How does cycript / substrate work to hook into a process?
I am currently doing some research on techniques about hooking mobile applications and came across some frameworks like Xposed (Android), Frida (Android and iOS) and Cycript (iOS). The documentation about Xposed and Frida is fairly good explaining how exactly they are doing it. Xposed states to manipulate the binary starting the Zygote process and loading an additional JAR file that assists in hooking the methods. Frida documentation explains that it uses ptrace (in Linux environments) to attach to a process, allocating and populating a bootstrapper that loads a thread to launch a .so file containing the frida agent, in a nutshell, if I understood it correctly. I couldn't find useful documentation about the strategy that Cycript pursues. I know that it is built on top of Cydia Substrate that does the actual hooking. I couldn't find details about how exactly Substrate accomplishes this either. I further understand that on iOS the objective-c runtime enables runtime manipulation as it is runtime-oriented. Does anybody know how exactly Cycript / Cydia Substrate works to hook/inject into applications? Thanks in advance.
It figured out that is apparently working by adding the DYLD_INSERT_LIBRARIES into the program's launchd manifest and thereby every time the application is started it loads the malicious payload by loading the dynamic library. Still, are there other techniques how to perform runtime hooking / manipulations on Android and iOS?
Xbox 360, PPC function Hook crashes when i call a function in the hook. PowerPC
How to use hook in WHMCS only on specific page?
When to do Nashorn over Java Hooks?
Best way to configure Gerrit repo server-side hooks
How to hook protocol,such as DiskIO and BlockIO,in UEFI?
ClearCase.ClearTool returns No view context available error
OrientDB - Duplicate a record into a read-only class
Custom Page in cPanel
Domain validation with hooks
How to insert module into product page in prestashop
WebDriver.io: Is there a way to excute steps before or after certain `it` blocks
Prestashop | Remove transplant restrictions
Android app : java / JNI call hooking strategies
using hook updateQuantity on prestashop 1.4
How can I add a column to the line items table in /admin/commerce/orders/[order-number]/edit
How to post a Zapier trigger to the REST Hook Subscribe URL?