HookCase not loading libraries on processes directly started by launchd
jslegendre opened this issue · comments
I have noticed that HookCase gives a ‘cast_hook_flying’ error that the library could not be found or loaded only on daemons and xpcproxy. Any process that execs over xpcproxy still works though. I’m on 10.15.3 and it could be just me but if someone could let me know whether this is happening to them or not, I could gauge how to proceed. Thanks!
Do you get any other interesting Console errors when you filter on "hook"?
If you work around issue #14 by using my first patch there and don't fully disable system integrity protection (by using csrutil disable), the xpcproxy errors are expected. I don't know what you mean by "on daemons".
It'll probably be next week before I have time to spend on this bug.
Ahh, I should have mentioned... this is happening with a clean version of HookCase with SIP fully disabled. And by daemons I mean services managed by launchservices like Dock, pkd, and amfid. Those don't seem to get 'hooked'. It's very odd.
Ok, so even more strange is that Finder can be 'hooked' but Dock cannot even though both are system services, not sandboxed, and signed by Apple.
Never mind. Nothing wrong with HC in this case. It's something about the library I am loading. Carry on