How can I detect which Android native function that is hooked by Cydia Substrate: MSHookFunction?

530 Views Asked by At

I want to detect hook behavior of MSHookFunction on Android but no idea yet. This is Cydia Substrate I use in my test app https://github.com/Breathleas/Android-Hooking-Template-Cydia-Substrate/tree/master/jni/Substrate

After complete function hook. I tried comparing the .text section between the in-memory module and the shared object lib file but couldn't find the trampoline function. Here is the Frida script on the codeshare that I referenced https://codeshare.frida.re/@lichao890427/find-android-hook/. The origin function is hooked but .text section data in memory is same with shared object lib file.

0

There are 0 best solutions below