#695
Fail on Wait for DFU
Summary
vm launch --dfu starts, but the VM never shows up in DFU mode, so recovery-probe times out after 90 attempts. The same thing happens with every device template I tried: iPad (M3), iPhone 17, and iPhone 16.
Environment
| Item | Value |
|---|---|
| Host | MacBook (M3), 8 GB RAM |
| VM | 6 CPU / 6144 MB memory / 64 GB disk |
| iPhone IPSW | iPhone17,3 27.0 (24A435) |
| cloudOS | 26.4 (23E5207q) |
| Patch preset | standard (190 CFW patches applied, no errors) |
Steps to reproduce
vphone-cli vm new salman --cpu 6 --memory 6144 --disk-size 64 \
--library-root ~/.vphone/machines
vphone-cli fw prepare salman \
--iphone-source https://updates.cdn-apple.com/2026FallFCS/2d0cd01d-b4f9-4a20-a1e8-f3be54570da7/iPhone17,3_27.0_24A435_Restore.ipsw \
--cloudos-source https://updates.cdn-apple.com/private-cloud-compute/c0ecdb4b310cf5239ab2b248dd3098eec297dc5aa3bbe6ada27273262b0b8b64 \
--library-root ~/.vphone/machines
vphone-cli fw patch salman --library-root ~/.vphone/machines
vphone-cli vm launch salman --dfu --library-root ~/.vphone/machinesExpected
The VM enters DFU mode and recovery-probe finds it, so the restore can continue.
Actual
fw prepare and fw patch both finish cleanly. After vm launch --dfu, the probe never gets a response:
$ vphone-cli recovery-probe --ecid 0x8BAD1966961AE2BD --timeout 2 (up to 90 attempts)
✕ The machine did not respond in DFU mode.Screenshots
Logs
fw prepare output
[*] Resolving iPhone IPSW...
[*] Resolving cloudOS IPSW...
[+] iPhone17,3 27.0 (24A435); cloudOS 26.4 (23E5207q)
[*] Extracting iPhone17,3 IPSW...
[*] Extracting cloudOS IPSW...
cloudOS vresearch101ap: release=#4, research=#6
cloudOS vphone600ap: release=#3, research=#5
iPhone17,3 erase: #0
wrote BuildManifest.plist
wrote Restore.plist
[+] GPU driver staged: /Users/salmanhassan/.vphone/machines/salman/.firmware-prepare-55DC8D0E-3D0B-4A5F-BD5E-8A692B27855E/iPhone17,3_27.0_24A435_Restore/.pcc-gpu/AppleParavirtGPUMetalIOGPUFamily.bundle
[+] GPU driver reused from cloudOS 26.4 (23E5207q) cache
[*] Merging bundled GPU compiler plugin...
[+] Restore tree ready: /Users/salmanhassan/.vphone/machines/salman/iPhone17,3_27.0_24A435_Restorefw patch output (190 patches, all components succeeded)
[*] VM directory: /Users/salmanhassan/.vphone/machines/salman
[*] Restore directory: /Users/salmanhassan/.vphone/machines/salman/iPhone17,3_27.0_24A435_Restore
[*] iPhone base iOS: 27.0
[*] cloudOS kernel: 26.4
[*] Boot ROM: OpenAVB, which needs no ROM patch
[*] Patch preset: standard (9 sets, 137 patches on)
[*] Not applicable: 3 patches for other OS versions
[*] Turned off: devicetree-exp-arm_io_device_type, devicetree-exp-arm_io_soc_generation, devicetree-exp-compatible_secondary, devicetree-exp-product_fdr_product_type, devicetree-exp-product_gestalt_variants_rename, devicetree-exp-product_sub_product_type, devicetree-exp-product_unique_model, devicetree-exp-target_sub_type, dyld-exp-hv_vmm, dyld-exp-mis_trust_auth, dyld-exp-settings_software_update_row, kernel-exp-frida_thread_set_state_entitlement_flag, kernel-exp-frida_vm_map_delete_immutable_code, kernel-exp-hv_vmm, kernel-exp-tv_tpro_pagers, preboot-exp-devicetree_identity, system-dyld-exp-tv_tpro, system-preferences-exp-root_rows, system-tv-exp-ota_userland, system-watchdogd-exp-hv_vmm_cache
[=] restoreramdisk-boot-apfs_sha3_hash: SystemVolume root hash uses SHA-256; restore tools stay pristine
[*] Patching 10 boot-chain components ...
============================================================
iBSS: /Users/salmanhassan/.vphone/machines/salman/iPhone17,3_27.0_24A435_Restore/Firmware/dfu/iBSS.vresearch101.RELEASE.im4p
============================================================
original: kept in FirmwareOriginals/
format: 740704 bytes
0x0A417B: → "Loaded iBSS" [serial label]
0x0A4226: → "Loaded iBSS" [serial label]
0x00975C: b.ne 0x986c → nop [image4 callback: b.ne → nop]
0x009760: mov x0, x22 → mov x0, #0 [image4 callback: mov x0,x22 → mov x0,#0]
[4 ibss patches applied]
[+] 4 iBSS patches applied
0x00B13C: tbz w0, #0, 0xb174 → b 0xb174 [ibss-boot-skip_generate_nonce]
[1 ibss patches applied]
[+] 1 iBSS patches applied
[+] saved
============================================================
iBEC: /Users/salmanhassan/.vphone/machines/salman/iPhone17,3_27.0_24A435_Restore/Firmware/dfu/iBEC.vresearch101.RELEASE.im4p
============================================================
original: kept in FirmwareOriginals/
format: 740704 bytes
0x0A417B: → "Loaded iBEC" [serial label]
0x0A4226: → "Loaded iBEC" [serial label]
0x00975C: b.ne 0x986c → nop [image4 callback: b.ne → nop]
0x009760: mov x0, x22 → mov x0, #0 [image4 callback: mov x0,x22 → mov x0,#0]
0x060330: → "serial=3 -v debug=0x2014e %s" [boot-args string]
0x01168C: adrp x2, 0xa5000 → adrp x2, 0x60000 [boot-args: adrp x2 → new string page]
0x011690: add x2, x2, #0x6c5 → add x2, x2, #0x330 [boot-args: add x2 → new string offset]
0x058180: tbz w0, #0, 0x58228 → nop [bootx precondition: NOP gate TBZ]
[8 ibec patches applied]
[+] 8 iBEC patches applied
[+] saved
============================================================
LLB: /Users/salmanhassan/.vphone/machines/salman/iPhone17,3_27.0_24A435_Restore/Firmware/all_flash/LLB.vresearch101.RELEASE.im4p
============================================================
original: kept in FirmwareOriginals/
format: 740704 bytes
0x0A417B: → "Loaded LLB" [serial label]
0x0A4226: → "Loaded LLB" [serial label]
0x00975C: b.ne 0x986c → nop [image4 callback: b.ne → nop]
0x009760: mov x0, x22 → mov x0, #0 [image4 callback: mov x0,x22 → mov x0,#0]
0x060330: → "serial=3 -v debug=0x2014e %s" [boot-args string]
0x01168C: adrp x2, 0xa5000 → adrp x2, 0x60000 [boot-args: adrp x2 → new string page]
0x011690: add x2, x2, #0x6c5 → add x2, x2, #0x330 [boot-args: add x2 → new string offset]
0x036A1C: cbz w0, 0x36a3c → b 0x36a3c [rootfs: skip sig check (0x3B7)]
0x0366F0: b.hs 0x36848 → nop [rootfs: NOP b.hs size check (0x400)]
0x036A64: cbz w0, 0x36830 → b 0x36830 [rootfs: skip sig verify (0x3C2)]
0x03A608: cbz x8, 0x3a654 → nop [rootfs: NOP cbz x8 null check (#0x78)]
0x03A7C8: cbz w0, 0x3a7e0 → b 0x3a7e0 [rootfs: skip size verify (0x110)]
0x01A35C: cbnz w0, 0x1a3e8 → nop [panic bypass: NOP cbnz w0]
[13 llb patches applied]
[+] 13 LLB patches applied
[+] saved
============================================================
TXM: /Users/salmanhassan/.vphone/machines/salman/iPhone17,3_27.0_24A435_Restore/Firmware/txm.iphoneos.research.im4p
============================================================
original: kept in FirmwareOriginals/
format: 442400 bytes
0x02C7E8: bl 0x2afb8 → mov x0, #0 [trustcache bypass: legacy binary-search call → mov x0, #0]
0x031A3C: mov x19, x1 → mov w0, #0xa1 [selector24 bypass: mov w0, #0xa1 (PASS)]
0x031A40: mov x20, x0 → b 0x31aac [selector24 bypass: b epilogue]
[·] TXM: selector 0x7e51 at 0201A8; next: pacia x16, x17
0x030BD4: stp xzr, xzr, [sp, #0x10] → mov w8, #0xa [pre-check admission: mov w8, #0xa (tolerated type)]
0x030BD8: ldr x22, [x20], #0x40 → strb w8, [x19] [pre-check admission: strb w8, [x19]]
0x030BDC: str xzr, [sp, #8] → mov w0, #0x90 [pre-check admission: mov w0, #0x90 (PASS)]
0x030BE0: ldr x8, [x22, #0x20] → b 0x30c7c [pre-check admission: b epilogue]
0x01F60C: bl 0x1ea38 → mov x0, #1 [get-task-allow: bl -> mov x0,#1]
0x027278: mov x0, x20 → b 0x5c038 [selector42|29: branch to shellcode]
0x05C038: udf #0 → nop [selector42|29 shellcode pad: udf -> nop]
0x05C03C: udf #0 → mov x0, #1 [selector42|29 shellcode: mov x0,#1]
0x05C040: udf #0 → strb w0, [x20, #0x30] [selector42|29 shellcode: strb w0,[x20,#0x30]]
0x05C044: udf #0 → mov x0, x20 [selector42|29 shellcode: mov x0,x20]
0x05C048: udf #0 → b 0x2727c [selector42|29 shellcode: branch back]
0x01F3D4: bl 0x1ea38 → mov w0, #1 [debugger entitlement: bl -> mov w0,#1]
0x01FA78: tbnz w9, #0, 0x1fa8c → nop [developer mode bypass]
[16 TXM patches applied]
[+] 16 TXM patches applied
[+] saved
[=] RestoreRamDisk: no patches for jb
[=] RestoreTrustCache: no patches for jb
============================================================
kernelcache: /Users/salmanhassan/.vphone/machines/salman/iPhone17,3_27.0_24A435_Restore/kernelcache.research.vphone600
============================================================
original: kept in FirmwareOriginals/
format: 43368448 bytes
[*] _panic at foff 0x24F92E8 (6331 callers)
[1] _apfs_vfsop_mount: root snapshot sealed volume check
0x1B65E00: tbnz w8, #5, 0x1b65ec4 → nop [NOP tbnz w8, #5, 0x1b65ec4 (sealed vol check) [_apfs_vfsop_mount]]
[2] _authapfs_seal_is_broken: seal broken panic
0x1AD7048: tbnz w0, #0xe, 0x1ad7074 → nop [NOP tbnz (seal broken) [_authapfs_seal_is_broken]]
[3] _bsd_init: rootvp not authenticated panic
0x218291C: cbnz w0, 0x2182b78 → nop [NOP cbnz (rootvp auth) [_bsd_init]]
[4-5] _proc_check_launch_constraints: stub with mov w0,#0; ret
0xDE0BE0: pacibsp → mov w0, #0 [mov w0,#0 [_proc_check_launch_constraints]]
0xDE0BE4: sub sp, sp, #0x180 → ret [ret [_proc_check_launch_constraints]]
[6-7] _PE_i_can_has_debugger: stub with mov x0,#1; ret
[*] trying code pattern search...
[+] code pattern match at 0x24C449C (82 callers)
0x24C449C: adrp x8, 0x7b2000 → mov x0, #1 [mov x0,#1 [_PE_i_can_has_debugger]]
0x24C44A0: cbz x0, 0x24c44bc → ret [ret [_PE_i_can_has_debugger]]
[8] post-validation NOP (txm-related)
0x2211378: tbnz w8, #0, 0x2211464 → nop [NOP tbnz w8, #0, 0x2211464 [txm post-validation]]
[9] postValidation: cmp w0,w0 (AMFI code signing)
0xDE8360: cmp w0, #2 → cmp w0, w0 [cmp w0,w0 (was cmp w0,#imm) [postValidation]]
[10-11] _check_dyld_policy_internal: mov w0,#1 (two BLs)
0xDE8DC4: bl 0x220fc00 → mov w0, #1 [mov w0,#1 (was BL) [_check_dyld_policy_internal @1]]
0xDE8DD0: bl 0xde0968 → mov w0, #1 [mov w0,#1 (was BL) [_check_dyld_policy_internal @2]]
[12] _apfs_graft: mov w0,#0 (validate_root_hash BL)
0x1B2286C: bl 0x1b5da40 → mov w0, #0 [mov w0,#0 [_apfs_graft]]
[13] _apfs_vfsop_mount: cmp x0,x0 (mount rw check)
0x1B650A8: cmp x0, x8 → cmp x0, x0 [cmp x0,x0 (was cmp x0, x8) [_apfs_vfsop_mount]]
[14] _apfs_mount_upgrade_checks: mov w0,#0 (tbnz bypass)
0x1B65F44: tbnz w0, #0xe, 0x1b65f50 → mov w0, #0 [mov w0,#0 [_apfs_mount_upgrade_checks]]
[15] _handle_fsioc_graft: mov w0,#0 (validate BL)
0x1B7B524: bl 0x1b19f7c → mov w0, #0 [mov w0,#0 [_handle_fsioc_graft]]
[16] handle_get_dev_by_role: bypass entitlement gate
0x1B79A14: cbz x0, 0x1b79a88 → nop [NOP [handle_get_dev_by_role entitlement gate -> 0x1B79A88]]
0x1B79A28: cbz w0, 0x1b79a88 → nop [NOP [handle_get_dev_by_role entitlement gate -> 0x1B79A88]]
0x1B79AC0: cbz w0, 0x1b79c24 → nop [NOP [handle_get_dev_by_role entitlement gate -> 0x1B79C24]]
[17-26] Sandbox MACF hooks
[*] Finding Sandbox mac_policy_ops via mac_policy_conf...
[*] Sandbox string at foff 0x620A01, Seatbelt at 0x61EBBB
[+] mac_policy_conf at foff 0xA88010, mpc_ops -> 0xA87598
[*] Sandbox __text: 0x1A8B980-0x1AC4198
0x1AA2B40: pacibsp → mov x0, #0 [mov x0,#0 [_hook_file_check_mmap]]
0x1AA2B44: stp x28, x27, [sp, #-0x30]! → ret [ret [_hook_file_check_mmap]]
[+] ops[36] file_check_mmap at foff 0x1AA2B40
0x1AA1170: pacibsp → mov x0, #0 [mov x0,#0 [_hook_mount_check_mount]]
0x1AA1174: stp x28, x27, [sp, #-0x30]! → ret [ret [_hook_mount_check_mount]]
[+] ops[87] mount_check_mount at foff 0x1AA1170
0x1AA0FB8: pacibsp → mov x0, #0 [mov x0,#0 [_hook_mount_check_remount]]
0x1AA0FBC: stp x28, x27, [sp, #-0x40]! → ret [ret [_hook_mount_check_remount]]
[+] ops[88] mount_check_remount at foff 0x1AA0FB8
0x1AA0E24: pacibsp → mov x0, #0 [mov x0,#0 [_hook_mount_check_umount]]
0x1AA0E28: stp x28, x27, [sp, #-0x40]! → ret [ret [_hook_mount_check_umount]]
[+] ops[91] mount_check_umount at foff 0x1AA0E24
0x1A9B9BC: pacibsp → mov x0, #0 [mov x0,#0 [_hook_vnode_check_rename]]
0x1A9B9C0: stp d9, d8, [sp, #-0x70]! → ret [ret [_hook_vnode_check_rename]]
[+] ops[120] vnode_check_rename at foff 0x1A9B9BC
[28 kernel patches applied]
[+] 28 kernelcache patches applied
[*] Symbol table: 0 symbols resolved
[*] _panic at foff 0x24F92E8 (6331 callers)
[CFW]AMFIIsCDHashInTrustCache: always allow + store flag
0xDDC294: pacibsp → mov x0, #1 [mov x0,#1 [AMFIIsCDHashInTrustCache]]
0xDDC298: sub sp, sp, #0x30 → cbz x2, 0xddc2a0 [cbz x2,+8 [AMFIIsCDHashInTrustCache]]
0xDDC29C: stp x20, x19, [sp, #0x10] → str x0, [x2] [str x0,[x2] [AMFIIsCDHashInTrustCache]]
0xDDC2A0: stp x29, x30, [sp, #0x20] → ret [ret [AMFIIsCDHashInTrustCache]]
[CFW]task_conversion_eval_internal: cmp xzr,xzr
0x1D047A8: cmp x0, x9 → cmp xzr, xzr [cmp xzr,xzr [_task_conversion_eval_internal]]
[CFW]Sandbox extended hooks: retarget ops entries to allow stub
[*] Finding Sandbox mac_policy_ops via mac_policy_conf...
[*] Sandbox string at foff 0x620A01, Seatbelt at 0x61EBBB
[+] mac_policy_conf at foff 0xA88010, mpc_ops -> 0xA87598
[+] common Sandbox allow stub at 0x1AAD3BC
0xA87BE0: .byte 0xb0, 0x89, 0xa9, 0x01 → .byte 0xbc, 0xd3, 0xaa, 0x01 [ops[201] -> allow stub [_hook_iokit_check_201]]
0xA87BE8: .byte 0x64, 0x88, 0xa9, 0x01 → .byte 0xbc, 0xd3, 0xaa, 0x01 [ops[202] -> allow stub [_hook_iokit_check_202]]
0xA87BF0: .byte 0x18, 0x87, 0xa9, 0x01 → .byte 0xbc, 0xd3, 0xaa, 0x01 [ops[203] -> allow stub [_hook_iokit_check_203]]
0xA87BF8: .byte 0xcc, 0x85, 0xa9, 0x01 → .byte 0xbc, 0xd3, 0xaa, 0x01 [ops[204] -> allow stub [_hook_iokit_check_204]]
0xA87C00: .byte 0x80, 0x84, 0xa9, 0x01 → .byte 0xbc, 0xd3, 0xaa, 0x01 [ops[205] -> allow stub [_hook_iokit_check_205]]
0xA87C08: .byte 0x2c, 0x83, 0xa9, 0x01 → .byte 0xbc, 0xd3, 0xaa, 0x01 [ops[206] -> allow stub [_hook_iokit_check_206]]
0xA87C10: .byte 0xe0, 0x81, 0xa9, 0x01 → .byte 0xbc, 0xd3, 0xaa, 0x01 [ops[207] -> allow stub [_hook_iokit_check_207]]
0xA87C18: .byte 0x88, 0x80, 0xa9, 0x01 → .byte 0xbc, 0xd3, 0xaa, 0x01 [ops[208] -> allow stub [_hook_iokit_check_208]]
0xA87C20: .byte 0x3c, 0x7f, 0xa9, 0x01 → .byte 0xbc, 0xd3, 0xaa, 0x01 [ops[209] -> allow stub [_hook_iokit_check_209]]
0xA87C28: .byte 0xf0, 0x7d, 0xa9, 0x01 → .byte 0xbc, 0xd3, 0xaa, 0x01 [ops[210] -> allow stub [_hook_iokit_check_210]]
0xA87D40: .byte 0xb4, 0x64, 0xa9, 0x01 → .byte 0xbc, 0xd3, 0xaa, 0x01 [ops[245] -> allow stub [_hook_vnode_check_getattr]]
0xA87D60: .byte 0x64, 0x5a, 0xa9, 0x01 → .byte 0xbc, 0xd3, 0xaa, 0x01 [ops[249] -> allow stub [_hook_proc_check_get_cs_info]]
0xA87D68: .byte 0x40, 0x58, 0xa9, 0x01 → .byte 0xbc, 0xd3, 0xaa, 0x01 [ops[250] -> allow stub [_hook_proc_check_set_cs_info]]
0xA87D78: .byte 0xf4, 0x53, 0xa9, 0x01 → .byte 0xbc, 0xd3, 0xaa, 0x01 [ops[252] -> allow stub [_hook_proc_check_set_cs_info2]]
0xA87D88: .byte 0x9c, 0x52, 0xa9, 0x01 → .byte 0xbc, 0xd3, 0xaa, 0x01 [ops[254] -> allow stub [_hook_vnode_check_chroot]]
0xA87D90: .byte 0xd4, 0x4f, 0xa9, 0x01 → .byte 0xbc, 0xd3, 0xaa, 0x01 [ops[255] -> allow stub [_hook_vnode_check_create]]
0xA87D98: .byte 0x50, 0x4e, 0xa9, 0x01 → .byte 0xbc, 0xd3, 0xaa, 0x01 [ops[256] -> allow stub [_hook_vnode_check_deleteextattr]]
0xA87DA0: .byte 0xcc, 0x4a, 0xa9, 0x01 → .byte 0xbc, 0xd3, 0xaa, 0x01 [ops[257] -> allow stub [_hook_vnode_check_exchangedata]]
0xA87DA8: .byte 0x34, 0xdc, 0xaa, 0x01 → .byte 0xbc, 0xd3, 0xaa, 0x01 [ops[258] -> allow stub [_hook_vnode_check_exec]]
0xA87DB0: .byte 0x24, 0x49, 0xa9, 0x01 → .byte 0xbc, 0xd3, 0xaa, 0x01 [ops[259] -> allow stub [_hook_vnode_check_getattrlist]]
0xA87DB8: .byte 0xc8, 0x47, 0xa9, 0x01 → .byte 0xbc, 0xd3, 0xaa, 0x01 [ops[260] -> allow stub [_hook_vnode_check_getextattr]]
0xA87DC0: .byte 0xe0, 0x44, 0xa9, 0x01 → .byte 0xbc, 0xd3, 0xaa, 0x01 [ops[261] -> allow stub [_hook_vnode_check_ioctl]]
0xA87DD8: .byte 0x40, 0x3e, 0xa9, 0x01 → .byte 0xbc, 0xd3, 0xaa, 0x01 [ops[264] -> allow stub [_hook_vnode_check_link]]
0xA87DE0: .byte 0xc0, 0x3c, 0xa9, 0x01 → .byte 0xbc, 0xd3, 0xaa, 0x01 [ops[265] -> allow stub [_hook_vnode_check_listextattr]]
0xA87E08: .byte 0x20, 0x39, 0xa9, 0x01 → .byte 0xbc, 0xd3, 0xaa, 0x01 [ops[270] -> allow stub [_hook_vnode_check_readlink]]
0xA87E30: .byte 0xdc, 0x33, 0xa9, 0x01 → .byte 0xbc, 0xd3, 0xaa, 0x01 [ops[275] -> allow stub [_hook_vnode_check_setattrlist]]
0xA87E38: .byte 0x58, 0x32, 0xa9, 0x01 → .byte 0xbc, 0xd3, 0xaa, 0x01 [ops[276] -> allow stub [_hook_vnode_check_setextattr]]
0xA87E40: .byte 0xf0, 0x2f, 0xa9, 0x01 → .byte 0xbc, 0xd3, 0xaa, 0x01 [ops[277] -> allow stub [_hook_vnode_check_setflags]]
0xA87E48: .byte 0x5c, 0x2d, 0xa9, 0x01 → .byte 0xbc, 0xd3, 0xaa, 0x01 [ops[278] -> allow stub [_hook_vnode_check_setmode]]
0xA87E50: .byte 0x04, 0x2c, 0xa9, 0x01 → .byte 0xbc, 0xd3, 0xaa, 0x01 [ops[279] -> allow stub [_hook_vnode_check_setowner]]
0xA87E58: .byte 0xb0, 0x2a, 0xa9, 0x01 → .byte 0xbc, 0xd3, 0xaa, 0x01 [ops[280] -> allow stub [_hook_vnode_check_setutimes]]
0xA87E60: .byte 0x48, 0x29, 0xa9, 0x01 → .byte 0xbc, 0xd3, 0xaa, 0x01 [ops[281] -> allow stub [_hook_vnode_check_stat]]
0xA87E68: .byte 0xe0, 0x27, 0xa9, 0x01 → .byte 0xbc, 0xd3, 0xaa, 0x01 [ops[282] -> allow stub [_hook_vnode_check_truncate]]
0xA87E70: .byte 0x08, 0x25, 0xa9, 0x01 → .byte 0xbc, 0xd3, 0xaa, 0x01 [ops[283] -> allow stub [_hook_vnode_check_unlink]]
0xA87F78: .byte 0x24, 0x0f, 0xa9, 0x01 → .byte 0xbc, 0xd3, 0xaa, 0x01 [ops[316] -> allow stub [_hook_vnode_check_fsgetpath]]
0xA87978: .byte 0x48, 0xb5, 0xa9, 0x01 → .byte 0xbc, 0xd3, 0xaa, 0x01 [ops[124] -> allow stub [_hook_proc_check_syscall_unix]]
[CFW]IOUC MACF gate: branch-level deny bypass
[+] IOUC MACF gate fn=0x2458D20, bl=0x245960C, cbz=0x2459610, allow=0x2459674
0x2459610: cbz w0, 0x2459674 → b 0x2459674 [b #0x64 [IOUC MACF deny → allow]]
[CFW]IOUC sandbox gate: deny-block → allow redirect
[+] IOUC sandbox gate fn=0x2458D20, cbnz=0x245979C, deny=0x24597B0 → allow=0x24596A8
0x24597B0: ldr x0, [sp, #0x38] → b 0x24596a8 [b #-0x108 [IOUC sandbox deny → allow]]
[CFW]DiskImages2 GATE1: CreateDevice controller-ABI b.ne -> nop
0xB83EC0: b.ne 0xb83f4c → nop [nop [DI2 CreateDevice controller-ABI cmp#9/b.ne gate]]
[CFW]DiskImages2 GATE2b: Connect daemon-ABI b.ne -> nop
0xB8EFD4: b.ne 0xb8f004 → nop [nop [DI2 Connect daemon-ABI cmp#9/b.ne gate]]
[CFW]DiskImages2 GATE2: widen notification-ports array + bound checks
0xB8F2B0: lsl x1, x23, #3 → mov x1, #0x4000 [mov x1,#0x4000 [DI2 AllocPortsArray widen notif-ports alloc to 0x800 entries]]
0xB9058C: ldrh w8, [x19, #0xd8] → mov w8, #0x800 [mov wD,#0x800 [DI2 RegisterNotificationPort bound-check field1 @+0xd8]]
0xB905A0: ldr w9, [x19, #0xe8] → mov w9, #0x800 [mov wD,#0x800 [DI2 RegisterNotificationPort bound-check field2 @+0xe8]]
[CFW]vm_shared_region_create: arm64 region size 0x180000000 → 0x1c0000000
0x1E0F4E8: mov x22, #0x180000000 → mov x22, #0xc0000000 [arm64 shared region size 0x180000000 → 0x1c0000000 [vm_shared_region_create]]
0xC0C6C4: udf #0 → cmp w1, #0xc [ARM64E_X1 subtype 12 or legacy subtype 2 [grade.cave]]
0x2338EB4: cmp w1, #2 → b 0xc0c6c4 [ARM64E_X1 subtype 12 or legacy subtype 2 [grade]]
0xC0C6D0: udf #0 → cmp w8, #0xc [ARM64E_X1 subtype 12 or legacy subtype 2 [exec_ptrauth.cave]]
0x21B6D94: cmp w8, #2 → b 0xc0c6d0 [ARM64E_X1 subtype 12 or legacy subtype 2 [exec_ptrauth]]
0xC0C6DC: udf #0 → cmp w8, #0xc [ARM64E_X1 subtype 12 or legacy subtype 2 [exec_shared_region.cave]]
0x21B7088: cmp w8, #2 → b 0xc0c6dc [ARM64E_X1 subtype 12 or legacy subtype 2 [exec_shared_region]]
[CFW]postValidation additional: cmp w0,w0
[=] already cmp w0,w0 at 0xDE8360 (base postValidation patch owns this site); nothing to patch
[CFW]_proc_security_policy: mov x0,#0; ret
[+] _proc_security_policy at 0x227A330 (PRIV_GLOBAL_PROC_INFO anchor)
0x227A330: pacibsp → mov x0, #0 [mov x0,#0 [_proc_security_policy]]
0x227A334: stp x24, x23, [sp, #-0x40]! → ret [ret [_proc_security_policy]]
[CFW]_proc_pidinfo: NOP pid-0 guard (2 sites)
0x2277DA8: cbz x0, 0x2278548 → nop [NOP [_proc_pidinfo pid-0 guard A]]
0x2277DB0: cbz w19, 0x2278558 → nop [NOP [_proc_pidinfo pid-0 guard B]]
[CFW]_convert_port_to_map_with_flavor: skip panic
0x1D06520: b.ne 0x1d06574 → b 0x1d06574 [b 0x1D06574 [_convert_port_to_map skip panic]]
[CFW]_bsd_init: ignore FSIOC_KERNEL_ROOTAUTH failure
[=] rootauth branch already bypassed at 0x218291C
[CFW]_dounmount: upstream cleanup-call NOP
0x1EBECA0: bl 0x1ea7d98 → nop [NOP [_dounmount upstream cleanup call]]
[CFW]_IOSecureBSDRoot: force SecureRootName success
0xB2CE10: csel w22, wzr, w9, ne → mov w22, #0 [mov w22, #0 [_IOSecureBSDRoot SecureRootName allow]]
[CFW]_load_dylinker: skip dyld policy check
[+] dyld anchor func at 0x2269F38, patch BL at 0x2269FC4
0x2269FC4: bl 0x1e2ad10 → b 0x226a008 [b #0x44 [_load_dylinker policy bypass]]
[CFW]___mac_mount: upstream twin bypass
0x1EBC6FC: tbnz w26, #5, 0x1ebc87c → nop [NOP [___mac_mount upstream flag gate]]
0x1EBC72C: ldrb w8, [x16, #0x71] → mov x8, xzr [mov x,xzr [___mac_mount upstream state clear]]
[CFW]verifyPermission (NVRAM): NOP
0x243841C: tbnz w24, #2, 0x243845c → nop [NOP [verifyPermission NVRAM]]
[CFW]_shared_region_map_and_slide_setup: upstream cmp x0,x0
0x2289B10: cmp x8, x16 → cmp x0, x0 [cmp x0,x0 [_shared_region_map_and_slide_setup]]
[CFW]_spawn_validate_persona: upstream dual-CBZ bypass
0x21BCDF8: cbz w8, 0x21bce14 → nop [NOP [_spawn_validate_persona pid-slot guard]]
0x21BCE00: cbz w8, 0x21bce14 → nop [NOP [_spawn_validate_persona persona-slot guard]]
[CFW]_task_for_pid: upstream pid==0 gate NOP
0x21DA128: cbz w24, 0x21da2c8 → nop [NOP [_task_for_pid pid==0 gate]]
[CFW]_thid_should_crash: zero out
[*] string at foff 0x26E4AF0
[+] variable at foff 0x6A71A0 (value=1, found via sysctl_oid at str+0x20)
0x6A71A0: udf #1 → udf #0 [zero [_thid_should_crash]]
[CFW]_vm_fault_enter_prepare: NOP
0x1DB2234: tbz w22, #3, 0x1db2240 → nop [NOP [_vm_fault_enter_prepare]]
[CFW]_vm_map_protect: bypass W^X downgrade
0x1DC6EA0: b.ne 0x1dc6ed0 → b 0x1dc6ed0 [b #0x30 [_vm_map_protect skip W^X downgrade, shape C]]
[CFW]AppleParavirtDisplay timing element refresh: host 60 Hz -> 120 Hz
0xEB1A98: ldur w3, [x8, #-4] → mov w3, #0x780000 [timing element refresh ldur w3,[mode,#-4] -> movz w3,#120,lsl #16 [16.16 Hz]]
[CFW]_cred_label_update_execve: C21-v3 split exits + helper bits
[+] func at 0xDE3DE8
[+] epilogue at 0xDE4268
[+] csflags reload: ldr x26, [x29, #0x18]
0xAEA1D4: udf #0 → mov w0, #0 [deny_trampoline+0 [_cred_label_update_execve C21-v3]]
0xAEA1D8: udf #0 → b 0xde4268 [deny_trampoline+4 [_cred_label_update_execve C21-v3]]
0xDE4264: mov w0, #1 → b 0xaea1d4 [b deny cave [_cred_label_update_execve C21-v3 exit @ 0xDE4264]]
0xC0D508: udf #0 → ldr x26, [x29, #0x18] [success_trampoline+0 [_cred_label_update_execve C21-v3]]
0xC0D50C: udf #0 → cbz x26, 0xc0d51c [success_trampoline+4 [_cred_label_update_execve C21-v3]]
0xC0D510: udf #0 → ldr w8, [x26] [success_trampoline+8 [_cred_label_update_execve C21-v3]]
0xC0D514: udf #0 → and w8, w8, #0xffffc0ff [success_trampoline+12 [_cred_label_update_execve C21-v3]]
0xC0D518: udf #0 → orr w8, w8, #0xc [success_trampoline+16 [_cred_label_update_execve C21-v3]]
0xC0D51C: udf #0 → str w8, [x26] [success_trampoline+20 [_cred_label_update_execve C21-v3]]
0xC0D520: udf #0 → mov w0, #0 [success_trampoline+24 [_cred_label_update_execve C21-v3]]
0xC0D524: udf #0 → b 0xde4268 [success_trampoline+28 [_cred_label_update_execve C21-v3]]
0xDE4448: b 0xde4268 → b 0xc0d508 [b success cave [_cred_label_update_execve C21-v3 exit @ 0xDE4448]]
0xDE4450: b 0xde4268 → b 0xc0d508 [b success cave [_cred_label_update_execve C21-v3 exit @ 0xDE4450]]
[CFW]_hook_cred_label_update_execve: faithful upstream C23
[+] mac_policy_conf at foff 0xA88010, mpc_ops -> 0xA87598
[+] hook cred-label wrapper ops[18] entry 0xA87628 -> 0x1AAF848
[+] vfs_context_current body at 0x1D7B39C (prologue shape)
[+] vnode_getattr at 0x1EE0394 (via BL at 0xC75FD0)
0xA87628: .byte 0x48, 0xf8, 0xaa, 0x01 → .byte 0x00, 0x32, 0xca, 0x01 [retarget ops[18] to faithful C23 cave [_hook_cred_label_update_execve]]
0x1CA3200: udf #0 → nop [faithful upstream C23 cave (vnode getattr -> uid/gid/P_SUGID fixup -> wrapper)]
[CFW]kcall10: ABI-correct sysent[439] cave
[+] sysent table base at foff 0x7693B0 (558 entries)
[+] sysent table at file offset 0x7693B0
[+] sysent[439] entry at 0x76BCD8
[+] reusing unique 8-arg munge32 target 0x1E7C708 (3 matching sysent rows)
[+] cave at 0x1CA32B8 (0x6C bytes)
0x1CA32B8: udf #0 → pacibsp [kcall10 ABI-correct cave (target + 7 args -> uint64 x0)]
0x76BCD8: .byte 0x90, 0xab, 0x28, 0x02 → .byte 0xb8, 0x32, 0xca, 0x01 [sysent[439].sy_call = cave 0x1CA32B8 (auth rebase, div=0xBCAD, next=2) [kcall10]]
0x76BCE0: .byte 0x2c, 0xc6, 0xe7, 0x01 → .byte 0x08, 0xc7, 0xe7, 0x01 [sysent[439].sy_arg_munge32 = 8-arg helper 0x1E7C708 [kcall10]]
0x76BCE8: udf #1 → udf #7 [sysent[439].sy_return_type=7,sy_narg=8,sy_arg_bytes=0x20 [kcall10]]
[CFW]_syscallmask_apply_to_proc: retargeted upstream C22
0x1A8BA00: bl 0x1d77e68 → mov x17, x0 [mov x17,x0 [syscallmask C22 save RO selector]]
0x1A8BAA0: b 0x1d772a4 → b 0x1ca3424 [b cave [syscallmask C22 mutate mask then setter]]
0x1CA3324: udf #0 → .byte 0xff, 0xff, 0xff, 0xff [syscallmask C22 cave (ff blob 0x100 + structural mutator + setter tail)]
[CFW]exec ip_mac_return SECURITY_POLICY kill: cbz -> b (allow)
0x21BE644: cbz w8, 0x21be68c → b 0x21be68c [cbz -> b [exec ip_mac_return SECURITY_POLICY kill bypass]]
[CFW]container-manager exec upcall: cbz w0 -> b (force success; skip autobox/temporary-sandbox)
0x1AB0654: cbz w0, 0x1ab0564 → b 0x1ab0564 [cbz w0 -> b [force container-manager exec upcall success; skip autobox/temporary-sandbox]]
[CFW]IOMFB SwapEnd dispatch checkStructureInputSize -> variable (accept iOS 27 native struct)
0x9C7234: udf #0x588 → .byte 0xff, 0xff, 0xff, 0xff [SwapEnd checkStructureInputSize 0x588 -> variable [accept iOS 27 native IOMFBSwapRec]]
[CFW]IOMFB swap_submit handler size gate cmp w2,#0x588 -> #0x6e0 (accept iOS 27 native struct)
0x16AE22C: cmp w2, #0x588 → cmp w2, #0x6e0 [swap_submit cmp w2,#0x588 -> #0x6e0 [accept iOS 27 native SwapEnd struct]]
[CFW]fpfs: scope vnode_check_open to FileProvider daemons
0xA87DF0: .byte 0x78, 0x3a, 0xa9, 0x01 → .byte 0x24, 0x33, 0xca, 0x01 [ops[267] -> FileProvider-scoped vnode_check_open trampoline]
0x1CA3324: udf #0 → mrs x8, TPIDR_EL1 [trampoline: FileProvider daemons -> real check, else allow]
[+] 102 kernelcache patches applied
[+] saved
============================================================
DeviceTree: /Users/salmanhassan/.vphone/machines/salman/iPhone17,3_27.0_24A435_Restore/Firmware/all_flash/DeviceTree.vphone600ap.im4p
============================================================
original: kept in FirmwareOriginals/
format: 68480 bytes
0x000128: 7379736366672f53724e6d2f → 7670686f6e652d3133333700 [devicetree-cfw-serial_number]
0x00052C: 73797363 → 02000000 [devicetree-cfw-home_button_type]
0x00D20C: 73797363 → fc090000 [devicetree-cfw-artwork_device_subtype]
0x00D354: 73797363 → 90000000 [devicetree-cfw-island_notch_location]
[·] devicetree-exp-target_sub_type: off in this preset
[·] devicetree-exp-compatible_secondary: off in this preset
[·] devicetree-exp-product_fdr_product_type: off in this preset
[·] devicetree-exp-product_sub_product_type: off in this preset
[·] devicetree-exp-product_unique_model: off in this preset
[·] devicetree-exp-arm_io_device_type: off in this preset
[·] devicetree-exp-arm_io_soc_generation: off in this preset
[·] devicetree-exp-product_gestalt_variants_rename: off in this preset
0x00CFCC: 7379736366672f66636f6600 → 61000100921c0000d8130000e803000000000000 [devicetree-cfw-product_front_cam_offset]
0x00D10C: 7379736366672f72636f6600 → eda50000b256000059080000e803000000000000 [devicetree-cfw-product_rear_cam_offset]
+node : /device-tree/product/camera (63 props, 2520B) [devicetree-cfw-product_camera_node]
+node : /device-tree/product/facetime (10 props, 516B) [devicetree-cfw-product_facetime_node]
+node : /device-tree/product/audio (32 props, 1592B) [devicetree-cfw-product_audio_node]
+node : /device-tree/product/iopm (3 props, 132B) [devicetree-cfw-product_iopm_node]
+node : /device-tree/arm-io/smc (1 props, 48B) [devicetree-cfw-arm_io_smc_stub]
+node : /device-tree/arm-io/smc/iop-smc-nub (1 props, 56B) [devicetree-cfw-arm_io_smc_iop_smc_nub_stub]
+node : /device-tree/arm-io/smc/iop-smc-nub/smc-ext-charger (2 props, 112B) [devicetree-cfw-arm_io_smc_ext_charger_camera_driver]
+node : /device-tree/arm-io/isp (3 props, 128B) [devicetree-cfw-arm_io_isp_camera_flags]
+node : /device-tree/arm-io/ispRtb (3 props, 132B) [devicetree-cfw-arm_io_isp_rtb_camera_flags]
-node : /product/haptics, no actuator or haptic server on a VM (172B) [devicetree-cfw-product_haptics_node]
-prop : /product/audio/supports-spatial-audio-capture 01000000 → absent [devicetree-cfw-product_audio_microphone_array]
-prop : /product/audio/supports-audio-mix 01000000 → absent [devicetree-cfw-product_audio_microphone_array]
[18 DeviceTree patch(es) applied]
[+] 18 DeviceTree patches applied
[+] saved
[=] Filesystem: no patches for jb
[=] Manifest: no patches for jb
============================================================
All 10 components processed successfully! (190 total patches)
============================================================
[fw patch] applied 190 CFW patches (preset standard)Activity
3
notpoisontech-create9d ago@rena-kiraneko how did you install vphone-ws, mine says it's damaged and cannot be opened, if you can find me a file or send me, can you please, and explain if you know how to use it.
rena-kiraneko9d ago2. @rena-kiraneko how did you install vphone-ws, mine says it's damaged and cannot be opened, if you can find me a file or send me, can you please, and explain if you know how to use it.
install the notarized version
same thing happened to me, im using vphone-ws until this issue is fixed