// the find
asLody/whale
Hook Framework for Android/IOS/Linux/MacOS
Whale is a cross-platform inline hook framework targeting Android, iOS, Linux, and macOS across ARM/ARM64/x86/x86_64. It handles the hard parts: pcrel instruction rewriting, ART method hooking with an Xposed-compatible API, and a built-in JIT for generating trampoline code at runtime. Aimed at Android reverse engineers, security researchers, and anyone building sandboxes or hotfix systems.
The pcrel instruction rewriter is the real differentiator — correctly relocating PC-relative instructions when patching is where most naive hook frameworks break, and Whale handles it per-architecture with dedicated decoder/rewriter pairs. Bundling a partial libffi and VIXL assembler means you get a proper code generation pipeline rather than hand-rolled shellcode arrays. The Xposed-compatible Java API is a practical decision: it lets existing Xposed modules be ported with minimal changes. ART internals are handled through symbol resolution rather than hardcoded offsets, which is more resilient across Android versions than the alternative.
Dead since December 2020 — the repo hasn't been touched in over five years, and Android's ART has changed significantly since Android 9. Android 10+ brought changes to hidden API enforcement, ART method layout, and JIT compilation that are almost certainly unhandled. The iOS story is half-finished: inline hooks only work in debug builds on non-jailbreak devices, and the promised 'Binary Static Inline Hook' to fix this was never open-sourced. There are essentially no tests — two test files exist, neither covers the instruction rewriters for edge cases like multi-instruction pcrel sequences. Documentation is thin enough that you'll be reading source to understand hook semantics.