Hook Detection
Protection ID: hook_detection
Hook Detection identifies when runtime hooking frameworks are active in your application's process. These frameworks allow attackers to intercept and modify method calls, bypass security checks, and alter application behavior at runtime.
Configuration
Hook Detection can be enabled through the rasp configuration:
{
"protections": {
"rasp": {
"enabled": true,
"hook_detection": true,
"action": "exit"
}
}
}{
"protections": {
"rasp": {
"enabled": true,
"hook_detection": true,
"action": "exit"
}
}
}Action options: "exit", "alert", "log", "crash".
How It Works
Runtime hooking frameworks are the primary tool for dynamic analysis of iOS applications. They allow an analyst to intercept any method call and inspect or modify its arguments and return values, replace entire method implementations at runtime, bypass security checks by overriding their return values, and trace application execution to understand its behavior.
Hook Detection identifies the presence of these frameworks in the application's process and responds according to your configured action. The detection runs continuously, not just at startup.
What Gets Detected
| Detection | Description |
|---|---|
| Dynamic instrumentation frameworks | Tools that inject into the process to intercept method calls |
| Method swizzling libraries | Libraries that replace method implementations at runtime |
| Objective-C runtime manipulation | Unauthorized use of the Objective-C runtime to modify behavior |
When to Use
Hook Detection is recommended for any application where method-level integrity is important. It is critical for applications with authentication flows, payment processing, license validation, or any security-sensitive logic that could be bypassed by hooking individual methods.
Related
- Anti-Debug - Detect debugger attachment
- Trace Detection - Detect tracing tools
- Tamper Detection - Detect binary modifications
- Protections Overview - All available protections