TransWikia.com

Hooking an interface method with Frida in an Android application

Reverse Engineering Asked by OBones on June 19, 2021

I’m trying to understand what an android application is sending over the network and as such am trying to hook into it with Frida, specifically a method called storeKeys .

I was able to perform the Android tutorial from Frida’s website, so I know it’s working. But when I issue this command, it tells me it hooked 0 functions:

frida-trace -U -i storeKeys com.vendor.app

I thus fired up apktool to get a readable set of source files and I could find storeKeys in two places. The first is the place where it gets called:

# virtual methods
.method public a(Ljava/lang/String;)I
    .locals 2

    const-string v0, "jwtToken"

    invoke-static {p1, v0}, Lkotlin/e/b/i;->b(Ljava/lang/Object;Ljava/lang/String;)V

    .line 20
    invoke-virtual {p0}, Lcom/vendor/alljoynbridge/provisioning/f;->getProxyObject()Lorg/alljoyn/bus/ProxyBusObject;

    move-result-object v0

    const-class v1, Lcom/vendor/alljoynbridge/provisioning/ProvisioningMediationTransport;

    invoke-virtual {v0, v1}, Lorg/alljoyn/bus/ProxyBusObject;->getInterface(Ljava/lang/Class;)Ljava/lang/Object;

    move-result-object v0

    check-cast v0, Lcom/vendor/alljoynbridge/provisioning/ProvisioningMediationTransport;

    .line 21
    invoke-interface {v0, p1}, Lcom/vendor/alljoynbridge/provisioning/ProvisioningMediationTransport;->storeKeys(Ljava/lang/String;)S

    move-result p1

    return p1
.end method

The second appears to be its declaration:

.class public interface abstract Lcom/vendor/alljoynbridge/provisioning/ProvisioningMediationTransport;
.super Ljava/lang/Object;
.source "ProvisioningMediationTransport.java"

# interfaces
.implements Lorg/alljoyn/bus/BusObject;


# annotations
.annotation runtime Lorg/alljoyn/bus/annotation/BusInterface;
    announced = "true"
    name = "com.app.standard.infrastructure.api.device.mediation.client"
.end annotation

.annotation runtime Lorg/alljoyn/bus/annotation/Secure;
.end annotation


# static fields
.field public static final INTERFACE_NAME:Ljava/lang/String; = "com.app.standard.infrastructure.api.device.mediation.client"

.field public static final OBJ_PATH:Ljava/lang/String; = "/Provisioning"


# virtual methods
.method public abstract storeKeys(Ljava/lang/String;)S
    .annotation system Ldalvik/annotation/Throws;
        value = {
            Lorg/alljoyn/bus/BusException;
        }
    .end annotation

    .annotation runtime Lorg/alljoyn/bus/annotation/BusMethod;
        replySignature = "n"
        signature = "s"
    .end annotation
.end method

What I’m most interested in seeing is the content of the String parameter given to storeKeys

It seems that because the method is virtual abstract, there is nothing for Frida to hook into.

What have I missed here?
What would you suggest that I try next?

Add your own answers!

Ask a Question

Get help from others!

© 2024 TransWikia.com. All rights reserved. Sites we Love: PCI Database, UKBizDB, Menu Kuliner, Sharing RPP