Pointer Guards

TIL_GUARD_PTR

Signature

TIL_GUARD_PTR(pkg, ptr)

Returns ptr unchanged when licensed. When not, XORs it with a mask that moves it into non-canonical address space, so using it faults rather than quietly working on real data.

The type is preserved, so this can wrap a pointer in place without casting.

Objective-C

MyState *s = TIL_GUARD_PTR("com.example.mytweak", shared_state);

The point is where the failure lands. A licence check that returns early leaves the rest of the function untouched and easy to reach by skipping the return. A poisoned pointer fails at the moment it is used, inside the work, with nothing to skip.

TIL_HOOK

Signature

TIL_HOOK(pkg, sym, rep, res)

Installs a hook only when licensed. Licensed, it forwards to MSHookFunction(sym, rep, res). Unlicensed, the replacement pointer is poisoned and the call is routed to an inert stub, so nothing is installed at all.

Name	Description
`pkg`	Your package identifier.
`sym`	The function being hooked.
`rep`	Your replacement.
`res`	Out pointer for the original, for chaining.

Objective-C

static void (*orig_draw)(void *);
static void my_draw(void *ctx) { orig_draw(ctx); }

TIL_HOOK("com.example.mytweak", draw, my_draw, &orig_draw);

Not installing is meaningfully better than installing and then doing nothing. A hook that is present but inert is still visible in the process and still tells anyone looking exactly which function you cared about.

MSHookFunction comes from ellekit, which TweakInject installs at /Library/TweakInject/TI_Ellekit.dylib. The macro expands to a reference to it, so link it as usual.