Patch active TXM for normal JB boot

[xhzq233]

Summary

Patch the release TXM image that the restore manifest marks as loaded by iBoot, and install the patched TXM into the Preboot FUD handoff path during JB/EXP install.

Reproduction

1. Run the JB flow:

   make fw_patch_jb
   make ramdisk_build
   make cfw_install_jb

2. Boot normally.
3. Check Developer Mode or task-port behavior, for example through devmode_status or a task_for_pid smoke test.
4. Compare the restore BuildManifest.plist TXM entries.

Local manifest evidence shows normal boot loads Firmware/txm.iphoneos.release.im4p, while the old pipeline patched Firmware/txm.iphoneos.research.im4p.

Before

• FirmwarePipeline selected Firmware/txm.iphoneos.research.im4p for TXM patching.
• JB/EXP install did not replace the Preboot FUD TXM used by normal boot.

After

• FirmwarePipeline patches Firmware/txm.iphoneos.release.im4p, matching the active manifest entry.
• JB/EXP install copies patched Ramdisk/txm.img4 to /private/preboot/<boot-hash>/usr/standalone/firmware/FUD/Ap,TrustedExecutionMonitor.img4.
• The original Preboot TXM is preserved as .pre-vphone on first replacement.
• The patch comparison doc records the Preboot TXM handoff.

Ramdisk/txm.img4 is signed from the restore-tree release TXM after make fw_patch_jb or make fw_patch_exp has already applied the variant TXM patches. The ramdisk step refreshes the base trustcache patch and preserves the existing dev/JB/EXP TXM bytes.

Verification

zsh -n scripts/cfw_install_jb.sh scripts/cfw_install_exp.sh
.venv/bin/python3 -m py_compile scripts/ramdisk_build.py
make patcher_build

The syntax and compile checks exited 0. make patcher_build reported nothing to do.

Manifest evidence:

BuildIdentity 0 Ap,RestoreTrustedExecutionMonitor: Path=Firmware/txm.iphoneos.release.im4p IsLoadedByiBoot=True IsLoadedByiBootStage1=False
BuildIdentity 0 Ap,TrustedExecutionMonitor: Path=Firmware/txm.iphoneos.research.im4p IsLoadedByiBoot=False IsLoadedByiBootStage1=False

Runtime smoke test from local VM:

{"ok":true,"enabled":true}
task_for_pid(34) -> 0 ((os/kern) successful), task=0xa03

Preboot TXM hash verification:

BOOT_HASH=B91DFD3074260710B4BC65AD4B13269D645293A09691D7E848D3049DCC9099879248D2C7225C944B46B0C7C976D1EB9D
-rw-r--r-- 1 root wheel 166878 Jun 30 07:31 /private/preboot/.../FUD/Ap,TrustedExecutionMonitor.img4
166878 /private/preboot/.../FUD/Ap,TrustedExecutionMonitor.img4

8c9603ddae3a667a58ca9da822c501cc852ce53c5967f510efa6131acda8e862  /tmp/vphone-pr3-txm.XMs828/Ap,TrustedExecutionMonitor.img4
8c9603ddae3a667a58ca9da822c501cc852ce53c5967f510efa6131acda8e862  vm/Ramdisk/txm.img4

[zqxwce]

iPhone17,3_26.5_23F77_Restore.ipsw
c0ecdb4b310cf5239ab2b248dd3098eec297dc5aa3bbe6ada27273262b0b8b64 (cloudOS 26.4)

iBoot Panic: : TXM image load failed

Board: vresearch101ap:0
Chip: fe01:00
Build: RELEASE:iBoot-13822.100.791.502.1
UUID: 416D8202-61E4-3B16-961A-EC0B920B9029


Stacktrace:
--> 0x000000007008a7bc
--> 0x0000000070089ce0
--> 0x00000000700c66d0
--> 0x000000007006cc08
--> 0x000000007007032c
--> 0x000000007006fb38
--> 0x000000007006f40c
--> 0x000000007006f278
--> 0x000000007006ef8c
--> 0x000000007008a9b8
======== Start of iBoot serial output. ========
d77fec40d6d8952:1215
d77fec40d6d8952:1215
d77fec40d6d8952:1215
d77fec40d6d8952:1215
d77fec40d6d8952:1215
d77fec40d6d8952:1215
d77fec40d6d8952:1215
d77fec40d6d8952:1215
d77fec40d6d8952:1215
89994699affdef:139
image <<PTR>>: bdev <<PTR>> type illb offset 0x20000 len 0xb6472
78faf5021313e82:74
78faf5021313e82:85
78faf5021313e82:233
ae71af5ee32b84:129
ee37000f60f2e6c:128


=Loaded LLB============================
::
:: 🔥🌸 Microkernel iBoot for vresearch101 Copyright 2007-2026, Apple Inc.
::
::	Local boot, Board 0x90 (vresearch101ap)/Rev 0x0
::
::	BUILD_TAG: iBoot-13822.100.791.502.1
::
::	UUID: 416D8202-61E4-3B16-961A-EC0B920B9029
::
::	BUILD_STYLE: RELEASE
::
::	USB_SERIAL_NUMBER: SDOM:01 CPID:FE01 CPRV:00 CPFM:03 SCEP:01 BDID:90 ECID:43DE61ECEF4D673B IBFL:3D SRNM:[Z6XH3YG23J]
::
=Loaded LLB============================

490dd6a1de0c147:139
490dd6a1de0c147:149
490dd6a1de0c147:150
a3fae6c53b7baa2:107
3974bfd3d441da3:1609
3974bfd3d441da3:1688
3b9107561aef41e:187
3b9107561aef41e:254


iBoot Panic: : TXM image load failed

Board: vresearch101ap:0
Chip: fe01:00
Build: RELEASE:iBoot-13822.100.791.502.1
UUID: 416D8202-61E4-3B16-961A-EC0B920B9029


Stacktrace:
--> 0x000000007008a7bc
--> 0x0000000070089ce0
--> [-] First boot panicked before command injection.
make: *** [setup_machine] Error 1