mirror of
https://github.com/Lakr233/vphone-cli.git
synced 2026-09-04 07:04:34 +00:00
Kila2
f92d82cd75
* fix AVPBooter DGST patch: restrict search to movz/movk instructions The DGST constant search matched any instruction string containing "0x4447", including branch targets like `bl #0x4447c`. On macOS 27 beta 3+ firmware, such a branch appeared before the real DGST movk, causing a false match and subsequent "x0 setter not found" failure. Restrict the search to movz/movk/mov mnemonics only, which are the actual constant-loading instructions. Fixes #373 * fix iBSS JB nonce patch: use tolerance-based ADRP+ADD search findRefsToOffset required exact match between ADRP+ADD computed address and the "boot-nonce" string file offset. On macOS 27 beta 3 firmware, code references a structure header 2 bytes before the string, causing the exact match to fail. Add findRefsNear() which allows up to 16 bytes of negative delta, matching references to the containing structure rather than the string itself. This makes the patch resilient to minor layout changes across firmware versions.