1

When reverse engineering an APK I came across a class that was marked synthetic. I have used JADX decompiler. The simplified result I got was:

package com;

public final class zz6 extends B implements C {
   public /* synthetic */ A(int i, Object obj, Object obj2, Object obj3) {
       ...
   }

   ...
}

Some googling about synthetic java classes learned me that those classes are generated dynamically.

I hooked this function using Frida and just printed a log when it is called. When running the app nothing got printed though I'm quite sure the specific function was called.

I wonder if Frida is able to hook these functions or if there are any methods to get a hook on these dynamic functions?

The same constructor function in smali-code:

# direct methods
.method public synthetic constructor <init>(ILjava/lang/Object;Ljava/lang/Object;Ljava/lang/Object;)V
    .locals 0

    .line 1
    iput p1, p0, Lcom/zz6;->d:I

    iput-object p2, p0, Lcom/zz6;->e:Ljava/lang/Object;

    iput-object p3, p0, Lcom/zz6;->f:Ljava/lang/Object;

    iput-object p4, p0, Lcom/zz6;->g:Ljava/lang/Object;

    const/4 p1, 0x0

    invoke-direct {p0, p1}, Lcom/w54;-><init>(I)V

    return-void
.end method
6
  • Have you checked SMALI code in Jadx for the same method? The SMALI methods should be what Frida sees => what should be hookable.
    – Robert
    Commented Nov 26, 2023 at 15:17
  • When I check the SMALI code I can find it. But not sure if this changes anything : # direct methods .method public synthetic constructor <init>(ILjava/lang/Object;Ljava/lang/Object;Ljava/lang/Object;)V .locals 0 Commented Nov 26, 2023 at 15:23
  • Don't search for "synthetic", search for the arguments or the method calls in the method (in smali syntax).
    – Robert
    Commented Nov 26, 2023 at 15:35
  • I did not search for this keyword. I searched for the method I wanted to find in the smali code. But I assume you saw that my arguments didnt match the one in my smali code. In my example I edited the arguments, (took arguments from another function). Or do I misinterpret your response? Commented Nov 26, 2023 at 15:44
  • It wasn't clear how you searched. so I just wanted to make sure. Some people are deterred by smali code as it is so low-level. And as the function you found is a synthetic constructor but you were searching for a regular method I guessed that you may have just searched for synthetic entries. If you are unable to find a matching method on smali level then it seems that you have to search a different way how to get access to the arguments you want to get access or modify.
    – Robert
    Commented Nov 26, 2023 at 16:24

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.