7

I need to get notified when a app (including system app/server) calls System Framework (CoreServices.framework). I am not sure whether Code Injection works on system-wide frameworks.

Is it possible to replace a system framework with my own copy, and then forward messages to the real one?

user2864740
  • 60,010
  • 15
  • 145
  • 220
xhan
  • 6,057
  • 4
  • 33
  • 47
  • There's a lot of existing work for tracing system level calls built in to DTrace. You may be able to do what you want system wide without injecting anything. – Michael Anderson Dec 22 '14 at 03:17

1 Answers1

2

You can use the DYLD_INSERT_LIBRARIES environment variable, but that only works with applications that you start, not system wide. More info here.

You can override system functions with mach_override, but it requires root privivaleges or the procmod group. mach_override was released at MacHack 2003. From a quick glance, it looks as easy as one function call.

mach_override_ptr(&orginalFunction, &overrideFunction, NULL);

Please note that system-wide overriding is strongly discouraged for non-debugging applications.

Related question.

Community
  • 1
  • 1
Jadar
  • 1,643
  • 1
  • 13
  • 25