# TXMPatcher vs TXMDevPatcher in vphone-cli: Key Differences Explained

> Discover the key differences between TXMPatcher and TXMDevPatcher in vphone-cli. Learn how TXMDevPatcher enhances the base trustcache bypass with developer-specific features.

- Repository: [Lakr/vphone-cli](https://github.com/Lakr233/vphone-cli)
- Tags: deep-dive
- Published: 2026-08-31

---

**TXMDevPatcher inherits from TXMPatcher and adds five developer-specific patches—including forced entitlements and debugger support—to the base trustcache bypass that TXMPatcher provides for regular firmware variants.**

The `vphone-cli` open-source project provides specialized tools for modifying iPhone firmware images, specifically targeting the TXM (Trusted Execution Monitor) component. When patching firmware variants, developers must choose between two core classes: `TXMPatcher` for standard builds and `TXMDevPatcher` for development, jailbreak, or experimental configurations. Understanding the distinction between these TXM patchers is essential for correctly configuring your firmware pipeline.

## Class Hierarchy and Architectural Relationship

`TXMDevPatcher` is a direct subclass of `TXMPatcher`, inheriting all base functionality while extending it with additional capabilities. According to the source code in [`sources/FirmwarePatcher/TXM/TXMDevPatcher.swift`](https://github.com/Lakr233/vphone-cli/blob/main/sources/FirmwarePatcher/TXM/TXMDevPatcher.swift) (lines 16-25), the class overrides `findAll()` to invoke both the inherited trustcache bypass and five additional patch methods.

`TXMPatcher` serves as the foundation in [`sources/FirmwarePatcher/TXM/TXMPatcher.swift`](https://github.com/Lakr233/vphone-cli/blob/main/sources/FirmwarePatcher/TXM/TXMPatcher.swift), implementing the core `Patcher` protocol and defining the base trustcache bypass logic between lines 107-134. This inheritance ensures that `TXMDevPatcher` automatically includes all base patching behavior before applying developer-specific modifications.

## Functional Differences and Patch Coverage

While both classes modify the TXM binary, they target different security features and firmware use cases.

### Trustcache Bypass (Both Classes)

Both patchers implement the **trustcache bypass**, which is the fundamental modification required for patched firmware to boot. This patch replaces the binary-search trustcache check with `mov x0,#0` or handles the newer selector-24 hash-flags call. The implementation is defined in [`TXMPatcher.swift`](https://github.com/Lakr233/vphone-cli/blob/main/TXMPatcher.swift) at lines 28-34 and lines 107-134, forming the foundation of both classes.

### Developer-Mode Patches (TXMDevPatcher Only)

`TXMDevPatcher` applies five additional patches beyond the base trustcache bypass, as documented in [`TXMDevPatcher.swift`](https://github.com/Lakr233/vphone-cli/blob/main/TXMDevPatcher.swift):

- **Selector24 Force PASS**: Injects `mov w0,#0xa1` with a branch to epilogue (lines 106-107)
- **Get-Task-Allow Entitlement**: Forces the entitlement check to true by replacing `bl` with `mov x0,#1` (lines 13-14)
- **Selector42/29 Shellcode Injection**: Implements a branch-to-cave technique to inject shellcode (lines 51-55)
- **Debugger Entitlement**: Forces debugger entitlement to true using `mov w0,#1` (lines 35-36)
- **Developer-Mode Guard Bypass**: NOPs out the developer-mode guard checks (lines 84-85)

## Search Strategies and Implementation Complexity

`TXMPatcher` uses straightforward pattern matching to locate the legacy BL site or the newer selector-24 hash-flags call required for the trustcache bypass.

`TXMDevPatcher` extends this with sophisticated scanning techniques including **ADRP+ADD string-reference scans**, zero-filled cave discovery, and complex pattern matching to locate the additional patch sites required for developer functionality.

## Pipeline Integration and Variant Selection

According to [`sources/FirmwarePatcher/Pipeline/FirmwarePipeline.swift`](https://github.com/Lakr233/vphone-cli/blob/main/sources/FirmwarePatcher/Pipeline/FirmwarePipeline.swift) (lines 9-12), the pipeline automatically selects the appropriate patcher based on the firmware variant:

- **TXMPatcher**: Selected for `Variant.regular` (standard firmware builds)
- **TXMDevPatcher**: Selected for `Variant.dev`, `Variant.jb`, and `Variant.exp` (development, jailbreak, and experimental builds)

This selection occurs automatically during pipeline execution, substituting the appropriate patcher class depending on whether the build requires developer-mode capabilities.

## Practical Usage Examples

When building a standard firmware image without developer capabilities, instantiate `TXMPatcher`:

```swift
import Foundation

let rawTXM = try Data(contentsOf: URL(fileURLWithPath: "path/to/txm"))
let regularPatcher = TXMPatcher(data: rawTXM, verbose: true)
try regularPatcher.apply()
let patchedTXM = regularPatcher.patchedData

```

For development, jailbreak, or experimental variants requiring the additional patches, use `TXMDevPatcher`:

```swift
import Foundation

let rawTXM = try Data(contentsOf: URL(fileURLWithPath: "path/to/txm"))
let devPatcher = TXMDevPatcher(data: rawTXM, verbose: true)
try devPatcher.apply()
let patchedTXM = devPatcher.patchedData

```

The API remains identical between classes, but `TXMDevPatcher` automatically applies all additional entitlement and debugger patches during the `apply()` execution.

## Summary

- `TXMDevPatcher` inherits from `TXMPatcher` and extends its functionality with five developer-specific patches
- Both classes implement the trustcache bypass, but only `TXMDevPatcher` adds entitlement forcing, debugger support, and shellcode injection capabilities
- `TXMPatcher` handles `Variant.regular` in the firmware pipeline, while `TXMDevPatcher` handles `Variant.dev`, `Variant.jb`, and `Variant.exp`
- Source files are located in `sources/FirmwarePatcher/TXM/` with specific implementations at documented line numbers
- `TXMDevPatcher` uses advanced scanning techniques including ADRP+ADD references and cave discovery to locate additional patch sites

## Frequently Asked Questions

### Can I use TXMDevPatcher for regular firmware variants?

Yes, but it is generally unnecessary. While `TXMDevPatcher` includes all `TXMPatcher` functionality through inheritance, applying developer-mode patches to regular firmware introduces security modifications—such as forced entitlements and debugger support—that are only required for development builds.

### What happens if I use TXMPatcher on a development variant?

The firmware will lack critical developer capabilities. `TXMPatcher` only applies the trustcache bypass defined in [`TXMPatcher.swift`](https://github.com/Lakr233/vphone-cli/blob/main/TXMPatcher.swift), omitting the forced entitlements, debugger support, selector24 forcing, and shellcode injection required for development builds to function correctly according to the `TXMDevPatcher` implementation.

### Are the patch locations hardcoded or dynamically discovered?

The patch locations are dynamically discovered using pattern matching and ADRP+ADD string-reference scans. `TXMPatcher` uses simpler patterns to locate the trustcache bypass site, while `TXMDevPatcher` implements additional scanning logic to locate the five extra patch sites including zero-filled caves for the selector42/29 shellcode injection.

### Do both classes support the same iOS versions?

Generally yes, as `TXMDevPatcher` inherits the base trustcache logic from `TXMPatcher`. However, the additional developer-mode patches in `TXMDevPatcher` require specific symbol locations and firmware structures to locate the entitlement and debugger check sites correctly across different iOS versions.