#TXM Variant Analysis: release vs research

Analysis of TXM (Trusted Execution Monitor) variants from iPhone17,3 26.3 (23D127) and PCC-CloudOS 26.3 (23D128) IPSWs.

#Source Files

Key finding: Both IPSWs contain identical TXM files (same SHA256). The TXM binary is shared across iPhone and cloudOS IPSWs.

#Decompressed Binary Overview

#Mach-O Segments

Both variants have identical segment layout:

Segment layout identical: True

#Diff Summary

• Total differing bytes: 3358 / 458784 (0.73%)
• Diff regions (16-byte merge gap): 87

#Diffs by Segment

#Diff Classification

#1. Build Identifier String (Primary Difference)

The largest diff region (0x17c5 - 0x2496, 3282 bytes) is in the __TEXT segment string/const data area. The key difference is the build variant identifier:

Full build string:

• RELEASE: release.TrustedExecutionMonitor_Guarded-182.40.3
• RESEARCH: research.TrustedExecutionMonitor_Guarded-182.40.3

Because "research" (8 chars) is 1 byte longer than "release" (7 chars), all subsequent strings in __TEXT are shifted by +1 byte, causing a cascade of instruction-level diffs in code that references these strings.

#2. String Reference Adjustments (Code Diffs)

The remaining diffs are in __TEXT_EXEC — all ADD instruction immediate adjustments compensating for the 1-byte string shift:

RELEASE:  add  x8, x8, #0x822   ; points to string at original offset
RESEARCH: add  x8, x8, #0x823   ; points to same string, shifted +1

• ADD immediate adjustments: 84 regions (all in __TEXT_EXEC)
• Other code diffs: 0 regions
• String data regions: 3 regions in __TEXT (3304 bytes total)

Sample code diffs (first 10):

#3. Functional Differences

None. All code diffs are string pointer adjustments caused by the 1-byte shift from "release" to "research". The two variants are functionally identical — same logic, same security policies, same code paths.

#Security-Relevant Strings

Both variants contain identical security-relevant strings:

#Implications for Patching

1. Either variant works — the code is functionally identical.
2. fw_patch.py uses the research variant (txm.iphoneos.research.im4p) because the iboot-build-variant device tree property in PCC VMs is set to "research", and TXM validates this matches its own embedded variant string.
3. String-based patch anchors that reference the build variant string ("release" / "research") will match at different offsets — patchers should use variant-agnostic anchors (e.g., mov w19, #0x2446 as in txm.py).
4. The 3-byte IM4P size difference (161025 vs 161028 bytes) comes from the extra byte in "research" plus LZFSE compression variance.
5. Both IPSWs ship the same TXM — no need to prefer one source over the other.

#Conclusion

The TXM release and research variants are cosmetically different but functionally identical. The only real difference is the embedded build variant string ("release" vs "research"), which causes a 1-byte cascade in string offsets and corresponding ADD immediate adjustments in code. Both IPSWs (iPhone and cloudOS) ship the same pair of TXM binaries.