vphone-cli/research/kernel_patch_base_11_15_validation.md

Base Kernel Patch Validation: #11-#15 (Regular + Dev)

Date: 2026-03-05 Scope: non-jailbreak shared kernel patch flow (fw_patch + fw_patch_dev) Target kernel input: vm/iPhone17,3_26.1_23B85_Restore/kernelcache.research.vphone600

Goal

Validate that base patch items #11-#15:

1. hit the intended code paths,
2. rewrite the intended instruction shape,
3. preserve expected local control flow semantics.

Source-of-truth path

• Regular flow calls patch_kernelcache() in scripts/fw_patch.py.
• Development flow imports and reuses the same patch_kernelcache() from scripts/fw_patch.py.
• KernelPatcher.find_all() order defines patch indices.

Key code references:

• scripts/fw_patch.py:235
• scripts/fw_patch_dev.py:12
• scripts/patchers/kernel.py:56
• scripts/patchers/kernel_patch_dyld_policy.py
• scripts/patchers/kernel_patch_apfs_graft.py
• scripts/patchers/kernel_patch_apfs_mount.py

Verification method

1. Load clean IM4P payload from kernelcache.research.vphone600.
2. Run KernelPatcher.find_all() and capture emitted offsets/descriptions.
3. Compare instruction bytes before/after for #11-#15.
4. Assert matcher semantics programmatically:
   • dyld patch pair has BL + conditional-on-w0 and distinct BL targets.
   • _apfs_graft BL target equals validate_on_disk_root_hash function.
   • _apfs_mount_upgrade_checks target is BL + TBNZ w0 with small leaf callee.
   • _handle_fsioc_graft BL target equals validate_payload_and_manifest function.
5. Cross-check in IDA:
   • patch site belongs to expected function region (string xref/function context).

Results

Base VA: 0xFFFFFE0007004000

#11 patch_check_dyld_policy (@2)

• file offset: 0x016410C8
• VA: 0xFFFFFE00086450C8
• before: bl #0x1638384
• after: mov w0, #1
• next instruction (unchanged): tbnz w0, #0, ...
• matcher assertions:
  • @1 and @2 are both BL followed by conditional branch on w0: PASS
  • BL targets are different: PASS
• IDA context:
  • site in function sub_FFFFFE000864507C
  • same function references string com.apple.developer.swift-playgrounds-app.development-build

#12 patch_apfs_graft

• file offset: 0x0242011C
• VA: 0xFFFFFE000942411C
• before: bl #0x246d398
• after: mov w0, #0
• next instruction: cbz w0, ...
• matcher assertion:
  • BL target equals _find_validate_root_hash_func() result: PASS
• IDA context:
  • site in function sub_FFFFFE000942326C (apfs_graft call path)
  • target function aligns with authenticate_root_hash string-referenced routine (sub_FFFFFE00094711CC/entry region at 0x...9471398)

#13 patch_apfs_vfsop_mount_cmp

• file offset: 0x02475044
• VA: 0xFFFFFE0009479044
• before: cmp x0, x8
• after: cmp x0, x0
• adjacent shape (before patch):
  • bl ...
  • adrp x8, ...
  • ldr x8, [x8, ...]
  • ldr x8, [x8]
  • cmp x0, x8
  • b.eq ...
• interpretation: correct hit on mount path thread-vs-kernel-task comparison.

#14 patch_apfs_mount_upgrade_checks

• file offset: 0x02476C00
• VA: 0xFFFFFE000947AC00
• before: tbnz w0, #0xe, ...
• after: mov w0, #0
• previous instruction: bl #0xCC6144
• matcher assertion:
  • previous BL target behaves as small leaf (ret within first 0x20 bytes): PASS
• IDA context:
  • site in function sub_FFFFFE000947AB88
  • function region references apfs_mount_upgrade_checks

#15 patch_handle_fsioc_graft

• file offset: 0x0248C800
• VA: 0xFFFFFE0009490800
• before: bl #0x2416bd4
• after: mov w0, #0
• next instruction: cbz w0, ...
• matcher assertion:
  • BL target equals _find_validate_payload_manifest_func() result: PASS
• IDA context:
  • site in function sub_FFFFFE000949074C
  • target function aligns with validate_payload_and_manifest (sub_FFFFFE000941ABD4)

Input consistency note

• VM clean IM4P payload and IDA-loaded macho have same size but different hash.
• Dword diff count is 25, and the diff set includes all expected base patch sites.
• This is consistent with IDA sample being the patched image variant for the same kernel.

Conclusion

For kernelcache.research.vphone600 prepared from clean firmware:

• patch #11 (_check_dyld_policy_internal @2) works and hits intended BL site.
• patch #12 (_apfs_graft) works and hits intended validation BL site.
• patch #13 (_apfs_vfsop_mount cmp) works and hits intended compare site.
• patch #14 (_apfs_mount_upgrade_checks) works and hits intended TBNZ w0 site.
• patch #15 (_handle_fsioc_graft) works and hits intended validation BL site.

Status: working for now (correct semantic hit + instruction rewrite on this kernel variant).