# Which VM-Specific Services Does the EXP Variant Leave Untouched in vphone-cli?

> Discover which VM-specific services the EXP variant leaves untouched in vphone-cli. Learn how it preserves graphics passthrough, compute acceleration, and more while adding anti-VM-detection patches.

- Repository: [Lakr/vphone-cli](https://github.com/Lakr233/vphone-cli)
- Tags: deep-dive
- Published: 2026-09-13

---

**The EXP firmware variant preserves all standard VM-specific services—including graphics passthrough, compute acceleration, hardware models, and unrelated syscalls—while only adding targeted anti-VM-detection patches that rename the `kern.hv_vmm_present` sysctl.**

The **EXP** variant in `Lakr233/vphone-cli` is designed as an experimental superset of the jailbreak (JB) firmware, adding specialized patches to evade virtual machine detection. When analyzing which **VM-specific services the EXP variant leaves untouched**, it becomes clear that the modifications are surgically precise, leaving the core virtualization infrastructure completely intact.

## EXP Variant Architecture and Design Philosophy

The EXP variant builds directly upon the JB variant foundation. According to the repository's [`research/0_binary_patch_comparison.md`](https://github.com/Lakr233/vphone-cli/blob/main/research/0_binary_patch_comparison.md), the EXP implementation adds only a handful of experimental anti-VM-detection patches while explicitly preserving all other components as unchanged.

In [`sources/FirmwarePatcher/Kernel/KernelEXPPatcher.swift`](https://github.com/Lakr233/vphone-cli/blob/main/sources/FirmwarePatcher/Kernel/KernelEXPPatcher.swift), the implementation confirms this scope limitation. The patcher inherits from `KernelJBPatcherBase` and only injects the specific `hv_vmm_present` rename logic, leaving GPU stacks, compute pathways, and hardware abstractions untouched.

## VM-Specific Services Preserved in EXP

### Graphics Passthrough and Metal Acceleration

**Graphics passthrough** remains fully operational in the EXP variant. The Virtualization.framework's GPU rendering pipeline and Metal acceleration continue to function exactly as they do in the JB variant because the experimental patches target only the `hv_vmm_present` sysctl and related watchdog cache entries.

The GPU stack is independent of the kernel OID rename operation. When launching an EXP variant VM, hardware-accelerated graphics remain available without modification:

```bash

# Create and launch an EXP variant VM—the graphics stack remains unchanged

vphone-cli vm create myExpPhone -V exp
vphone-cli vm launch myExpPhone

```

### Compute and Neural Engine Fast-Paths

**Compute acceleration** channels, including neural engine access and CoreGraphics compute fast-paths, remain untouched by the EXP patches. These AI and image processing pathways operate independently of the kernel sysctl modifications.

The EXP variant does not intercept or modify the virtual device's compute capabilities. The neural engine and CoreGraphics acceleration continue to function at full speed, identical to the JB variant behavior.

### Standard VM Hardware Model

The **standard VM hardware model**—encompassing CPU core configuration, RAM allocation, APFS disk management, and vsock networking—remains identical between JB and EXP variants. The EXP installation script at [`scripts/cfw_install_exp.sh`](https://github.com/Lakr233/vphone-cli/blob/main/scripts/cfw_install_exp.sh) only appends the anti-VM patches atop the existing JB hardware model without altering the underlying virtual device specification.

This means the virtual iPhone's hardware fingerprint remains consistent, with only the detection-evasion mechanisms modified.

### Unmodified VM-Related Syscalls

All **VM-related syscalls** except `kern.hv_vmm_present` retain their original behavior. The EXP variant specifically targets only this single OID for renaming, leaving other virtualization introspection interfaces unmodified.

As documented in [`AGENTS.md`](https://github.com/Lakr233/vphone-cli/blob/main/AGENTS.md), the EXP variant adds "anti-VM-detection research patches" while ensuring "other variants are deliberately NOT affected by these changes." This surgical approach means system calls for VM introspection unrelated to the renamed OID continue to operate as standard.

## Source Code Evidence

The repository documentation explicitly confirms which services remain untouched. The [`research/0_binary_patch_comparison.md`](https://github.com/Lakr233/vphone-cli/blob/main/research/0_binary_patch_comparison.md) file lists the complete set of EXP-only modifications:

- Kernel rename of `hv_vmm_present`
- Watchdog-d cache patch
- Device tree (DT) rewrite
- Optional `SystemVersion.plist` rewrite

Crucially, this documentation states that **all other components are unchanged**, confirming that the EXP variant is strictly a JB superset with experimental additions only.

## Practical Verification

You can verify that only the `hv_vmm_present` sysctl has been modified by querying the system from within the guest:

```swift
import Foundation

// Check the renamed sysctl (returns ENOENT)
let original = Process.run("/usr/sbin/sysctl", arguments: ["kern.hv_vmm_present"])

// Check the renamed OID (returns the VM presence value)
let renamed = Process.run("/usr/sbin/sysctl", arguments: ["kern.Xv_vmm_present"])

// Verify graphics passthrough remains functional
let gpu = Process.run("/usr/bin/system_profiler", arguments: ["SPDisplaysDataType"])

```

The [`KernelEXPPatcher.swift`](https://github.com/Lakr233/vphone-cli/blob/main/KernelEXPPatcher.swift) implementation reinforces this scope:

```swift
// EXP-only: rename sysctl OID and mangle internal callers
public final class KernelEXPPatcher: KernelJBPatcherBase, Patcher {
    // Implementation limited to hv_vmm_present handling
}

```

## Summary

- The EXP variant is a strict superset of the JB variant, adding only anti-VM-detection patches.
- **Graphics passthrough** (GPU/Metal) remains completely unmodified and fully functional.
- **Compute acceleration** paths (neural engine, CoreGraphics) operate identically to the JB variant.
- The **standard VM hardware model** (CPU, memory, storage, networking) is preserved without alteration.
- Only the `kern.hv_vmm_present` sysctl is renamed; all other VM-related syscalls remain untouched.
- Source files [`research/0_binary_patch_comparison.md`](https://github.com/Lakr233/vphone-cli/blob/main/research/0_binary_patch_comparison.md) and [`AGENTS.md`](https://github.com/Lakr233/vphone-cli/blob/main/AGENTS.md) explicitly document this limited scope.

## Frequently Asked Questions

### Does the EXP variant disable GPU passthrough to avoid VM detection?

No. The EXP variant specifically avoids modifying the graphics stack. According to [`research/0_binary_patch_comparison.md`](https://github.com/Lakr233/vphone-cli/blob/main/research/0_binary_patch_comparison.md), the experimental patches target only the `hv_vmm_present` sysctl and watchdog cache, leaving Virtualization.framework's GPU passthrough and Metal acceleration completely intact.

### Will neural engine acceleration work in an EXP variant virtual machine?

Yes. The compute and acceleration fast-paths, including neural engine access and CoreGraphics compute channels, remain untouched by the EXP patches. These services function exactly as they do in the JB variant because they operate independently of the kernel OID rename.

### What hardware configuration differences exist between JB and EXP variants?

None. The EXP variant uses the identical standard VM hardware model as the JB variant, including CPU cores, RAM size, APFS disk configuration, and vsock networking. The [`scripts/cfw_install_exp.sh`](https://github.com/Lakr233/vphone-cli/blob/main/scripts/cfw_install_exp.sh) script only adds the anti-VM patches without altering the underlying hardware abstraction.

### Which specific sysctl does the EXP variant modify?

The EXP variant modifies only `kern.hv_vmm_present`, renaming it to evade VM detection checks. All other VM-related syscalls and introspection interfaces remain in their original state, as implemented in [`sources/FirmwarePatcher/Kernel/KernelEXPPatcher.swift`](https://github.com/Lakr233/vphone-cli/blob/main/sources/FirmwarePatcher/Kernel/KernelEXPPatcher.swift).