Calling a method of a Java object passed as argument to hooked function in Frida

Question

I am trying to obtain the SecretKey passed to the decryptAesCipherText function. I hooked the function in Frida to try to print out the arguments when the method is called but since SecretKey is an object, all attempts to print it out give output as [object Object]. However the SecretKey object has a method getEncoded() which will return a byte array which can be printed out in hex format. How can I call this method from Frida and get the result?

The java function, I am hooking to is given below

import javax.crypto.Cipher;
import javax.crypto.SecretKey;

private byte[] decryptAesCipherText(SecretKey secretKey, byte[] bArr) {
        Cipher instance = Cipher.getInstance("AES/ECB/PKCS5Padding");
        instance.init(2, secretKey);
        return decryptCipherText(instance, bArr);
}

The javascript snippet (incomplete) to hook the function

var target_class = Java.use('com.reactlibrary.securekeystore.RNSecureKeyStoreModule');

target_class.decryptAesCipherText.overload('javax.crypto.SecretKey','[B').implementation = function(key, array){
        console.log("Inside decrypt aes");

        //Call getEncoded method on key to get byte array

        var ret = my_class.decryptAesCipherText.overload('javax.crypto.SecretKey','[B').call(this, key, array);
        return ret;
}

Answer 1

It's very likely you need to access the .value of the object. Alternatively you could also "stringfy" this which is an easy was to understand all the properties of the Object. Also, you do not need to perform an overload inside of your overload, just call the method directly using this.decryptAesCipherText()

You can do all of the above with the fix as follows;

var target_class = Java.use('com.reactlibrary.securekeystore.RNSecureKeyStoreModule');

target_class.decryptAesCipherText.overload('javax.crypto.SecretKey','[B').implementation = function(key, array){
        console.log("Inside decrypt aes");

        console.log("key.value : ", key.value);
        console.log("JSON.stringify(key) : ", JSON.stringify(key));

        //Call getEncoded method on key to get byte array
        var ret = this.decryptAesCipherText(key, array);


        console.log("JSON.stringify(ret) : ", JSON.stringify(ret));

        return ret;
}