I did something similar but for macOS. I used Frida, a really easy toolkit for intercepting native calls. Information: https://github.com/kendfinger/AppleCache

I did something similar but for macOS. I used Frida, a really easy toolkit for intercepting native calls. Information: https://github.com/kendfinger/AppleCache#methodology https://github.com/kendfinger/AppleCache#methodology Tools: https://github.com/kendfinger/AppleCache/tree/master/tools https://github.com/kendfinger/AppleCache/tree/master/tools