Find the sandbox ops[18] wrapper, returning (opsTable, entryOff, entryRaw, wrapperOff).

Return the index of the first iPhone erase identity.

Find a reusable 8-arg munge32 helper with matching metadata. Returns (targetFoff, exemplarEntry, matchCount) or (-1, -1, 0).

Find a NUL-prefixed string (i.e. the exact C symbol "Sandbox" at a NUL boundary). Returns the file offset of the first character (after the NUL).

Find the BL to _panic within 0x40 bytes after `addOff`.

Find the file offset of _panic by locating the most-called BL target. _panic is by far the most-called function in the kernel; the BL index built by

Find all file offsets where the given 4-byte pattern appears. Equivalent to Python `_find_asm_pattern(data, asm_str)`.

Find `_proc_security_policy` by its unique reference to `PRIV_GLOBAL_PROC_INFO`. Source: `bsd/kern/proc_info.c` — `proc_security_policy()` is the sha

Find a property by name within a node.

Find all ADRP+ADD pairs that point within `tolerance` bytes before `targetOff`. This handles the common case where code references a structure header

Find all ADRP+ADD pairs in the flat binary that resolve to `targetOff`. TXM is a raw flat binary (no Mach-O), so we cannot use a pre-built ADRP index

Find all ADRP+ADD pairs in the binary that point to `targetOff`. Scans the entire buffer in 4-byte steps, checking consecutive instruction pairs for

Find the Sandbox common allow stub: `mov x0, #0 ; ret`. Scans sandbox kext text for consecutive MOV_X0_0 + RET pairs and returns the highest-address

Find the sandbox mac_policy_ops table via the mac_policy_conf struct. Mirrors Python `_find_sandbox_ops_table_via_conf()`: locates the conf struct by

Find the Sandbox mac_policy_ops table via the mac_policy_conf struct. Strategy (aligned with Python _find_sandbox_ops_table_via_conf): - Locate the "

Locate the Sandbox mac_policy_ops table via mac_policy_conf. Searches __DATA_CONST and __DATA segments for the conf struct: [0..7] tagged ptr → "San

Find all functions that reference both "SecureRootName" and "SecureRoot".

Scan [funcStart, funcEnd) for the unique CSEL that selects between success (wzr) and kIOReturnNotPrivileged — the SecureRootName deny/allow selector.

Find the unique role-state byte gate: `ldrb wN, [xBase, #imm] ; tbz/tbnz wN, #6, <target>`. On 26.1 this read as `add x8,x16,#0x70 ; ldrb w8,[x8,#1]

Find all ADRP+ADD instruction pairs referencing any occurrence of `needle` in the binary. Returns `(stringOff, adrpOff, addOff)` tuples — mirrors Pyt

Find all ADRP+ADD references to a string at the given file offset.

Find a run of NUL bytes ≥ 64 bytes long to write the new string into. Python: `_find_string_slot()`

Find the high-level apply manager via its three error strings, then find the low-level wrapper it calls three times.

Find the pre-setter helper BL site in the apply wrapper. Python: scan forward from func start, after the first `cbz x2`, return the next BL.

Locate the high-level apply manager by its three error log strings.

Find the final tail B into the setter core (last unconditional branch in the func).

Find the wrapper callee that appears 3+ times and is called with w1=0,1,2.

Find the sysent table base structurally — the longest run of valid 24-byte `struct sysent` rows in a DATA segment. No symbol or `_nosys` dependency: e

Find a zero-filled cave of at least `minInsns * 4` bytes — mirrors Python `_find_udf_cave`. The Python logic: - Scan forward for a run of zero words.

Locate a unique `<mnemonic> wD,[xB,#disp]` field load in [funcStart,funcEnd).

Scan for the 8-instruction upstream cleanup call pattern and return the file offset of the first BL, or nil if not uniquely found.

Scan at most 9 instructions ending at `strRefOff` for the pattern: cmp Xm, Xn b.eq #forward str xzr, [...]

Find validate_on_disk_root_hash by locating the `authenticate_root_hash` string and resolving the function that references it.

Locate vfs_context_current generically: prefer the symbol, else match the stable 4-word prologue prefix followed by *any* `ldr x1, [x0, #imm]` (the ut

Resolve vnode_getattr from a BL near its log string "vnode_getattr".

Scan [start, end) for `and wProt, wProt, #imm` that strips one of the low protection bits.

Find the `b.ne` that skips the write-downgrade block, and its target.

Locate the `mov wMask, #5` that defines the W^X protection mask, identified by the unique `lsr wT, _, #7 ; and wD, wT, wMask` pair that narrows the pr

Find all function starts that reference `needle` via ADRP+ADD.

Generate hybrid BuildManifest.plist and Restore.plist. - Parameters: - iPhoneDir: Path to the extracted iPhone IPSW directory. - cloudOSDir: Path to

Walk backward from `off` looking for `movk <regName>, #0xE000, lsl #16` — the high half of an IOKit return code (kIOReturn* == 0xE000xxxx).

Return true if there is a BL to _imageboot_needed (or any BL if unknown) within 3 instructions after `off`.

Heuristic: does the function at `calleeOff` look like a MACF aggregator? The aggregator loads from the mac_policy_list slot at offset 0x9E8 and makes

Heuristic: scan the first `maxInsns` instructions after `funcOff` for `ldr wN, [x8, ...]` — the canonical _PE_i_can_has_debugger prologue.

Older bottles ship only the static archive.

Parse from the dict returned by vphoned file_list entries.