instrumentation

EDR products, profilers, game cheats and banking trojans all use the same trick: make a call to function A run your code first. Knowing the mechanics tells you both how to detect it and why user-mode hooks are a weak place for security controls.

Most mobile findings do not need root at all. The ones that do usually point to the same conclusion: the server must not trust the client.