# Hook detection

The application can be analysed or modified even though its source code has not been changed, applying a technique known as hooking. This technique can be used to intercept system or application calls and then modify them. An attacker can exploit this by inserting new (often malicious) code or by altering existing one to obtain personal client data. The most well-known hooking frameworks are [Frida](https://frida.re/), [Xposed](https://github.com/LSPosed/LSPosed), or [Cydia Substrate](http://www.cydiasubstrate.com/).

{% hint style="info" %}
Learn more about [hook detection](broken://spaces/KBmBODjLkEFQ9aOt3xT8/pages/RS7vhHfrbUiYnr2RZCmg) in our glossary.
{% endhint %}

Below are code snippets demonstrating hook detection across various platforms:

```dart
// Android hook check
override fun onHookDetected() {
    TODO("Not yet implemented")
}

// iOS hook detection
case runtimeManipulation

// Flutter hook and runtime manipulation detection
onHooks: () => print("Hooks")

// Cordova hook and runtime manipulation detection
hooks: () => {
    // Place your reaction here
}

// React Native hook and runtime manipulation detection
hooks: () => {
    // Place your reaction here
}

// Capacitor hook and runtime manipulation detection
hooks: () => {
    // Place your reaction here
}
```

{% hint style="info" %}
**Recommended action:** Notify users that their device or app is insecure and log the event on your BE. In some cases, it is recommended to even kill the application.
{% endhint %}


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.talsec.app/freerasp/freerasp/wiki/threat-detection/hook-detection.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.