ios6 - sqlite3_open implementation changed in iOS 6 -

i used cydia substrate hook set of c file io functions: open, read, write, pread, pwrite, lseek... found sqlite3 implementation in ios 4 , 5 call open function file descriptor db file. file descriptor used read/write db when queried/updated.

however when same test ios 6, found open (and other functions: close, fstat) didn't call. i'm sure function hook works because saw open/close/fstat got called in other places.

the following log printed when test ios 6:

ssize_t pread_vg(int, void *, size_t, off_t) fildes=9 nbyte=100 offset = 0 ssize_t pwrite_vg(int, void *, size_t, off_t) fildes=10 nbyte=512 offset = 0 ssize_t pread_vg(int, void *, size_t, off_t) fildes=10 nbyte=8 offset = 512 ssize_t pwrite_vg(int, void *, size_t, off_t) fildes=10 nbyte=12 offset = 0 ssize_t pwrite_vg(int, void *, size_t, off_t) fildes=9 nbyte=4096 offset = 0 ssize_t pwrite_vg(int, void *, size_t, off_t) fildes=9 nbyte=4096 offset = 4096 ssize_t pwrite_vg(int, void *, size_t, off_t) fildes=9 nbyte=4096 offset = 8192  success create table ssize_t pread_vg(int, void *, size_t, off_t) fildes=9 nbyte=100 offset = 0 ssize_t pread_vg(int, void *, size_t, off_t) fildes=9 nbyte=4096 offset = 0 ssize_t pread_vg(int, void *, size_t, off_t) fildes=9 nbyte=16 offset = 24 ssize_t pread_vg(int, void *, size_t, off_t) fildes=9 nbyte=4096 offset = 8192 ssize_t pread_vg(int, void *, size_t, off_t) fildes=9 nbyte=4096 offset = 4096 ssize_t pwrite_vg(int, void *, size_t, off_t) fildes=10 nbyte=512 offset = 0 ssize_t pwrite_vg(int, void *, size_t, off_t) fildes=10 nbyte=4 offset = 512 ssize_t pwrite_vg(int, void *, size_t, off_t) fildes=10 nbyte=4096 offset = 516 ssize_t pwrite_vg(int, void *, size_t, off_t) fildes=10 nbyte=4 offset = 4612 ssize_t pwrite_vg(int, void *, size_t, off_t) fildes=10 nbyte=4 offset = 4616 ssize_t pwrite_vg(int, void *, size_t, off_t) fildes=10 nbyte=4096 offset = 4620 ssize_t pwrite_vg(int, void *, size_t, off_t) fildes=10 nbyte=4 offset = 8716 ssize_t pwrite_vg(int, void *, size_t, off_t) fildes=10 nbyte=4 offset = 8720 ssize_t pwrite_vg(int, void *, size_t, off_t) fildes=10 nbyte=4096 offset = 8724 ssize_t pwrite_vg(int, void *, size_t, off_t) fildes=10 nbyte=4 offset = 12820 ssize_t pread_vg(int, void *, size_t, off_t) fildes=10 nbyte=8 offset = 13312 ssize_t pwrite_vg(int, void *, size_t, off_t) fildes=10 nbyte=12 offset = 0 ssize_t pwrite_vg(int, void *, size_t, off_t) fildes=9 nbyte=4096 offset = 0 ssize_t pwrite_vg(int, void *, size_t, off_t) fildes=9 nbyte=4096 offset = 4096 ssize_t pwrite_vg(int, void *, size_t, off_t) fildes=9 nbyte=4096 offset = 8192  contact added ssize_t pread_vg(int, void *, size_t, off_t) fildes=9 nbyte=100 offset = 0 ssize_t pread_vg(int, void *, size_t, off_t) fildes=9 nbyte=4096 offset = 0 ssize_t pread_vg(int, void *, size_t, off_t) fildes=9 nbyte=16 offset = 24 ssize_t pread_vg(int, void *, size_t, off_t) fildes=9 nbyte=4096 offset = 4096  match found: sandiago 9939182 

below same code, run on ios 5:

int open_vg(const char *, int, ...) path=/var/mobile/applications/b5e571b3-9119-416e-8132-954eb3ae2f05/documents/contacts oflag=514 int open_vg(const char *, int, ...) path=/var/mobile/applications/b5e571b3-9119-416e-8132-954eb3ae2f05/documents/contacts oflag=514 --> 6 int fstat_vg(int, struct stat *) fd=6 --> 0 ssize_t pread_vg(int, void *, size_t, off_t) fildes=6 nbyte=100 offset = 0 ssize_t pread_vg(int, void *, size_t, off_t) fildes=6 nbyte=100 offset = 0 --> 0 int fstat_vg(int, struct stat *) fd=6 --> 0 int fstat_vg(int, struct stat *) fd=6 --> 0 int fstat_vg(int, struct stat *) fd=6 --> 0 int fstat_vg(int, struct stat *) fd=6 --> 0 int fstat_vg(int, struct stat *) fd=6 --> 0 int open_vg(const char *, int, ...) path=/var/mobile/applications/b5e571b3-9119-416e-8132-954eb3ae2f05/documents/contacts-journal oflag=514 int open_vg(const char *, int, ...) path=/var/mobile/applications/b5e571b3-9119-416e-8132-954eb3ae2f05/documents/contacts-journal oflag=514 --> 7 int open_vg(const char *, int, ...) path=/var/mobile/applications/b5e571b3-9119-416e-8132-954eb3ae2f05/documents oflag=0 int open_vg(const char *, int, ...) path=/var/mobile/applications/b5e571b3-9119-416e-8132-954eb3ae2f05/documents oflag=0 --> 8 int open_vg(const char *, int, ...) path=/dev/urandom oflag=0 int open_vg(const char *, int, ...) path=/dev/urandom oflag=0 --> 9 ssize_t read_vg(int, void *, size_t) fildes=9 nbyte=256 --> 256 int close_vg(int) fildes=9 --> 0 ssize_t pwrite_vg(int, void *, size_t, off_t) fildes=7 nbyte=512 offset = 0 ssize_t pwrite_vg(int, void *, size_t, off_t) fildes=7 nbyte=512 offset = 0 --> 512 ssize_t pread_vg(int, void *, size_t, off_t) fildes=7 nbyte=8 offset = 512 ssize_t pread_vg(int, void *, size_t, off_t) fildes=7 nbyte=8 offset = 512 --> 0 int close_vg(int) fildes=8 --> 0 ssize_t pwrite_vg(int, void *, size_t, off_t) fildes=7 nbyte=12 offset = 0 ssize_t pwrite_vg(int, void *, size_t, off_t) fildes=7 nbyte=12 offset = 0 --> 12 ssize_t pwrite_vg(int, void *, size_t, off_t) fildes=6 nbyte=4096 offset = 0 ssize_t pwrite_vg(int, void *, size_t, off_t) fildes=6 nbyte=4096 offset = 0 --> 4096 ssize_t pwrite_vg(int, void *, size_t, off_t) fildes=6 nbyte=4096 offset = 4096 ssize_t pwrite_vg(int, void *, size_t, off_t) fildes=6 nbyte=4096 offset = 4096 --> 4096 ssize_t pwrite_vg(int, void *, size_t, off_t) fildes=6 nbyte=4096 offset = 8192 ssize_t pwrite_vg(int, void *, size_t, off_t) fildes=6 nbyte=4096 offset = 8192 --> 4096 int close_vg(int) fildes=7 --> 0 success create table int close_vg(int) fildes=6 --> 0 int open_vg(const char *, int, ...) path=/var/mobile/applications/b5e571b3-9119-416e-8132-954eb3ae2f05/documents/contacts oflag=514 int open_vg(const char *, int, ...) path=/var/mobile/applications/b5e571b3-9119-416e-8132-954eb3ae2f05/documents/contacts oflag=514 --> 6 int fstat_vg(int, struct stat *) fd=6 --> 0 ssize_t pread_vg(int, void *, size_t, off_t) fildes=6 nbyte=100 offset = 0 ssize_t pread_vg(int, void *, size_t, off_t) fildes=6 nbyte=100 offset = 0 --> 100 int fstat_vg(int, struct stat *) fd=6 --> 0 int fstat_vg(int, struct stat *) fd=6 --> 0 ssize_t pread_vg(int, void *, size_t, off_t) fildes=6 nbyte=4096 offset = 0 ssize_t pread_vg(int, void *, size_t, off_t) fildes=6 nbyte=4096 offset = 0 --> 4096 int fstat_vg(int, struct stat *) fd=6 --> 0 ssize_t pread_vg(int, void *, size_t, off_t) fildes=6 nbyte=16 offset = 24 ssize_t pread_vg(int, void *, size_t, off_t) fildes=6 nbyte=16 offset = 24 --> 16 int fstat_vg(int, struct stat *) fd=6 --> 0 int fstat_vg(int, struct stat *) fd=6 --> 0 ssize_t pread_vg(int, void *, size_t, off_t) fildes=6 nbyte=4096 offset = 8192 ssize_t pread_vg(int, void *, size_t, off_t) fildes=6 nbyte=4096 offset = 8192 --> 4096 ssize_t pread_vg(int, void *, size_t, off_t) fildes=6 nbyte=4096 offset = 4096 ssize_t pread_vg(int, void *, size_t, off_t) fildes=6 nbyte=4096 offset = 4096 --> 4096 int open_vg(const char *, int, ...) path=/var/mobile/applications/b5e571b3-9119-416e-8132-954eb3ae2f05/documents/contacts-journal oflag=514 int open_vg(const char *, int, ...) path=/var/mobile/applications/b5e571b3-9119-416e-8132-954eb3ae2f05/documents/contacts-journal oflag=514 --> 7 int open_vg(const char *, int, ...) path=/var/mobile/applications/b5e571b3-9119-416e-8132-954eb3ae2f05/documents oflag=0 int open_vg(const char *, int, ...) path=/var/mobile/applications/b5e571b3-9119-416e-8132-954eb3ae2f05/documents oflag=0 --> 8 ssize_t pwrite_vg(int, void *, size_t, off_t) fildes=7 nbyte=512 offset = 0 ssize_t pwrite_vg(int, void *, size_t, off_t) fildes=7 nbyte=512 offset = 0 --> 512 ssize_t pwrite_vg(int, void *, size_t, off_t) fildes=7 nbyte=4 offset = 512 ssize_t pwrite_vg(int, void *, size_t, off_t) fildes=7 nbyte=4 offset = 512 --> 4 ssize_t pwrite_vg(int, void *, size_t, off_t) fildes=7 nbyte=4096 offset = 516 ssize_t pwrite_vg(int, void *, size_t, off_t) fildes=7 nbyte=4096 offset = 516 --> 4096 ssize_t pwrite_vg(int, void *, size_t, off_t) fildes=7 nbyte=4 offset = 4612 ssize_t pwrite_vg(int, void *, size_t, off_t) fildes=7 nbyte=4 offset = 4612 --> 4 ssize_t pwrite_vg(int, void *, size_t, off_t) fildes=7 nbyte=4 offset = 4616 ssize_t pwrite_vg(int, void *, size_t, off_t) fildes=7 nbyte=4 offset = 4616 --> 4 ssize_t pwrite_vg(int, void *, size_t, off_t) fildes=7 nbyte=4096 offset = 4620 ssize_t pwrite_vg(int, void *, size_t, off_t) fildes=7 nbyte=4096 offset = 4620 --> 4096 ssize_t pwrite_vg(int, void *, size_t, off_t) fildes=7 nbyte=4 offset = 8716 ssize_t pwrite_vg(int, void *, size_t, off_t) fildes=7 nbyte=4 offset = 8716 --> 4 ssize_t pwrite_vg(int, void *, size_t, off_t) fildes=7 nbyte=4 offset = 8720 ssize_t pwrite_vg(int, void *, size_t, off_t) fildes=7 nbyte=4 offset = 8720 --> 4 ssize_t pwrite_vg(int, void *, size_t, off_t) fildes=7 nbyte=4096 offset = 8724 ssize_t pwrite_vg(int, void *, size_t, off_t) fildes=7 nbyte=4096 offset = 8724 --> 4096 ssize_t pwrite_vg(int, void *, size_t, off_t) fildes=7 nbyte=4 offset = 12820 ssize_t pwrite_vg(int, void *, size_t, off_t) fildes=7 nbyte=4 offset = 12820 --> 4 ssize_t pread_vg(int, void *, size_t, off_t) fildes=7 nbyte=8 offset = 13312 ssize_t pread_vg(int, void *, size_t, off_t) fildes=7 nbyte=8 offset = 13312 --> 0 int close_vg(int) fildes=8 --> 0 ssize_t pwrite_vg(int, void *, size_t, off_t) fildes=7 nbyte=12 offset = 0 ssize_t pwrite_vg(int, void *, size_t, off_t) fildes=7 nbyte=12 offset = 0 --> 12 ssize_t pwrite_vg(int, void *, size_t, off_t) fildes=6 nbyte=4096 offset = 0 ssize_t pwrite_vg(int, void *, size_t, off_t) fildes=6 nbyte=4096 offset = 0 --> 4096 ssize_t pwrite_vg(int, void *, size_t, off_t) fildes=6 nbyte=4096 offset = 4096 ssize_t pwrite_vg(int, void *, size_t, off_t) fildes=6 nbyte=4096 offset = 4096 --> 4096 ssize_t pwrite_vg(int, void *, size_t, off_t) fildes=6 nbyte=4096 offset = 8192 ssize_t pwrite_vg(int, void *, size_t, off_t) fildes=6 nbyte=4096 offset = 8192 --> 4096 int close_vg(int) fildes=7 --> 0 contact added int close_vg(int) fildes=6 --> 0 int open_vg(const char *, int, ...) path=/var/mobile/applications/b5e571b3-9119-416e-8132-954eb3ae2f05/documents/contacts oflag=514 int open_vg(const char *, int, ...) path=/var/mobile/applications/b5e571b3-9119-416e-8132-954eb3ae2f05/documents/contacts oflag=514 --> 6 int fstat_vg(int, struct stat *) fd=6 --> 0 ssize_t pread_vg(int, void *, size_t, off_t) fildes=6 nbyte=100 offset = 0 ssize_t pread_vg(int, void *, size_t, off_t) fildes=6 nbyte=100 offset = 0 --> 100 int fstat_vg(int, struct stat *) fd=6 --> 0 int fstat_vg(int, struct stat *) fd=6 --> 0 ssize_t pread_vg(int, void *, size_t, off_t) fildes=6 nbyte=4096 offset = 0 ssize_t pread_vg(int, void *, size_t, off_t) fildes=6 nbyte=4096 offset = 0 --> 4096 int fstat_vg(int, struct stat *) fd=6 --> 0 ssize_t pread_vg(int, void *, size_t, off_t) fildes=6 nbyte=16 offset = 24 ssize_t pread_vg(int, void *, size_t, off_t) fildes=6 nbyte=16 offset = 24 --> 16 int fstat_vg(int, struct stat *) fd=6 --> 0 int fstat_vg(int, struct stat *) fd=6 --> 0 ssize_t pread_vg(int, void *, size_t, off_t) fildes=6 nbyte=4096 offset = 4096 ssize_t pread_vg(int, void *, size_t, off_t) fildes=6 nbyte=4096 offset = 4096 --> 4096 match found: bukit merah view 84049398 int close_vg(int) fildes=6 --> 0 

it's obvious call pread/pwrite on 2 file descriptors 9 , 10 (which think db , db-journal file). how did file descriptor without calling open?

i tried looking libsqlite3.dylib, there no open function in imported symbol list, instead there guarded_open_np. suspect in ios 4 , ios 5, guarded_open_np built using open. in ios 6, may implemented without using open more.