Files
vphone-cli/scripts
Lakr 916c9c2168 Fix C23 (WIP): switch from ops table pointer rewrite to inline trampoline
Ops table pointer modification breaks chained fixup integrity in the
fileset kernelcache, causing PAC failures in unrelated kexts (e.g.,
AppleImage4). The fixup diversity (0xEC79) also doesn't match the
dispatch discriminator.

New approach: replace PACIBSP at hook function entry with B cave.
Cave runs relocated PACIBSP, ownership propagation shellcode, then
B hook+4 to resume. Uses only PC-relative branches — no PAC, no
chained fixup modification. Also fixes branch offsets in shellcode
to ensure all registers are properly restored in error/skip paths.
2026-03-04 21:02:03 +08:00
..
2026-02-28 03:38:14 +09:00