Stealth Inline Hook Detection via LR Return Address

Jack Sparrow — Sat, 13 Dec 2025 03:15:49 +0000

1. Background: Why Traditional Inline Hook Detection Fails

Inline hook detection on Android commonly relies on:

CRC or code hash verification
Comparing function prologue bytes (e.g., detecting LDR/BR trampolines)

However, these methods have major weaknesses:

They read code pages, which makes them easily traceable with memory breakpoints.
Attackers can hook the detection function itself.
Their “signatures” are well known and easy to bypass.

Thus they are visible and high-risk in real offensive–defensive scenarios.

2. Core Idea: Detecting Hooks via the LR (Return Address)

This article introduces a stealth and cross-platform method that doesn't read any instructions, doesn't scan memory, and is extremely difficult for Frida to bypass.

✔ Why LR works

Inline hook frameworks (Frida, Dobby, xhook, etc.) must:

overwrite the LR register
redirect RET to a trampoline stored in a custom allocated memory page (not inside the original module)

Thus:

➜ If a function’s LR is outside its module’s memory range → it is inline-hooked.

This approach:

Does not read .text code section
Cannot be traced via hardware breakpoints
Works on ARM64 and x86_64

3. Detection Pipeline

Step 1 — Retrieve current module range

static uint64_t g_begin = 0;
static uint64_t g_end = 0;

__attribute__((constructor))
static void init_module_range() {
    Dl_info info;
    if (dladdr((void*)init_module_range, &info)) {
        g_begin = (uint64_t)info.dli_fbase;
        g_end = g_begin + get_module_size(info.dli_fname);
    }
}

Step 2 — Read LR via ARM64 inline assembly

__attribute__((alwaysinline))
uint64_t get_lr() {
    uint64_t lr;
    asm volatile(
        "mov x10, x29 \n"
        "ldr %0, [x10, #8]\n"
        : "=r"(lr)
        :
        : "x10"
    );
    return lr;
}

Step 3 — Detect inline hook

void check_inline_hook() {
    uint64_t lr = get_lr();

    if (lr < g_begin || lr > g_end) {
        LOGD("[!] Inline-hook detected. lr = %llx", lr);
    } else {
        LOGD("[+] Function not hooked.");
    }
}

4. Advanced Protection: Stack Corruption & Anti-Analysis

To make debugging nearly impossible:

detect hook
overwrite stack (FP → FP+2048)
jump to an invalid address

void anti_debug_crash() {
    uint64_t fp;
    asm volatile("mov %0, x29" : "=r"(fp));

    memset((void*)fp, 0xCC, 2048);
    ((void(*)())0x12345678)();
}

This destroys stack traces and prevents reverse engineering of your protection logic.

5. Conclusion

This LR-based inline hook detection method:

does not read code pages
is nearly breakpoint-proof
detects Frida, Dobby, xhook, and other trampoline mechanisms
works on Android and Windows

It offers a new direction for mobile security, anti-cheat systems, and runtime protection.

I’m H.
Six years deep in Android reversing.
Is this sword sharp today?
— H

You Thought Frida Was Stealth When Not Attached? Dirty Pages Beg to Differ

Jack Sparrow — Wed, 03 Dec 2025 14:31:37 +0000

All the classic Frida checks in 2025 — maps, thread names, CRC, ports — are dead.

Today I’m dropping the one that still kills 99 % of setups: Dirty-Page Detection.

Key point: As long as frida-server is running on the device — even if it never attaches to your app — you can detect it globally.

Why Dirty-Page Detection Is Almost Unbypassable

To listen for zygote forks and signals, frida-server inline-hooks three critical modules inside system_server:

libc.so
libselinux.so
libandroid_runtime.so

Inline-hooking the read-only .text section triggers Copy-On-Write.

The original file-backed pages become private dirty pages.

Even if Frida later restores the original bytes in the on_leave callback, the pages stay private forever.

That’s the permanent fingerprint we hunt.

Method 1 – smaps file detection

Sample code is used to demonstrate the thought process.

import re

def frida_detected_smaps():
    targets = ['libc.so', 'libselinux.so', 'libandroid_runtime.so']
    with open('/proc/self/smaps', 'r') as f:
        smaps = f.read()

    for lib in targets:
        # Find the library mapping
        pos = smaps.find(lib)
        if pos == -1:
            continue
        segment = smaps[pos:pos+800]
        # Private_Dirty > 0 → COW happened → Frida was here
        if 'Private_Dirty:' in segment:
            dirty = re.search(r'Private_Dirty:\s+(\d+)', segment)
            if dirty and int(dirty.group(1)) > 0:
                return True
    return False

Method 2 – pagemap (nuclear option, bit 61)

Linux pagemap entry (64 bit):bit 63 → page present

bit 61 → soft-dirty (set on COW)

import struct, ctypes

def page_is_dirty(vaddr):
    with open('/proc/self/pagemap', 'rb') as f:
        f.seek((vaddr // 4096) * 8)
        entry = struct.unpack('Q', f.read(8))[0]
        present     = (entry >> 63) & 1
        soft_dirty  = (entry >> 61) & 1   # ← this is the killer bit 
        return present == 1 and soft_dirty == 1  

# Example: check fork()
libc = ctypes.CDLL('libc.so')
fork_addr = ctypes.cast(libc.fork, ctypes.c_void_p).value
print(page_is_dirty(fork_addr))   # True → Frida present
# you can add more function for detection, such as : vfork/opendir/abort/closedir/close/signal/sigaction/exit

Bottom LineIn

2025, if you’re still checking /proc/self/maps or thread names, you’re fighting 2022 battles.
Dirty-page detection is the current meta.

I’m H.
Six years deep in Android reversing.
The real game has just started.
— H

Forem: Jack Sparrow