2

I'm trying to understand what an android application is sending over the network and as such am trying to hook into it with Frida, specifically a method called storeKeys .

I was able to perform the Android tutorial from Frida's website, so I know it's working. But when I issue this command, it tells me it hooked 0 functions:

frida-trace -U -i storeKeys com.vendor.app

I thus fired up apktool to get a readable set of source files and I could find storeKeys in two places. The first is the place where it gets called:

# virtual methods
.method public a(Ljava/lang/String;)I
    .locals 2

    const-string v0, "jwtToken"

    invoke-static {p1, v0}, Lkotlin/e/b/i;->b(Ljava/lang/Object;Ljava/lang/String;)V

    .line 20
    invoke-virtual {p0}, Lcom/vendor/alljoynbridge/provisioning/f;->getProxyObject()Lorg/alljoyn/bus/ProxyBusObject;

    move-result-object v0

    const-class v1, Lcom/vendor/alljoynbridge/provisioning/ProvisioningMediationTransport;

    invoke-virtual {v0, v1}, Lorg/alljoyn/bus/ProxyBusObject;->getInterface(Ljava/lang/Class;)Ljava/lang/Object;

    move-result-object v0

    check-cast v0, Lcom/vendor/alljoynbridge/provisioning/ProvisioningMediationTransport;

    .line 21
    invoke-interface {v0, p1}, Lcom/vendor/alljoynbridge/provisioning/ProvisioningMediationTransport;->storeKeys(Ljava/lang/String;)S

    move-result p1

    return p1
.end method

The second appears to be its declaration:

.class public interface abstract Lcom/vendor/alljoynbridge/provisioning/ProvisioningMediationTransport;
.super Ljava/lang/Object;
.source "ProvisioningMediationTransport.java"

# interfaces
.implements Lorg/alljoyn/bus/BusObject;


# annotations
.annotation runtime Lorg/alljoyn/bus/annotation/BusInterface;
    announced = "true"
    name = "com.app.standard.infrastructure.api.device.mediation.client"
.end annotation

.annotation runtime Lorg/alljoyn/bus/annotation/Secure;
.end annotation


# static fields
.field public static final INTERFACE_NAME:Ljava/lang/String; = "com.app.standard.infrastructure.api.device.mediation.client"

.field public static final OBJ_PATH:Ljava/lang/String; = "/Provisioning"


# virtual methods
.method public abstract storeKeys(Ljava/lang/String;)S
    .annotation system Ldalvik/annotation/Throws;
        value = {
            Lorg/alljoyn/bus/BusException;
        }
    .end annotation

    .annotation runtime Lorg/alljoyn/bus/annotation/BusMethod;
        replySignature = "n"
        signature = "s"
    .end annotation
.end method

What I'm most interested in seeing is the content of the String parameter given to storeKeys

It seems that because the method is virtual abstract, there is nothing for Frida to hook into.

What have I missed here?
What would you suggest that I try next?

6
  • Are you sure the frida-trace command is correct? If I understood frida-trace correctly the -i parameter is for native functions, but you are searching for a Java method which would be the -j parameter.
    – Robert
    Feb 25, 2021 at 15:41
  • Ah, I should read the documentation more carefully. But when I try with the -j switch, I get this error: {'type': 'error', 'description': 'Error: Invalid method query', 'stack': 'Error: Invalid method query\n at enumerateMethods (frida/node_modules/frida-java-bridge/lib/class-model.js:12)\n [...], 'fileName': 'frida/node_modules/frida-java-bridge/lib/class-model.js', 'lineNumber': 12, 'columnNumber': 1}
    – OBones
    Feb 25, 2021 at 16:00
  • I would try -j '*storeKeys'
    – Robert
    Feb 25, 2021 at 16:16
  • Alas, it does not change a thing, still the same error about an invalid method query
    – OBones
    Feb 25, 2021 at 16:23
  • Looks like the query has to match this regex. Therefore -j '*!storeKeys' should work?
    – Robert
    Feb 25, 2021 at 16:31

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.