These hooks are pretty straight forward to construct. You will require the class name and function call details. “class-dump” tool can be used to retrieve such information.
%hook ANSMetadata //Name of target class
-(bool)computeIsJailbroken{// name of the function we want to hook
NSLog(@" ## We hooked ANSMetadata - computIsJailbroken ! ## ");// this will be printed on the device console once it is called.
bool result =%orig;// we call the "original" function that we are currently hooking. The return of the given function stored in "result".
NSLog(@" ## ANSMetadata - computIsJailbroken original return value is %d ## ", result);// Print the original result.
//Example console snippet:
//default 16:19:54.889467 -0400 DuoMobileApp ## ANSMetadata - computIsJailbroken original return value is 1 ##
//Now we return 0 as we want to bypass this jailbreak detection check.
return0;}%hook AFSecurityPolicy //Name of target class
+(id)policyWithPinningMode:(uint64_t)policyID{// function which requires 1 parameter
id result =%orig(policyID);//we call original function with original parameter.
//Print the result to device console and return the original result.
NSLog(@" ## AFSecurityPolicy - policyWithPinningMode is hit. PolicyID/Argument is %ld\nResult is %@ ## ",(long)policyID, result);return result;}%end
// In this example, given function returns a NSDictionary object (id is like void *).
// Our hook gets the original output, changes the value of a parameter and returns the modified output.
%hook DUODeviceInfo
-(id)dictionaryRepresentation{id result =%orig;NSLog(@" ## DUODeviceInfo - dictionaryRepresentation original return value is: %@\n\n ## ", result);/* Example console snippet:
default 16:03:51.008002 -0400 DuoMobileApp ## DUODeviceInfo - dictionaryRepresentation original return value is: {
"app_id" = "com.duosecurity.DuoMobile";
"app_version" = "3.27.0.4";
"device_name" = iPhone;
jailbroken = true; <-- our jailbreak is detected by the application.
language = en;
manufacturer = Apple;
model = "iPhone9,1";
pkpush = "rsa-sha512";
platform = iOS;
region = US;
version = "12.2";
}
*/NSMutableDictionary*muteDict =[result mutableCopy];//we cast it into a mutable form.
muteDict[@"jailbroken"]=@"false";// setting the "jailbreak" flag to FALSE.
NSLog(@"## DUODeviceInfo - dictionaryRepresentation after modification: %@", muteDict);/* Example console snippet:
default 16:03:51.008002 -0400 DuoMobileApp ## DUODeviceInfo - dictionaryRepresentation after modification: {
"app_id" = "com.duosecurity.DuoMobile";
"app_version" = "3.27.0.4";
"device_name" = iPhone;
jailbroken = false; <-- now the value is false hence server will not flag the device as jailbroken.
language = en;
manufacturer = Apple;
model = "iPhone9,1";
pkpush = "rsa-sha512";
platform = iOS;
region = US;
version = "12.2";
}
*/return(NSDictionary*) muteDict;// returning the modified dictionary to pass server-side validation.
}%end
static FILE *(*orig_fopen)(constchar* filename,constchar* mode );
FILE *new_fopen(constchar*filename,constchar*mode){if(strcmp(filename,"/bin/bash")==0){returnNULL;}returnorig_fopen(filename, mode);}%ctor {//Address of Function, Replacement Function, Backup Function address
MSHookFunction((void*)fopen,(void*)new_fopen,(void**)&orig_fopen);}
Hooking a C function by Address:
#include<mach-o/dyld.h>#import"substrate.h"intnew_100037950(void){return0;}int(*orig_100037950)();%ctor
{
@autoreleasepool
{//Get Function Address from ASLR Offset and Function Address
unsignedlong function_address =_dyld_get_image_vmaddr_slide(0)+0x100037950;//Replace the origination function address to the new Function
//Address of Function, Replacement Function, Backup Function address
MSHookFunction((void*)function_address,(void*)new_100037950,(void**)&orig_100037950);}}