Frida Android how to change value of array passed to method

Question

Let's assume we have a such code snippet:

public class Test {
  public void testArrayValue() {
    Object[] objects = new Object[1];
    fillObject(objects);
    Log.d("test", (String)objects[0]);
  }
  public void fillObject(Object[] objects) {
    objects[0] = new String("fillObject str");
  }
}

How to hook the fillObject method to change the value of the first element in array passed to method?

Java.perform(function () {
    var clazz = Java.use("com.some.package.Test");
    clazz.fillObject.overload('[Ljava.lang.Object;').implementation = function(var_0) {
        
      // this won't work :( assigning a string value to var_0[0] 
      // does not pass it outside the hooked code
      // 
      var stringClass = Java.use("java.lang.String");
      var stringInstance = stringClass.$new("Hello World");
      var_0[0] = stringInstance
    };
});

The output of running hooked code will be "fillObject str", and not "Hello World"

Answer 1

Frida seems to have some bugs regarding Java arrays that are modified or replaced by JavaScript code. My guess is that the conversion (and mapping of modifications) between the Java array instance and JavaScript array instance has some flaws.

Therefore the only alternative I see is using pure Java methods to modify the array content, that way you should be able to bypass this bug.

One possible way is to use the method Arrays.fill(Object[] array, int fromIndex,int toIndex, Object val)¹:

var stringClass = Java.use("java.lang.String");
var stringInstance = stringClass.$new("Hello World");
var arraysClass = Java.use("java.util.Arrays");
arraysClass.fill(var_0, 0, 1, stringInstance); // equivalent to var_0[0] = stringInstance

I have not tested this code, but it should perform the array modification you want to do.