Stealth Inline Hook Detection via LR Return Address

1. Background: Why Traditional Inline Hook Detection Fails

Inline hook detection on Android commonly relies on:

1. CRC or code hash verification

2. Comparing function prologue bytes (e.g., detecting LDR/BR trampolines)

However, these methods have major weaknesses:

• They read code pages, which makes them easily traceable with memory breakpoints.

• Attackers can hook the detection function itself.

• Their “signatures” are well known and easy to bypass.

Thus they are visible and high-risk in real offensive–defensive scenarios.

2. Core Idea: Detecting Hooks via the LR (Return Address)

This article introduces a stealth and cross-platform method that doesn’t read any instructions, doesn’t scan memory, and is extremely difficult for Frida to bypass.

✔ Why LR works

Inline hook frameworks (Frida, Dobby, xhook, etc.) must:

• overwrite the LR register

• redirect RET to a trampoline stored in a custom allocated memory page (not inside the original module)

Thus:

➜ If a function’s LR is outside its module’s memory range → it is inline-hooked.

This approach:

• Does not read .text code section

• Cannot be traced via hardware breakpoints

• Works on ARM64 and x86_64

3. Detection Pipeline

Step 1 — Retrieve current module range

static uint64_t g_begin = 0;
static uint64_t g_end = 0;

__attribute__((constructor))
static void init_module_range() {
    Dl_info info;
    if (dladdr((void*)init_module_range, &info)) {
        g_begin = (uint64_t)info.dli_fbase;
        g_end = g_begin + get_module_size(info.dli_fname);
    }
}

Step 2 — Read LR via ARM64 inline assembly

__attribute__((alwaysinline))
uint64_t get_lr() {
    uint64_t lr;
    asm volatile(
        "mov x10, x29 n"
        "ldr %0, [x10, #8]n"
        : "=r"(lr)
        :
        : "x10"
    );
    return lr;
}

Step 3 — Detect inline hook

void check_inline_hook() {
    uint64_t lr = get_lr();

    if (lr < g_begin || lr > g_end) {
        LOGD("[!] Inline-hook detected. lr = %llx", lr);
    } else {
        LOGD("[+] Function not hooked.");
    }
}

4. Advanced Protection: Stack Corruption & Anti-Analysis

To make debugging nearly impossible:

1. detect hook

2. overwrite stack (FP → FP+2048)

3. jump to an invalid address

void anti_debug_crash() {
    uint64_t fp;
    asm volatile("mov %0, x29" : "=r"(fp));

    memset((void*)fp, 0xCC, 2048);
    ((void(*)())0x12345678)();
}

This destroys stack traces and prevents reverse engineering of your protection logic.

5. Conclusion

This LR-based inline hook detection method:

• does not read code pages

• is nearly breakpoint-proof

• detects Frida, Dobby, xhook, and other trampoline mechanisms

• works on Android and Windows

It offers a new direction for mobile security, anti-cheat systems, and runtime protection.

I’m H.
Six years deep in Android reversing.
Is this sword sharp today?
— H