I want to detect hook behavior of MSHookFunction on Android. This is Mobile Substrate I use in my test app https://github.com/Breathleas/Android-Hooking-Template-Cydia-Substrate/tree/master/jni/Substrate

After complete function hook. I tried comparing the .text section between the in-memory module and the shared object lib file but couldn't find the trampoline function. Here is the Frida script on the codeshare that I referenced https://codeshare.frida.re/@lichao890427/find-android-hook/. The origin function is hooked but .text section data in memory is same with shared object lib file. I also used memory tools like Cheat Engine or Game-Guardian (on Android) to look for the offset I hooked in memory and found it wasn't replaced. So, how did MSHookFunction work and how can I detect hooked functions ?


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.