iOS

Suspicious loaded librariesHooking & instrumentation

Scans every loaded Mach-O image name for instrumentation and tweak-injection frameworks.

hooking_librariesCompromising by default

At a glance

Platform: iOS
Category: Hooking & instrumentation
Source: DIIntegrityChecks.m · hasHookingLibraries
Default status: Makes status compromised
Seen firing: Seen firing in D06, A05. Based on validated scenarios whose observed result includes this signal; see below.
OWASP MASTG: MASTG-TEST-0091

How it works

What the code inspects.

Walks the loaded image list with _dyld_image_count() / _dyld_get_image_name() and lowercases each path.

Flags any image whose name contains a known marker: frida, fridagadget, cynject, libcycript, mobilesubstrate, substrate*, substitute, libhooker, ellekit, tweakinject, sslkillswitch, revealserver, systemhook.

This check runs on the Simulator too (unlike the filesystem checks) because the loaded-image list is the process's own, not the host filesystem.

The exploit it addresses

Why this matters.The threat.

Dynamic instrumentation (Frida) and tweak loaders (Cydia Substrate, ellekit, libhooker) inject a dylib into the process so they can rewrite functions at runtime — bypassing login, disabling pinning (SSL Kill Switch), or exfiltrating data. If such a library is mapped in, the app's own code can no longer be trusted.

How it can be bypassed

No single check is sufficient.Known evasions.

Frida's 'gadget' can be renamed, and stealthier injection maps code anonymously so it never appears as a named image in the dyld list.

An attacker can hook _dyld_get_image_name to filter its own library out of the enumeration.

Frida can also attach over a port without loading a recognizable named library into the target.

Validation scenarios

Where this check is exercised.2 scenarios.

A05

Frida on a stock iPhone

Validated · ios

Open →A06

Jailbroken iPhone

Blocked · ios

Open →

References & further reading

All checks

← Bootloader unlocked DYLD_INSERT_LIBRARIES set →