5

So far as I know, in iOS there are three techniques of function hooking:

  1. preload library using DYLD_INSERT_LIBRARIES
  2. imported symbol table redirection using fishhook
  3. patch the functions when they are already loaded - i.e. already in memory using substrate MSHookFunction

These expose security issues so I wanna be able to detect when such things happen. For point number 1, I can apply function pointer verification to detect. However for 2 and 3, I haven't had any idea. I am very thankful for ideas what can be done to address the issue.

Krypton
  • 228
  • 2
  • 6

3 Answers3

1

I don't know if you still care but I think I recently came up with a way of detecting at least swizzling. It comes from the fact that on the first call to a method, it's imp pointer is not in the class cache and the call takes much longer than subsequent calls.

When a swizzle is performed, that method's imp pointer is substituted and therefore the method cache will be flushed (I believe the whole thing is flushed, not just the entry for that method) and the next call to the method will take a long time.

I tested this method out using Frida (which has much more overhead than just a swizzle) and it's easily able to detect when a function is being hooked. I've yet to try out manually swizzling a method.

EDIT: So I just ran some tests and it turns out the timing before and after swizzling is the same. I did some research and it turns out I had a flawed understanding of the method cache. It turns out that when objc_msgSend is figuring out whether a bucket in the cache is a hit, it only checks the selector, so the imp pointer can change. Oh well.

genghiskhan
  • 111
  • 2
1

The is a variation of the Ken Tompson Hack. If the platform is modified to lie, then what tools can be trusted? No form of reflection can be trusted, because anything can be modified on a compromised iOS device.

Apple is addressing this issue as best as they can by trying to make it difficult to jailbreak an iOS device. In practice there is no solution to this problem, because iOS devices can almost always be jailbroken.

Community
  • 1
rook
  • 47,238
  • 10
  • 96
  • 182
0

Perform some sort swizzle monitoring as mentioned in the guidance found in the OWASP document on Technical Risks of Reverse Engineering and Unauthorized Code Modification

This may not solve all attempts at hooking, but it would be a step in the right direction.

BlueBox Security monitors for all sorts of techniques, including the function hooking methods identified in the question.

atdre
  • 19,072
  • 6
  • 61
  • 108