Find method IMP through ObjC runtime metadata.

True iff the 4 insns at `va` are `cbz x0,.. ; ldr xN,[x0,#imm] ; cbz xN,.. ; braaz xN`.

Determine whether a build identity is a research variant.

Check if foff points to a function return sequence (ret/retab within 8 insns).

Return (page_index, page_start, page_end_exclusive) for the page that contains file_off. page_end_exclusive is clamped to code_limit so the ta

Return list of dicts {addr, size, file_off, max_prot, init_prot} for one chunk file. Only the standard dyld_cache_mapping_info entries are us

Parse a CodeDirectory blob. Returns a dict of fields, or None. Fields: slot_type — left blank here, filled in by caller from the B

Return list of (slot_type, blob_abs_off, blob_magic). None on error.

Apply the post-restore DT identity rewrites. Returns the new blob. Raises if the DT structure doesn't match what we expect.

Locate the chunk's CS_CodeDirectory. Returns a dict with the fields we need to write back slot hashes: cd_file_off (chunk-file offs

Resolve an ObjC method symbol to its vmaddr via the DSC's own `.symbols` local-symbol table (in-image; no repo-exported dumps). ipsw `symaddr

Resolve a single symbol's vmaddr in `image` via `ipsw dyld symaddr`. Returns the vmaddr, or raises if unresolved. Mirrors the resolution idiom

From the ADD that completes a cstring xref, scan forward for the canonical shape: add x0, ... ; insns[add_idx]

Validate the finder against a synthetic call-setup sequence built from the assembler, with a source size (0x548) unlike the target.

Gate logic: a cache that overflows gets clamped; one that fits is untouched.

Apply all patches to the buffer. Returns the number of patches applied.

Apply only the AVFCapture authorization gate patch. Useful when running on a chunk pulled from a device that already has the NU patches applied

Identifiers of host interfaces available for bridging (empty without the `com.apple.vm.networking` entitlement, e.g. in unsigned test binaries).

Build ADRP index for O(1) page-address lookups.

Build BL index for target-to-callers mapping.

Build symbol table from LC_SYMTAB in the main Mach-O header AND all LC_FILESET_ENTRY sub-Mach-Os. Reads from `buffer.original` (Python: `self.raw`) s

Capture current screen as a small grayscale JPEG, returned as base64.

Create a VM manifest plist file. Args: vm_dir: Path to VM directory cpu_count: Number of CPU cores memory_mb: Memory

Decode a B or BL target address from an instruction at `pc`.

Decrypt every AEA1-encrypted `*.dmg.aea` in `dir` in place (via `ipsw fw aea`), keeping the `.aea` filename with decrypted content (matches make resto

Only `exp` rewrites the DeviceTree identity; others keep the base type.

Encode ADRP instruction. ADRP loads a 4KB-aligned page address relative to PC. Format: `[31] = 1 (op)`, `[30:29] = immlo`, `[28:24] = 0b10000`, `[23:

Encode ADD Xd, Xn, #imm12 (64-bit, no shift). Format: `[31] = 1 (sf)`, `[30:29] = 00`, `[28:24] = 0b10001`, `[23:22] = 00 (shift)`, `[21:10] = imm12`

Encode MOVZ Xd, #imm16 (64-bit).

Find all occurrences of a byte pattern in the data.

Find a firmware file by trying glob-style patterns under `baseDir`. Mirrors Python `find_file`.

Find _panic: the most-called function whose callers reference '@%s:%d' strings. Populates `panicOffset`.

Find the `*Restore*` subdirectory inside the VM directory. Mirrors Python `find_restore_dir`.

Find a symbol containing the given name fragment. Returns its virtual address.

Find release and research identity indices for the given DeviceClass.

Return the index of the first iPhone erase identity.

Walk backwards from `vma` looking for a Mach-O 64 header (magic 0xfeedfacf) at a page boundary. Returns the magic's vmaddr, or None if

Return all unmangled "kern.hv_vmm_present\\0" cstring occurrences. Each entry: {string_vma, file_offset, section}. Hits are anchored at a cs

Return all vmaddrs where `needle` (bytes) appears within a single mapping, anchored either at the mapping start or after a NUL byte.

Parse LC_SYMTAB from Mach-O header. Returns (symoff, nsyms, stroff, strsize) or None.

Return the list of rootfs binary paths that should be byte-5 mangled at install time. This is `ALL_KNOWN_ROOTFS_PATHS` minus `DONT_PATCH_ROOTF

Mark the current connection dead and start reconnecting. Called when a write fails with EPIPE — the most common case is vphoned auto-update killing it

Inject a swipe from one pixel coordinate to another.

Inject a tap at pixel coordinates (matching screenshot image dimensions).

Inject bash/dropbear/trollvnc entries into launchd.plist.

True if the file begins with the AEA1 magic (`41 45 41 31`).

BL — branch with link, [31:26]=100101.