I'm trying to reverse a compiled tweak. As a first step, I want to find out all the functions it hooks. I can find all the calls to substrate framework functions, but I didn't figure out which functions are hooked (r0). What is the best way to do this?

1. How can I start an app using gdb instead of attaching to a running process. The straightforward way results in a SIGABRT and the call stacks look something like

   #0 0x39ee91f0 in __pthread_kill () #1 0x39f53796 in pthread_kill () #2 0x39e99fdc in abort () #3 0x33bdec10 in GSRegisterPurpleNamedPort () #4 0x33bde890 in _GSEventInitialize () #5 0x31604f38 in UIApplicationMain () #6 0x0022d97c in ?? () #7 0x000910c8 in ?? ()

2. I tried to write a tweak to hook into the substrate framework functions, e.g. MSHookFunction.

#include <CydiaSubstrate.h>

void (*oldMSHookFunction)(void *, void *, void **);

void newMSHookFunction(void *symbol, void *hook, void **old) { printf("CC_HOOKED\n"); oldMSHookFunction(symbol, hook, old); }

attribute((constructor)) static void initialize() { NSLog(@"CC_LOADED"); MSHookFunction(MSHookFunction, &newMSHookFunction, &oldMSHookFunction); }

With syslog, I found that my tweak is successfully loaded with CC_LOADED printed and there were other tweaks loaded after mine. However, no CC_HOOKED is printed out. What happened?

I'm trying to reverse a compiled tweak. As a first step, I want to find out all the functions it hooks. I can find all the calls to substrate framework functions, but I didn't figure out which functions are hooked (r0). What is the best way to do this?

1. How can I start an app using gdb instead of attaching to a running process. The straightforward way results in a SIGABRT and the call stacks look something like

    #0  0x39ee91f0 in __pthread_kill ()
    #1  0x39f53796 in pthread_kill ()
    #2  0x39e99fdc in abort ()
    #3  0x33bdec10 in GSRegisterPurpleNamedPort ()
    #4  0x33bde890 in _GSEventInitialize ()
    #5  0x31604f38 in UIApplicationMain ()
    #6  0x0022d97c in ?? ()
    #7  0x000910c8 in ?? ()
   

2. I tried to write a tweak to hook into the substrate framework functions, e.g. MSHookFunction.

    #include <CydiaSubstrate.h>
   
    void (*oldMSHookFunction)(void *, void *, void **);
   
    void newMSHookFunction(void *symbol, void *hook, void **old) {
        printf("CC_HOOKED\n");
        oldMSHookFunction(symbol, hook, old); 
     }
   
    __attribute__((constructor)) static void initialize() {
        NSLog(@"CC_LOADED");
        MSHookFunction(MSHookFunction, &newMSHookFunction, &oldMSHookFunction);
     }
   

With syslog, I found that my tweak is successfully loaded with CC_LOADED printed and there were other tweaks loaded after mine. However, no CC_HOOKED is printed out. What happened  ?

I'm trying to reverse a compiled tweak. As a first step, I want to find out all the functions it hooks. I can find all the calls to substrate framework functions, but I didn't figure out which functions are hooked (r0). What is the best way to do this?

1. How can I start an app using gdb instead of attaching to a running process. The straightforward way results in a SIGABRT and the call stacks look something like

   #0 0x39ee91f0 in __pthread_kill () #1 0x39f53796 in pthread_kill () #2 0x39e99fdc in abort () #3 0x33bdec10 in GSRegisterPurpleNamedPort () #4 0x33bde890 in _GSEventInitialize () #5 0x31604f38 in UIApplicationMain () #6 0x0022d97c in ?? () #7 0x000910c8 in ?? ()

2. Can I write a tweak to hook substrate framework functions, e.g. MSHookFunction. If so, how can I make sure my tweak is loaded before the tweak I want to reverse?

I'm trying to reverse a compiled tweak. As a first step, I want to find out all the functions it hooks. I can find all the calls to substrate framework functions, but I didn't figure out which functions are hooked (r0). What is the best way to do this?

1. How can I start an app using gdb instead of attaching to a running process. The straightforward way results in a SIGABRT and the call stacks look something like

   #0 0x39ee91f0 in __pthread_kill () #1 0x39f53796 in pthread_kill () #2 0x39e99fdc in abort () #3 0x33bdec10 in GSRegisterPurpleNamedPort () #4 0x33bde890 in _GSEventInitialize () #5 0x31604f38 in UIApplicationMain () #6 0x0022d97c in ?? () #7 0x000910c8 in ?? ()

2. I tried to write a tweak to hook into the substrate framework functions, e.g. MSHookFunction.

#include <CydiaSubstrate.h>

void (*oldMSHookFunction)(void *, void *, void **);

void newMSHookFunction(void *symbol, void *hook, void **old) { printf("CC_HOOKED\n"); oldMSHookFunction(symbol, hook, old); }

attribute((constructor)) static void initialize() { NSLog(@"CC_LOADED"); MSHookFunction(MSHookFunction, &newMSHookFunction, &oldMSHookFunction); }

With syslog, I found that my tweak is successfully loaded with CC_LOADED printed and there were other tweaks loaded after mine. However, no CC_HOOKED is printed out. What happened?