Hook iOS BSD socket connect method to get local and remote port - ios

Question

I tried to hook iOS socket connect method to get the information of connected ports between the local host and remote server.
However, from the socket struct sockaddr, the sa_family is always AF_SYSTEM(kernel event message).
Hood code:
int (*origin_connect)(int socket, const struct sockaddr *address, socklen_t address_len);
int replaced_connect(int socket, const struct sockaddr *address, socklen_t address_len) {
int r = origin_connect(socket, address, address_len);
sa_family_t f = address->sa_family;
NSLog(#"CONNECT FAMILY %d", f);
if (f == AF_INET) {
struct sockaddr_in *addr = (struct sockaddr_in *)address;
NSString *remote_ip = [[NSString alloc]initWithCString:inet_ntoa(addr->sin_addr) encoding:NSUTF8StringEncoding];
uint16_t remote_port = ntohs(addr -> sin_port);
NSLog(#"The CONNECT ip = %# port = %u", remote_ip, remote_port);
struct sockaddr local_address;
socklen_t addr_size = sizeof(local_address);
getsockname(socket, &local_address, &addr_size);
struct sockaddr_in *laddr = (struct sockaddr_in*)&local_address;
NSString *local_ip = [[NSString alloc]initWithCString:inet_ntoa(laddr->sin_addr) encoding:NSUTF8StringEncoding];
uint16_t local_port = ntohs(laddr->sin_port);
NSLog(#"The CONNECT Local ip = %# port = %u", local_ip, local_port);
} else if (f == AF_SYSTEM) {
NSLog(#"hello there :(");
struct sockaddr_ctl * ctl = (struct sockaddr_ctl *)address;
}
return r;
}
Did I hook wrong method or is there any other way to get the connected ports information?

Answer 1

You're getting AF_SYSTEM hooked because when apps start, they also call on a system socket. If you allow your hook to just ignore that, the next calls should intercept TCP/IP Sockets.
There are, by the way, much better ways to do that. You can externally get information of connected sockets and even notifications, by using com.apple.network.statistics. A full sample of how to do so is at http://newosxbook.com/src.jl?tree=listings&file=lsock.c