Skiptracing: Reversing Spotify.app

If we load the Spotify binary into IDA (free version of course) and search for this string, we find the corresponding method:
Partial disassembly for startWatchingMediaKeysIf we look at this corresponding source code for this function, we find the interesting parameter tapEventCallback to the CGEventTapCreate function:
Source code for startWatchingMediaKeysIf we look back at the disassembly, we can see that the sub_10010C230 subroutine is passed as the tapEventCallback parameter. If we look at either the source code or disassembly of this function, we see that only one library function, CGEventTapEnable is called:
CGEventTapEnable called in tapEventCallbackLet’s try to hook this function. Finding sub_100CC2E20
Now that we have a way to hook into any function within the Spotify binary, there’s only one question remaining… Where?

Source: medium.com