pymobiledevice3 developer

Developer tooling for iOS devices (needs Developer Mode, and usually the DDI mounted).

Most of these commands need the Developer Disk Image (DDI) mounted on the device first (dvt needs it only on iOS < 17, core-device always does). Mount it with:

pymobiledevice3 mounter auto-mount

On iOS 17+ these services are reached through an RSD tunnel, which is set up automatically (no flag or root needed).

shell

Open an IPython shell connected to a developer service (for exploration/R&D).

pymobiledevice3 developer shell [OPTIONS] {service}

Arguments:

Argument	Description
service	DTX service name to open (e.g. com.apple.instruments.dtservicehub on iOS 17+). [required]

Options:

Option	Description
--native	macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]
-r, --remove-ssl-context / --keep-ssl-context	Strip (or keep) TLS after the handshake. Default: decided automatically for the device.

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

screenshot

Capture a PNG screenshot using the legacy screenshotr service (deprecated; prefer dvt screenshot).

pymobiledevice3 developer screenshot [OPTIONS] {out}

Arguments:

Argument	Description
out	Local file to write the PNG screenshot to. [required]

Options:

Option

Description

--native

macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

dvt

Drive the Instruments (DVT) services: process control, metrics, traces and more.

On iOS < 17 these need the DeveloperDiskImage mounted (pymobiledevice3 mounter auto-mount); on iOS 17+ the required tunnel is set up automatically.

dvt proclist

List running processes (with PIDs, bundle ids and start times) as JSON.

pymobiledevice3 developer dvt proclist [OPTIONS]

Options:

Option

Description

--native

macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

dvt is-running-pid

Print whether a PID is currently running (true/false).

pymobiledevice3 developer dvt is-running-pid [OPTIONS] {pid}

Arguments:

Argument	Description
pid	Process ID on the device (see developer dvt proclist). [required]

Options:

Option

Description

--native

macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

dvt memlimitoff

Lift the memory (jetsam) limit of a running process; fails if the device declines.

pymobiledevice3 developer dvt memlimitoff [OPTIONS] {pid}

Arguments:

Argument	Description
pid	Process ID on the device (see developer dvt proclist). [required]

Options:

Option

Description

--native

macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

dvt applist

List installed applications as JSON.

pymobiledevice3 developer dvt applist [OPTIONS]

Options:

Option

Description

--native

macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

dvt signal

Send a signal to a process (give either a numeric SIG or --signal-name).

pymobiledevice3 developer dvt signal [OPTIONS] {pid} [sig]

Arguments:

Argument	Description
pid	Process ID on the device (see developer dvt proclist). [required]
sig	Signal number to send (e.g. 15 for SIGTERM). Mutually exclusive with --signal-name.

Options:

Option	Description
--native	macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]
-s, --signal-name <str>	Signal name to send instead of SIG (e.g. TERM or SIGTERM).

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

dvt kill

Kill a process by PID (sends SIGKILL).

pymobiledevice3 developer dvt kill [OPTIONS] {pid}

Arguments:

Argument	Description
pid	Process ID on the device (see developer dvt proclist). [required]

Options:

Option

Description

--native

macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

dvt process-id-for-bundle-id

Print the PID of a running app by bundle identifier (prints 0 if it is not running).

pymobiledevice3 developer dvt process-id-for-bundle-id [OPTIONS] {app_bundle_identifier}

Arguments:

Argument	Description
app_bundle_identifier	Bundle identifier of the app (e.g. com.apple.Preferences). [required]

Options:

Option

Description

--native

macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

dvt pkill

Kill (SIGKILL) every process whose name (or bundle id, with --bundle) contains an expression.

pymobiledevice3 developer dvt pkill [OPTIONS] {expressions}...

Arguments:

Argument	Description
expressions...	One or more process-name (or bundle id) expressions to match. [required]

Options:

Option	Description
--native	macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]
--bundle / --no-bundle	Treat given expressions as bundle-identifiers instead of process names [default: no-bundle]

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

dvt launch

Launch an installed app by bundle identifier and print its PID.

pymobiledevice3 developer dvt launch [OPTIONS] {arguments}

Arguments:

Argument	Description
arguments	Bundle identifier followed by optional launch arguments, as one quoted string (e.g. 'com.apple.mobilesafari -arg value'). [required]

Options:

Option	Description
--native	macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]
--kill-existing / --no-kill-existing	Kill an already-running instance of the app before launching. [default: kill-existing]
--suspended / --no-suspended	Start the process suspended, waiting for a debugger to attach. [default: no-suspended]
--env <str>	Environment variable to pass to process given as key=value (can be specified multiple times)
--stream / --no-stream	Keep running and print the app's stdout/stderr until interrupted (Ctrl+C). [default: no-stream]

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

dvt shell

Open an IPython shell connected to the DVT service (for pymobiledevice3 R&D).

pymobiledevice3 developer dvt shell [OPTIONS]

Options:

Option

Description

--native

macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

dvt ls

List a directory on the device's filesystem by absolute path.

pymobiledevice3 developer dvt ls [OPTIONS] {path}

Arguments:

Argument	Description
path	Absolute path of the device directory to list. [required]

Options:

Option	Description
--native	macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]
-r, --recursive	Also list every subdirectory.

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

dvt device-information

Print hardware, network, kernel and system information as JSON.

pymobiledevice3 developer dvt device-information [OPTIONS]

Options:

Option

Description

--native

macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

dvt netstat

Stream new network connections as they are detected, until interrupted (Ctrl+C).

pymobiledevice3 developer dvt netstat [OPTIONS]

Options:

Option	Description
--native	macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]
--format <text\|json>	Output format. 'json' emits one JSON object per line (NDJSON) on stdout. [default: text]

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

dvt screenshot

Take a screenshot of the device screen and save it as PNG.

pymobiledevice3 developer dvt screenshot [OPTIONS] {out}

Arguments:

Argument	Description
out	Local file to write the PNG screenshot to. [required]

Options:

Option

Description

--native

macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

dvt vm-regions

List the virtual memory regions of a debuggable (development-signed) app's process.

pymobiledevice3 developer dvt vm-regions [OPTIONS] {pid}

Arguments:

Argument	Description
pid	Process ID on the device (see developer dvt proclist). [required]

Options:

Option

Description

--native

macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

dvt memgraph

Save the memory graph of a running debuggable (development-signed) app's process.

Prints the leak count and addresses as JSON. The .memgraph file can be inspected on macOS with leaks(1), heap(1) or vmmap(1). With --leaked-only, no file is written when nothing leaked.

pymobiledevice3 developer dvt memgraph [OPTIONS] {pid} {out}

Arguments:

Argument	Description
pid	Process ID on the device (see developer dvt proclist). [required]
out	Local .memgraph file to write. [required]

Options:

Option	Description
--native	macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]
--leaked-only	Keep only the leaked allocations in the graph.

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

dvt dyld-metrics

Print the dynamic loader's launch metrics of a debuggable (development-signed) app's process.

pymobiledevice3 developer dvt dyld-metrics [OPTIONS] {pid}

Arguments:

Argument	Description
pid	Process ID on the device (see developer dvt proclist). [required]

Options:

Option	Description
--native	macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]
--at-main	Wait for the process to reach main before capturing.

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

dvt allocations

Launch a debuggable (development-signed) app and record its memory allocations.

Kills an already-running instance of the app first. Records until --duration elapses or you press Ctrl+C, then prints a summary of the allocations by category.

pymobiledevice3 developer dvt allocations [OPTIONS] {bundle_id}

Arguments:

Argument	Description
bundle_id	Bundle identifier of the development-signed app to launch. [required]

Options:

Option	Description
--native	macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]
--duration <float>	Seconds to record for. Records until interrupted by default.
--kind <heap\|reference-counts\|vm\|zombies>	Kind of events to record; can be repeated. Heap events by default.
--events	Print every event with its backtrace as a JSON line, instead of the summary. Frames are printed as image+offset.

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

dvt xcuitest

Launch an installed XCTest runner app and run its UI tests (e.g. WebDriverAgent).

 Usage example:  pymobiledevice3 developer dvt xcuitest com.facebook.WebDriverAgentRunner.xctrunner

pymobiledevice3 developer dvt xcuitest [OPTIONS] {bundle_id}

Arguments:

Argument	Description
bundle_id	Bundle identifier of the XCTest runner (e.g. com.apple.test.WebDriverAgentRunner.xctrunner) [required]

Options:

Option	Description
--native	macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]
--target-bundle-id <str>	Bundle identifier of the target app (if different from runner, e.g. for testing app extensions)
--output-log <path>	File to write the test log to (default: the regular logger output).
--timeout <float>	Maximum execution time, in seconds (default: no limit).
--env <str>	Environment variable to pass to process given as key=value (can be specified multiple times)

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

dvt trace-codes

Print the device's KDebug trace code to name table as JSON.

pymobiledevice3 developer dvt trace-codes [OPTIONS]

Options:

Option

Description

--native

macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

dvt name-for-uid

Print the user name of a numeric user ID on the device.

pymobiledevice3 developer dvt name-for-uid [OPTIONS] {uid}

Arguments:

Argument	Description
uid	Numeric user ID. [required]

Options:

Option

Description

--native

macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

dvt name-for-gid

Print the group name of a numeric group ID on the device.

pymobiledevice3 developer dvt name-for-gid [OPTIONS] {gid}

Arguments:

Argument	Description
gid	Numeric group ID. [required]

Options:

Option

Description

--native

macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

dvt oslog

Stream the device's unified log (os_log) until interrupted (Ctrl+C).

Includes more detail (subsystem, category, sender image) than syslog live, but is less stable.

pymobiledevice3 developer dvt oslog [OPTIONS]

Options:

Option	Description
--native	macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]
--pid <int>	Only show messages from this process ID.
--format <text\|json>	Output format. 'json' emits one JSON object per line (NDJSON) on stdout. [default: text]

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

dvt energy

Stream energy-usage telemetry for the given PIDs as JSON lines, until interrupted (Ctrl+C).

pymobiledevice3 developer dvt energy [OPTIONS] {pid_list}...

Arguments:

Argument	Description
pid_list...	One or more process IDs to monitor. [required]

Options:

Option

Description

--native

macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

dvt network-statistics

Stream network traffic for the given PIDs as JSON lines (one per PID per sample), until Ctrl+C.

pymobiledevice3 developer dvt network-statistics [OPTIONS] {pid_list}...

Arguments:

Argument	Description
pid_list...	One or more process IDs to monitor. [required]

Options:

Option	Description
--native	macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]
-i, --interval <int>	Interval in milliseconds between samples [default: 1000]

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

dvt notifications

Stream memory and app-state notifications as JSON lines, until interrupted (Ctrl+C).

pymobiledevice3 developer dvt notifications [OPTIONS]

Options:

Option

Description

--native

macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

dvt graphics

Stream GPU graphics performance samples as JSON lines, until interrupted (Ctrl+C).

pymobiledevice3 developer dvt graphics [OPTIONS]

Options:

Option

Description

--native

macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

dvt fps

Stream the display frame rate (Core Animation FPS), one JSON line per second, until Ctrl+C.

pymobiledevice3 developer dvt fps [OPTIONS]

Options:

Option

Description

--native

macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

dvt har

Enable HTTP archive (HAR) logging on the device until interrupted (Ctrl+C).

 For more information, please read:  https://github.com/doronz88/harlogger?tab=readme-ov-file#enable-http-instrumentation-method

pymobiledevice3 developer dvt har [OPTIONS]

Options:

Option

Description

--native

macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

dvt sysmon

Monitor system-wide and per-process CPU, memory and other metrics (like Activity Monitor).

dvt sysmon system

Print a single snapshot of system-wide stats (CPU usage and other counters).

pymobiledevice3 developer dvt sysmon system [OPTIONS]

Options:

Option	Description
--native	macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]
-f, --fields <str>	Only print these system fields, separated by "," (default: all).

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

dvt sysmon process

Show or monitor per-process metrics (CPU, memory, ...).

dvt sysmon process single

Print a single snapshot of the running processes and their metrics.

pymobiledevice3 developer dvt sysmon process single [OPTIONS]

Options:

Option	Description
--native	macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]
-f, --filter <str>	Filter processes by key=value. Can be specified multiple times.
-k, --key <str>	Show only selected process keys for each emitted record. Can be specified multiple times.
--human	Format known byte-count fields such as physFootprint using human-readable units, and nanosecond fields such as cpuTotalUser as durations.
-o, --output <path>	Output file path for JSONL format (optional, defaults to stdout)

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

dvt sysmon process monitor

Continuously stream process metrics, until interrupted (Ctrl+C) or --duration elapses.

dvt sysmon process monitor threshold

Continuously print processes above a cpuUsage threshold, one JSON object per line.

pymobiledevice3 developer dvt sysmon process monitor threshold [OPTIONS] {threshold}

Arguments:

Argument	Description
threshold	Minimum cpuUsage value to emit [required]

Options:

Option	Description
--native	macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]
-k, --key <str>	Show only selected process keys for each emitted record. Can be specified multiple times.
-d, --duration <int>	Maximum duration in milliseconds to run monitoring (optional)
--human	Format known byte-count fields such as physFootprint using human-readable units, and nanosecond fields such as cpuTotalUser as durations.
-o, --output <path>	Output file path for JSONL format (optional, defaults to stdout)

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

dvt sysmon process monitor process

Continuously print one process selected by key=value filters, one JSON object per line.

pymobiledevice3 developer dvt sysmon process monitor process [OPTIONS]

Options:

Option	Description
--native	macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]
-f, --filter <str>	Filter processes by key=value. Can be specified multiple times.
-k, --key <str>	Show only selected process keys for each emitted record. Can be specified multiple times.
--choose <prompt\|first\|last>	How to resolve multiple matching processes: "prompt" asks interactively; "first" selects the oldest matching process; "last" selects the newest matching process. Automatic ordering is by startAbsTime, then pid, then name. [default: prompt]
--keep-monitoring	Re-apply the filters on every snapshot instead of locking onto the process selected from the first one. Snapshots where nothing matches are skipped instead of ending the command, and a relaunched process is picked up again automatically. Requires "--choose first" or "--choose last".
-i, --interval <int>	Minimum interval in milliseconds between outputs (optional) [default: 500]
-d, --duration <int>	Maximum duration in milliseconds to run monitoring (optional)
--human	Format known byte-count fields such as physFootprint using human-readable units, and nanosecond fields such as cpuTotalUser as durations.
-o, --output <path>	Output file path for JSONL format (optional, defaults to stdout)

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

dvt core-profile-session

Trace kernel events (kdebug), call stacks and stackshots, like Instruments' System Trace.

dvt core-profile-session live

Print raw kernel trace events (kevents) in real time, until --count or Ctrl+C.

pymobiledevice3 developer dvt core-profile-session live [OPTIONS]

Options:

Option	Description
--native	macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]
-c, --count <int>	Number of events to print. Omit to run until interrupted (Ctrl+C). [default: -1]
--bsc / --no-bsc	Add the BSD system call (BSC) subclass to the subclass filter. [default: no-bsc]
-cf, --class-filters <based_int>	Events class filter. Omit for all. Can be specified multiple times.
-sf, --subclass-filters <based_int>	Events subclass filter. Omit for all. Can be specified multiple times.
--tid <int>	Thread ID to filter. Omit for all.
--timestamp / --no-timestamp	Whether to print timestamp or not. [default: timestamp]
--event-name / --no-event-name	Whether to print event name or not. [default: event-name]
--func-qual / --no-func-qual	Whether to print function qualifier or not. [default: func-qual]
--show-tid / --no-show-tid	Whether to print thread ID or not. [default: show-tid]
--process-name / --no-process-name	Whether to print process name or not. [default: process-name]
--args / --no-args	Whether to print event arguments or not. [default: args]

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

dvt core-profile-session save

Record raw kdebug trace data to a file, until interrupted (Ctrl+C).

pymobiledevice3 developer dvt core-profile-session save [OPTIONS] {out}

Arguments:

Argument	Description
out	Local file to write the raw kdebug trace to. [required]

Options:

Option	Description
--native	macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]
--bsc / --no-bsc	Add the BSD system call (BSC) subclass to the subclass filter. [default: no-bsc]
-cf, --class-filters <based_int>	Events class filter. Omit for all. Can be specified multiple times.
-sf, --subclass-filters <based_int>	Events subclass filter. Omit for all. Can be specified multiple times.

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

dvt core-profile-session stackshot

Print the call stacks of all threads of all processes.

The call stacks are symbolicated using the Xcode device support of the device, which developer fetch-symbols download creates. Kernel frames are symbolicated when given --kernelcache and --kernel-signatures.

pymobiledevice3 developer dvt core-profile-session stackshot [OPTIONS]

Options:

Option	Description
--native	macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]
--out <path>	Write the raw stackshot as JSON into this file instead of printing it.
--json	Print the raw stackshot as JSON instead of the call stacks.
--process <str>	Process ID / name to filter. Omit for all.
--symbols <directory>	Directory of symbols to use (as created by developer fetch-symbols download), instead of the Xcode device support of the device.
--kernelcache <file>	Kernelcache of the firmware the device runs (as found in its IPSW), to name the kernel images of kernel frames. Requires ipsw unless it is already decompressed.
--kernel-signatures <directory>	Directory of ipsw kernel symbolication signatures (the kernel directory of https://github.com/blacktop/symbolicator), to symbolicate kernel frames of --kernelcache. Requires ipsw.

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

dvt core-profile-session parse-live

Print traces (syscalls, thread events, etc.) received from the device in real time.

The selections add up. The device filters by subclass at best, so the events not selected are dropped right after decoding, which keeps up with the device even over --userspace. events with the same options lists the events that are printed.

pymobiledevice3 developer dvt core-profile-session parse-live [OPTIONS]

Options:

Option	Description
--native	macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]
-c, --count <int>	Number of events to print. Omit to run until interrupted (Ctrl+C).
--bsc / --no-bsc	Add the BSD system call (BSC) subclass to the subclass filter. [default: no-bsc]
-cf, --class-filters <based_int>	Events class filter. Omit for all. Can be specified multiple times.
-sf, --subclass-filters <based_int>	Events subclass filter. Omit for all. Can be specified multiple times.
--tid <int>	Thread ID to filter. Omit for all.
--show-tid / --no-show-tid	Whether to print thread ID or not. [default: no-show-tid]
--process <str>	Process ID / name to filter. Omit for all.
-s, --syscall <str>	This syscall (e.g. open, openat; with its _nocancel and _dprotected_np variants), with its paths. Can be specified multiple times.
-e, --event <str>	This event, by its trace code name (e.g. DBG_DYLD_TIMING_DLSYM; events TEXT finds the name). Can be specified multiple times.
--fs	The syscalls that take a path.
--net	The socket syscalls.
--proc	The process lifecycle syscalls.
--io	The syscalls on file descriptors: read, write, ...
--mem	The memory mapping syscalls and Mach traps.
--signal	The signal syscalls.
--cred	Credential, code signing and policy checks, and access to other tasks.
--sync	Locks, condition variables, kqueues and workqueues.
--mach	The Mach traps.
--dyld	dyld events (image loads, dlopen, dlsym, ...), filtered on the device.
--xpc	libxpc events: messages sent and received, replies, transactions.
--dispatch	libdispatch events: Mach messages received through dispatch, queue misuse.
--runloop	CoreFoundation run loop events: iterations, waits, sources, timers, observers and blocks.
-m, --match <str>	Only print the traces containing this text, highlighted (repeatable; all must match).
-v, --invert-match <str>	Only print the traces not containing this text (repeatable; any match excludes).
-mi, --match-insensitive <str>	Like --match, ignoring case.
-vi, --invert-match-insensitive <str>	Like --invert-match, ignoring case.
-r, --regex <str>	Only print the traces matching this regex, highlighted (repeatable; any match includes).
-ri, --insensitive-regex <str>	Like --regex, ignoring case.
--json	Print each trace as a JSON object, one per line: its time, thread, process, event name, parsed fields and text. The filters match the line it would print.
--color-mode <fast\|rich>	Trace color style: 'rich' also colors the event by what it shows (call, strings, numbers, errors, ...), 'fast' colors only the columns. [default: rich]
--skip-behind / --no-skip-behind	Skip ahead to recent events whenever output falls more than --max-lag behind the device, instead of failing. Without class/subclass filters the device can emit events faster than they can be parsed. [default: no-skip-behind]
--max-lag <float>	How far (in seconds) output may fall behind the device before it skips ahead (--skip-behind) or fails (--no-skip-behind). [default: 2.0]

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

dvt core-profile-session events

List the events parse-live prints with the same options (e.g. events --fs, events -s open), or every event name parse-live --event accepts.

pymobiledevice3 developer dvt core-profile-session events [OPTIONS] [pattern]

Arguments:

Argument	Description
pattern	Only list the names containing this text, ignoring case (e.g. dlsym).

Options:

Option	Description
--bsc / --no-bsc	Add the BSD system call (BSC) subclass to the subclass filter. [default: no-bsc]
-cf, --class-filters <based_int>	Events class filter. Omit for all. Can be specified multiple times.
-sf, --subclass-filters <based_int>	Events subclass filter. Omit for all. Can be specified multiple times.
-s, --syscall <str>	This syscall (e.g. open, openat; with its _nocancel and _dprotected_np variants), with its paths. Can be specified multiple times.
-e, --event <str>	This event, by its trace code name (e.g. DBG_DYLD_TIMING_DLSYM; events TEXT finds the name). Can be specified multiple times.
--fs	The syscalls that take a path.
--net	The socket syscalls.
--proc	The process lifecycle syscalls.
--io	The syscalls on file descriptors: read, write, ...
--mem	The memory mapping syscalls and Mach traps.
--signal	The signal syscalls.
--cred	Credential, code signing and policy checks, and access to other tasks.
--sync	Locks, condition variables, kqueues and workqueues.
--mach	The Mach traps.
--dyld	dyld events (image loads, dlopen, dlsym, ...), filtered on the device.
--xpc	libxpc events: messages sent and received, replies, transactions.
--dispatch	libdispatch events: Mach messages received through dispatch, queue misuse.
--runloop	CoreFoundation run loop events: iterations, waits, sources, timers, observers and blocks.

dvt core-profile-session callstacks-live

Print sampled call stacks in real time, until --count or Ctrl+C.

pymobiledevice3 developer dvt core-profile-session callstacks-live [OPTIONS]

Options:

Option	Description
--native	macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]
-c, --count <int>	Number of events to print. Omit to run until interrupted (Ctrl+C).
--process <str>	Process ID / name to filter. Omit for all.
--tid <int>	Thread ID to filter. Omit for all.
--show-tid / --no-show-tid	Whether to print thread ID or not. [default: no-show-tid]

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

dvt simulate-location

Simulate the device's GPS location through DVT (use this one on iOS 17 and newer).

dvt simulate-location clear

Clear the currently simulated location on iOS 17 and newer.

pymobiledevice3 developer dvt simulate-location clear [OPTIONS]

Options:

Option

Description

--native

macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

dvt simulate-location set

Simulate a fixed location, keeping the session open until interrupted (Ctrl+C).

 For example:  ... set -- 40.690008 -74.045843 for liberty island

pymobiledevice3 developer dvt simulate-location set [OPTIONS] {latitude} {longitude}

Arguments:

Argument	Description
latitude	Latitude in decimal degrees. [required]
longitude	Longitude in decimal degrees (put -- before negative values). [required]

Options:

Option

Description

--native

macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

dvt simulate-location play

Replay a GPX route at its recorded pace, then wait until interrupted (Ctrl+C).

pymobiledevice3 developer dvt simulate-location play [OPTIONS] {filename} [timing_randomness_range]

Arguments:

Argument	Description
filename	GPX file with the route to replay. [required]
timing_randomness_range	Random jitter, in milliseconds (+/-), added to each wait between points. [default: 0]

Options:

Option	Description
--native	macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]
--disable-sleep / --no-disable-sleep	Jump through the points without waiting the time between their timestamps. [default: no-disable-sleep]

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

dvt condition

Simulate device conditions (e.g. slow network, thermal state) via DVT.

dvt condition list

List the available condition groups and their profile identifiers as JSON.

pymobiledevice3 developer dvt condition list [OPTIONS]

Options:

Option

Description

--native

macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

dvt condition clear

Disable the currently active induced condition, returning the device to normal.

pymobiledevice3 developer dvt condition clear [OPTIONS]

Options:

Option

Description

--native

macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

dvt condition set

Activate a condition profile, then wait until interrupted (Ctrl+C).

Replaces any previously active condition. Use developer dvt condition clear to disable it.

pymobiledevice3 developer dvt condition set [OPTIONS] {profile_identifier}

Arguments:

Argument	Description
profile_identifier	Profile identifier to activate (see developer dvt condition list). [required]

Options:

Option

Description

--native

macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

fetch-symbols

Download the device's dyld shared cache (DSC) and dyld, for symbolicating crashes and traces.

fetch-symbols list

List the symbol files the device offers for download.

pymobiledevice3 developer fetch-symbols list [OPTIONS]

Options:

Option

Description

--native

macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

fetch-symbols download

Download the device's symbols, by default into its Xcode DeviceSupport directory.

This command downloads symbol data. Optionally, the user can specify an output directory where the data will be stored. If no output directory is provided, the symbols will be downloaded into the Xcode directory directly (DeviceSupport).

Symbols which were already downloaded are kept, unless --force is given.

pymobiledevice3 developer fetch-symbols download [OPTIONS] [out]

Arguments:

Argument	Description
out	Directory to download into (default: this device's Xcode DeviceSupport directory).

Options:

Option	Description
--native	macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]
--force	Download the symbols again even if they were already downloaded.

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

simulate-location

Simulate GPS location on iOS versions below 17 (set, clear, or replay GPX routes).

simulate-location clear

Stop location simulation and resume real GPS on iOS versions below 17.

pymobiledevice3 developer simulate-location clear [OPTIONS]

Options:

Option

Description

--native

macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

simulate-location set

Set a fixed simulated location on iOS versions below 17 (stays until clear).

Example: set -- 40.690008 -74.045843 (Liberty Island).

pymobiledevice3 developer simulate-location set [OPTIONS] {latitude} {longitude}

Arguments:

Argument	Description
latitude	Latitude in decimal degrees. [required]
longitude	Longitude in decimal degrees (put -- before negative values). [required]

Options:

Option

Description

--native

macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

simulate-location play

Replay a GPX route on iOS versions below 17; optionally disable sleeps and add timing jitter.

pymobiledevice3 developer simulate-location play [OPTIONS] {filename} {timing_randomness_range}

Arguments:

Argument	Description
filename	GPX file with the route to replay. [required]
timing_randomness_range	Random jitter, in milliseconds (+/-), added to each wait between points (0 for none). [required]

Options:

Option	Description
--native	macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]
--disable-sleep / --no-disable-sleep	Jump through the points without waiting the time between their timestamps. [default: no-disable-sleep]

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

accessibility

Run accessibility audits, inspect on-screen elements and change accessibility settings.

accessibility run-audit

Run accessibility audits on the foreground app and print the issues found as JSON.

pymobiledevice3 developer accessibility run-audit [OPTIONS] {test_types}...

Arguments:

Argument	Description
test_types...	One or more audit types to run (see supported-audit-types). [required]

Options:

Option

Description

--native

macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

accessibility supported-audit-types

List the accessibility audit types this device supports.

pymobiledevice3 developer accessibility supported-audit-types [OPTIONS]

Options:

Option

Description

--native

macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

accessibility capabilities

Print the device's accessibility inspector capabilities as JSON.

pymobiledevice3 developer accessibility capabilities [OPTIONS]

Options:

Option

Description

--native

macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

accessibility shell

Open an IPython shell connected to the accessibility audit service (for R&D).

pymobiledevice3 developer accessibility shell [OPTIONS]

Options:

Option

Description

--native

macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

accessibility notifications

Stream accessibility focus and app-state changes as they happen, until interrupted (Ctrl+C).

pymobiledevice3 developer accessibility notifications [OPTIONS]

Options:

Option	Description
--native	macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]
--format <text\|json>	Output format. 'json' emits one JSON object per line (NDJSON) on stdout. [default: text]

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

accessibility list-items

List the accessibility elements of the foreground app by moving the inspector focus through them.

pymobiledevice3 developer accessibility list-items [OPTIONS]

Options:

Option

Description

--native

macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

accessibility element-attributes

Move the accessibility inspector focus and read attributes (label, identifier, value, ...) of the focused element.

pymobiledevice3 developer accessibility element-attributes [OPTIONS] [attributes]...

Arguments:

Argument	Description
attributes...	Attribute names to read (default: Label, Identifier, Value).

Options:

Option	Description
--native	macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]
--direction <first\|next\|previous\|last>	How to move the inspector focus before reading the newly focused element. [default: next]

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

accessibility settings

Show, change or reset the device's accessibility settings.

accessibility settings show

Show the current accessibility settings and their values.

pymobiledevice3 developer accessibility settings show [OPTIONS]

Options:

Option

Description

--native

macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

accessibility settings set

Change an accessibility setting on the device, then wait until interrupted (Ctrl+C).

To list the available settings use the "show" command.

pymobiledevice3 developer accessibility settings set [OPTIONS] {setting} {value}

Arguments:

Argument	Description
setting	Setting key to change (see the show command). [required]
value	New value as a Python literal (e.g. True, False, 0.5). [required]

Options:

Option

Description

--native

macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

accessibility settings reset

Reset all accessibility settings to their device defaults.

pymobiledevice3 developer accessibility settings reset [OPTIONS]

Options:

Option

Description

--native

macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

debugserver

Debug apps with LLDB through the device's debugserver.

debugserver applist

Print the apps debugserver can launch or attach to, as JSON.

pymobiledevice3 developer debugserver applist [OPTIONS]

Options:

Option

Description

--native

macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

debugserver start-server

Start debugserver and print the LLDB connect string.

 - For iOS < 17, you must forward to a local port (--local-port). - For iOS >= 17 without --local-port, the device's tunnel address is printed; that needs a kernel-routable tunnel (e.g. --tunnel), so with the default userspace tunnel use --local-port. Connect quickly with your own LLDB client using the printed steps.

pymobiledevice3 developer debugserver start-server [OPTIONS]

Options:

Option	Description
--native	macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]
--local-port <int>	Forward debugserver to this local port and keep running until interrupted (Ctrl+C).
--host <str>	Address to bind the local port to. [default: 127.0.0.1]

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

debugserver lldb

Automate lldb launch for a given xcodeproj, IPA, or installed bundle identifier (iOS 17+).

 This will: - Build the given xcodeproj (if provided) - Extract the given IPA (if provided) - Install it (for xcodeproj/IPA inputs) - Start a debugserver attached to it - Place breakpoints if given any - Launch the application if requested - Execute any additional commands if requested - Switch to lldb shell

pymobiledevice3 developer debugserver lldb [OPTIONS] {project_or_ipa_or_bundle_id}

Arguments:

Argument	Description
project_or_ipa_or_bundle_id	Path to .xcodeproj/.ipa or an installed app bundle identifier [required]

Options:

Option	Description
--native	macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]
--configuration <str>	Build configuration to invoke (e.g., Debug or Release). [default: Debug]
--lldb-command <str>	Path to the lldb executable to run. [default: lldb]
--launch / --no-launch	Automatically launch the app after attaching. [default: no-launch]
-b, --break <str>	Add multiple startup breakpoints
-c, --command <str>	Additional commands to run at startup

Accepts the connection options: --rsd, --tunnel, --userspace.

arbitration

Mark/unmark a device as "in-use" to avoid conflicts with other tools.

arbitration version

Show arbitration protocol version.

pymobiledevice3 developer arbitration version [OPTIONS]

Options:

Option

Description

--native

macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

arbitration check-in

Check in as the device's owner (marks it as in-use), then wait until interrupted (Ctrl+C).

Fails if another host has it checked in, unless --force is given. Use check-out to release it.

pymobiledevice3 developer arbitration check-in [OPTIONS] {hostname}

Arguments:

Argument	Description
hostname	Name to claim the device under (shown to other tools). [required]

Options:

Option	Description
--native	macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]
-f, --force	Take the device even if another host has it checked in.

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

arbitration check-out

Release ownership and allow other tools to use the device.

pymobiledevice3 developer arbitration check-out [OPTIONS]

Options:

Option

Description

--native

macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

core-device

Use the CoreDevice services Xcode uses (files, apps, processes, screen, input, diagnostics).

Needs iOS 17+ and the Developer Disk Image mounted (pymobiledevice3 mounter auto-mount). The required tunnel is set up automatically.

core-device list-directory

List the contents of a directory in a file domain, as JSON.

pymobiledevice3 developer core-device list-directory [OPTIONS] {domain}:<appDataContainer|appGroupDataContainer|temporary|systemCrashLogs> {path}

Arguments:

Argument	Description
domain:<appDataContainer\|appGroupDataContainer\|temporary\|systemCrashLogs>	File domain: an app's data container, an app group container (both need --identifier), the temporary directory or the system crash logs. [required]
path	Path relative to the domain's root. [required]

Options:

Option	Description
--native	macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]
--identifier <str>	App or app group identifier, for the container domains

Accepts the connection options: --rsd, --tunnel, --userspace.

core-device read-file

Read a file from a file domain to stdout or --output.

pymobiledevice3 developer core-device read-file [OPTIONS] {domain}:<appDataContainer|appGroupDataContainer|temporary|systemCrashLogs> {path}

Arguments:

Argument	Description
domain:<appDataContainer\|appGroupDataContainer\|temporary\|systemCrashLogs>	File domain: an app's data container, an app group container (both need --identifier), the temporary directory or the system crash logs. [required]
path	Path relative to the domain's root. [required]

Options:

Option	Description
--native	macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]
--identifier <str>	App or app group identifier, for the container domains
-o, --output <path>	Local file to write the contents to (default: print to stdout).

Accepts the connection options: --rsd, --tunnel, --userspace.

core-device propose-empty-file

Create an empty file in a file domain with custom permissions, owner and timestamps.

pymobiledevice3 developer core-device propose-empty-file [OPTIONS] {domain}:<appDataContainer|appGroupDataContainer|temporary|systemCrashLogs> {path}

Arguments:

Argument	Description
domain:<appDataContainer\|appGroupDataContainer\|temporary\|systemCrashLogs>	File domain: an app's data container, an app group container (both need --identifier), the temporary directory or the system crash logs. [required]
path	Path relative to the domain's root. [required]

Options:

Option	Description
--native	macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]
--identifier <str>	App or app group identifier, for the container domains
--file-permissions <int>	Permission bits of the new file, as a decimal number (default 420 = 0o644). [default: 420]
--uid <int>	Owner user ID (501 = mobile). [default: 501]
--gid <int>	Owner group ID (501 = mobile). [default: 501]
--creation-time <int>	Creation time, in seconds since the epoch (default: now).
--last-modification-time <int>	Last modification time, in seconds since the epoch (default: now).

Accepts the connection options: --rsd, --tunnel, --userspace.

core-device create-directory

Create a directory at the given domain/path.

pymobiledevice3 developer core-device create-directory [OPTIONS] {domain}:<appDataContainer|appGroupDataContainer|temporary|systemCrashLogs> {path}

Arguments:

Argument	Description
domain:<appDataContainer\|appGroupDataContainer\|temporary\|systemCrashLogs>	File domain: an app's data container, an app group container (both need --identifier), the temporary directory or the system crash logs. [required]
path	Path relative to the domain's root. [required]

Options:

Option	Description
--native	macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]
--identifier <str>	App or app group identifier, for the container domains

Accepts the connection options: --rsd, --tunnel, --userspace.

core-device remove-directory

Remove an empty directory at the given domain/path.

pymobiledevice3 developer core-device remove-directory [OPTIONS] {domain}:<appDataContainer|appGroupDataContainer|temporary|systemCrashLogs> {path}

Arguments:

Argument	Description
domain:<appDataContainer\|appGroupDataContainer\|temporary\|systemCrashLogs>	File domain: an app's data container, an app group container (both need --identifier), the temporary directory or the system crash logs. [required]
path	Path relative to the domain's root. [required]

Options:

Option	Description
--native	macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]
--identifier <str>	App or app group identifier, for the container domains

Accepts the connection options: --rsd, --tunnel, --userspace.

core-device remove-file

Remove a file or symbolic link at the given domain/path.

pymobiledevice3 developer core-device remove-file [OPTIONS] {domain}:<appDataContainer|appGroupDataContainer|temporary|systemCrashLogs> {path}

Arguments:

Argument	Description
domain:<appDataContainer\|appGroupDataContainer\|temporary\|systemCrashLogs>	File domain: an app's data container, an app group container (both need --identifier), the temporary directory or the system crash logs. [required]
path	Path relative to the domain's root. [required]

Options:

Option	Description
--native	macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]
--identifier <str>	App or app group identifier, for the container domains

Accepts the connection options: --rsd, --tunnel, --userspace.

core-device rename

Rename or move an item within a domain.

pymobiledevice3 developer core-device rename [OPTIONS] {domain}:<appDataContainer|appGroupDataContainer|temporary|systemCrashLogs> {old_path} {new_path}

Arguments:

Argument	Description
domain:<appDataContainer\|appGroupDataContainer\|temporary\|systemCrashLogs>	File domain: an app's data container, an app group container (both need --identifier), the temporary directory or the system crash logs. [required]
old_path	Current path, relative to the domain's root. [required]
new_path	New path, relative to the domain's root. [required]

Options:

Option	Description
--native	macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]
--identifier <str>	App or app group identifier, for the container domains

Accepts the connection options: --rsd, --tunnel, --userspace.

core-device create-symlink

Create a symbolic link at the given domain/path.

pymobiledevice3 developer core-device create-symlink [OPTIONS] {domain}:<appDataContainer|appGroupDataContainer|temporary|systemCrashLogs> {path} {target}

Arguments:

Argument	Description
domain:<appDataContainer\|appGroupDataContainer\|temporary\|systemCrashLogs>	File domain: an app's data container, an app group container (both need --identifier), the temporary directory or the system crash logs. [required]
path	Path relative to the domain's root. [required]
target	What the link points to; stored as given [required]

Options:

Option	Description
--native	macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]
--identifier <str>	App or app group identifier, for the container domains

Accepts the connection options: --rsd, --tunnel, --userspace.

core-device stat

Show the attributes of an item at the given domain/path.

pymobiledevice3 developer core-device stat [OPTIONS] {domain}:<appDataContainer|appGroupDataContainer|temporary|systemCrashLogs> {path}

Arguments:

Argument	Description
domain:<appDataContainer\|appGroupDataContainer\|temporary\|systemCrashLogs>	File domain: an app's data container, an app group container (both need --identifier), the temporary directory or the system crash logs. [required]
path	Path relative to the domain's root. [required]

Options:

Option	Description
--native	macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]
--identifier <str>	App or app group identifier, for the container domains
--follow-symlinks / --no-follow-symlinks	Report on a link's target rather than the link [default: follow-symlinks]

Accepts the connection options: --rsd, --tunnel, --userspace.

core-device write-file

Create or replace a file at the given domain/path with a local file's contents.

pymobiledevice3 developer core-device write-file [OPTIONS] {domain}:<appDataContainer|appGroupDataContainer|temporary|systemCrashLogs> {path} {local_file}

Arguments:

Argument	Description
domain:<appDataContainer\|appGroupDataContainer\|temporary\|systemCrashLogs>	File domain: an app's data container, an app group container (both need --identifier), the temporary directory or the system crash logs. [required]
path	Path relative to the domain's root. [required]
local_file	Local file to upload. [required]

Options:

Option	Description
--native	macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]
--identifier <str>	App or app group identifier, for the container domains

Accepts the connection options: --rsd, --tunnel, --userspace.

core-device watch

Print file changes under a domain as they happen, one JSON record per change, until Ctrl+C (iOS 27+).

pymobiledevice3 developer core-device watch [OPTIONS] {domain}:<appDataContainer|appGroupDataContainer|temporary|systemCrashLogs> [paths]...

Arguments:

Argument	Description
domain:<appDataContainer\|appGroupDataContainer\|temporary\|systemCrashLogs>	File domain: an app's data container, an app group container (both need --identifier), the temporary directory or the system crash logs. [required]
paths...	Paths to watch, relative to the domain's root (default: all of it)

Options:

Option	Description
--native	macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]
--identifier <str>	App or app group identifier, for the container domains

Accepts the connection options: --rsd, --tunnel, --userspace.

core-device launch-application

Launch an installed app and print the launch result as JSON (or its console, with --console).

pymobiledevice3 developer core-device launch-application [OPTIONS] {bundle_identifier} [argument]...

Arguments:

Argument	Description
bundle_identifier	Bundle identifier of the app to launch. [required]
argument...	Arguments to pass to the app

Options:

Option	Description
--native	macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]
--kill-existing / --no-kill-existing	Kill an already-running instance of the app before launching. [default: kill-existing]
--suspended / --no-suspended	Start the process suspended, waiting for a debugger to attach. [default: no-suspended]
--env <str>	Environment variable to pass to process given as key=value (can be specified multiple times)
--console / --no-console	Attach to the app's stdout and stderr and print them until it exits [default: no-console]

Accepts the connection options: --rsd, --tunnel, --userspace.

core-device list-processes

List running processes as JSON.

pymobiledevice3 developer core-device list-processes [OPTIONS]

Options:

Option

Description

--native

macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]

Accepts the connection options: --rsd, --tunnel, --userspace.

core-device uninstall

Uninstall an app by bundle identifier.

pymobiledevice3 developer core-device uninstall [OPTIONS] {bundle_identifier}

Arguments:

Argument	Description
bundle_identifier	Bundle identifier of the app to uninstall. [required]

Options:

Option

Description

--native

macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]

Accepts the connection options: --rsd, --tunnel, --userspace.

core-device send-signal-to-process

Send a signal (e.g. to terminate) to a process by PID and print the reply as JSON.

pymobiledevice3 developer core-device send-signal-to-process [OPTIONS] {pid} {signal}

Arguments:

Argument	Description
pid	Process ID (see list-processes). [required]
signal	Signal number to send (e.g. 9 for SIGKILL, 15 for SIGTERM). [required]

Options:

Option

Description

--native

macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]

Accepts the connection options: --rsd, --tunnel, --userspace.

core-device get-device-info

Print CoreDevice device information as JSON.

pymobiledevice3 developer core-device get-device-info [OPTIONS]

Options:

Option

Description

--native

macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]

Accepts the connection options: --rsd, --tunnel, --userspace.

core-device get-display-info

Print the device's displays and their modes as JSON.

pymobiledevice3 developer core-device get-display-info [OPTIONS]

Options:

Option

Description

--native

macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]

Accepts the connection options: --rsd, --tunnel, --userspace.

core-device query-mobilegestalt

Query MobileGestalt (the device's hardware/software property store) for the given keys.

pymobiledevice3 developer core-device query-mobilegestalt [OPTIONS] {key}...

Arguments:

Argument	Description
key...	One or more MobileGestalt keys (e.g. ProductType). [required]

Options:

Option

Description

--native

macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]

Accepts the connection options: --rsd, --tunnel, --userspace.

core-device get-lockstate

Print the device's lock state as JSON.

pymobiledevice3 developer core-device get-lockstate [OPTIONS]

Options:

Option

Description

--native

macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]

Accepts the connection options: --rsd, --tunnel, --userspace.

core-device paste

Paste device pasteboard contents to stdout (text by default, --raw for the full snapshot).

pymobiledevice3 developer core-device paste [OPTIONS]

Options:

Option	Description
--native	macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]
--raw	Print the full snapshot JSON instead of UTF-8 text.
--pasteboard <str>	Named pasteboard to read from. [default: general]

Accepts the connection options: --rsd, --tunnel, --userspace.

core-device copy

Copy text onto the device pasteboard (UTF-8). Reads from stdin if no argument is given.

pymobiledevice3 developer core-device copy [OPTIONS] [text]

Arguments:

Argument	Description
text	Text to copy. If omitted, read UTF-8 from stdin.

Options:

Option	Description
--native	macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]
--pasteboard <str>	Named pasteboard to write to. [default: general]

Accepts the connection options: --rsd, --tunnel, --userspace.

core-device rotate

Rotate the device 90 degrees. Four consecutive 'left' calls cycle a full turn.

pymobiledevice3 developer core-device rotate [OPTIONS] [direction]:<left|right>

Arguments:

Argument	Description
direction:<left\|right>	Rotate 90 degrees: 'left' = CCW, 'right' = CW. [default: left]

Options:

Option

Description

--native

macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]

Accepts the connection options: --rsd, --tunnel, --userspace.

core-device user-interface-style

Print the user-interface style (dark/light mode); pass dark/light to change it.

pymobiledevice3 developer core-device user-interface-style [OPTIONS] [style]:<dark|light>

Arguments:

Argument	Description
style:<dark\|light>	Style to switch to; omit to print the current one.

Options:

Option

Description

--native

macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]

Accepts the connection options: --rsd, --tunnel, --userspace.

core-device list-apps

List installed applications as JSON.

pymobiledevice3 developer core-device list-apps [OPTIONS]

Options:

Option

Description

--native

macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]

Accepts the connection options: --rsd, --tunnel, --userspace.

core-device fetch-app-icon

Save an application's icon as a PNG file (com.apple.coredevice.iconservice).

pymobiledevice3 developer core-device fetch-app-icon [OPTIONS] {bundle_identifier} {output}

Arguments:

Argument	Description
bundle_identifier	Bundle identifier of the app. [required]
output	Local PNG file to write. [required]

Options:

Option	Description
--native	macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]
--width <float>	Requested width, in points. [default: 60.0]
--height <float>	Requested height, in points. [default: 60.0]
--scale <float>	Scale factor (pixels = points x scale). [default: 2.0]
--no-placeholder	Fail instead of returning a generic icon for apps without one.

Accepts the connection options: --rsd, --tunnel, --userspace.

core-device stream-processes

Fetch the running process list through the streaming API and print it as JSON.

pymobiledevice3 developer core-device stream-processes [OPTIONS]

Options:

Option

Description

--native

macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]

Accepts the connection options: --rsd, --tunnel, --userspace.

core-device sysdiagnose

Generate a sysdiagnose archive on the device and download it (can take several minutes).

The archive is downloaded over usbmux when usbmuxd lists the device (much faster), and through the RSD tunnel otherwise.

pymobiledevice3 developer core-device sysdiagnose [OPTIONS] {output}

Arguments:

Argument	Description
output	Existing directory to save the archive into, or a file path to write it to. [required]

Options:

Option

Description

--native

macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]

Accepts the connection options: --rsd, --tunnel, --userspace.

core-device screen-capture

Capture content from the device's screen (com.apple.coredevice.screencaptureservice).

core-device screen-capture screenshot

Capture a PNG screenshot of the device's screen.

pymobiledevice3 developer core-device screen-capture screenshot [OPTIONS] {output}

Arguments:

Argument	Description
output	Local PNG file to write. [required]

Options:

Option	Description
--native	macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]
--display-unique-id <str>	Display to capture (default: the primary display).

Accepts the connection options: --rsd, --tunnel, --userspace.

core-device hid

Send HID button events (com.apple.coredevice.hid.indigo).

core-device hid button

Press a named iOS hardware button (home / lock / volume-up / etc.).

pymobiledevice3 developer core-device hid button [OPTIONS] {name}:<home|lock|volume-up|volume-down|mute|siri> [state]:<press|down|up|canceled>

Arguments:

Argument	Description
name:<home\|lock\|volume-up\|volume-down\|mute\|siri>	Named hardware button (home, lock, volume-up, ...) [required]
state:<press\|down\|up\|canceled>	press = send down+up; otherwise send a single state event [default: press]

Options:

Option

Description

--native

macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]

Accepts the connection options: --rsd, --tunnel, --userspace.

core-device hid raw-button

Send a HID button event by raw usage page/code (for buttons not in the named list).

pymobiledevice3 developer core-device hid raw-button [OPTIONS] {usage_page} {usage_code} [state]:<press|down|up|canceled>

Arguments:

Argument	Description
usage_page	HID usage page (decimal or 0xHEX), e.g. 0x0C for Consumer [required]
usage_code	HID usage code (decimal or 0xHEX) [required]
state:<press\|down\|up\|canceled>	press = send down+up; otherwise send a single state event [default: press]

Options:

Option

Description

--native

macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]

Accepts the connection options: --rsd, --tunnel, --userspace.

core-device universal-hid-service

Send touch, gesture and keyboard input to the device (com.apple.coredevice.hid.universalhidservice).

core-device universal-hid-service list-connected

List currently connected virtual HID services.

pymobiledevice3 developer core-device universal-hid-service list-connected [OPTIONS]

Options:

Option

Description

--native

macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]

Accepts the connection options: --rsd, --tunnel, --userspace.

core-device universal-hid-service send-report

Send a raw HID report to a connected HID surface.

Use list-connected to discover ServiceIDs. Touch goes via 257 (mainTouchscreen, true digitizer) or 1281 (touchscreenGesture, trackpad-like pointer). Report bytes are surface-specific — capture devicectl traffic with misc/remotexpc_sniffer.py to learn the layout.

pymobiledevice3 developer core-device universal-hid-service send-report [OPTIONS] {service_id} {report_hex}

Arguments:

Argument	Description
service_id	Target _ServiceID (from list-connected; decimal or 0xHEX) [required]
report_hex	Raw HID report bytes as hex (first byte is the report ID) [required]

Options:

Option

Description

--native

macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]

Accepts the connection options: --rsd, --tunnel, --userspace.

core-device universal-hid-service tap

Tap at (X, Y) — one mainTouchscreen CONTACT + RELEASE pair.

X/Y are 0..65535 normalised across the device's screen — see the coordinate-system comment at the top of this section, or developer core-device get-display-info for pixel dimensions. Auto-opens a media stream so the touch reaches UIKit.

pymobiledevice3 developer core-device universal-hid-service tap [OPTIONS] {x} {y}

Arguments:

Argument	Description
x	X (0..65535, 0=left, 65535=right) [required]
y	Y (0..65535, 0=top, 65535=bottom) [required]

Options:

Option	Description
--native	macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]
--touch-service-id <str>	mainTouchscreen _ServiceID [default: 257]

Accepts the connection options: --rsd, --tunnel, --userspace.

core-device universal-hid-service drag

Drag from (X1, Y1) to (X2, Y2) — streaming CONTACT reports, then RELEASE.

X/Y are 0..65535 normalised across the device's screen. Use developer core-device get-display-info to look up the device's pixel dimensions if you need to convert from pixel coordinates.

pymobiledevice3 developer core-device universal-hid-service drag [OPTIONS] {x1} {y1} {x2} {y2}

Arguments:

Argument	Description
x1	Start X (0..65535, screen-normalised) [required]
y1	Start Y (0..65535, screen-normalised) [required]
x2	End X (0..65535) [required]
y2	End Y (0..65535) [required]

Options:

Option	Description
--native	macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]
--steps <int>	Interpolated frames [default: 30]
--duration <float>	Drag time, seconds [default: 0.6]
--touch-service-id <str>	mainTouchscreen _ServiceID [default: 257]

Accepts the connection options: --rsd, --tunnel, --userspace.

core-device universal-hid-service multi-tap

Tap with several fingers at once — e.g. multi-tap -- 25000 32768 40000 32768 is a two-finger tap.

pymobiledevice3 developer core-device universal-hid-service multi-tap [OPTIONS] {coordinates}...

Arguments:

Argument	Description
coordinates...	X Y per finger (1..5 fingers, 0..65535 each) [required]

Options:

Option	Description
--native	macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]
--hold <float>	Seconds the fingers stay down [default: 0.05]
--touch-service-id <str>	mainTouchscreen _ServiceID [default: 257]

Accepts the connection options: --rsd, --tunnel, --userspace.

core-device universal-hid-service multi-drag

Drag several fingers together, each from its (X1, Y1) to its (X2, Y2).

Fingers moving apart zoom in, towards each other pinch, in parallel make a multi-finger swipe. E.g. zoom in around the center::

multi-drag -- 28000 32768 12000 32768  37536 32768 53536 32768

pymobiledevice3 developer core-device universal-hid-service multi-drag [OPTIONS] {coordinates}...

Arguments:

Argument	Description
coordinates...	X1 Y1 X2 Y2 (start, end) per finger (1..5 fingers, 0..65535 each) [required]

Options:

Option	Description
--native	macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]
--steps <int>	Interpolated frames [default: 30]
--duration <float>	Drag time, seconds [default: 0.6]
--touch-service-id <str>	mainTouchscreen _ServiceID [default: 257]

Accepts the connection options: --rsd, --tunnel, --userspace.

core-device universal-hid-service swipe

Pure pointer-motion gesture — moves the cursor without a contact event.

pymobiledevice3 developer core-device universal-hid-service swipe [OPTIONS] {x1} {y1} {x2} {y2}

Arguments:

Argument	Description
x1	Start X of the pointer path (gesture-surface units, Int32) [required]
y1	Start Y of the pointer path (gesture-surface units, Int32) [required]
x2	End X of the pointer path (gesture-surface units, Int32) [required]
y2	End Y of the pointer path (gesture-surface units, Int32) [required]

Options:

Option	Description
--native	macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]
--steps <int>	Interpolated frames [default: 30]
--duration <float>	Swipe time, seconds [default: 0.3]
--service-id <str>	Gesture surface _ServiceID; default 1281 = touchscreenGesture [default: 1281]

Accepts the connection options: --rsd, --tunnel, --userspace.

core-device universal-hid-service session

Run a sequence of gestures inside ONE auth-gated media stream.

Avoids stream-churn timeouts when firing many tap/drag calls back-to-back — the stream is opened once for the whole batch.

Recognised commands (whitespace-separated; # and blank lines ignored)::

tap   X Y                              # CONTACT + RELEASE
drag  X1 Y1 X2 Y2 [STEPS [DURATION]]   # continuous contact with motion
swipe X1 Y1 X2 Y2 [STEPS [DURATION]]   # pure pointer motion (no contact)
move  X Y                              # one gesture-surface sample
sleep SECONDS

Example::

printf 'tap 30000 40000\nsleep 0.3\ndrag 30000 8000 30000 60000\n' | \
    pymobiledevice3 developer core-device universal-hid-service session

pymobiledevice3 developer core-device universal-hid-service session [OPTIONS]

Options:

Option	Description
--native	macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]
--script <path>	Read gesture lines from this file (default: stdin)
--gesture-service-id <str>	Gesture surface _ServiceID (for move/swipe) [default: 1281]
--touch-service-id <str>	mainTouchscreen _ServiceID (for tap/drag) [default: 257]

Accepts the connection options: --rsd, --tunnel, --userspace.

core-device universal-hid-service type

Type TEXT on the device via a host-registered virtual keyboard.

Auto-opens a media stream (the dtuhidd auth gate) and registers a virtual keyboard surface, then emits one down/up HID Keyboard report pair per character. Capital letters and shifted symbols synthesise the matching Left-Shift bit in the bitmap.

pymobiledevice3 developer core-device universal-hid-service type [OPTIONS] {text}

Arguments:

Argument	Description
text	Text to type (printable ASCII; a newline presses Return and a tab presses Tab) [required]

Options:

Option	Description
--native	macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]
--char-delay <float>	Seconds between key down and key up [default: 0.04]
--inter-delay <float>	Seconds between characters [default: 0.02]

Accepts the connection options: --rsd, --tunnel, --userspace.

core-device universal-hid-service key

Press a named key COUNT times on the device via the same virtual keyboard as type.

pymobiledevice3 developer core-device universal-hid-service key [OPTIONS] {name}:<backspace|enter|escape|tab|left|right|up|down>

Arguments:

Argument	Description
name:<backspace\|enter\|escape\|tab\|left\|right\|up\|down>	Named key (backspace, enter, left, ...) [required]

Options:

Option	Description
--native	macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]
--count <int range>	How many times to press it [default: 1; x>=1]
--char-delay <float>	Seconds between key down and key up [default: 0.04]
--inter-delay <float>	Seconds between presses [default: 0.02]

Accepts the connection options: --rsd, --tunnel, --userspace.

core-device display

Stream and mirror the device's screen and audio (com.apple.coredevice.displayservice).

core-device display get-media-support-info

Return the device's supported media-stream features and AVC framework version.

pymobiledevice3 developer core-device display get-media-support-info [OPTIONS]

Options:

Option

Description

--native

macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]

Accepts the connection options: --rsd, --tunnel, --userspace.

core-device display get-media-stream-server-status

Return the media-stream server's running state and active sessions.

pymobiledevice3 developer core-device display get-media-stream-server-status [OPTIONS]

Options:

Option

Description

--native

macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]

Accepts the connection options: --rsd, --tunnel, --userspace.

core-device display start-video-stream

Capture raw RTP/HEVC packets from a display into a file (iOS 27+).

Each packet is written as [4-byte BE length][packet bytes]. Use misc/rtp_dump.py to depacketize into an Annex-B .h265 bitstream.

pymobiledevice3 developer core-device display start-video-stream [OPTIONS] {output}

Arguments:

Argument	Description
output	Write received RTP packet bytes to this file [required]

Options:

Option	Description
--native	macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]
--display-id <int>	Display to stream (1 = the main display). [default: 1]
--duration <float>	Seconds to capture [default: 5.0]
--port <int>	Local UDP port to receive the stream on (0 = any free port). [default: 0]

Accepts the connection options: --rsd, --tunnel, --userspace.

core-device display start-audio-stream

Capture raw RTP audio packets from the device's system-audio output.

Each packet is written as [4-byte BE length][packet bytes]. The device advertises RxPayloadType=101 and AudioStreamMode=8 — inspect the captured payloads to identify the codec before building browser playback.

pymobiledevice3 developer core-device display start-audio-stream [OPTIONS] {output}

Arguments:

Argument	Description
output	Write received RTP packet bytes to this file [required]

Options:

Option	Description
--native	macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]
--duration <float>	Seconds to capture [default: 10.0]
--port <int>	Local UDP port to receive the stream on (0 = any free port). [default: 0]

Accepts the connection options: --rsd, --tunnel, --userspace.

core-device display serve-web

Serve the device's screen via HTTP — view in any modern browser (iOS 27+), until Ctrl+C.

Pipeline (no external executables):

device → asyncio UDP receive → RFC 7798 RTP/HEVC depacketize
       → HTTP chunked stream → browser WebCodecs decoder → canvas

Open http://<bind>:<http_port>/ in Safari or Chrome (macOS Chrome needs HEVC support — recent versions enable it by default if the OS supports it). Pass --https when connecting from another LAN host (browsers gate WebCodecs on a secure context; only loopback origins bypass that).

pymobiledevice3 developer core-device display serve-web [OPTIONS]

Options:

Option	Description
--native	macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]
--display-id <int>	Display to stream (1 = the main display). [default: 1]
--bind <str>	Host to bind the webserver on. Loopback by default; --bind 0.0.0.0 makes the viewer reachable from the LAN (set --password too). [default: 127.0.0.1]
--http-port <int>	Port for the webserver [default: 8080]
--password <str>	Require this password from every viewer. Without one, anyone who can reach the port can watch and control the device, so only bind beyond loopback with a password set.
--no-audio	Don't auto-enable sound in the viewer (user can still click Enable Sound).
--ltrp	Opt into LTRP (long-term reference pictures). LEAVE OFF for browser viewing. LTRP lowers the encoder's QP under motion (sharper bitstream — ffmpeg decodes it cleanly), BUT the browsers' real-time VideoToolbox/WebCodecs decoder mishandles the long-term references and renders a mosaic of displaced blocks during rapid motion. Verified on-device: identical hard swipes are clean with LTRP off and tear with it on, while the same captured bitstream is clean in ffmpeg either way — i.e. the tear is a live-decode artifact, not in the stream. The encoder QP win (≈19 vs ≈23-31) is not worth the mosaic.
--rtcp-fb	Negotiate allowRTCPFB=True in the mediaBlob. No observable effect in streamConfig but may influence internal encoder behaviour.
--https	Serve over HTTPS using an ephemeral self-signed certificate. Required for WebCodecs when accessing the viewer from a non-loopback origin: the browser's secure-context policy refuses WebCodecs over plain http:// from any LAN IP. The browser will warn on first visit -- accept the cert and the viewer works normally afterwards.
--rctl / --no-rctl	Run the AVConference RCTL receiver-feedback loop (RTCP APP + per-frame receipts), reversed byte-exact from Xcode's mirror -- the closed-loop rate control Xcode uses. OFF by default: it does NOT prevent the motion resolution-collapse (that's a device encoder decision at the ~6 Mbps cap), and a wrong OWRD or non-per-frame receipt makes the device throttle framerate. Kept as the correct closed-loop base for further research. [default: no-rctl]
--motion-idr / --no-motion-idr	Force a keyframe ~1x/second WHILE the screen is moving (ON by default). Under rapid motion the device drops capture resolution into a top-left corner of the frame ('screen shrinks while swiping'); these keyframes snap it back to full resolution fast, and the viewer stretches the shrunk region to fill the canvas so the brief window is hidden. Trade-off: the keyframe pressure can stall the ~6 Mbps-capped encoder under sustained motion. --no-motion-idr drops it for a stall-free but slower-recovering stream (relies on the viewer stretch + settle keyframe alone). NOTE: combining --motion-idr with --rctl throttles fps hard -- the default keeps RCTL off so the IDR stays fast. [default: motion-idr]
--compensate / --no-compensate	Viewer-side resolution-collapse compensation (ON by default). When the device shrinks the captured screen into the top-left corner + gray padding under motion, the browser detects that content rectangle per frame and stretches it back to fill the canvas, turning the hard corner-shrink into a softer momentary resolution dip. --no-compensate shows the raw device output (useful for seeing the collapse / research). [default: compensate]

Accepts the connection options: --rsd, --tunnel, --userspace.

core-device display serve-vnc

Serve the device's screen as a VNC (RFB 3.8) server (iOS 27+), until Ctrl+C.

Connect from any VNC client. macOS Finder: Cmd+K -> enter vnc://<bind>:<port> (default vnc://127.0.0.1:5901; port 5900 is owned by macOS's own Screen Sharing daemon). No browser involved -- the OS's native screen-sharing renders the framebuffer directly.

Pipeline: device HEVC -> VideoToolbox (macOS) or libav (cross-platform) decode (BGRA output) -> RFB Raw framebuffer updates. No JPEG round-trip; the bytes that came out of the decoder go straight onto the wire. Mouse clicks in the screen-sharing window translate to HID touch events on the device.

Audio: pass --audio to decode the device's AAC-ELD audio stream and play it through the host Mac's speakers (RFB has no audio of its own, so the playback is host-local).

pymobiledevice3 developer core-device display serve-vnc [OPTIONS]

Options:

Option	Description
--native	macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]
--display-id <int>	Display to stream (1 = the main display). [default: 1]
--bind <str>	Host to bind the VNC listener on. Loopback by default; --bind 0.0.0.0 lets the LAN connect (set --password too). [default: 127.0.0.1]
--port <int>	TCP port for the VNC listener [default: 5901]
--password <str>	Require this password from every viewer. Without one, anyone who can reach the port can watch and control the device, so only bind beyond loopback with a password set.
--audio	Play device audio out the host Mac's speakers (off by default).
--decoder <str>	HEVC decoder: 'auto' (VideoToolbox on macOS, libav elsewhere), 'vt' (force VideoToolbox -- macOS only), or 'av' (force libav / PyAV). Forcing 'av' on macOS comes with audio choppiness from GIL contention. [default: auto]
--ltrp	Opt back into LTRP (off by default; see serve-web for context).
--share-clipboard	Share the clipboard with VNC clients: text copied on the device reaches the client's clipboard and vice versa. UTF-8 with clients that support the Extended Clipboard pseudo-encoding (e.g. TigerVNC, noVNC), Latin-1 otherwise.
--rtcp-fb	Negotiate allowRTCPFB=True in the mediaBlob (experimental).

Accepts the connection options: --rsd, --tunnel, --userspace.

core-device location

Simulate the device's location (com.apple.coredevice.locationservice).

core-device location available-scenarios

List the device's built-in simulation scenarios.

pymobiledevice3 developer core-device location available-scenarios [OPTIONS]

Options:

Option

Description

--native

macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]

Accepts the connection options: --rsd, --tunnel, --userspace.

wda

Drive the device UI through WebDriverAgent (launch apps, tap, type, swipe, screenshots).

WebDriverAgent must already be installed on the device. Start its runner with --xctrunner, or have it running already; with --xctrunner it is stopped when the command ends.

wda launch

Launch an app by starting a WDA session and print the session id.

pymobiledevice3 developer wda launch [OPTIONS] {bundle_id}

Arguments:

Argument	Description
bundle_id	Bundle identifier of the app to launch. [required]

Options:

Option	Description
--native	macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]
--port <int>	WDA device port to connect to. [default: 8100]
--timeout <float>	HTTP timeout in seconds. [default: 10.0]
-xc, --xctrunner <str>	Bundle id of an XCUITest runner to start (e.g. com.facebook.WebDriverAgentRunner.xctrunner).

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

wda tap

Tap an element (typically a button) using a WDA selector.

pymobiledevice3 developer wda tap [OPTIONS] {selector}

Arguments:

Argument	Description
selector	Element to tap, matched using the --using strategy. [required]

Options:

Option	Description
--native	macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]
--port <int>	WDA device port to connect to. [default: 8100]
--timeout <float>	HTTP timeout in seconds. [default: 10.0]
-xc, --xctrunner <str>	Bundle id of an XCUITest runner to start (e.g. com.facebook.WebDriverAgentRunner.xctrunner).
-u, --using <str>	Element lookup strategy (e.g. 'accessibility id', 'name', 'label', 'xpath'). [default: accessibility id]
-s, --session-id <str>	Existing WDA session id (omit to create a new session).
--bundle-id <str>	Bundle id to launch if a new session is created.

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

wda press

Press one or more device buttons (e.g. home, volumeup, volumedown, lock).

pymobiledevice3 developer wda press [OPTIONS] {names}...

Arguments:

Argument	Description
names...	One or more device buttons to press in order (e.g. home lock volumeup). [required]

Options:

Option	Description
--native	macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]
--port <int>	WDA device port to connect to. [default: 8100]
--timeout <float>	HTTP timeout in seconds. [default: 10.0]
-xc, --xctrunner <str>	Bundle id of an XCUITest runner to start (e.g. com.facebook.WebDriverAgentRunner.xctrunner).
-s, --session-id <str>	Existing WDA session id (optional; some servers require it).

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

wda unlock

Unlock the device through WDA's unlock endpoint.

pymobiledevice3 developer wda unlock [OPTIONS]

Options:

Option	Description
--native	macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]
--port <int>	WDA device port to connect to. [default: 8100]
--timeout <float>	HTTP timeout in seconds. [default: 10.0]
-xc, --xctrunner <str>	Bundle id of an XCUITest runner to start (e.g. com.facebook.WebDriverAgentRunner.xctrunner).
-s, --session-id <str>	Existing WDA session id (optional; used for session-scoped unlock endpoints).

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

wda list-items

Show tappable WDA elements (use with 'tap' selectors).

pymobiledevice3 developer wda list-items [OPTIONS]

Options:

Option	Description
--native	macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]
--port <int>	WDA device port to connect to. [default: 8100]
--timeout <float>	HTTP timeout in seconds. [default: 10.0]
-xc, --xctrunner <str>	Bundle id of an XCUITest runner to start (e.g. com.facebook.WebDriverAgentRunner.xctrunner).
-s, --session-id <str>	Existing WDA session id (optional).
--hittable-only	Show only elements marked hittable by WDA.
--clickable	Filter by a clickable type allowlist + visible/enabled.
--types <str>	Comma-separated element type allowlist (e.g. Icon,Button,Cell).
--with-rect	Include element bounds (x,y,width,height) if present.

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

wda screenshot

Take a screenshot via WDA and save it as PNG.

pymobiledevice3 developer wda screenshot [OPTIONS] {out}

Arguments:

Argument	Description
out	Local file to write the PNG screenshot to. [required]

Options:

Option	Description
--native	macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]
--port <int>	WDA device port to connect to. [default: 8100]
--timeout <float>	HTTP timeout in seconds. [default: 10.0]
-xc, --xctrunner <str>	Bundle id of an XCUITest runner to start (e.g. com.facebook.WebDriverAgentRunner.xctrunner).
-s, --session-id <str>	Existing WDA session id (optional).

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

wda status

Show the WDA server status as JSON (useful to check that WDA is reachable).

pymobiledevice3 developer wda status [OPTIONS]

Options:

Option	Description
--native	macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]
--port <int>	WDA device port to connect to. [default: 8100]
--timeout <float>	HTTP timeout in seconds. [default: 10.0]
-xc, --xctrunner <str>	Bundle id of an XCUITest runner to start (e.g. com.facebook.WebDriverAgentRunner.xctrunner).

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

wda type

Type text into the focused element.

pymobiledevice3 developer wda type [OPTIONS] {text}

Arguments:

Argument	Description
text	Text to type into the focused element. [required]

Options:

Option	Description
--native	macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]
--port <int>	WDA device port to connect to. [default: 8100]
--timeout <float>	HTTP timeout in seconds. [default: 10.0]
-xc, --xctrunner <str>	Bundle id of an XCUITest runner to start (e.g. com.facebook.WebDriverAgentRunner.xctrunner).
-s, --session-id <str>	Existing WDA session id (omit to create a new session).
--bundle-id <str>	Bundle id to launch if a new session is created.

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

wda swipe

Swipe from one coordinate to another.

pymobiledevice3 developer wda swipe [OPTIONS] {start_x} {start_y} {end_x} {end_y}

Arguments:

Argument	Description
start_x	Start X coordinate, in screen points. [required]
start_y	Start Y coordinate, in screen points. [required]
end_x	End X coordinate, in screen points. [required]
end_y	End Y coordinate, in screen points. [required]

Options:

Option	Description
--native	macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]
--port <int>	WDA device port to connect to. [default: 8100]
--timeout <float>	HTTP timeout in seconds. [default: 10.0]
-xc, --xctrunner <str>	Bundle id of an XCUITest runner to start (e.g. com.facebook.WebDriverAgentRunner.xctrunner).
-d, --duration <float>	Swipe duration in seconds. [default: 0.2]
-s, --session-id <str>	Existing WDA session id (omit to create a new session).
--bundle-id <str>	Bundle id to launch if a new session is created.

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

wda window-size

Show window size (screen dimensions).

pymobiledevice3 developer wda window-size [OPTIONS]

Options:

Option	Description
--native	macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]
--port <int>	WDA device port to connect to. [default: 8100]
--timeout <float>	HTTP timeout in seconds. [default: 10.0]
-xc, --xctrunner <str>	Bundle id of an XCUITest runner to start (e.g. com.facebook.WebDriverAgentRunner.xctrunner).
-s, --session-id <str>	Existing WDA session id (omit to create a new session).
--bundle-id <str>	Bundle id to launch if a new session is created.

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.