NO NETWORK · NO TELEMETRY · FAILS CLOSED · v0.3.0

A05

Frida on a stock iPhoneValidated

An app with the Frida gadget embedded raises hooking_libraries — and nothing else — on a stock iPhone.

Validatedios

How to read this page

A scenario is one test case: prepare the environment, run the steps, then compare the expected result (written before the run) with the observed result (copied from the run, with screenshots).

A05 · A
Run on a real phone that's been attacked or modified — rooted, jailbroken, hooked or hidden.
Validated
Run, and the result matched what was expected.

Why it matters

Tests hooking detection on iOS without needing a jailbreak, on hardware that has no public jailbreak.

Environment

App
Example app, Release, built with yarn example prebuild:frida
Device
iPhone XS Max (A12), iOS 18.7.10 (22H374), stock
Tool
Frida Gadget 17.20.0 embedded via the opt-in with-frida-gadget config plugin, signed with a Personal Team
Library
0.2.1

Setup

Prepare the environment.Then run the steps.

  1. 01Embed FridaGadget.dylib in the app and sign it with your own Apple Account (a free Personal Team works) — see the Frida Gadget testing guide.
  2. 02Gadget config: on_load resume and code_signing required (without it, a stock iPhone kills the app at launch when no debugger is attached).
  3. 03Launch the app from the home screen, not from Xcode, so debugger_attached does not also fire.

Testing guide

Set up the device.Step by step.

Frida Gadget on a stock iPhone →

No jailbreak needed: embed the Frida Gadget library in your own app, sign it with your Apple Account, install it on any iPhone, and check that hooking detection fires.

Steps

What to run.What to read.

  1. 01Open the app.
  2. 02Read the status badge and the signal list.

Expected result · written before the run

Status: compromised1 signal.

Also tamper_team_id_mismatch when expectedTeamIds is set to a team other than the one that signed the build.

Observed result · copied from the run

Status: compromisedObserved 2026-10-02.

Run from Xcode with LLDB attached, the same build also reported debugger_attached and hooking_dyld_insert (Xcode injects its view-debugging library via DYLD_INSERT_LIBRARIES). Both disappear without the debugger — expected, not false positives.

evidence
Status: COMPROMISED · Duration: 21 ms · Ignored: 0 · Signals (1) · [hooking] hooking_libraries: Suspicious dynamic libraries are loaded
Example app on an iPhone XS Max: status COMPROMISED, one signal, hooking_libraries — Suspicious dynamic libraries are loaded.
iPhone XS Max · iOS 18.7.10 · Frida Gadget 17.20.0 · launched from the home screen
Same build run from Xcode with the debugger: status COMPROMISED, signals hooking_libraries (Strong), debugger_attached (Context) and hooking_dyld_insert (Medium).
The same build launched by Xcode with LLDB: debugger_attached and hooking_dyld_insert are added — Xcode's tooling, not false positives.

Checks this scenario covers

Every check this test case touches — including ones that aren't expected to fire here. The expected and observed results above say which ones should and did. Each links to how the check works.

All scenarios
← A04 Xposed / LSPosedA06 Jailbroken iPhone →