Frida manipulating arguments - Android

Question

I've attempting to learn how to use Frida to instrument android app, just for person interest.

So far I've managed to get my environment set up with a physical android tablet and I can successfully run the example on Frida's website. In addition to changing variables in the method I want to change the arugment passed to the method. I know how to do this with Xposed but I'm not sure with Frida.

Generic Question: How can the arugments passed to method be maniputed with Frida and what is good souce of documentation and examples for Frida?

---

More specific question:

I wanted something that was more of a challenge so I moved onto Snapchat. My aim is to emulate the speed spoofing feature of the SnapPrefs Xposed module as this seemed fairly simple to do and its effect can be easily seen in the app. I looked through the SnapPrefs souce and found that I need to hook the "adL" class and change the argument passed to the "a" method.

The code for the method in the APK is:

public final void a(float paramFloat) { .... }

I'm using this JavaScript code in order to print "Speed showing" to the screen whenever the method is active.

Java.perform(function () {
// Function to hook is defined here
var SpeedometerView = Java.use('adL');

// Whenever button is clicked
SpeedometerView.a.overload('float').implementation = function (v) {
    // Show a message to know that the function got called
    send('Speed showing');

    // Call the original onClick handler
    this.a.overload('float');
};
});

So from this: What would be the easiest way to manipulate the paramFloat argument?

Answer 1

If I understand your question correctly, you want to change the parameter, v, inside the inner function. Right? If that's the case, you would already have access to the v argument inside your inner function. So what you can do is something like this:

Java.perform(function () {
// Function to hook is defined here
var SpeedometerView = Java.use('adL');

// Whenever button is clicked
SpeedometerView.a.overload('float').implementation = function (v) {
    // Show a message to know that the function got called
    send('Speed showing');
    old_param_value = v;
    new_param_value = 100.00;
    // Call the original onClick handler
    x = this.a(new_param_value);
};
});

also, assuming you wanted to change the value of the param from whatever exiting to 100.00 return x if needed.

However, if you are looking to do this dynamically, like say based on user input etc., at run time, I do not know how to do it. In fact, I would be keeping an eye out for it if someone answers that !

In fact I tried things like this:

s4.js

Java.perform(
 function()
 {
   var item = Java.use("java.util.Random");
   console.log("Found random loaded");
   item.nextInt.overload("int").implementation = function(a)
   {
     var ret = this.nextInt(a);
     send("[*] The random no " + ret.toString());
     recv(function (received_json_object) {
           cheat_num = received_json_object.my_data
           console.log("[*] Cheated bot number received " + cheat_num);            
       }).wait();
     return cheat_num;
   }
 }
);

not_working.py

import time
import frida

def my_message_handler(message, payload):
   print message.get('payload')

   if message["type"] == "send":
       print "in here"      
       place_bot_chic_at = raw_input("Give the index where bot chicken should be placed ")
       print "bot chick will be placed at " + str(place_bot_chic_at)
       # script.post({"my_data": 7331}) # This works perfectly fine.
       script.post({"my_data": place_bot_chic_at}) # This gives error as :
       print "Bot chick position sent"

device = frida.get_device_manager().enumerate_devices()[-1]
pid = device.spawn(["chicken.wars.main"])
device.resume(pid)
time.sleep(1)  
session = device.attach(pid)
with open("s4.js") as f:
   jss = f.read()
   script = session.create_script(jss)

script.on("message", my_message_handler) #register the message handler
script.load()
raw_input()

But when I run that python, I get the following error:

lib/python2.7/site-packages/frida/core.py", line 298, in _on_message
  callback(message, data)
File "not_working.py", line 12, in my_message_handler
  script.post({"my_data": place_bot_chic_at}) # This gives error as :
AttributeError: 'NoneType' object has no attribute 'post'

Also, strangely, the moment after the in here string gets printed, I was expecting the user input line to be executed next. But that does not happen unless I press an enter. As soon as I press enter, the user input line place_bot_chic_at = raw_input("Give the index where bot chicken should be placed ") gets executed. I give a value and enter and that's when the above error occurs. I have no idea what is going wrong. If someone does, please help understand where am I going wrong.