So far as I know, in iOS there are three techniques of function hooking:
- preload library using DYLD_INSERT_LIBRARIES
- imported symbol table redirection using fishhook
- patch the functions when they are already loaded - i.e. already in memory using substrate MSHookFunction
These expose security issues so I wanna be able to detect when such things happen. For point number 1, I can apply function pointer verification to detect. However for 2 and 3, I haven't had any idea. I am very thankful for ideas what can be done to address the issue.