iOS
iOS SimulatorEmulator / simulator
Compile-time flag marking a Simulator build. Reported separately; not compromising by default.
At a glance
- Platform
- iOS
- Category
- Emulator / simulator
- Source
- DIIntegrityChecks.m · TARGET_OS_SIMULATOR
- Default status
- Reported only (set policy / treatEmulatorAsCompromised to block)
- Seen firing
- Seen firing in S01, S03, S04. Based on validated scenarios whose observed result includes this signal; see below.
- OWASP MASTG
- MASTG-TEST-0092
How it works
What the code inspects.
Emitted when the module is compiled with TARGET_OS_SIMULATOR — i.e. the app is running on the iOS Simulator rather than a physical device. This is a compile-time fact, not a runtime probe, so it cannot be faked at runtime.
On the Simulator the jailbreak filesystem checks, DYLD_INSERT_LIBRARIES check, and tamper checks are all skipped by design, because they would otherwise inspect the host Mac and misreport.
The exploit it addresses
Why this matters.The threat.
The Simulator is a development environment with no real security boundary and full host access. It is a legitimate place to run in development but should usually not be trusted for production / high-value flows.
How it can be bypassed
No single check is sufficient.Known evasions.
Not an adversarial check — it reports a fact. By default it does not make status 'compromised'; set treatEmulatorAsCompromised (or a policy including 'emulator') to block Simulator runs.
Validation scenarios