You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
libwacalls first checks that Cydia Mobile substrate exists by attempting to load and link /usr/lib/libdata.dylib. If it isn’t present<br />
then libwacalls exits. Otherwise execution continues, resulting in the decryption <strong>of</strong> several strings that are used to identify classes<br />
and methods to be hooked.<br />
Libwacalls is responsible for hooking the following methods that belong to the CallManager class:<br />
• setCallConnected<br />
• setCallInterrupted<br />
• setCallInterruptedByPeer<br />
• endCall<br />
The following method is also hooked that belongs to the CallLogger class:<br />
• addCallEvent<br />
All hooks rely on distributed notifications for IPC. As a result all hooks post a system-wide notification, with each notification<br />
containing a unique identifier that notification observers must reference exactly in order to receive. In all cases notification IDs<br />
are 56 characters, likely a sha224 hash digest. The functionality <strong>of</strong> these hooks is as follows:<br />
Hook method Information included in Notification Notification IDs<br />
TECHNICAL ANALYSIS OF PEGASUS SPYWARE | 28
Change language