
--timeout <float> |
HTTP timeout in seconds. [default: 10.0] |
-xc, --xctrunner <str> |
Bundle id of an XCUITest runner to start (e.g. com.facebook.WebDriverAgentRunner.xctrunner). |
-d, --duration <float> |
Swipe duration in seconds. [default: 0.2] |
-s, --session-id <str> |
Existing WDA session id (omit to create a new session). |
--bundle-id <str> |
Bundle id to launch if a new session is created. |
Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.
wda window-size¶
Show window size (screen dimensions).
Options:
| Option | Description |
|---|---|
--port <int> |
WDA device port to connect to. [default: 8100] |
--timeout <float> |
HTTP timeout in seconds. [default: 10.0] |
-xc, --xctrunner <str> |
Bundle id of an XCUITest runner to start (e.g. com.facebook.WebDriverAgentRunner.xctrunner). |
-s, --session-id <str> |
Existing WDA session id (omit to create a new session). |
--bundle-id <str> |
Bundle id to launch if a new session is created. |
Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.