VPhoneVirtualMachineManifest represents the on-disk VM configuration manifest. Structure is compatible with security-pcc's VMBundle.Config format.

A single patch application record, used to compare Python vs Swift output.

A mutable binary buffer for reading and patching firmware data.

Lazy random-access byte view over a chunked dyld shared cache.

A long-lived child process with stdin driving and stdout/stderr regex-waiting — the primitive for DFU background boot, first-boot command injection, a

Patcher for iBoot components (iBSS, iBEC, LLB).

CLI output verbosity. Higher levels are supersets of lower ones. The guest VM serial console is deliberately NOT part of this ladder: `vm launch` alw

Orchestrates firmware patching for all boot-chain components. The pipeline discovers firmware files inside the VM directory (mirroring `find_restore_

The resolved `fw prepare` sources — a URL or local path per component, or nil to let `fw_prepare.sh` fall back to its built-in default.

JB kernel patcher across 3 groups. Variant- and feature-gated methods can change the emitted record count; iOS-27-only patches are gated by `applyIOS2

iOS-userland and cloudOS-kernel versions a bundle was restored with, recorded host-side so they're readable without booting the VM. Persisted as `rest

JB-variant patcher for iBoot images. Adds iBSS-only patches: 1. patchSkipGenerateNonce — locate "boot-nonce" ADRP+ADD refs, find tbz w0, #0, <target>

Regular kernel patcher for iOS prelinked kernelcaches. Patches are applied in the same order as the Python reference implementation. Each patch metho

Patcher for TXM trustcache bypass. Patches: 1. Trustcache binary-search BL → mov x0, #0 (in the AMFI cert verification function identified by the uni

Patcher for AVPBooter DGST bypass.

A node in the device tree containing properties and child nodes.

A single property in a device tree node.

Thread-safe accumulator for a pipe's bytes. `@unchecked Sendable` because access is serialized by its lock, satisfying the readability handler's `@Sen

Dev-variant patcher for TXM images. Adds 5 patch methods (11 patch records) beyond base trustcache bypass: 1. selector24 force PASS (mov w0, #0xa1 +

A single BGRA frame produced by a frame source.

A single-line, redrawing byte progress bar for long transfers. Renders to stderr only when it is a TTY, so piped/`--json`/GUI-subprocess invocations (

A patch that adds a brand-new child node under an existing parent. Used when iPhone17,3 carries a node that vphone600 does not — e.g. `/device-tree/pr

Describes a single firmware component in the pipeline.

Default loader: transparently handles IM4P containers and raw payloads.

Patcher for the Filesystem payload.

Patcher for DeviceTree payloads.

Experimental kernel patcher. Inherits the JB infrastructure (symbol table, ADRP/BL indices, branch encoders, code-cave finder, string-anchored functi

Separate object to avoid @MainActor vs nonisolated delegate conflicts.

Minimal section info extracted from a Mach-O binary.

Minimal segment info extracted from a Mach-O binary.

Patcher for Manifest payloads.

Thread-safe accumulator for the combined stdout+stderr bytes, plus an EOF flag so `waitForOutput` can tell "no more output is coming" apart from "the

Callback for a pending request. Called on the read-loop queue.

A single property patch specification.

Thread-safe box for passing results between main actor and accept queue.

Standalone NSObject that receives BKOperationDelegate callbacks from biometrickitd. No actor isolation — callbacks can arrive on any queue biometricki

Host-side virtual-camera server. Opens a vsock connection to the guest on port 1338 (separate from the vphoned control channel on 1337) and pushes ra

Host-side client for the vphoned guest agent. Communicates over vsock using length-prefixed JSON (vphone-control protocol). Each message is `[uint32

Native port of `scripts/setup_machine.sh`'s `main()` — runs the full `vm create` pipeline (prepare → patch → restore → CFW → first boot → boot analysi

Codable view of the firmware catalog for `fw catalog --json`.

Lightweight Unix domain socket server that accepts automation commands from local processes (e.g. Claude Code via `nc -U`). One JSON line in, one JSO

Forwards the host Mac's location to the guest VM via vsock. Uses macOS CoreLocation to track the Mac's real location and forwards every update to the

Generates a smoothly-animating BGRA pattern: a moving vertical gradient modulated by a sin wave, plus a frame counter overlay in the corner so the rec

Monitors the physical Touch ID sensor for finger contact using the BiometricKit singleton (`[BiometricKit manager]`) and its `detectPresenceWithOption

Plays a video file in a loop. Decode is delegated to `AVAssetReader` with a BGRA output spec, so anything AVFoundation can demux on macOS works (`.mov

Minimal VM for booting a vphone (virtual iPhone) in DFU mode.

Round-trip coverage for the shared raw-instruction predicates in `ARM64Inst`, the single source of truth for the JB pattern scanners. Each predicate i