I want to find a way to prevent apps from Cycript attaching. So far I know Cycript works as below, but I can not find a way to stop Cycript.

One method to stop injection is to add -Wl,-sectcreate,__RESTRICT,__restrict,/dev/null, but it is very easy to be bypassed.

Any other suggestion to stop Cycript?

Cycript uses cynject in mobile substrate https://git.saurik.com/cycript.git/blob/HEAD:/Inject.cpp

Cynject uses the mach task port to inject and create a thread in the target process: https://github.com/rweichler/substrate/blob/master/DarwinInjector.cpp

mach_port_t self(mach_task_self()), task;
_krncall(task_for_pid(self, pid, &task)); 

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.