# What Patches Are Applied to the Kernel by vphone-cli? A Complete Technical Breakdown

> Discover the kernel patches applied by vphone-cli. This toolchain modifies the iOS boot chain and kernel cache for virtualized iPhone execution on standard hardware. Get the technical breakdown.

- Repository: [Lakr/vphone-cli](https://github.com/Lakr233/vphone-cli)
- Tags: deep-dive
- Published: 2026-09-05

---

**The vphone-cli toolchain applies a multi-layered firmware patching pipeline that modifies the iOS boot chain, Trusted Execution Model components, and kernel cache to enable virtualized iPhone execution on standard hardware.**

The `Lakr233/vphone-cli` repository implements a sophisticated kernel modification system designed to run iOS in virtualized environments. Unlike simple configuration changes, the **patches applied to the kernel by vphone-cli** fundamentally alter sandbox restrictions, code signing enforcement, and hardware abstraction layers across approximately 127 discrete patch points.

## Five Distinct Layers of System Modification

The patching architecture targets specific stages of the iOS boot process and runtime environment. Each layer serves a distinct purpose in establishing a functional virtual iPhone environment.

### Boot-Chain Patches for Early-Stage Loading

Before the kernel executes, the system must patch the **iBSS**, **iBEC**, and **LLB** (Low Level Bootloader) components. These modifications, implemented in [`sources/FirmwarePatcher/IBoot/IBootJBPatcher.swift`](https://github.com/Lakr233/vphone-cli/blob/main/sources/FirmwarePatcher/IBoot/IBootJBPatcher.swift), include the *AVPBooter* patch and various **IBoot** tweaks that inject code caves for early-stage configuration. These patches ensure the boot loader properly initializes the virtual hardware environment before handing control to the main kernel.

### TXM Patches for Hardware Identity Spoofing

The **Trusted Execution Model** (TXM) layer targets DeviceTree (DT) and DSC (Display-Security-Controller) blobs. According to [`research/txm_jb_patches.md`](https://github.com/Lakr233/vphone-cli/blob/main/research/txm_jb_patches.md), these patches perform DT-node renames and **DSC-identity spoofing** to convince Apple services that the virtual device is authentic. This includes patching **hv_vmm** strings to mask the virtual machine nature of the execution environment.

### Regular Kernel Patches for Clean System Support

For non-jailbroken virtual device variants, [`scripts/cfw_install.sh`](https://github.com/Lakr233/vphone-cli/blob/main/scripts/cfw_install.sh) applies **regular-variant kernel patches** focusing on minor fixes for iOS versions 15 through 26. These enable graphics passthrough and fix iOS-specific syscalls without compromising system security boundaries, providing a "clean" system experience.

### Jailbreak Kernel Patches for Sandboxed Execution

The most extensive modifications occur in the jailbreak layer, consisting of approximately **127 individual patch IDs** managed by [`sources/FirmwarePatcher/Kernel/KernelJBPatcher.swift`](https://github.com/Lakr233/vphone-cli/blob/main/sources/FirmwarePatcher/Kernel/KernelJBPatcher.swift). These **patches applied to the kernel by vphone-cli** specifically target:

- **Sandbox hook removal** – Disables `sandbox_*` checks throughout the kernel, including those documented in [`patch_sandbox_hooks_extended.md`](https://github.com/Lakr233/vphone-cli/blob/main/patch_sandbox_hooks_extended.md)
- **Credential label updates** – Modifies `cred_label_update_execve` to permit unsigned code execution
- **Task conversion bypasses** – Alters `task_conversion_eval_internal` and `task_for_pid` to circumvent code-signing restrictions
- **Process security policy** – Rewrites `_proc_security_policy` to accept arbitrary processes
- **VM map protections** – Patches `vm_map_protect`, `vm_map_delete`, and related functions to allow writable and executable memory mappings simultaneously
- **Thread state handling** – Fixes edge cases in `thread_set_state` for debugger integration
- **IOKit security relaxation** – Modifies `iouc_failed_macf`, `io_secure_bsd_root`, and `mac_mount` to reduce IOKit security constraints
- **Mount and dylinker checks** – Removes validation in `dounmount` and load-dylinker paths that would otherwise reject untrusted operations

### Experimental Patches for Advanced Virtualization

The experimental variant, controlled by [`scripts/cfw_install_exp.sh`](https://github.com/Lakr233/vphone-cli/blob/main/scripts/cfw_install_exp.sh), applies additional research-grade modifications including *hv_vmm* renaming and extended sandbox bypasses. These patches maintain VM-specific service functionality while ensuring graphics acceleration paths remain intact.

## The Patching Engine Architecture

Underneath these modifications lies a sophisticated binary instrumentation framework defined in [`sources/FirmwarePatcher/Kernel/KernelJBPatcherBase.swift`](https://github.com/Lakr233/vphone-cli/blob/main/sources/FirmwarePatcher/Kernel/KernelJBPatcherBase.swift).

### Symbol Resolution and Mach-O Parsing

The `buildSymbolTable()` method parses the main Mach-O header and any `LC_FILESET_ENTRY` sub-Mach-Os to construct a mapping of symbol names to file offsets. This enables rapid location of target functions like `cred_label_update_execve` without hardcoding addresses.

### Code-Cave Discovery and ARM64 Branch Encoding

When patching requires new logic, the system employs `findCodeCave(size:align:)` to scan `__TEXT_EXEC` and `__TEXT_BOOT_EXEC` segments for sequences of `0x00000000`, `0xffffffff`, or UDF instructions (`0xD4200000`). Once located, the patcher uses `encodeB` and `encodeBL` helpers to generate ARM64 absolute branch encodings that redirect execution flow to these injected code caves.

### Function Boundary Detection

To prevent patch overflow, the `findFuncEnd` method walks forward from known function starts until encountering the next `PACIBSP` marker, ensuring modifications remain within intended boundaries. Each concrete patch method (e.g., `patchBsdInitAuth()`, `patchTaskConversionEvalInternal()`) leverages these utilities to apply changes safely.

## Validation and Testing Infrastructure

The repository maintains rigorous validation through two primary test harnesses:

- [`tests/test_jb_kernel_patches.sh`](https://github.com/Lakr233/vphone-cli/blob/main/tests/test_jb_kernel_patches.sh) – Validates all 127+ jailbreak patches against `kernelcache.research.vphone600`, verifying patch ID emission and boot capability
- [`tests/test_firmware_patches.sh`](https://github.com/Lakr233/vphone-cli/blob/main/tests/test_firmware_patches.sh) – Executes the complete firmware pipeline across multiple cloudOS builds, ensuring zero skipped sub-patches in boot-chain, TXM, and kernel layers

Both scripts exit non-zero if any patch fails, maintaining synchronization with upstream iOS releases.

Example implementation from the source:

```swift
// Example – locating the `cred_label_update_execve` symbol
if let off = resolveSymbol("_cred_label_update_execve") {
    // Allocate a code‑cave of 0x20 bytes, aligned to 4
    if let cave = findCodeCave(size: 0x20) {
        // Encode an unconditional branch from the original function to the cave
        let branch = encodeB(from: off, to: cave)
        buffer.write(data: branch, at: off)          // patch the original location
        // …write custom shellcode into `cave` to bypass the check…
    }
}

```

Running the validation suite:

```bash

# Run the full firmware patch pipeline on the latest local cloudOS build

./tests/test_firmware_patches.sh --quick

```

## Summary

- **vphone-cli** applies five distinct patch layers: boot-chain, TXM, regular kernel, jailbreak kernel, and experimental modifications.
- The jailbreak layer alone contains **127 individual patch IDs** targeting sandbox, credential, task, and memory management subsystems.
- Core infrastructure in [`KernelJBPatcherBase.swift`](https://github.com/Lakr233/vphone-cli/blob/main/KernelJBPatcherBase.swift) provides symbol resolution, code-cave discovery, and ARM64 branch encoding capabilities.
- Detailed documentation for each patch resides in `research/kernel_patch_jb/patch_*` markdown files.
- All patches are validated through automated testing harnesses that verify application success across multiple iOS versions.

## Frequently Asked Questions

### What types of patches are applied to the kernel by vphone-cli to remove sandbox restrictions?

The **patches applied to the kernel by vphone-cli** disable sandbox enforcement by patching `sandbox_*` hook functions, `mac_mount`, and `io_secure_bsd_root`. These modifications prevent the kernel from rejecting unsigned code execution and allow the virtual iPhone to run applications outside the standard App Store distribution model.

### How does vphone-cli handle iOS version updates without breaking patches?

The patching system uses symbol-based anchoring rather than hardcoded addresses. The `buildSymbolTable()` method parses Mach-O headers and `LC_FILESET_ENTRY` load commands to locate functions like `task_for_pid` and `vm_map_protect` by name, allowing the patcher to adapt to kernel cache changes across iOS versions 15 through 26 automatically.

### What is the difference between regular and jailbreak kernel patches?

Regular patches in [`scripts/cfw_install.sh`](https://github.com/Lakr233/vphone-cli/blob/main/scripts/cfw_install.sh) provide minimal modifications for graphics passthrough and syscall compatibility while maintaining standard iOS security boundaries. Jailbreak patches in [`KernelJBPatcher.swift`](https://github.com/Lakr233/vphone-cli/blob/main/KernelJBPatcher.swift) extensively disable code signing, process security policies, and sandbox restrictions through approximately 127 distinct modifications to enable development and debugging capabilities.

### How are patches validated before deployment in vphone-cli?

The repository uses [`tests/test_jb_kernel_patches.sh`](https://github.com/Lakr233/vphone-cli/blob/main/tests/test_jb_kernel_patches.sh) to verify all jailbreak patches emit their unique IDs and produce bootable kernels. Additionally, [`tests/test_firmware_patches.sh`](https://github.com/Lakr233/vphone-cli/blob/main/tests/test_firmware_patches.sh) runs end-to-end validation across boot-chain, TXM, and kernel patches, aborting with non-zero exit codes if any sub-patch fails to apply or if the modified kernel fails to boot.