print [B byte array in frida js script

Question

I'm learning frida and trying to hook a function that looks like:

`.method public final fn()[B`

It returns a byte array. Here's my code:

Java.perform(function () {
    var test = Java.use("com...");
    test.fn.overload().implementation = function () {
        var ret = this.fn();
        console.log("how to write here?");
        return ret;
    };
});

How to print the ret variable returned by the function? It's a byte[]. I tried console.log but it only prints a [object], and hexdump complains 'expected a pointer'. How can I print the array?

Answer 1

　

var ret = this.fn();
var buffer = Java.array('byte', ret);
console.log(buffer.length);
var result = "";
for(var i = 0; i < buffer.length; ++i){
    result+= (String.fromCharCode(buffer[i]));
}
console.log(result);

Answer 2

Frida's java byte array element representation is signed number currently. Therefore, your byte array may contain negative number. We should edit accepted answer to reflect this:

var buffer = Java.array('byte', ret);
var result = "";
for(var i = 0; i < buffer.length; ++i){
    result += (String.fromCharCode(buffer[i] & 0xff)); // here!!
}
console.log(result);

Related https://stackoverflow.com/a/9609447/9304999 and https://github.com/frida/frida/issues/289

Answer 3

One liner console.log(Java.use("java.util.Arrays").toString(ret));

Answer 4

Dump byte-array as hex (Android only)

If you are using Frida on Android there is an alternative, using the Android built-in Apache commons codec Hex encoder. As far as I know all Android versions should include the class org.apache.commons.codec.binary.Hex. Unfortunately the version available in Android does not directly output a String, hence you also have to use java.lang.String class:

function encodeHex(byteArray) {
    const HexClass = Java.use('org.apache.commons.codec.binary.Hex');
    const StringClass = Java.use('java.lang.String');
    const hexChars = HexClass.encodeHex(byteArray);
    return StringClass.$new(hexChars).toString();
}

Answer 5

Easy:

var stringClass = Java.use("java.lang.String");
var stringInstance = stringClass.$new(ret);
console.log('look = ' + stringInstance.toString())