Askpass helper: emits `$SUDO_PASSWORD` (set per-invocation in the env). The password is never written into the script itself.

For every kernel-internal occurrence of `kern.hv_vmm_present` inside the kernelcache buffer (kernel proper + kexts + fileset entries + compiled sandbo

Return [(vmaddr_start, vmaddr_end, file_offset, init_prot, chunk_path)].

The window rooted at `ldr wF,[entry,#0x38] ; tbz wF,#19` (vme_permanent), carrying the inlined developer_mode_state() read and the immutable-code curr

Match the upstream sibling nil-field reject shape: ldr w?, [r, #0x18] ; preceding sibling-field guard cbz w?, continue ldr wA, [base, #8] cbz wA,

Check if instruction at `off` is the rootauth CBNZ gate site. Returns "live", "patched", or nil.

Return true if instruction is `mov <dst>, #0`.

Return the source register name if instruction is `mov <dst>, <src_reg>`.

Find the start offset of the next function after `start` (exclusive), up to `maxSize` bytes ahead. Returns `start + maxSize` if none found.

Get the "name" property value from a node.

Pin the function via its unique signature cstring, then NOP the unique `cmp wN,#9 ; b.ne` inside it.

The snapshot lives at the bundle root, so `vm export` must not strip it: it is matched by neither the `*_Restore*` exclude nor any regenerable- artifa

Fired by BKPresenceDetectOperation when finger presence changes. Second param is BOOL-encoded: non-zero = finger on sensor, 0 = finger off.

Sent by BKOperation when the XPC link to biometrickitd is torn down.

Parse LC_SYMTAB from a fileset entry Mach-O whose header starts at `mhOff`. Reads from `buffer.original`. Mirrors Python `_parse_fileset_symtab(mh_off

Parse an embedded kext Mach-O at `kextFoff` and return its __TEXT_EXEC.__text range.

Parse an embedded kext Mach-O at the given file offset and return its __TEXT_EXEC.__text (or __TEXT_EXEC segment) range in file offsets.

Parse nlist64 entries: add defined function symbols (n_type & 0x0E == 0x0E) to `symbols`. Reads from `buffer.original` (Python: `self.raw`). Mirrors P

Parse a device tree node from the flat binary at the given offset. Returns the parsed node and the offset past the end of the node.

Parse the entire device tree payload.

Parse LC_SYMTAB information. Returns (symoff, nsyms, stroff, strsize) or nil.

AMFI trustcache gate bypass: rewrite AMFIIsCDHashInTrustCache to always return 1.

Bypass AMFI execve kill by patching the shared MOV W0,#1 → MOV W0,#0. All kill paths in the AMFI execve hook function converge on a shared epilogue:

Patch 12: Replace the BL to validate_on_disk_root_hash inside _apfs_graft with `mov w0, #0`, bypassing root hash validation. Strategy: 1. Locate the

Apply all APFS mount patches (13, 14, 15, 16).

Patch 14: Replace `tbnz w0, #0xe, ...` with `mov w0, #0`. Within the function a BL calls a small leaf flag-reading function, then TBNZ w0, #0xe branc

Patch 13: Replace `cmp x0, Xm` with `cmp x0, x0` in _apfs_vfsop_mount. The target CMP follows the pattern: BL (returns current_thread in x0), ADRP +

NOP the `b.hs` of the unique `cmp x8,#0x400 ; b.hs` rootfs size gate. Anchoring on the cmp+b.hs pair disambiguates 26.4's three `cmp x8,#0x400` (the o

Redirect ADRP+ADD x2 to a custom boot-args string. Python: `patch_boot_args()`

NOP the conditional branch gating the modern iBoot bootx-handoff panic. Gate signature (Capstone-decoded): BL <bit_getter> ; tiny 4-insn

NOP the conditional branch guarding the "rootvp not authenticated after mounting" panic. Flow: 1. Find the string "rootvp not authenticated after mou

Find unique `mov w8, #<errorCode>` and convert the cbz/cbnz 4 bytes before it into an unconditional branch to the same target. Python: `_patch_cbz_bef