0

I want to detect hook behavior of MSHookFunction on Android but no idea yet. This is Cydia Substrate I use in my test app https://github.com/Breathleas/Android-Hooking-Template-Cydia-Substrate/tree/master/jni/Substrate

After complete function hook. I tried comparing the .text section between the in-memory module and the shared object lib file but couldn't find the trampoline function. Here is the Frida script on the codeshare that I referenced https://codeshare.frida.re/@lichao890427/find-android-hook/. The origin function is hooked but .text section data in memory is same with shared object lib file.

Ken Kem
  • 635
  • 1
  • 6
  • 13
  • For questions about reverse engineering there is a special stack exchange site https://reverseengineering.stackexchange.com. when it comes to process and memory analysis you may get more attention there especially as the number of questions is way lower as here on SO. – Robert Jan 14 '23 at 21:47
  • Thank you, I will move the question to Stack exchange – Ken Kem Jan 16 '23 at 02:48

0 Answers0