javascriptjavaandroidsecurityfrida

Frida - access to a class attribute that has the desired type


I have an android program that has been obfuscated. And in this program classes have attributes with the same name. Decompiled code like this

public class d implements c
{
    public int a;
    public Cache$Entry a;
    public Cache a;
    public volatile a a;
    public e a;
    public ByteArrayOutputStream a;
    public volatile AtomicBoolean a;

or smali code like this

# interfaces
.implements Le/a/x/c;
# instance fields
.field public a:I
.field public a:Lanetwork/channel/cache/Cache$Entry;
.field public a:Lanetwork/channel/cache/Cache;
.field public volatile a:Ld/a/w/a;
.field public a:Le/a/x/e;
.field public a:Ljava/io/ByteArrayOutputStream;
.field public volatile a:Ljava/util/concurrent/atomic/AtomicBoolean;  

I create a hook to one method asd() and i need to access to attribute "a" of this class. But I need attribute "a" with type "e.a.x.e"

Java.perform(function () {
   var var_ddd = Java.use("e.a.x.d");
    var_ddd.asd.implementation = function() {
       this.asd();
       console.log("e.a.x.d.asd()",Java.cast(this.a.value,Java.use("e.a.x.e")));
    };
});

When I try to write this.a.value - I get a wrong attribute. When I write Java.cast(this.a.value,Java.use("e.a.x.e")) I get message

TypeError: cannot read property 'hasOwnProperty' of undefined

Please tell me how to get the right attribute with the right type


Solution

  • Thanks to Robert, a solution was found.The code made minor corrections

    var lo_fld_eaxe;
    var lv_found = false;
    var lt_fields = this.getClass().getDeclaredFields();
    for (var i = 0; i < lt_fields.length && lv_found == false; i++) {
        if(lt_fields[i].getName().toString() == 'a' &&  lt_fields[i].getType().getName().toString() == 'e.a.x.e' ){
           lo_fld_eaxe = lt_fields[i];
           lv_found = true; 
      }
    }
    if(lv_found == true) {
       lo_fld_eaxe.setAccessible(true);
       try{ 
              var       lv_e_a_x_e = lo_fld_eaxe.get(this);   
       }
       catch(err){
              console.log("Error:"+err);
       }
     }