WEBVTT

1
00:00:00.600 --> 00:00:07.525
Welcome. Frida has its own tutorial. This one covers the other hooking frameworks the library detects.

2
00:00:07.975 --> 00:00:16.650
On Android that means Xposed and LSPosed. On iOS it means tweak loaders such as Substrate, libhooker, and ellekit.

3
00:00:17.100 --> 00:00:21.525
We will look at three detection techniques, and at how each one is evaded.

4
00:00:23.133 --> 00:00:30.858
Xposed and LSPosed let a module hook any method of any app, process-wide, without modifying the APK.

5
00:00:31.308 --> 00:00:36.708
The hooks persist across reboots, which makes them far more durable than a Frida session.

6
00:00:37.158 --> 00:00:43.858
On iOS, tweak loaders inject a dylib into apps so they can rewrite functions at runtime.

7
00:00:44.308 --> 00:00:49.833
Either way, if your process is hooked, your security logic can no longer be trusted.

8
00:00:51.433 --> 00:00:58.108
The Android check looks for Xposed, LSPosed, and similar frameworks in three independent ways.

9
00:00:58.558 --> 00:01:07.458
First, it scans the process memory map for XposedBridge.jar, liblspd, libriru, libsubstrate, and libzygisk.

10
00:01:07.908 --> 00:01:13.708
Second, it tries to load the XposedBridge class through every class loader it can reach.

11
00:01:14.158 --> 00:01:22.958
Third, it inspects the current call stack for frames from Xposed or Substrate packages, which appear when a hooked method is on the stack.

12
00:01:24.567 --> 00:01:31.217
On iOS, the hooking libraries signal walks every loaded image and lowercases its path.

13
00:01:31.667 --> 00:01:39.667
The needle list covers Frida, Cydia Substrate, Substitute, libhooker, ellekit, TweakInject, and SSL Kill Switch.

14
00:01:40.117 --> 00:01:47.392
A match means a tweak loader or injection library is mapped into your process, so its code can rewrite yours.

15
00:01:47.842 --> 00:01:55.142
A separate signal reports the DYLD insert libraries variable. Frida Gadget is covered in its own video.

16
00:01:56.767 --> 00:02:07.542
Modern LSPosed runs through Zygisk and can hide itself from the target app's class loader and memory maps. Shamiko-style hiding removes even more traces.

17
00:02:07.992 --> 00:02:15.942
On iOS, a renamed library, or injection that maps code anonymously, never shows up as a named image.

18
00:02:16.392 --> 00:02:24.417
And a jailbreak can inject without ever setting the DYLD environment variable, so that check only catches the naive vector.

19
00:02:26.033 --> 00:02:34.333
Let us recap. One: on Android, three techniques catch Xposed and LSPosed: maps, class loaders, and the call stack.

20
00:02:34.783 --> 00:02:42.458
Two: on iOS, loaded images and the DYLD variable catch Substrate, libhooker, ellekit, and TweakInject.

21
00:02:42.908 --> 00:02:48.283
Three: hiding is an arms race, with Zygisk, Shamiko, and anonymous mapping.

22
00:02:48.733 --> 00:02:55.133
Four: detection raises the cost of an attack, and attestation gives you the server-side backstop.

23
00:02:56.767 --> 00:03:02.617
Thanks for watching. Every signal is explained in the README and in the example app.

24
00:03:03.067 --> 00:03:05.842
Now go try the checks on your own device.