Lakr 03cb2a8389 fix TXM selector24 bypass: return 0xA1 (PASS) instead of NOP/fail ...

The original selector24 patches (NOP ldr + NOP bl) broke the hash flags
extraction, causing the consistency check to fail. The second attempt
(return 0x130A1) also failed because the return code semantics were
inverted — byte 1 != 0 means FAIL, not success.

Correct approach: insert `mov w0, #0xa1; b <epilogue>` after the prologue.
0xA1 has byte 1 = 0 which the caller checks via `tst w0, #0xff00` as PASS.

Update AGENTS.md

move selector24 bypass from txm_jb.py to txm_dev.py, delete TXMJBPatcher

Selector24 CS validation bypass now applies to both dev and JB variants
via txm_dev.py. The separate txm_jb.py patcher is removed since it had
no other patches. Dev boot chain: 47→49 patches.

Create txm_fullchain_analysis.md

2026-03-04 18:56:07 +08:00

..

devmode_xpc_protocol.md

Create txm_return_mechanism.md

2026-03-04 13:34:02 +08:00

firmware_manifest_and_origins.md

Create txm_return_mechanism.md

2026-03-04 13:34:02 +08:00

iboot_patches.md

refactor: split patchers into base/mixin modules and format scripts

2026-03-04 15:19:17 +08:00

kernel_fairplay_kexts.md

Create txm_return_mechanism.md

2026-03-04 13:34:02 +08:00

kernel_jb_patch_notes.md

Create txm_return_mechanism.md

2026-03-04 13:34:02 +08:00

kernel_patcher_verification.md

Create txm_return_mechanism.md

2026-03-04 13:34:02 +08:00

keyboard_event_pipeline.md

Create txm_return_mechanism.md

2026-03-04 13:34:02 +08:00

patch_comparison_all_variants.md

fix TXM selector24 bypass: return 0xA1 (PASS) instead of NOP/fail

2026-03-04 18:56:07 +08:00

txm_fullchain_analysis.md

fix TXM selector24 bypass: return 0xA1 (PASS) instead of NOP/fail

2026-03-04 18:56:07 +08:00

txm_jb_patches.md

Create txm_return_mechanism.md

2026-03-04 13:34:02 +08:00

txm_selector24_analysis.md

fix TXM selector24 bypass: return 0xA1 (PASS) instead of NOP/fail

2026-03-04 18:56:07 +08:00

txm_variant_diff.md

Create txm_return_mechanism.md

2026-03-04 13:34:02 +08:00