---
title: Research Variant
framework: Private Cloud Compute Security Guide
role: article
role_heading: Article
path: private-cloud-compute/vreresearchvariant
---

# Research Variant

Use the research variant to dive deeper into PCC.

## Overview

Overview By default, pccvre restores new VRE instances with a “customer” variant of the operating system. We also provide a “research” variant that enables functionality specific to dynamic analysis of the system. To restore the research variant of the Private Cloud Compute operating system, use pccvre instance create --variant research. There are three VRE firmware images that relax security policy under the research variant: iBoot: relaxes constraints on NVRAM variables, such as boot-args. Kernel cache: relaxes constraints on DYLD environment policy, such as allowing DYLD_INSERT_LIBRARIES. Trusted Execution Monitor: relaxes constraints on debugging policy, allowing debuggers using the research.com.apple.license-to-operate entitlement. iBoot iBoot implements a security policy that sanitizes the boot-args that are passed to the kernel. On research builds, iBoot does not enforce this sanitization when it provides the boot-args data kept within NVRAM to the kernel. As a result, any boot-args that are parsed by the research kernel are respected on the system (some security-sensitive boot-args are not parsed on non-development-style builds of the kernel). For example, the serial=3 argument instructs the kernel to output serial logging to the console. This is an argument that is parsed by the research kernel, which allows you to obtain rich serial logs from the system kernel. Kernel cache As a process starts running, the dynamic linker is the first component that runs code within the process. The dynamic linker resolves all linkages for dynamic libraries within the process and then jumps to the application’s main() function. There are certain environment variables that you can pass to an application, which can affect the behavior of the dynamic linker. For example, use the DYLD_INSERT_LIBRARIES environment variable to pre-inject a custom dynamic library into a process. Given the security-sensitive nature of such an operation, the dynamic linker consults with the kernel to determine whether such environment variables are allowed. The research kernel cache relaxes security enforcement for this policy and allows you to pass these environment variables to all kinds of applications and processes on the system. Pre-injecting a custom dynamic library can interpose on library code within a process, which allows you to run code with the same privileges as the target process. Trusted Execution Monitor Trusted Execution Monitor (TXM) is the monitor layer that enforces all execution policy on the system. On PCC nodes, TXM unconditionally disables Developer Mode to prevent modification of system runtime behavior. On the research variant, TXM keeps Developer Mode — and debug functionality — enabled for user-space code. PCC is built on the security foundations of iOS. Enabling Developer Mode on iOS is only one of the requirements to debug an application. To allow code modification, an application must mark itself as debuggable by claiming the get-task-allow entitlement. This ensures that even in Developer Mode, you can debug only development applications, and system binaries such as launchd remain off-limits. On the research variant, TXM allows the use of the research.com.apple.license-to-operate entitlement. This special entitlement is bestowed upon a debugger, instead of a debuggee, and allows the debugger to mark any target application as debuggable. This allows you to perform dynamic analysis of any process on the system.