I'm trying to get the return value of a android native function call using Frida but with no success:

Interceptor.attach(Module.getExportByName('lib.so', 'Token'), {
    onEnter: function(args) {
    onLeave: function(retval) {

I know that the value is a bytearray but I can't find a way to read it from the native pointer.

Can anyone point me in the right direction? What should I do the get the value from retval? I already tried to use cast, but it didn't work.



1 Answer 1


I just needed to cast to array buffer:

        var b = Java.use('[B')
        var buffer = Java.cast(retval, b);
        var result = Java.array('byte', buffer);

        var str_ = "";
        for (var i=0; i < result.length; i++) {
            str_ += String.fromCharCode(result[i]);     

        console.log("String: " + str_)


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.