How does cycript / substrate work to hook into a process?
I am currently doing some research on techniques about hooking mobile applications and came across some frameworks like Xposed (Android), Frida (Android and iOS) and Cycript (iOS). The documentation about Xposed and Frida is fairly good explaining how exactly they are doing it. Xposed states to manipulate the binary starting the Zygote process and loading an additional JAR file that assists in hooking the methods. Frida documentation explains that it uses ptrace (in Linux environments) to attach to a process, allocating and populating a bootstrapper that loads a thread to launch a .so file containing the frida agent, in a nutshell, if I understood it correctly. I couldn't find useful documentation about the strategy that Cycript pursues. I know that it is built on top of Cydia Substrate that does the actual hooking. I couldn't find details about how exactly Substrate accomplishes this either. I further understand that on iOS the objective-c runtime enables runtime manipulation as it is runtime-oriented. Does anybody know how exactly Cycript / Cydia Substrate works to hook/inject into applications? Thanks in advance.
It figured out that is apparently working by adding the DYLD_INSERT_LIBRARIES into the program's launchd manifest and thereby every time the application is started it loads the malicious payload by loading the dynamic library. Still, are there other techniques how to perform runtime hooking / manipulations on Android and iOS?
WooCommerce custom price using get_price() function
Win7/8 DWM Draw hooking
Context path not working in liferay Hook
Creating additional validation steps for user registrarion in Liferay
Webappclass loader unable to load superclass in a hook?
What are the differences between LD_PRELOAD and strace?
Liferay Document Library: execute method on document download
GetMessage(WM_CHAR) override? Making sure all other Window Hooks activate
TYPO3: Hook after creating or editing page
Liferay Hook customization
capistrano after hooks not firing
Custom Metadatafield in Document and Web content in Liferay
MS Detours 3.0 on Win 7 x64?
How to hook an API function
IPB - Hook into usercpForms_core.php
Is it possible to enable hooks in Trac Wiki?