Skip kernel-map panic in _convert_port_to_map_with_flavor.

C21-v3 split exits + helper bits for _cred_label_update_execve.

Patches 6-7: stub _PE_i_can_has_debugger with mov x0,#1; ret. Three strategies in priority order: 1. Symbol table lookup via LC_SYMTAB nlist64 entrie

Force debugger entitlement check to return true (BL → mov w0, #1). Pattern (at BL site): [scan-8] mov x0, #0 [scan-4] mov x2, #0 [scan+0] bl <entitl

Developer-mode bypass: NOP conditional guard before deny log path. Finds `tbz/tbnz/cbz/cbnz w9, #0, <...>` just before the "developer mode enabled du

Apply all DiskImages2 ABI pokes. Wired into KernelJBPatcher.findAll().

`DIDeviceIOUserClient::Connect` rejects a client whose daemon ABI (`cmp wN,#9 ; b.ne <reject>`) != 9. NOP the b.ne. Same shape, different function.

`DIDeviceCreatorUserClient::CreateDevice` rejects a client whose controller ABI (`cmp wN,#9 ; b.ne <reject>`) != 9. NOP the b.ne so the ABI-11 iOS-27

Widen the notification-ports array allocation AND both bound-check fields to 0x800 entries, fixing the RegisterNotificationPort off-by-one (userland r

NOP the upstream cleanup call in _dounmount.

Patches 10–11: Replace two BL calls in _check_dyld_policy_internal with mov w0,#1.

Disable Mach port guard violation enforcement (EXC_GUARD). Patches `thread_guard_violation` to return immediately, preventing all guard violations fr

Force get-task-allow entitlement check to return true (BL → mov x0, #1).

Patch 15: Replace the BL to `validate_payload_and_manifest` with `mov w0, #0` inside `_handle_fsioc_graft`.

Patch 16: NOP CBZ/CBNZ on X0/W0 that branch to entitlement-error blocks in `handle_get_dev_by_role`. Error blocks are identified by `mov w8, #0x332D`

Apply Part A (OID rename) + Part B (kernel-internal caller byte-5 mangle). Returns true if any byte was modified.

Find the b.ne + mov x0, x22 pattern with a preceding cmp. Patch: b.ne → NOP, mov x0, x22 → mov x0, #0. Python: `patch_image4_callback()`

Force SecureRootName policy return to success in AppleARMPE::callPlatformFunction.

The swap_submit handler has a SECOND, internal exact-size gate beyond the dispatch table's checkStructureInputSize: cmp w2, #0x588 ; b.ne <error> (w

ABI-correct kcall10 patch: install a sysent[439] cave.

Patches 4–5: Stub _proc_check_launch_constraints with `mov w0, #0; ret`. Returns true when both instructions are emitted, false on any failure.

Bypass the load_dylinker policy gate in the dyld path.

Apply the upstream twin bypasses in the mount-role wrapper. Patches two sites in the wrapper that decides whether execution can continue into `mount_

Find `ldr xR, [xN, #0x78]; cbz xR` preceding the unique `mov w8, #0x110` and NOP the cbz. Python: `_patch_null_check_0x78()`

NOP the verifyPermission gate in the `krn.` key-prefix path. Runtime reveal is string-anchored only: enumerate code refs to `"krn."`, recover the con

Find `mov w8, #0x328; movk w8, #0x40, lsl #16; ...; bl X; cbnz w0` and NOP the cbnz. Python: `patch_panic_bypass()`

Patch: rewrite the SHA256-only reject compare in AMFI's post-validation path.

Replace `cmp w0, #imm` with `cmp w0, w0` in AMFI's postValidation path. The 'AMFI: code signature validation failed' string is in a caller function,

NOP the TBNZ that follows the TXM CodeSignature error log call. The 'TXM [Error]: CodeSignature: selector: ...' string is followed by a BL (printf/lo

Bypass the two early pid-0 guards in the inlined proc_pidinfo path.

Stub _proc_security_policy: mov x0,#0; ret.

Apply all five rootfs bypass patches. Python: `patch_rootfs_bypass()`

Patches 17-26: stub Sandbox MACF hooks with mov x0,#0; ret.

Extended sandbox hooks bypass: retarget ops entries to the allow stub.

Patch selector24 handler to return 0xA1 (PASS) immediately. Inserts `mov w0, #0xa1 ; b <epilogue>` right after the prologue, skipping validation whil

Selector 42|29 patch via dynamic cave shellcode + branch redirect. Shellcode (6 instructions in a zero-filled cave): nop (safety p

Force `cmp x0, x0` in the root-vs-preboot gate of `_shared_region_map_and_slide_setup`. Anchor: `/private/preboot/Cryptexes` string → find the functi

NOP the upstream dual-CBZ bypass in the persona helper. 1. Recover the outer spawn policy function from `com.apple.private.spawn-panic-crash-behavior

Retargeted C22 patch: syscallmask apply to proc.

NOP the upstream early `pid == 0` reject gate in `task_for_pid`. Anchor: `proc_ro_ref_task` string → enclosing function. Shape: ldr wPid, [xArgs, #8]

Zero out `_thid_should_crash` via the nearby sysctl metadata. The raw PCC 26.1 kernels do not provide a usable runtime symbol table, so this patch al

Clear TSSF_CHECK_ENTITLEMENT in the flags passed by the thread_set_state user setters so Frida Stalker can update an existing thread's registers.

Force the upstream cs_bypass fast-path in `_vm_fault_enter_prepare`. Expected semantic shape: ... early in prologue: LDR Wflags, [fault_info_reg, #0x

Bypass the vm_map_protect W^X downgrade so write+execute protections are honored.

Entry point used by `cfw.py patch-camera-dsc`.

Mangle the kern.hv_vmm_present cstring in a standalone Mach-O. Returns the count of mangled cstring sites. Idempotent.

Convert screenshot pixel coordinates to NSView local coordinates.

`-v` repeated `min(v.rawValue, 2)` times, for the pmd3 bridge's own `--verbose`/`-v` count option (`.info`→1 INFO / pmd3's colorful default, `.debug`/

Validate a sudo credential non-interactively via the askpass env (`sudo -A -v`). Returns whether it succeeded.

Find a null-terminated C string at the given offset.

`ProductVersion` from a manifest in `restoreDir`, or nil if absent/unreadable.

A scripted stdin: pops one line per `read()` call.

A scripted stdin: pops one line per `read()` call.

Snapshot the just-restored iOS + cloudOS versions to `restore-info.json`, read host-side from the bundle's restore-dir plists. Best-effort: the restor

Snapshot the just-restored iOS + cloudOS versions to `restore-info.json`, read host-side from the bundle's restore-dir plists. Best-effort: the restor

Get the register name string for an aarch64_reg value.