Kernel Hooks using the UI

The Kernel Hooks feature is available for iOS devices only for on-site customers.

When you navigate to the iOS device you will see a new Kernel Hooks tab (1) available. To start using this feature, you need to power on (2) the device first.

Overview

You can configure kernel hook behavior for select devices.

A few options are available:

• Disabled
• Enabled
• Enabled next boot only

Creating your first hook

If you wanted to hook into the execve sandbox hook at 0xfffffff0068a1b1c, typically you would use something like this in the debugger:

mon patch 0xfffffff0068a1b1c print("execve sandbox hook\n");

To do the same thing in the Corellium UI, you can create a new hook by clicking the add new hook button (1)

When you click the add new hook button, you will see a new hook draft:

1. Hook name, by default every new hook name has the following pattern - hook {hook order number}, you can change it to something more recognizable.
2. Hook address, must be a valid hex address and 16 chars long
3. Patch type. Supports csmfcc and csmfvm (more on this below)
4. Hook code itself
5. Is the hook enabled?
6. Create hook
7. Discard unsaved hook
8. A little tooltip which indicates a hook's status (draft hooks have an orange icon color)

Patch Types

• csmfcc: A Limited C-like language. This compiles into csmfvm automatically.
• csmfvm: Custom stack-based virtual machine language.

Existing Hooks

Once you have created your first hook you can see extra buttons (4, 5, 6).

1. Updated tooltip with created/updated datetime + enabled/disabled status
2. Update hook data
3. Delete hook (confirmation required)
4. Execute all hooks
5. See execution result in device Console (navigates directly to the device Console)
6. Clears hooks execution result
7. Add one more hook (same steps as creating your first hook)

Searching through hooks

If you have more than 5 hooks you can search by hook name and see matching results