Hacker News new | ask | show | jobs
by barco 490 days ago
Does iOS have something like PTRACE_SYSCALL to hook up on syscalls entry and maybe change the return value? (Or detect where the SVC is being made)
1 comments

No, but you can use Frida (which replaces an inline syscall with a JMP to a handler) but it quickly becomes complicated if the app verifies its own integrity at unpredictable points during runtime. When this happens hardware breakpoints are your friend, however the developer can still make your life hard by inlining all over the app, and then you quickly run out of hardware breakpoints.