Find ADRP+ADD pair that computes target_va in code. Handles non-adjacent pairs: tracks recent ADRP results per register and matches them with

Find the start of the null-terminated C string containing match_off. Scans backwards from match_off to find the previous null byte (or section

Locate the `mov w3,#imm` that sets the SwapEnd input-state size. Anchored on the external-method call setup: `mov w1,#5` (selector), immediat

Return (idx, insn) of the first insn at or after start_idx whose mnemonic is in `mnemonics`, within `max_scan` instructions. None if not found

Return the lowercase register name of the op_index-th operand of insn (e.g. 'w8', 'x9'), or None.

Resolve a symbol to its vmaddr via the DSC's own `.symbols` local-symbol table (in-image; no repo-exported dumps).

Resolve a set of ObjC method symbols in `image_path` against `dsc_path` via `ipsw dyld symaddr`. Returns {symbol: vmaddr}. Raises if any are missi

Unsigned 12-bit immediate of an ADD/SUB (immediate), bits [21:10].

Align a value up to the next 4-byte boundary.

Decode a null-terminated C string from raw bytes.

Encode BL (branch with link) instruction. Format: `[31:26] = 0b100101`, `[25:0] = signed offset / 4` Range: +/-128 MB

Encode raw bytes for a property whose layout the caller has prepared (typically a multi-string NUL-delimited blob like `compatible`). Truncates if lon

Encode a string value with null termination, padded/truncated to a fixed length.

Encode an integer value as little-endian bytes.

Encode TBZ/TBNZ (test bit and branch). Target must be 4-byte aligned and within the signed 14-bit range (+/-32 KB). Format: `[31] = b5`, `[30:24] = 0

Search Mach-O symbol table for a symbol containing name_fragment. Returns the symbol's VA, or -1 if not found.

ADRP (any Rd): op=1, [28:24]=10000.

AND Wd, Wn, Wm — 32-bit shifted-register AND (imm6=0; shift type left free, harmless at shift amount 0): [31:24]=00001010, N=0.

B.EQ — conditional branch, [31:24]=0x54, bit4=0, cond=0000.

CBZ Xn (sf=1): top byte 0xB4.

CMP Xn, Xm ≡ SUBS XZR, Xn, Xm (64-bit, shift=0, imm6=0); Rn/Rm left free.

LSR Wd, Wn, #7 ≡ UBFM Wd, Wn, #7, #31 (immr=7, imms=0x1F).

SUB Wd, Wn, #imm — 32-bit SUB (immediate), shift=0; [31:22]=0101000100.

Replace `+[AVCaptureDevice authorizationStatusForMediaType:]` with `mov w0, #3; ret`. Authorized = 3 across every media type — broader than ju

Dotted `ProductVersion` >= major.minor, compared numerically. nil is false.

A python is usable only if it carries an `ipsw_parser` new enough for the bridge — the exact gap behind `IPSW has no attribute 'create_from_path'` whe

Read `length` bytes starting at `vma`, contained in a single mapping. With `allow_short=True`, returns whatever is available within th

Remove the `iPhone*_Restore/` tree from the bundle; returns its name, or nil if absent. Record versions (`derive`) first — it reads this directory.

Resolve a NEW name (rename/clone destination): return it if given, else prompt for text.

Resolve +[AVCaptureDevice authorizationStatusForMediaType:] in AVFCapture.

Stream an archive through a `/usr/bin/tar` consumer that reads on stdin, invoking `onBytes` with the running byte total so a caller can drive a progre

Run `executable args` as root via macOS's native auth dialog (`osascript` → `do shell script … with administrator privileges`). `do shell script` runs

The running executable, resolved reliably. `CommandLine.arguments[0]` is NOT reliable — under a PATH/symlink launch (e.g. a Homebrew symlink) it's a b

Write `line + "\n"` to the child's stdin.

Begin sending location to the guest. Safe to call on every (re)connect.

Synthesize an NSEvent at a given window point.

The per-user data root: `$VPHONE_ROOT` when set, else `~/.vphone`. Both `VPhoneResources` (ipsws/tools/debs/venv) and `VPhoneLibrary` (VMs) derive fro

Save manifest to a plist file

Return {symbol_name: vmaddr} for every symbol `ipsw` reports in `image`.

Return True iff the cbnz slot is already a NOP and the cset slot is already a `mov wN, #1` (any wN). Used for idempotence.

Walk back from `string_vma` to find the containing Mach-O header and return its install name (LC_ID_DYLIB), or None if not found.

Disassemble from `vma` up to the first ret/retab (function end) or `max_insns`, whichever comes first.

Return list of chunk file paths in numeric order; the unsuffixed file first, then .01, .02, ... `.symbols` is excluded (it doesn't map code).

Yield the (adrp_va, add_va) of every ADRP+ADD pair that resolves to target_va. Tracks recent ADRP results per destination register; pairs the

Find every CS_CodeDirectory in the binary's LC_CODE_SIGNATURE blob. Returns a list of dicts (one per CD), each with the fields from `_parse_c

Locate the LWCR self-consistency idiom and return the (cset, eor, tbz) instructions plus the error_code register. Shape: cset wC, ne

Locate "kern.hv_vmm_present\0" in any cstring-like section. Returns (va, file_offset, section_name) or None.

The `cmn wR, #1; b.eq` sysctl-error idiom, preceded by a bl.

Locate the conditional branch that gates the entitled result: the `cbz`/`cbnz` on w0 whose fall-through instruction is `mov w<reg>,#1` (the YE

Resolve the method IMP through ObjC runtime metadata (relative method lists). selector cstring -> __objc_selrefs entry -> relative method-list en

Return (dataoff, datasize) for the binary's LC_CODE_SIGNATURE, or None.

Find a conditional branch after a BL (function call) near ref_foff. The typical pattern is: ADRP+ADD (load string argument) ← ref_foff