[kaendfinger]

I did something similar but for macOS. I used Frida, a really easy toolkit for intercepting native calls.

Information: https://github.com/kendfinger/AppleCache#methodology

Tools: https://github.com/kendfinger/AppleCache/tree/master/tools