Read a little-endian UInt32 at the given byte offset.

Find the first occurrence of a C string in the data. Matches Python `find_string()`: walks backward from the match to the preceding NUL byte so that t

Disassemble a single 4-byte instruction at the given address.

Load firmware from `url`, returning the mutable payload data.

Disassemble instructions from data starting at the given virtual address. - Parameters: - data: Raw instruction bytes. - address: Virtual address of

Resolve an existing-VM name. Returns `provided` unchanged when given; otherwise shows a numbered menu of `names` and reads a 1-based index or an exact

Canonical name of the instruction's first operand when it is a register (the write target for the moves/loads/branches the patchers match), else nil.

Load a little-endian integer without assuming the buffer is naturally aligned.

Run `executable args` to completion, capturing stdout/stderr. Throws only if the process cannot be launched; a nonzero exit is returned in the result,

Read a little-endian UInt64 at the given byte offset.

Read `length` bytes starting at `vma`. Must be contained in one mapping (we don't stitch across mappings).

Resolve a python with working deps: an explicit `VPHONE_PYTHON`, the dev repo `.venv`, the managed per-user venv, else provision the managed venv on t

Resolve an existing-VM name, prompting with a numbered picker when omitted.

Run `executable args`, inheriting the parent's stdout/stderr so output streams live to the terminal (for long-running tools: downloads, restore, CFW i

When `to` is an existing directory, the archive is written inside it as `<name>.<compression.fileExtension>`. Returns the resolved output URL. Runs a

Encode unconditional B (branch) instruction. Format: `[31:26] = 0b000101`, `[25:0] = signed offset / 4` Range: +/-128 MB

Recompute and write SHA-256 slot hashes for every 16 KiB page that contains a `modified_vmas` entry. `chunks` a DSCChunks instance.

Spawn the child with a piped stdin and a combined piped stdout/stderr. The read side is drained by a readability handler that appends decoded chunks t

`interrupt()` (SIGINT), then escalate to an unmaskable `SIGKILL` if the process is still running after a ~2 s grace period. `SIGKILL` (not `Process.te

Poll (~50 ms) until a captured line matches `regex`, the process exits first, or `timeout` elapses. Matches against the FULL accumulated buffer each p

Write raw bytes at the given offset.

Persist `data` bytes at `vma` to the right chunk file. The target span must lie within a single mapping.

Extracts (auto-detecting gzip/zstd/xz) into a private staging dir, then promotes the single top-level bundle to the library. Extracting first means th

Port of `normalize_ecid` (setup_machine.sh:80-86): strip one leading `0x` and one leading `0X` (matching the shell's two sequential `#0x`/ `#0X` strip

Rd / Rt — destination (or transfer) register, bits [4:0].

Read bytes at the given range.

Encode an unconditional B instruction.

Find all patch sites and return patch records (dry-run mode).

Merge partial edits onto an existing config, validating the result. A nil argument leaves that field unchanged.

Parse Mach-O 64-bit to extract section info. Returns dict: "segment,section" -> (vm_addr, size, file_offset)

Log disassembly of `count` instructions at file offset for before/after comparison.

Read both versions from the bundle's `iPhone*_Restore` plists: `iPhone-BuildManifest.plist` (iOS userland) and the hybrid `BuildManifest.plist` (cloud

Deep-copy a single Manifest entry from a build identity.

Find the first matching section from candidates.

Resolve `vm create`'s iPhone/cloudOS sources, prompting on a TTY for whichever component the user didn't pass. Non-interactive or fully specified → re

Rn — first source / base register, bits [9:5].

Disassemble n instructions at file offset.

Encode MOVZ Wd, #imm16 (32-bit). Format: `[31] = 0 (sf)`, `[30:29] = 10`, `[28:23] = 100101`, `[22:21] = hw`, `[20:5] = imm16`, `[4:0] = Rd`

LDR Xt, [Xn, #imm] — 64-bit unsigned-offset load, [31:22]=1111100101.

MOVZ Wd, #imm16 (32-bit, no shift): [31:21]=01010010100.

MOVZ/MOVN/MOVK 16-bit immediate, bits [20:5].

Pure parse of `sysctl -n kern.hv_vmm_present` output — `"1"` means the host is itself an Apple VM (nested), where Virtualization.framework PV=3 guest

Make dropbear use host keys on writable Data instead of read-only /etc.

Set `variant` (and its device) on the bundle's restore-info.json, keeping the recorded versions. nil if no versions exist yet to preserve.

ECID from `--ecid`, else the `ECID=` line of the bundle's udid-prediction.txt.

Save patched `data` back to `url`, repackaging as needed.

Copy the built vphoned into the bundle if present and different.

Convert virtual address to file offset using LC_SEGMENT_64 commands.

If `insn` is `mov <reg>, #<imm>`, return (reg_name, imm); else None.

Apply every camera DSC patch against `chunks_dir`, resolving symbols against `dsc_path`.

Clone a bundle with a fast APFS copy-on-write clone (fallback: recursive copy), then reset the boot-identity artifacts so the clone comes up as a fres

Encode `MOV Xd, Xm` (the ORR Xd, XZR, Xm alias). With `rm == 31` (XZR) this is the canonical "zero a 64-bit register" (`mov xd, xzr`). Format: `[31]

Return (chunk_path, file_offset) for `vma`, or None if unmapped.

Check whether the instruction at `offset` is a BL targeting `target` (file offset). Returns true if the BL opcode decodes to the exact target offset.

CBZ or CBNZ Wn.

Build the VZ network device for a config, or nil for `.off` (no NIC). The MAC is left framework-assigned; a forced MAC breaks guest networking. Throws

Run the full patching pipeline. Returns combined ``PatchRecord`` arrays from every component, in order. Throws on the first component that fails to p

Find the two long '====...' banner runs and write the mode label into each. Python: `patch_serial_labels()`

Return the canonical name string for an AArch64 register ID (e.g. "x0", "w1", "wzr").

UDID from the `UDID=` line of the bundle's udid-prediction.txt, or nil.

Rm — second source register, bits [20:16].

Update the synthetic battery charge and connectivity at runtime. - Parameters: - charge: Battery percentage (0.0–100.0). - connectivity: 1 = charging,

Stop forwarding host location updates.

Stop an active replay task.