HOW AN IOS DEVELOPER JUST UNCOVERED THE NEXT IPHONE

WHEN DEVELOPER GUILHERME Rambo saw that Apple had released firmware for the upcoming HomePod speaker, he thought it must have been a mistake. The HomePod doesn’t come out until December, after all. Curiosity piqued, he started digging through the code, where he found perhaps the last thing he expected: Apple’s next iPhone.

While some details regarding Apple’s redesigned, high-end iPhone—called the iPhone 8 or iPhone Pro, though no one outside Cupertino knows the official name yet—had previously leaked, Rambo found in the HomePod not rumors or hints but Apple’s own documentation of one of its biggest releases in years. It confirms a new look with a slimmer bezel, the death of the home button, and a powerful new face-recognition feature. It’s the biggest bombshell Apple leak in years—and it came from Apple itself.

Phone Home

The HomePod firmware first appeared on an official Apple public update feed a few days ago. Rambo unpacked it, hoping to glean anything interesting about how Apple’s Siri-powered speaker works before Apple realized its mistake and pulled the code.

Like the iPhone, HomePod runs iOS. That in itself is unremarkable; developers have had access to a beta version of iOS 11 for more than a month now. But Rambo, a developer for a Brazilian e-commerce company, quickly made a critical discovery: The HomePod firmware that Apple released was iOS 11.0.2, a full two patches ahead of what’s publicly available.

That means that it included some performance-related tweaks, sure. But more importantly, because it wasn’t intended for public release, Apple hadn’t yet scrubbed the code for mentions of its unreleased products. Like, say, its upcoming iPhone, which is expected in September.

“It’s a process Apple goes through every year, to make sure developers can still access the upcoming iOS without revealing too much about the unannounced iPhone that will come upon the final release,” says iOS developer Steven Troughton-Smith, who backed up Rambo’s findings.

Realizing the potential for discovery, Rambo set to work.

“I decided to search for strings inside the firmware that could be related to the rumored ‘Face ID’ feature,” Rambo says. “I searched for the word ‘face’ and noticed it matched several symbols in BiometricKit, the framework that currently handles Touch ID.” Those references don’t exist in the iOS 11 beta.

Rambo was onto something. So he kept digging.

Pearls Before iPhones

References to face recognition do not an iPhone 8 make. But as Rambo continued to comb through BiometricKit, he realized that the same terminology used to register a new Touch ID finger (“EnrollTouchID”) had a face-authentication counterpart: EnrollPearlID. “Pearl ID” continued to show up throughout his searches, always tied to facial recognition.

That may not end up being what Apple calls its face-recognition feature, but calling it Pearl ID at this stage likely isn’t intended to hide its purpose. “The codename just makes it easier to find all the related pieces of code in the OS, and by inspecting the code you can then see what kind of functions it has,” says Troughton-Smith. What Rambo saw at that point, in other words, was an unreleased, unannounced Apple feature laid bare.

Figuring out what “Pearl ID” meant led to an even bigger find.

“During the search for references to this ‘Pearl ID’ thing I found a reference to ‘Pearl-D22,'” says Rambo. “I decided to search for ‘D22’ and discovered it is the internal codename for the ‘iPhone Pro’ or ‘iPhone 10.'”

While there aren’t many D22 references, Apple left little doubt as to what it means. What sealed it? Rambo found a file in the PassKit framework, used by Wallet, called “Payment_glyph_phone-D22.caar,” a format type that Apple uses to store vector graphics for animated UI elements. When Rambo rendered that image, he saw an iPhone unlike any he had seen before, because it doesn’t yet exist.