Record a code patch (disassembles before/after for logging).

Record a patch at the given file offset.

Emit the two patch instructions at the function entry point.

Record a string/data patch (not disassemblable).

AND W8, W8, #imm (32-bit logical immediate). For mask 0xFFFFC0FF: encodes as NOT(0x3F00) = elements with inverted bits

Retarget an auth-rebase chained pointer while preserving PAC metadata. Auth-rebase format (high bit set): [63]=1, [62:32]=auth/diversity bits, [31:0]

Retarget an auth-rebase chained pointer while preserving PAC metadata.

Encode a BL instruction.

CBZ X26, #0x10 — skip 4 instructions if x26 == 0

Encode an arm64e kernel cache auth-rebase chained fixup pointer.

LDR W8, [X26]

Encode `mov x<rd>, xzr` where `rd` is the destination register of the LDRB at `off` (the role-state byte load). Zeroing the loaded register neutralize

ORR W8, W8, #0xC (CS_GET_TASK_ALLOW | CS_INSTALLER)

STR W8, [X26]

Encode `mov w8, #<imm16>` (MOVZ W8, #imm) as 4 little-endian bytes. MOVZ W encoding: [31]=0 sf, [30:29]=10, [28:23]=100101, [22:21]=hw=00, [20:5]=imm1

Encode `movk w8, #<imm16>, lsl #16` (MOVK W8, #imm, LSL #16). MOVK W: [31]=0, [30:29]=11, [28:23]=100101, [22:21]=hw=01, [20:5]=imm16, [4:0]=Rd=8

Deep-copy a single Manifest entry from a build identity.

Enumerate 4-insn `ADRP + LDRB + UBFX (width=1) + RET` functions — the "return one bit of one byte global" shape used as the precondition feature-check

Enumerate 5-insn `MOVZ + 3×MOVK + RET` functions assembling a 64-bit constant into a single X register (used by iBoot's panic/log calls to load the so

Enumerate "panic block" call sites: 3-insn sequence of `BL <hash_getter>; MOV W?, #<imm>; BL <anything>`. Returns the file offset of the first BL in e

Extract the patched data from a patcher's internal buffer. All current patchers own a ``BinaryBuffer`` whose `.data` property holds the mutated bytes

Best-effort: look back up to 0x20 bytes from a BL for the last `mov w1, #imm`.

Convert file offset to virtual address.

Find all occurrences of a C string in the data.

Find the first BL to `_panic` in `range`. Returns the file offset or nil. Reads from `buffer.original` (Python: `_rd32(self.raw, off)` via `_is_bl`).

Scan [funcStart, funcEnd) for `BL <check> ; CBZ W0, <allow> ; MOV W0, #2`. Returns (blOff, allowTarget) on success.

Find ADRP+ADD x2 pointing to the format string at fmtOff. Python: `_find_boot_args_adrp()`

Find the standalone "%s" format string near "rd=md0" or "BootArgs". Python: `_find_boot_args_fmt()`

Find a direct child node by name.

Find release and research identity indices for the given DeviceClass.

Find a region of zeros/0xFF/UDF in executable memory for shellcode. Only searches __TEXT_EXEC and __TEXT_BOOT_EXEC segments. Reads from buffer.data (m

Recover ldr x26, [x29, #imm] instruction bytes from the function body.

Find shared deny return: MOV W0,#1 at epilogueOff - 4.

Find the canonical epilogue: last `ldp x29, x30, [sp, ...]` in function.

String-cluster search for _cred_label_update_execve.

Find success exits: `b epilogue` preceded (within 0x10 bytes) by `mov w0, #0`.

Find the unique `tbz Wflags, #3 / mov Wt, #0 / b ...` gate inside a function, where Wflags is the register loaded from [base, #0x28] in the function p

Locate the AllocPortsArray allocator size arg `lsl x1, xN, #3` (count << 3 == count * 8), unique within the function. Function pinned by its C++ signa

Pin the RegisterNotificationPort function via its unique AssertMacros cstring.

Strategy 2: scan the pre-built BL index for the candidate with the most callers in the [50, 250] window that matches the ADRP-x8 + LDR heuristic.

Strategy 3: linear sweep of all code ranges with the same heuristics.

Find the function start of the debugger-gate function containing the `com.apple.private.cs.debugger` BL site — mirrors Python `_find_debugger_gate_fun

Find a unique `tbnz wN, #5, <deny>` where deny-block starts with `mov w?, #1`.

Scan back up to 8 instructions for `mov w6, #0x201`, abandoning if w6 is otherwise written first. Returns the setter's file offset.

Find a function that references a given string constant. Returns the function-start file offset, or nil. Mirrors Python `_find_func_by_string(string,

Find a function that contains a reference to `string` (null-terminated).

Find a function containing a string reference. Returns (funcStart, funcEnd, refs) or nil. Mirrors Python `_find_func_containing_string(string, code_ra

Find the end of a function by scanning forward for the next PACIBSP boundary. Reads from `buffer.original` (Python: `_rd32(self.raw, off)`). Mirrors

Scan backward from `off` for PACIBSP — mirrors Python `_find_func_start`.

Scan backward from `offset` (aligned to 4 bytes) for a PACIBSP instruction. Searches up to 0x200 bytes back, matching the Python implementation.

Find the start of the function containing the instruction at `offset`. Scans backward for PACIBSP or STP x29, x30, [sp, ...].