I'm trying to reverse a compiled tweak. As a first step, I want to find out all the functions it hooks. I can find all the calls to substrate framework functions, but I didn't figure out which functions are hooked (r0). What is the best way to do this?

1. How can I start an app using gdb instead of attaching to a running process. The straightforward way results in a SIGABRT and the call stacks look something like

    #0  0x39ee91f0 in __pthread_kill ()
    #1  0x39f53796 in pthread_kill ()
    #2  0x39e99fdc in abort ()
    #3  0x33bdec10 in GSRegisterPurpleNamedPort ()
    #4  0x33bde890 in _GSEventInitialize ()
    #5  0x31604f38 in UIApplicationMain ()
    #6  0x0022d97c in ?? ()
    #7  0x000910c8 in ?? ()
   

2. I tried to write a tweak to hook into the substrate framework functions, e.g. MSHookFunction.

    #include <CydiaSubstrate.h>
   
    void (*oldMSHookFunction)(void *, void *, void **);
   
    void newMSHookFunction(void *symbol, void *hook, void **old) {
        printf("CC_HOOKED\n");
        oldMSHookFunction(symbol, hook, old); 
     }
   
    __attribute__((constructor)) static void initialize() {
        NSLog(@"CC_LOADED");
        MSHookFunction(MSHookFunction, &newMSHookFunction, &oldMSHookFunction);
     }
   

With syslog, I found that my tweak is successfully loaded with CC_LOADED printed and there were other tweaks loaded after mine. However, no CC_HOOKED is printed out. What happened ?