Write a little-endian UInt32 at the given byte offset.

True iff the instruction's first (destination) operand is the named register.

File-offset range (start, end) of the AMFI kext's __TEXT_EXEC.__text section. Discovered from __PRELINK_INFO. Falls back to the full kernel code rang

Decode a BL instruction at `offset`. Returns the target file offset, or nil.

Return true if the function at `funcOff` contains a RET within `maxBytes`.

File-offset range (start, end) of the APFS kext's __TEXT_EXEC.__text section. Discovered from __PRELINK_INFO. Falls back to the full kernel code rang

Rewrite the AllocPortsArray size shift to `mov x1,#0x4000` (0x800 entries * 8).

Rewrite a bound-check field load to `mov wD,#0x800`, deriving wD from the decode.

Apply a single `AddChildNodePatch`: construct the new `DTNode`, fill its `name` + caller-supplied properties, attach to the parent's `children`, and r

Apply all property patches and record each change. Always runs `basePropertyPatches`. Additionally runs `identityPropertyPatches` + `experimentalNode

Apply all collected patches to the buffer.

On-disk logical size of the members `export` will archive, mirroring the tar `--exclude` patterns so the progress total matches the streamed bytes.

Convert to JSON string for logging/debugging

If `insn` is B.EQ <label>, return its target; else nil. B.cond: [31:24]=0x54, [4]=0, cond=[3:0]; EQ cond = 0.

A `tbz`/`tbnz wReg,#bit,target` matching the given mnemonic, register, and bit; returns the branch target file offset.

Any `tbz`/`tbnz wReg,#bit,target` of the given mnemonic; returns bit + target.

Provision `~/.vphone/venv`: try each candidate host python for real (build the venv, install deps, verify) and use the first that fully succeeds — a c

Direct B/BL target (disassembly runs in file-offset space).

Build the faithful upstream C23 shellcode (exactly 46 instructions = 184 bytes). Layout (instruction offsets from caveOff): 0: nop 1: cbz x3, #0xa8

Build the ordered component list based on the variant.

Build the single DFU erase identity by merging components from multiple sources.

Build the ABI-correct kcall10 function body. Contract: x0 = proc* x1 = &uthread->uu_arg[0] (uap pointer) x2 = &uthread->uu_rval[0] (retval pointer)

Build the merged Restore.plist from cloudOS and iPhone sources.

Build the C22 cave: 0x100 0xFF-blob + code section. Returns (caveBytes, codeStartFoff) or nil on branch encoding failure. The code section contract:

Cancel all currently pending request continuations.

Ordered, existence-checked host python3 candidates to bootstrap from. Canonical Homebrew locations first, then versioned names on PATH, then generic `

Access the recorder's private capture method via the existing async wrapper.

Decode CBZ/CBNZ target (imm19, sign-extended, scaled by 4).

Return true if instruction is `cbz x<N>, <label>` (64-bit register).

Show a numbered menu and read a 1-based index (mirrors VPhoneVMPicker).