mirror of
https://github.com/Lakr233/vphone-cli.git
synced 2026-09-02 02:34:29 +00:00
zqxwceandClaude Fable 5
81b0cd828c
The 26.5 Shape B W^X matcher (mov #5 -> #7) mis-targets vm_map.c:6202 `prot &= ~VM_PROT_WRITE` -- the copy-on-write-preservation write-strip -- instead of the RWX/ALLEXEC gate at vm_map.c:5997. Widening it keeps write on code-page protections, so a debugger's breakpoint write lands a writable PTE on the code frame; SPTM rejects that (VIOLATION_ILLEGAL_MAP, page_fte->type=0xf), killing any debugged process on 26.4+. Isolation confirmed: with cs_bypass (patch_vm_fault_enter_prepare) left enabled and Shape B disabled, the debugger works -- Shape B was the sole cause. Retired on 26.5+ (not retargeted): on SPTM, code modification uses write-then-flip via vm_protect(VM_PROT_COPY) -> XNU_USER_DEBUG. The debugger, MobileSubstrate tweaks, and the JB's own plugins (vcc_patch_two_nops in libvcamcaptured.m) all use this path; none need non-MAP_JIT RWX. Shape A (26.1-26.4, the real ALLEXEC gate) is unaffected. Co-Authored-By: Claude Fable 5 <[email protected]>