I want to find a way to prevent apps from Cycript attaching. So far I know Cycript works as below, but I can not find a way to stop Cycript.
One method to stop injection is to add
-Wl,-sectcreate,__RESTRICT,__restrict,/dev/null, but it is very easy to be bypassed.
Any other suggestion to stop Cycript?
Cycript uses cynject in mobile substrate https://git.saurik.com/cycript.git/blob/HEAD:/Inject.cpp
Cynject uses the mach task port to inject and create a thread in the target process: https://github.com/rweichler/substrate/blob/master/DarwinInjector.cpp
mach_port_t self(mach_task_self()), task; _krncall(task_for_pid(self, pid, &task));