mirror of
https://github.com/Lakr233/vphone-cli.git
synced 2026-09-02 02:34:29 +00:00
zqxwceandClaude Fable 5
fdf9487bfd
Two narrowly-scoped patches, emitted only under the Frida opt-in: - thread_set_state: clear TSSF_CHECK_ENTITLEMENT in the thread_set_state user setters (mov w6,#0x201 -> #0x1) so Frida can follow an existing thread without a GUARD_TYPE_MACH_PORT kill, while preserving TSSF_TRANSLATE_TO_USER and the TH_IN_MACH_EXCEPTION guard. - vm_map_delete: retarget the immutable-code exception from current-protection execute (bit 9) to max-protection execute (bit 13) so a debugger-created RW/max-RWX permanent mapping survives repeated VM_PROT_COPY re-instrumentation instead of returning KERN_PROTECTION_FAILURE. Both matchers are semantic (entitlement-string / developer-mode / call-flow anchored, no hardcoded offsets/VAs/registers/bytes) and fail closed; replacement bytes come from ARM64Encoder and are Capstone-verified. Co-Authored-By: Claude Fable 5 <[email protected]>