CBNZ Wn (sf=0): top byte 0x35.

CBZ Wn (sf=0): top byte 0x34.

True when running inside an Apple VM (`kern.hv_vmm_present == 1`), where Virtualization.framework PV=3 guest boot is unavailable.

Detect whether the binary already contains the mangled form. Used purely for friendlier logging — `find_string_sites` already returns empty o

Must assemble, not just import — a bindings-only install imports fine and then fails inside `fw patch`.

Print the patch paths, one per line, for shell consumption.

Parse the Mach-O structure and build indices.

Parse all sections from a Mach-O binary. Returns a dictionary keyed by "segment,section".

Parse all segments from a Mach-O binary in a Data buffer.

Extract Cryptex DMG paths from BuildManifest.plist. Searches ALL BuildIdentities for: - Cryptex1,SystemOS -> Info -> Path - Cryptex1,AppO

Bypass the real rootvp auth failure branch inside _bsd_init.

Faithful upstream C23: redirect ops[18] to a vnode-getattr trampoline.

IOUC MACF gate bypass: replace CBZ W0, <allow> with B <allow>.

Task conversion eval bypass: patch the guard CMP to always be equal.

Patch a devicetree.img4 (preferred) or devicetree.im4p file in place. Returns the number of property changes applied (0 if the file was alread

Force -[DIDiskArb isMountCompleteWithExpectedCount:diskTracker:] → YES. Anchor strategies (in order): 1. LC_SYMTAB symbol containing "isMou

Apply the blacklist-flip mangle inside the DSC chunks at `chunks_dir`. For every occurrence of `"kern.hv_vmm_present\\0"` in any executab

NOP the cache validation check in launchd_cache_loader. Anchor strategy: Search for "unsecure_cache" substring, resolve to full null-terminat

Bypass launchd jetsam panic path via dynamic string-xref branch rewrite. Anchor strategy: 1. Find jetsam panic string in cstring-like data.

Dynamically find -[DeviceType should_hactivate] and patch to return YES. Anchor strategies (in order): 1. Search LC_SYMTAB for symbol contain

Replace each `+[_NUStyleTransfer*Processor processWithInputs:...]` with `mov w0, #0; ret`. Camera's style-thumbnail pipeline then short-circuits

Rewrite the ProductBuildVersion key. Returns True if the file was rewritten, False if it was already in the target state.

Dynamically find and patch the gigalocker path format string in seputil. Anchor: The format string "/%s.gl" used by seputil to construct the

Apply the surgical patch to a watchdogd Mach-O. Returns the number of sites patched (>=1 on success, 0 if the binary was already patched). Ra

iPhone base version (`iPhone-BuildManifest.plist`, preserved by fw_prepare).

cloudOS/kernel version (the live `BuildManifest.plist`).

Given the vmaddr of a Mach-O 64 header in the DSC, return the dylib's install name (LC_ID_DYLIB), or None if the file isn't a dylib or

Recompute slot hashes for every page touched by `file_offsets`. `file_offsets` iterable of byte offsets within the Mach-O file

PyPI has no arm64 macOS wheel and the sdist ignores its build's exit status, so a failed native build still installs bindings alone and pip reports su

Resolve final options by merging manifest values.

Resolve the five NeutrinoCore symbols.

Run `executable args` as a controlling-terminal FOREGROUND job. Foundation spawns children in a new process group, which leaves them in the *backgrou

Send a fixed simulated location to the guest.

Inject a single-finger digitizer touch guest-side (bypasses VZ USB touch). phase: 0 = down, 1 = move, 3 = up. x/y are normalized 0..1, top-left origin

Start replaying a list of simulated locations at a fixed interval.

Enable or disable the location toggle based on guest capability. Preserves the user's checkmark state across connect/disconnect cycles.