Rename `\0hv_vmm_present\0` → `\0Xv_vmm_present\0` (single byte at offset 0 of the 14-byte cstring). Exactly one occurrence is required.

Resolve the iPhone/cloudOS sources for `vm create`, prompting only for what's missing. Both given → passthrough. Non-interactive → passthrough (fw_pre

Resolve relative path to absolute URL within VM directory

Resolve the concrete bridge interface to persist for bridged mode. - `requested`: an explicit `--bridge-interface`, validated against the host. - `cur

Resolve _bsd_init via symbol table, else via rootvp anchor string.

Resolve a node path like ["device-tree", "buttons"] from the root.

Resolve a 64-bit data pointer to a file offset, trying both chained fixup decoding and a plain (VA − baseVA) conversion.

Look up a function symbol, return file offset or nil.

Resolve the mutation helper: the function immediately following the helper's containing function in text. It must start with PACIBSP or BTI.

Find the ADRP+ADD pair for the rootvp panic string inside `funcStart`.

File-offset range (start, end) of the Sandbox kext's __TEXT_EXEC.__text section. Discovered from __PRELINK_INFO. Falls back to the full kernel code r

Save patched data back to an IM4P container or as raw data. If the original was IM4P, re-packages with the same fourcc and LZFSE compression. Otherwi

Send a request and await the response. Returns the response dict and optional raw data.