Since apparently it can be rooted without affecting the listening process, it should be possible to monitor writes in pure software.

Of course, it may detect the monitoring and avoid writing in those cases /tinfoil