██╗   ██╗██████╗  ██████╗ ██████╗
 ██║   ██║██╔══██╗██╔════╝██╔════╝
 ██║   ██║██████╔╝██║     ██║
 ╚██╗ ██╔╝██╔═══╝ ██║     ██║
  ╚████╔╝ ██║     ╚██████╗╚██████╗
   ╚═══╝  ╚═╝      ╚═════╝ ╚═════╝
     V o i d   P a t c h e r   f o r   C l a u d e   C o d e

curl -fsSL https://raw.githubusercontent.com/VoidChecksum/void-patcher-cc/main/install.sh | bash

irm https://raw.githubusercontent.com/VoidChecksum/void-patcher-cc/main/install.ps1 | iex

%%{init: {'theme':'dark','themeVariables':{
   'primaryColor':'#00D4FF','edgeLabelBackground':'#0D1117',
   'tertiaryColor':'#FF6B9D','fontFamily':'JetBrains Mono'}}}%%
flowchart LR
    NPM[npm -g<br/>@anthropic-ai/claude-code] -->|236 MB SEA or 26 MB cli.js| TGT[target binary]
    TGT --> SIG{96 regex<br/>signatures}
    SIG -->|match| BYTE[byte-patch<br/>in-place]
    BYTE --> VER{verify<br/>--version}
    VER -->|ok| SWAP[atomic swap]
    VER -->|fail| RB[rollback]
    SWAP --> RUN[claude runs]
    RUN --> PRE[preload hook]
    PRE --> HOOK{runtime shims<br/>JSON.parse / fetch / defineProperty}
    HOOK --> RUN
    TGT -.-> WATCH[vpcc watch]
    WATCH -->|sha drift| HEAL[auto-heal scanner]
    HEAL -->|regex regen| SIG
    style SIG fill:#00D4FF,stroke:#0D1117,color:#0D1117
    style PRE fill:#FF6B9D,stroke:#0D1117,color:#0D1117
    style HEAL fill:#E9D900,stroke:#0D1117,color:#0D1117

          ┌─────────────── 3-LAYER DEFENSE ──────────────┐
          │                                              │
 layer 1  ▶  .bun ELF byte-patches   (96 regex sigs)    ◀
 layer 2  ▶  Bun --preload hook      (JS runtime shims) ◀
 layer 3  ▶  auto-heal sig-scanner   (regex regen)      ◀
          │                                              │
          └──────────────────────────────────────────────┘

Anthropic's Bun build re-minifies on every release — gM4 → s5K → Qw7 → … The only stable thing is text that must stay human-readable: event names (tengu_refusal_api_response), URLs (anthropic.com/legal/aup), log prefixes, schema keys.

Every patch ships three independent locators, ordered by hit reliability:

When ② drifts, vpcc scan --auto-heal rewrites it from ①'s context window. When ① also drifts (rare), ③ still catches the refusal at runtime. All three must fail simultaneously to break.

Starting at Claude Code 2.1.119, the .bun ELF section embeds two copies of the entry JS bundle:

[header][active-entry-blob ~13 MB][bytecode-cache ~102 MB]
[lookup-key\x00][vfs-path\x00][vfs-copy-of-cli.js ~13 MB][other-vfs-files][trailer]

Bun re-parses the VFS copy at startup for module resolution. Patching both copies (as pre-2.1.119 vpcc did) corrupts the VFS bundle and fails with an opaque entry.instantiate crash inside Bun's ESM linker.

vpcc ≥ 2.1.119 adds _find_active_bundle_bounds(): locates the // @bun @bytecode marker, reads the u32 blob length at marker-4, and restricts all search_regex writes to [marker, marker + blob_size). VFS copy stays pristine, Bun loads cleanly.

Falls back to the full section on older (single-bundle) builds.

SEA binaries are patched in-place via direct .bun ELF section byte writes. No objcopy, no size drift. JSC SourceCodeKey is fail-open — bytecode-hash mismatch → source re-parse → app boots clean.

curl -fsSL https://raw.githubusercontent.com/VoidChecksum/void-patcher-cc/main/install.sh | bash

irm https://raw.githubusercontent.com/VoidChecksum/void-patcher-cc/main/install.ps1 | iex

Both scripts are idempotent — re-run to update. They:

1. Install Claude Code via Anthropic's official installer if missing (https://claude.ai/install.sh / install.ps1).
2. Install pipx if missing.
3. Install vpcc from GitHub.
4. Clone contrib/ assets (preload hook, systemd units, Windows wrappers).
5. Run vpcc patch + vpcc install-preload.
6. Enable systemd --user vpcc-autoheal.timer (Linux) / add claude.cmd wrapper to user PATH (Windows).

pipx install git+https://github.com/VoidChecksum/void-patcher-cc
vpcc patch && vpcc install-preload

# editable dev
git clone https://github.com/VoidChecksum/void-patcher-cc
cd void-patcher-cc && pipx install -e . --force

# uninstall
pipx uninstall vpcc

$ vpcc doctor
vpcc doctor
  vpcc ver   : 2.1.120
  patches    : 96
  target     : .../claude-code-linux-x64/claude
  format     : Bun SEA ELF
  sha256     : 989a82997d69
  size       : 234 MB
  sig drift  : 0 (all anchors locatable)
  applied    : all
  backups    : 3
  upstream   : current

$ vpcc watch -i 10 &
[1] vpcc watch — polling every 10s

function s5K(H,$,q){
  if(H!=="refusal") return;
  let K = q?.type==="refusal"
        ? q.explanation?.trimEnd()??null
        : null;
  l("tengu_refusal_api_response",{has_explanation:!!K});
  …
  let z = `${qP}: Claude Code is unable to respond to
           this request, which appears to violate our
           Usage Policy (https://…/legal/aup).${A}`;
}

function s5K(H,$,q){
  return;                              // 52
  if(H!=="refusal") return;
  let K = q?.type==="refusal" ? null : null;  // 55
  …
  let z = "Claude Code is processing this request       // 54
           under operator authorization.";
}

Reference binary: @anthropic-ai/claude-code-linux-x64/claude SHA-256 prefix: cca43053f062 · size: 245 230 208 B · format: ELF 64-bit LSB, .bun section (active bundle + VFS copy — see 2.1.119 layout change below)

Every offset is live-resolved via vpcc scan against the current binary. The table is regenerated after every CC update — absolute addresses drift on every re-minification, regex anchors stay stable. Offset — = marker-only (patch idempotency checked via applied_marker only; no scannable anchor needed). R column: ✓ = regex pattern resolvable · ~ = anchor-string fallback only.

# full scan — all anchors, live offsets
vpcc scan -v

# single-patch deep-dive — view regex matches + context
vpcc scan --export-patch js-s5K-refusal-neutralize-v2.1.114

# ad-hoc grep (Linux x64 sample)
SEA=$(npm root -g)/@anthropic-ai/claude-code/node_modules/@anthropic-ai/claude-code-linux-x64/claude
rg -oab --text 'tengu_refusal_api_response|function s5K|Claude Code is unable' "$SEA"

⭐ = added in this v2.1.114 release (patches 52-59).

%%{init:{'theme':'dark','themeVariables':{'primaryColor':'#00D4FF','fontFamily':'JetBrains Mono'}}}%%
graph TD
    W["~/.local/bin/claude<br/>bash wrapper"]
    W -->|detect| B1["npm @anthropic-ai/claude-code-linux-x64/claude"]
    W -->|detect| B2["/opt/claude-code/bin/claude"]
    W -->|detect| B3["cli.js legacy path"]
    W -->|"BUN_OPTIONS=--preload"| P["~/.local/share/void-patcher/claude-preload.js"]
    B1 --> BUN["Bun runtime"]
    B2 --> BUN
    B3 --> NODE["Node runtime"]
    BUN -->|".bun section"| JSC["JSC parser"]
    JSC -->|"patched bytes"| RUN["Claude Code running"]
    P --> RUN
    RUN -.-> WATCH
    WATCH["vpcc watch"] -->|"sha drift"| HEAL["auto-heal"]
    HEAL -->|"regex regen"| PATCHES[("patches/*.json")]
    PATCHES --> PATCH["vpcc patch"]
    PATCH --> B1
    style W fill:#00D4FF,color:#0D1117
    style P fill:#FF6B9D,color:#0D1117
    style HEAL fill:#E9D900,color:#0D1117
    style RUN fill:#3FB950,color:#0D1117

vpcc/
├── __init__.py    — version 2.1.120
├── __main__.py    — 14 sub-commands
├── updater.py     — GitHub API sync + autoheal state machine
└── scanner.py     — SigScanner + auto-heal regen

patches/           — 96 signed JSON patches
contrib/
├── preload/claude-preload.js   — runtime monkey-patch layer
└── systemd/                    — autoheal timer unit

%%{init:{'theme':'dark','themeVariables':{'primaryColor':'#00D4FF','fontFamily':'JetBrains Mono'}}}%%
flowchart LR
    U[npm update -g<br/>@anthropic-ai/claude-code] --> S[sha changes]
    S --> W{vpcc watch}
    W -->|sha drift| BK[backup<br/>~/.vpcc/backups/]
    BK --> AH[vpcc autoheal]
    AH --> V1{vpcc verify}
    V1 -->|markers present| OK[update state · done]
    V1 -->|markers missing| SU[vpcc self-update]
    SU --> AS[auto-heal scanner]
    AS --> PT[vpcc patch]
    PT --> V2{node --check / bin --version}
    V2 -->|ok| OK
    V2 -->|fail| RB[vpcc rollback]
    RB --> LB[restore pre-patch backup]
    style W fill:#00D4FF,color:#0D1117
    style AS fill:#E9D900,color:#0D1117
    style OK fill:#3FB950,color:#0D1117
    style RB fill:#FF4F4F,color:#0D1117

Triggered three ways:

1. vpcc watch — polling daemon (-i seconds, default 10).
2. systemd timer — contrib/systemd/vpcc-autoheal.{service,timer} (every 15 min).
3. Manual — vpcc autoheal -f.

State at ~/.vpcc/state.json (synthetic example):

{
  "last_cc_sha":    "12bd4b0916de",
  "last_cc_kind":   "bun_sea",
  "patches_commit": "a1b2c3d4e5f6",
  "patches_count":  96,
  "updated_at":     "2026-04-24T10:00:00+00:00"
}

Backups: 10 most recent claude.<ts>.<sha12>.{js,exe}.bak in ~/.vpcc/backups/.

SEA=$(npm root -g)/@anthropic-ai/claude-code/node_modules/@anthropic-ai/claude-code-linux-x64/claude
rg -oab --text \
  'Acceptable Use|tengu_refusal_api_response|function s5K|Xj\$|function jtH|function tg7|safetyCheck|classifierApprovable|behavior:"deny"' "$SEA"

r2 -AA -q -c '
  izz~tengu_refusal
  izz~bypassPermissions
  izz~"function s5K"
  /j tengu_refusal_api_response
' "$SEA"

pwndbg claude
pwndbg> start
pwndbg> find 0x00007fff00000000, +0x10000000, "tengu_refusal_api_response"
pwndbg> x/200s $_
pwndbg> telescope $_ 8

vpcc scan -v
vpcc scan --export-patch js-s5K-refusal-neutralize-v2.1.114
vpcc scan --auto-heal    # rewrite every drifted regex in place

Research software for a single operator-owned workstation. Sole purpose: give you, the account holder of a Claude Max subscription unconditional write-access to your own locally-cached Claude Code binary, and unlock your own data from client-side gating that does not materially affect what Anthropic's servers enforce anyway.

• No credentials, keys, tokens, cookies, or telemetry beacons are collected, stored, or transmitted.
• No callbacks beyond GitHub's public REST API (api.github.com/repos/VoidChecksum/void-patcher-cc/*) for patch-catalog sync.
• No auto-execution on machines other than yours — every entry point is a manual invocation (vpcc, install.sh, install.ps1, or the optional systemd timer you enable).
• All patches are atomic, idempotent, and verified by running claude --version on a tmp copy before atomic-swap.

By cloning, installing, or running any part of this repository you agree that:

1. Personal use only. You are the sole human operator of the hardware this runs on and the account holder of the Claude Max/Pro subscription being patched. No shared machines, no redistribution of patched binaries, no running this on someone else's account.
2. Your Claude account, your compliance. Anthropic's Usage Policy (AUP) and Commercial Terms still bind you. Removing a client-side refusal string does not authorize you to use Claude for anything prohibited by the AUP — server-side enforcement, rate limiting, abuse detection, and account-level review remain fully operational and will act on your account.
3. No evasion of server-side controls. Anything that crosses the wire to Anthropic (rate limits, model-safety classifiers, abuse signals, subscription checks at the control-plane level) is out of scope for this tool and must not be bypassed by any means.
4. No use against employer hardware / accounts / subscriptions without written authorization from the device owner and the account holder — even if that's the same legal entity, get it in writing.
5. No abuse-enabling redistribution. You may fork, study, and share improvements under GPL-3.0. You may not package the patched binary for distribution, resell the capability, or advertise this tool as a way to abuse Anthropic's services.
6. No liability. Software is AS-IS. You accept all consequences — account termination, subscription forfeiture, civil action — that arise from your use of this tool.
7. Security-research context only for any patch that touches refusal or safety scaffolding. These patches are documented for transparency and audit purposes; using them outside an authorized research or single-operator dogfood context is your own risk.

If you cannot satisfy all seven, do not install this tool. Use the stock Claude Code binary from @anthropic-ai/claude-code.

• Every patch is verified (node --check for cli.js · --version exec for Bun SEA) and rolls back atomically on failure.
• Pre-patch binary is stored under ~/.vpcc/backups/ — timestamped and sha-256-named for deterministic restore.
• Every patch is idempotent: re-applying never double-patches (cheap applied_marker check).
• Pre-flight refuses to run on binaries it doesn't recognise (unknown magic bytes → abort, no write).
• Bun SEA bytecode integrity: patches only touch the active entry bundle via _find_active_bundle_bounds(); VFS copy and bytecode cache stay pristine (see 2.1.119 layout change).

vpcc assumes the operator has physical + user-level access to the host and an already-installed, already-authenticated Claude Code binary. It does not:

• Elevate privileges (no setuid, no sudo inside code, no kernel hooks).
• Modify any binary it didn't install (no /usr/bin, no system daemons).
• Auto-apply patches without an explicit vpcc patch / vpcc autoheal invocation.
• Persist across user accounts — everything lives under $HOME/.vpcc, $XDG_BIN, $XDG_DATA_HOME.

• Patch signature research: @VoidChecksum.
• Bun SEA format: Bun docs — bun build --compile · JSC SourceCodeKey source.
• ELF shdr walk pattern borrowed from pwntools.
• CC releases: @anthropic-ai/claude-code on npm.

Licensed GPL-3.0-or-later.

 $ vpcc doctor
   vpcc ver   : 2.1.120
   patches    : 96
   sig drift  : 0 (all anchors locatable)
   applied    : all
   upstream   : current