That's nice. I did something similar a while ago, together with mach_override, to hook into some functions, like ___NSAutoreleaseNoPool or ___THE_PROCESS_HAS_FORKED_AND_YOU_CANNOT_USE_THIS_COREFOUNDATION_FUNCTIONALITY___YOU_MUST_EXEC__, for debugging purpose.