# The Three Stacked Layers of Kernel Patching in vphone-cli: Base, Jailbreak, and Experimental > Discover vphone-cli's three kernel patching layers: Base, Jailbreak, and Experimental. Learn how these build stages create a bootable, jailbreak-enabled virtual iPhone kernel. - Repository: [Lakr/vphone-cli](https://github.com/Lakr233/vphone-cli) - Tags: internals - Published: 2026-08-31 --- **vphone-cli implements three stacked layers of kernel patching—Base, Jailbreak, and Experimental—that are sequentially applied during the build process to create a bootable, jailbreak-enabled virtual iPhone kernel.** The `Lakr233/vphone-cli` repository provides a command-line interface for running virtual iPhone environments, utilizing a sophisticated **three stacked layers of kernel patching in vphone-cli** architecture to modify iOS kernels for virtualization. This layered approach separates concerns between boot-chain stability, jailbreak functionality, and experimental research features, allowing developers to compose kernels based on their specific use cases. ## Understanding the Kernel Patch Architecture The patching strategy employed by vphone-cli divides modifications into three distinct tiers. Each layer builds upon the previous one, ensuring that foundational boot fixes remain intact while additional capabilities are added. ### Layer 1: Base Kernel Patch Layer The **Base kernel patch layer** provides low-level binary patches that resolve critical boot-chain issues affecting iBSS, iBEC, and LLB components. These patches establish the foundational stability required for the virtual device to initialize correctly. According to the source documentation in [`research/0_binary_patch_comparison.md`](https://github.com/Lakr233/vphone-cli/blob/main/research/0_binary_patch_comparison.md), this layer includes regular, development, and jailbreak variants, though it focuses primarily on boot-time corrections rather than runtime modifications. ### Layer 2: Jailbreak Kernel Patch Layer Built directly on top of the base layer, the **Jailbreak kernel patch layer** injects hooks for sandbox escapes, AMFI (Apple Mobile File Integrity) bypasses, and credential handling mechanisms. These modifications enable code execution capabilities that are unavailable in stock iOS kernels, effectively jailbreaking the virtual device. The technical specifics are documented in [`research/kernel_jb_patch_notes.md`](https://github.com/Lakr233/vphone-cli/blob/main/research/kernel_jb_patch_notes.md), which details how this layer interacts with kernel security features while preserving the boot-chain fixes from Layer 1. ### Layer 3: Experimental Kernel Patch Layer The **Experimental kernel patch layer** represents an optional research-oriented tier that applies additional modifications to make the virtual machine appear less like a virtualized device. This includes device-identity spoofing and `hv_vmm` (hypervisor virtual machine monitor) tweaks. As detailed in [`research/txm_variant_diff.md`](https://github.com/Lakr233/vphone-cli/blob/main/research/txm_variant_diff.md), these patches preserve the jailbreak functionality from Layer 2 while adding anti-detection measures useful for security research. ## How the Layers are Composed in the Build System The `Makefile` in the repository root defines three specific targets that implement this stacking behavior. When invoked sequentially, these targets combine the patches to produce the final kernel binary. The build progression follows this order: ```bash # Applies the Base kernel patch layer make fw_patch # Adds the Jailbreak kernel patch layer on top of the base make fw_patch_jb # Stacks the Experimental kernel patch layer (optional final tier) make fw_patch_exp ``` When building the *Experimental* variant using `make fw_patch_exp`, the Makefile executes all three steps sequentially, ensuring that `fw_patch` runs first, followed by `fw_patch_jb`, and finally applying the experimental modifications. This guarantees that each subsequent layer builds on the cumulative state of the previous patches, preventing conflicts between boot-chain fixes and jailbreak hooks. ## Summary - vphone-cli utilizes **three stacked layers of kernel patching** to separate boot-chain stability, jailbreak functionality, and experimental research features. - **Layer 1 (Base)** applies low-level binary patches for iBSS/iBEC/LLB boot issues, documented in [`research/0_binary_patch_comparison.md`](https://github.com/Lakr233/vphone-cli/blob/main/research/0_binary_patch_comparison.md). - **Layer 2 (Jailbreak)** adds sandbox and AMFI bypasses on top of the base layer, documented in [`research/kernel_jb_patch_notes.md`](https://github.com/Lakr233/vphone-cli/blob/main/research/kernel_jb_patch_notes.md). - **Layer 3 (Experimental)** optionally injects anti-detection and hypervisor tweaks while preserving jailbreak capabilities, documented in [`research/txm_variant_diff.md`](https://github.com/Lakr233/vphone-cli/blob/main/research/txm_variant_diff.md). - The `Makefile` orchestrates this stacking through the `fw_patch`, `fw_patch_jb`, and `fw_patch_exp` build targets. ## Frequently Asked Questions ### What is the purpose of the base kernel patch layer? The base kernel patch layer resolves fundamental boot-chain issues in iBSS, iBEC, and LLB components to ensure the virtual iPhone kernel initializes correctly. Without these low-level binary patches applied first, subsequent jailbreak or experimental modifications would fail to execute because the kernel would not reach a stable execution state. ### How does the jailbreak layer interact with the base layer? The jailbreak layer is applied sequentially after the base layer, building upon the stable boot environment established by the initial patches. It injects hooks for sandbox escapes, AMFI bypasses, and credential handling without modifying the underlying boot-chain fixes, ensuring that stability and jailbreak capabilities coexist. ### When should I use the experimental kernel patch layer? You should use the experimental layer when conducting security research that requires the virtual device to appear less like a VM to detection mechanisms. This layer adds device-identity modifications and `hv_vmm` tweaks while preserving the jailbreak functionality, making it suitable for anti-detection studies and advanced virtualization research. ### Where are the patch definitions documented in the source code? The patch definitions and technical notes are located in three key documentation files within the `research/` directory: [`0_binary_patch_comparison.md`](https://github.com/Lakr233/vphone-cli/blob/main/0_binary_patch_comparison.md) covers the base layer, [`kernel_jb_patch_notes.md`](https://github.com/Lakr233/vphone-cli/blob/main/kernel_jb_patch_notes.md) details the jailbreak layer, and [`txm_variant_diff.md`](https://github.com/Lakr233/vphone-cli/blob/main/txm_variant_diff.md) explains the experimental modifications.