iOS 17+ Tunnels

iOS 17+ moved many developer services away from the older lockdown service path.

The newer path uses:

• RSD for service discovery.
• RemoteXPC for XPC messages over HTTP/2.
• CoreDevice tunnel services for protected developer features.
• Remote pairing records for trusted hosts.

The tunnel is the bridge between the device and newer protected services. Once the path is established, CoreDevice and DVT-style clients can connect through RSD instead of asking lockdown for a service port.

Relevant features:

• rsd
• xpc
• remote_pairing
• core_device
• core_device_proxy
• tunnel_tcp_stack
• tunneld

Useful CLI commands:

idevice-tools remotexpc
idevice-tools rppairing
idevice-tools screencapture
idevice-tools hid

Related service reference

• RSD
• CoreDevice Proxy
• Pairing
• App Service
• Screen Capture