[ "$$found" = "0" ] && echo ... returns exit 1 when backups exist,
which propagates as a make rule failure. Replace it with if/fi so the
target exits successfully in both cases.
* kernel: add patch #27 — disable thread_guard_violation (EXC_GUARD)
Research kernels fatally enforce Mach port guard violations via
thread_guard_violation() → AST delivery → EXC_GUARD. This kills any
app whose crash reporting SDK (Bugly, Crashlytics, KSCrash, etc.)
calls task_swap_exception_ports() to register Mach exception handlers.
Production iOS does not enforce these fatally.
Patch strategy: locate thread_guard_violation through an anchor chain
(entitlement string → set_exception_behavior_violation → inner BL) and
replace its PACIBSP prologue with RET so it returns immediately without
recording or delivering the violation.
Closes#291
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
* review: remove SDK mentions, add patch #27 to patch comparison table
Address PR review feedback:
1. Remove specific SDK names from KernelPatchExcGuard.swift comments
2. Add patch #27 (thread_guard_violation) to research/0_binary_patch_comparison.md
3. Update kernel base patch counts 28→29 across all references
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
* kernel: scope thread_guard_violation patch to dev variant only
Per maintainer review, the EXC_GUARD disable patch is only needed for the
dev variant. Regular cannot sideload the affected apps at all (no developer
mode), and JB already masks the crash via its extended patch set.
Add `isDev` flag to KernelPatcher, gate patchExcGuardBehavior() on it, and
have FirmwarePipeline pass the right value per variant.
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
* Apply suggestions from code review
Co-authored-by: zqxwce <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>
Co-authored-by: zqxwce <[email protected]>
It could be more clear that git submodules must be installed.
In my case, I missed this, leading to hours of troubleshooting.
This commit seeks to make it more clear what steps are needed to install dependencies.
Every command response now includes an "image" field with a base64-
encoded grayscale JPEG of the current screen (~40-60KB vs multi-MB PNG).
This eliminates the need for a separate screenshot call after each action.
The image is:
- Downscaled to 1/3 resolution (430x932)
- Converted to grayscale for high contrast
- JPEG compressed at quality 0.35
Optional parameters on any command:
- "screen":false → skip the screenshot capture
- "delay":800 → ms to wait before capture (default 500)
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
Sets the guest clipboard via the vsock control channel, enabling
text input from external automation. Callers can then tap Paste in
the iOS context menu to insert the text.
echo '{"t":"type","text":"Hello"}' | nc -U vm/vphone.sock
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
* Implement battery sync with host
* Clean up the previous sync implementation
* Enable the battery sync functionality by default
* Re-sync the VM's battery state when vphoned reconnects
* Fix iproxy port number for SSH connection
* Fix iproxy port number in README_zh.md
* Fix iproxy port number in Japanese README
* Fix iproxy port number in README_ko.md
* fix: prefer project venv Python for patchers
* add: VM backup, restore, and switch support
Named backups via rsync --sparse for efficient sparse disk handling.
- vm_backup.sh: save current VM as a named backup to vm.backups/
- vm_restore.sh: restore a named backup into vm/
- vm_switch.sh: save current + restore target in one step
- Makefile targets: vm_backup, vm_restore, vm_switch, vm_list
- Documentation added to all READMEs (EN, ZH, KO, JA)
Closes#204
Made-with: Cursor
* fix: macOS 26.3 ImageIO SIGBUS crash fixes
All crashes share the same root cause: a corrupt function pointer in
macOS 26.3's ImageIO PNG decoder (EXC_BAD_ACCESS SIGBUS at 0x0bad4007).
Fixes:
- Replace emoji and non-ASCII characters in UI strings that trigger
the broken PNG decoder via AppKit's text rendering pipeline
- Replace all NSAlert usage with NSPanel to avoid the crash when
NSAlert loads a NIB containing an NSImageView that triggers
IconServices -> ImageIO -> PNGReadPlugin
- Replace requireConnection() NSAlert in VPhoneKeyHelper with a print
statement to prevent crash on home gesture before vphoned connects
- Switch screenshot output format from PNG to JPEG to avoid the crash
in CGImageDestinationFinalize -> PNGWritePlugin
* fix: additional macOS 26.3 ImageIO SIGBUS crash fixes
- Fix copyScreenshotToPasteboard crash by writing JPEG data directly
to pasteboard instead of using NSImage writeObjects which internally
triggers the broken TIFF encoder
- Replace requireConnection() print statement with NSPanel to properly
notify user when key injection is attempted before VM connects
* fix: additional macOS 26.3 ImageIO SIGBUS crash fixes
- Fix copyScreenshotToPasteboard crash by writing JPEG data directly
to pasteboard instead of using NSImage writeObjects which internally
triggers the broken TIFF encoder
- Replace requireConnection() print statement with NSPanel to properly
notify user when key injection is attempted before VM connects
* fix: preserve caller PATH through Nix zshenv reset in cfw scripts
Nix darwin's /etc/zshenv resets PATH on every zsh subprocess,
discarding the Makefile's carefully constructed PATH (which includes
.venv/bin and /opt/homebrew/bin). This caused 'Missing Python deps'
and ldid PKCS12_parse errors during cfw_install.
Pass the Makefile PATH through _VPHONE_PATH env var (which zshenv
won't touch), and restore it at the top of each cfw_install script.
* fix(cfw_install_dev): add python resolver, use glob for vphoned sources
- Add _resolve_python3() matching cfw_install.sh so the venv python
is used instead of Nix system python (which lacks capstone/keystone).
- Replace hardcoded VPHONED_SRCS list with glob pattern to auto-pick
up new .m files (was missing 5 files: accessibility, apps, clipboard,
settings, url — causing linker errors).
* fix: amfidont uses bundle binary CDHash and .build path
make boot launches the bundle binary (.build/vphone-cli.app/Contents/
MacOS/vphone-cli), not the release binary. amfidont's --path must
cover the .app bundle location.
- amfidont_allow_vphone depends on bundle (not build)
- start_amfidont_for_vphone.sh extracts CDHash from bundle binary
- --path points to .build/ so amfidont covers .app bundle contents
* fix(preflight): prevent run_capture errexit on non-zero return
zsh set -e is global scope — set -e inside run_capture then
return 137 triggers errexit and kills the script before reaching
the assert-bootable check. Use '|| rc=$?' instead to capture
the exit code without modifying errexit state.
Maximilian Paß