androidreversingfrida

Frida print all variables in class


Hy my professor asked how you can print the contents of the variables within a class he provided us with an apk to be launched and analyzed with frida:

package com.test_uni_apk.lib.proftest;


 public class ProfApi{


  public static class StateReady
  extends ProfApi.CallState
  {


  public CallStateReady() {}

  public CallStateReady(ProfApi.CallProc paramCallProc, 
    ProfApi.CallConnection[] paramArrayOfCallConnection, String 
     paramString, byte[] paramArrayOfByte, String[] paramArrayOfString)
   {

  this.printthis = paramArrayOfCallConnection;

  }


 }


}

I read that with frida you can hook a class but I do not understand how to print the value of printthis.


Solution

  • I will assume CallStateReady is an inner class of com.test_uni_apk.lib.proftest.ProfApi and you want to hook the c'tor and print the second parameter #PleaseSubmitElegantCode

    function printParamArrayOfCallConnection() {
        var ArrayList = Java.use("java.util.ArrayList");
        var CallConnection = Java.use("com.test_uni_apk.lib.proftest.ProfApi$CallConnection");
        Java.use("com.test_uni_apk.lib.proftest.ProfApi$CallStateReady") // dollar sign for inner class
            .$init // init represent the constructor
            // list of arguments are passed in byte code style, [B represents byte array
            // when you try to hook Frida will provide an informative error with all the possible arguments for overloading
            // copy & paste the right one which will look like this:
            .overload("Lcom..ProfApi.CallProc;", "Lcom...ProfApi.CallConnection;", "java.lang.String", "[B", "Ljava.lang.String;")
            .implementation = function(paramCallProc, paramArrayOfCallConnection, paramString, paramArrayOfByte, paramArrayOfString) {
                // first we cast to list
                var list = Java.cast(paramArrayOfCallConnection, ArrayList);
                // iterating the list
                for (var i = 0, l = list.size(); i < l; i++) {
                    // casting each element to the object we created earlier
                    var currentElement = Java.cast(list.get(i), CallConnection);
                    // printing to terminal
                    console.log(i, currentElement);
                }
                // executing original c'tor 
                this.$init(paramCallProc, paramArrayOfCallConnection, paramString, paramArrayOfByte, paramArrayOfString);
            }
    }
    Java.perform(printParamArrayOfCallConnection);