Which VM-Specific Services Does the EXP Variant Leave Untouched in vphone-cli?

The EXP firmware variant preserves all standard VM-specific services—including graphics passthrough, compute acceleration, hardware models, and unrelated syscalls—while only adding targeted anti-VM-detection patches that rename the kern.hv_vmm_present sysctl.

The EXP variant in Lakr233/vphone-cli is designed as an experimental superset of the jailbreak (JB) firmware, adding specialized patches to evade virtual machine detection. When analyzing which VM-specific services the EXP variant leaves untouched, it becomes clear that the modifications are surgically precise, leaving the core virtualization infrastructure completely intact.

EXP Variant Architecture and Design Philosophy

The EXP variant builds directly upon the JB variant foundation. According to the repository's research/0_binary_patch_comparison.md, the EXP implementation adds only a handful of experimental anti-VM-detection patches while explicitly preserving all other components as unchanged.

In sources/FirmwarePatcher/Kernel/KernelEXPPatcher.swift, the implementation confirms this scope limitation. The patcher inherits from KernelJBPatcherBase and only injects the specific hv_vmm_present rename logic, leaving GPU stacks, compute pathways, and hardware abstractions untouched.

VM-Specific Services Preserved in EXP

Graphics Passthrough and Metal Acceleration

Graphics passthrough remains fully operational in the EXP variant. The Virtualization.framework's GPU rendering pipeline and Metal acceleration continue to function exactly as they do in the JB variant because the experimental patches target only the hv_vmm_present sysctl and related watchdog cache entries.

The GPU stack is independent of the kernel OID rename operation. When launching an EXP variant VM, hardware-accelerated graphics remain available without modification:

# Create and launch an EXP variant VM—the graphics stack remains unchanged

vphone-cli vm create myExpPhone -V exp
vphone-cli vm launch myExpPhone

Compute and Neural Engine Fast-Paths

Compute acceleration channels, including neural engine access and CoreGraphics compute fast-paths, remain untouched by the EXP patches. These AI and image processing pathways operate independently of the kernel sysctl modifications.

The EXP variant does not intercept or modify the virtual device's compute capabilities. The neural engine and CoreGraphics acceleration continue to function at full speed, identical to the JB variant behavior.

Standard VM Hardware Model

The standard VM hardware model—encompassing CPU core configuration, RAM allocation, APFS disk management, and vsock networking—remains identical between JB and EXP variants. The EXP installation script at scripts/cfw_install_exp.sh only appends the anti-VM patches atop the existing JB hardware model without altering the underlying virtual device specification.

This means the virtual iPhone's hardware fingerprint remains consistent, with only the detection-evasion mechanisms modified.

Unmodified VM-Related Syscalls

All VM-related syscalls except kern.hv_vmm_present retain their original behavior. The EXP variant specifically targets only this single OID for renaming, leaving other virtualization introspection interfaces unmodified.

As documented in AGENTS.md, the EXP variant adds "anti-VM-detection research patches" while ensuring "other variants are deliberately NOT affected by these changes." This surgical approach means system calls for VM introspection unrelated to the renamed OID continue to operate as standard.

Source Code Evidence

The repository documentation explicitly confirms which services remain untouched. The research/0_binary_patch_comparison.md file lists the complete set of EXP-only modifications:

• Kernel rename of hv_vmm_present
• Watchdog-d cache patch
• Device tree (DT) rewrite
• Optional SystemVersion.plist rewrite

Crucially, this documentation states that all other components are unchanged, confirming that the EXP variant is strictly a JB superset with experimental additions only.

Practical Verification

You can verify that only the hv_vmm_present sysctl has been modified by querying the system from within the guest:

import Foundation

// Check the renamed sysctl (returns ENOENT)
let original = Process.run("/usr/sbin/sysctl", arguments: ["kern.hv_vmm_present"])

// Check the renamed OID (returns the VM presence value)
let renamed = Process.run("/usr/sbin/sysctl", arguments: ["kern.Xv_vmm_present"])

// Verify graphics passthrough remains functional
let gpu = Process.run("/usr/bin/system_profiler", arguments: ["SPDisplaysDataType"])

The KernelEXPPatcher.swift implementation reinforces this scope:

// EXP-only: rename sysctl OID and mangle internal callers
public final class KernelEXPPatcher: KernelJBPatcherBase, Patcher {
    // Implementation limited to hv_vmm_present handling
}

Summary

• The EXP variant is a strict superset of the JB variant, adding only anti-VM-detection patches.
• Graphics passthrough (GPU/Metal) remains completely unmodified and fully functional.
• Compute acceleration paths (neural engine, CoreGraphics) operate identically to the JB variant.
• The standard VM hardware model (CPU, memory, storage, networking) is preserved without alteration.
• Only the kern.hv_vmm_present sysctl is renamed; all other VM-related syscalls remain untouched.
• Source files research/0_binary_patch_comparison.md and AGENTS.md explicitly document this limited scope.

Frequently Asked Questions

Does the EXP variant disable GPU passthrough to avoid VM detection?

No. The EXP variant specifically avoids modifying the graphics stack. According to research/0_binary_patch_comparison.md, the experimental patches target only the hv_vmm_present sysctl and watchdog cache, leaving Virtualization.framework's GPU passthrough and Metal acceleration completely intact.

Will neural engine acceleration work in an EXP variant virtual machine?

Yes. The compute and acceleration fast-paths, including neural engine access and CoreGraphics compute channels, remain untouched by the EXP patches. These services function exactly as they do in the JB variant because they operate independently of the kernel OID rename.

What hardware configuration differences exist between JB and EXP variants?

None. The EXP variant uses the identical standard VM hardware model as the JB variant, including CPU cores, RAM size, APFS disk configuration, and vsock networking. The scripts/cfw_install_exp.sh script only adds the anti-VM patches without altering the underlying hardware abstraction.

Which specific sysctl does the EXP variant modify?

The EXP variant modifies only kern.hv_vmm_present, renaming it to evade VM detection checks. All other VM-related syscalls and introspection interfaces remain in their original state, as implemented in sources/FirmwarePatcher/Kernel/KernelEXPPatcher.swift.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}