How to Detect and Block Memory Injection Attacks on iOS, Android apps

Memory injection is a common method used to dynamically instrument mobile apps in order to change their behavior or logic. Cyber-criminals often use a dynamic instrumentation tool such as Frida to inspect functions as they are called, modify their arguments, and perform custom calls to functions inside a target process – all while the app is running.

Memory injection is also a common game cheating method that involves altering the running memory of a mobile game dynamically while the game is running. Memory injection can be used to cheat in mobile games by altering game scores, in-app values, player attributes and other game behaviors by creating a new memory-mapped region that can be executed, or a function hook.  The fraudster first scans the memory of the game to learn where certain values or game states are stored. Then they can use a tool like Frida to hook into the application (function hooking or method hooking) to interact with the running processes and inject their own JavaScript code which alters the game’s memory. Memory editing can be done for any mobile game where the player’s actions are stored in local memory, which is true for most mobile games.