Need help with fishhook?
Click the “chat” button below for chat support from the developer who created it, or find similar developers for support.

About the developer

4.6K Stars 806 Forks BSD 3-Clause "New" or "Revised" License 41 Commits 30 Opened issues


A library that enables dynamically rebinding symbols in Mach-O binaries running on iOS.

Services available


Need anything else?

Contributors list


fishhook is a very simple library that enables dynamically rebinding symbols in Mach-O binaries running on iOS in the simulator and on device. This provides functionality that is similar to using

on OS X. At Facebook, we've found it useful as a way to hook calls in libSystem for debugging/tracing purposes (for example, auditing for double-close issues with file descriptors).


Once you add

to your project, you can rebind symbols as follows: ```Objective-C



import "AppDelegate.h"

import "fishhook.h"

static int (orig_close)(int); static int (orig_open)(const char *, int, ...);

int myclose(int fd) { printf("Calling real close(%d)\n", fd); return origclose(fd); }

int myopen(const char *path, int oflag, ...) { valist ap = {0}; mode_t mode = 0;

if ((oflag & OCREAT) != 0) { // mode only applies to OCREAT vastart(ap, oflag); mode = vaarg(ap, int); vaend(ap); printf("Calling real open('%s', %d, %d)\n", path, oflag, mode); return origopen(path, oflag, mode); } else { printf("Calling real open('%s', %d)\n", path, oflag); return orig_open(path, oflag, mode); } }

int main(int argc, char * argv[]) { @autoreleasepool { rebindsymbols((struct rebinding[2]){{"close", myclose, (void *)&origclose}, {"open", myopen, (void *)&orig_open}}, 2);

// Open our own binary and print out first 4 bytes (which is the same
// for all Mach-O binaries on a given architecture)
int fd = open(argv[0], O_RDONLY);
uint32_t magic_number = 0;
read(fd, &magic_number, 4);
printf("Mach-O Magic Number: %x \n", magic_number);

return UIApplicationMain(argc, argv, nil, NSStringFromClass([AppDelegate class]));

} } ```

Sample output

Calling real open('/var/mobile/Applications/161DA598-5B83-41F5-8A44-675491AF6A2C/', 0)
Mach-O Magic Number: feedface 
Calling real close(3)

How it works

binds lazy and non-lazy symbols by updating pointers in particular sections of the
segment of a Mach-O binary. fishhook re-binds these symbols by determining the locations to update for each of the symbol names passed to
and then writing out the corresponding replacements.

For a given image, the

segment may contain two sections that are relevant for dynamic symbol bindings:
is an array of pointers to non-lazily bound data (these are bound at the time a library is loaded) and
is an array of pointers to imported functions that is generally filled by a routine called
during the first call to that symbol (it's also possible to tell
to bind these at launch). In order to find the name of the symbol that corresponds to a particular location in one of these sections, we have to jump through several layers of indirection. For the two relevant sections, the section headers (
struct section
s from
) provide an offset (in the 
field) into what is known as the indirect symbol table. The indirect symbol table, which is located in the
segment of the binary, is just an array of indexes into the symbol table (also in
) whose order is identical to that of the pointers in the non-lazy and lazy symbol sections. So, given
struct section nl_symbol_ptr
, the corresponding index in the symbol table of the first address in that section is
. The symbol table itself is an array of
struct nlist
s (see
), and each 
contains an index into the string table in
which where the actual symbol names are stored. So, for each pointer
, we are able to find the corresponding symbol and then the corresponding string to compare against the requested symbol names, and if there is a match, we replace the pointer in the section with the replacement.

The process of looking up the name of a given entry in the lazy or non-lazy pointer tables looks like this: Visual explanation

We use cookies. If you continue to browse the site, you agree to the use of cookies. For more information on our use of cookies please see our Privacy Policy.