1

I would like to find out if there's a way to detect if a C function is hooked in iOS? So for example let's say I hook SSLHandshake,

OSStatus (*orig_SSLHandshake) (SSLContextRef context);

OSStatus replaced_SSLHandshake (SSLContextRef context)
{
    OSStatus result = orig_SSLHandshake(context);
    if (result == errSSLServerAuthCompleted)
    {
        return orig_SSLHandshake(context);
    }
    else
        return result;
    }
}

Is there anyway to detect if this function has been hooked?

1

Basic way to do it

The concept is simple (but implementing it to protect your app from a hacker is a hassle). Function implementations are stored in memory and hence have a memory address. That's why you can use a function pointer in your example.


In order to see if a function has been hooked, you would just :

  1. Save the address of the original function implementation (get the address of the function pointer using &orig_SSLHandshake). The implementation are all loaded in memory when the app calls the first ApplicationDelegate method.
  2. Each time you need it, compare the address of the current implementation with the original address you stored.

If you do not care about being hooked from the outside, then this solution may satisfy you.

Protecting your app against hooking done by an attacker

Here I assume you want to protect your app against a function hook done by a hacker (and not hook the function yourself).

One of the easiest ways to hook functions in iOS is using MobileSubstrate. It can hook function implementations early in the application launching process (already hooked when in application:didFinishLaunching...), so that when you would try to get the address of your original function (& originalFunction) you would in fact get the address of the hooked function. You would never be able to get the address of the original one.

Because function hooking can happen very early in the application launching process, you would have to use some tricks.

Basically, you would verify that the implementation you want to store as the original function is really the original one.
You could decide to have some global variables (despite it is not a good programming style) and make your original function perform some operations on them and output an expected value.
Then if an attacker has already hooked your function, you would know it (after having called your function) because it would not produce the expected output on the global variable. You may add an extra parameter to your function for these checks.

However, it is important to note that a hacker have access to both your original function implementation and the arguments you pass when trying to call that function.
Hence, although the previous solution makes the verification secure in cases where the attacker does not call your original function (with the expected arguments), it does not help if he calls your function before or after having done his own modifications.

void hookedImplementation (type1 arg1, type2 arg2){
    // ... the hacker does stuffs
    
    // he calls your original function with the arguments you passed.
    originalFunction(arg1,arg2);
    
    // .. other hooking
}

In regards of all this, my only reply is that you cannot be 100% sure that your original function has not been hooked by an attacker. However, you may discourage most hackers, and maybe that is sufficient for your case.
Just be councious about that if you work in the IT department of a worldwide bank institute (since it would then matter).

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.