5

So far as I know, in iOS there are three techniques of function hooking:

  1. preload library using DYLD_INSERT_LIBRARIES
  2. imported symbol table redirection using fishhook
  3. patch the functions when they are already loaded - i.e. already in memory using substrate MSHookFunction

These expose security issues so I wanna be able to detect when such things happen. For point number 1, I can apply function pointer verification to detect. However for 2 and 3, I haven't had any idea. I am very thankful for ideas what can be done to address the issue.

1

The is a variation of the Ken Tompson Hack. If the platform is modified to lie, then what tools can be trusted? No form of reflection can be trusted, because anything can be modified on a compromised iOS device.

Apple is addressing this issue as best as they can by trying to make it difficult to jailbreak an iOS device. In practice there is no solution to this problem, because iOS devices can almost always be jailbroken.

0

Perform some sort swizzle monitoring as mentioned in the guidance found in the OWASP document on Technical Risks of Reverse Engineering and Unauthorized Code Modification

This may not solve all attempts at hooking, but it would be a step in the right direction.

BlueBox Security monitors for all sorts of techniques, including the function hooking methods identified in the question.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.