This change is needed because since iOS 17, Xcode can load the /private/preboot/Cryptexes/OS/usr/lib/libLogRedirect.dylib library (there’s also a macOS counterpart:
/System/Cryptexes/OS/usr/lib/libLogRedirect.dylib) which uses interposing for wrapping a bunch of commonly used (and commonly hooked) symbols.
Since those libraries are not in the dyld cache, Frida was flagging them as non-system libraries, making Interceptor fail loudly (instead of silently) if no direct import grafts were found in the loaded binaries for those symbols.
This change adds a check for /private/preboot prefix, and now the prefix check is in OR with the dyld cache one instead of being mutually exclusive.
This change is needed because since iOS 17, Xcode can load the
/private/preboot/Cryptexes/OS/usr/lib/libLogRedirect.dylib
library (there’s also a macOS counterpart:/System/Cryptexes/OS/usr/lib/libLogRedirect.dylib
) which uses interposing for wrapping a bunch of commonly used (and commonly hooked) symbols.Since those libraries are not in the dyld cache, Frida was flagging them as non-system libraries, making Interceptor fail loudly (instead of silently) if no direct import grafts were found in the loaded binaries for those symbols.
This change adds a check for
/private/preboot
prefix, and now the prefix check is in OR with the dyld cache one instead of being mutually exclusive.