How to detect in a jailbreak tweak AVCaptureSession start and get which app started it?

Question

Basically, I want to know when a user is presented the camera feed and from which app this was triggered.

I tried to hook in AVCaptureSession's -(void)startRunning;

but

SBApplication *topApp = [(SpringBoard *)[UIApplication sharedApplication] _accessibilityFrontMostApplication];

is not working. It turns out that calling sharedApplication returns null. I've also tried calling the method on %c(SpringBoard) or objc_getClass("SpringBoard") but had the same result.

Besides this, the hook works only when opening the camera in the Messages app, although I specified in the Filters dictionary several bundles like com.apple.springboard, com.facebook.Facebook etc.

What am I doing wrong? Isn't AVCaptureSession API used by other apps ?

Answer 1

The SpringBoard class only exists in the SpringBoard process therefore %c(SpringBoard) or objc_getClass("SpringBoard") will return nil on any other process.

To get the current bundle name of the applications you are hooking, you can use [[NSBundle mainBundle] bundleIdentifier]. You'd have to use some form of IPC/XPC to send this information as well as additional information regarding the session that you want to know about. The receiving end could be either the SpringBoard process or a personal daemon so as to not clog SpringBoard with additional tasks.

As for your question "Isn't AVCaptureSession API used by other apps ?", it is possible that some applications use other classes to capture images/video rendering this hook useless. As a jailbreak developer I have found, as many others, that Apple programmers don't adhere to a strict coding style. There can also be other lower level functions that achieve the same purpose, in which case you would have more work to do as there is no class-dump parallel to C functions.

Answer 2

The most obvious thing would be to load your hook into every application. To achieve that you could use com.apple.UIKit as bundle filter. That way your hook will be loaded into every application where you would hook AVCaptureSession -(void)startRunning or UIImagePickerController methods to detect camera usage.

The problem with this - you have to implement some IPC mechanism to send notifications with user info from within sandboxed application. I don't know of any IPC API that could send those. Distributed notifications can't send user info with notifications from sandboxed app - it must be empty. Darwin notification center doesn't support user info. CFMessagePort also doesn't work. May be XPC does but I didn't tried it.

One possible solution is to find directory where even sandboxed app has write permissions (http://iphonedevwiki.net/index.php/Seatbelt). That way you could create a file in that directory with some data and send Darwin notification to your, let's say, daemon that will be observing these notifications. This daemon then will find the file and read the data you "attached" to your notification.

As for "lower level functions" to access camera. Basically, there are two ways you could access camera - AVCaptureSession and UIImagePickerController. Those are the only public APIs available for AppStore apps. If we are talking about cydia apps/tweaks, I don't think anyone would bother when you have AVFoundation APIs.