Hooking iOS Lock Screen Notifications with Cycript and THEOS to Auto‑Send Emails

After obtaining root access on an iPhone, the author wanted to trigger an app from the lock screen, which led to the development of a jailbreak utility that simulates location‑based wake‑up and later evolved into a lock‑screen notification hook.

Initial attempts to hook SMS‑related classes such as MobileSMS , commoncenter , imagent , MessagesNotificationViewService , and MessagesViewService failed to reveal useful methods, so the focus shifted to the SpringBoard lock‑screen notification view.

Using the tool Cycript , the author entered the running SpringBoard process, printed the current keyWindow , and discovered the SBLockScreenNotificationTableView class, which holds each notification as a table‑view cell.

Cycript commands such as choose(UILabel) and recursiveDescription helped locate the specific label containing the text "10086" and trace its nextResponder chain up to the table view:

cy# choose(UILabel)

# "<UILabel: 0x13eedefb0; frame = (52 12.6667; 42.3333 18); text = '10086'..."

cy# [#0x13eedefb0 nextResponder].nextResponder() .nextResponder() .nextResponder() .nextResponder()
# "<SBLockScreenNotificationTableView: 0x13e5d3200; ...>"

Having identified the class, the author used THEOS to generate a tweak project targeting SpringBoard. The generated Tweak.xm file hooks SBLockScreenNotificationTableView , storing its delegate and dataSource for later use.

static id <UITableViewDataSource> theDataSource;
static id <UITableViewDelegate> theDelegate;
%hook SBLockScreenNotificationTableView
- (void)setDelegate:(id)orgDlg {
    %orig;
    theDelegate = orgDlg;
}
- (void)setDataSource:(id)orgDS {
    %orig;
    theDataSource = orgDS;
}
%end

The crucial method - (void)insertRowsAtIndexPaths:withRowAnimation: is hooked to detect when a new notification cell is added. The hook retrieves the cell via the saved data source, checks if it is an SBLockScreenBulletinCell , extracts the sender and message, and then sends the information by email.

- (void)insertRowsAtIndexPaths:(NSArray<NSIndexPath *> *)indexPaths withRowAnimation:(UITableViewRowAnimation)animation {
    %orig;
    NSIndexPath *lastIndexPath = [indexPaths firstObject];
    id cell = [theDataSource tableView:(UITableView *)self cellForRowAtIndexPath:lastIndexPath];
    if ([cell isKindOfClass:NSClassFromString(@"SBLockScreenBulletinCell")]) {
        // extract message details and send email
    }
}

Because iOS provides no public API for silent email sending, the tweak uses private classes from MIME.framework —specifically MFMessageWriter , MFMutableMessageHeaders , and MFMailDelivery —to compose and deliver the email without user interaction.

if (!shouldIgnore) {
    static NSString *xl_subject = @"iPhone unread messages";
    static NSString *xl_mailTo = @"[email protected]";
    static NSString *xl_mailBy = @"Yang Xinlei
";
    if ([xl_relativeDate isEqualToString:@"now"]) {
        MFMessageWriter *messageWriter = [[%c(MFMessageWriter) alloc] init];
        MFMutableMessageHeaders *headers = [[%c(MFMutableMessageHeaders) alloc] init];
        [headers setHeader:xl_subject forKey:@"subject"];
        [headers setAddressListForTo:@[xl_mailTo]];
        [headers setAddressListForSender:@[xl_mailBy]];
        MFOutgoingMessage *message = [messageWriter createMessageWithString:[NSString stringWithFormat:@"Source:%@\nContent:%@", xl_sender, xl_message] headers:headers];
        MFMailDelivery *messageDelivery = [%c(MFMailDelivery) newWithMessage:message];
        [messageDelivery deliverAsynchronously];
    }
}

The result is an automatically triggered email containing the lock‑screen notification content, demonstrating how a jailbreak tweak can turn the lock screen into a remote‑control entry point for various custom actions.