After almost going bald from attempting to find a solution, I have decided to ask my fellow programmers who are most likely better at Java than I.
I have a method that looks like this
i.l.a.i.m.a.e
public class e extends Object {
public final a5.e0 a(java.net.URL url, i.l.a.i.b bVar,
java.util.Map<java.lang.String, java.lang.String> map,
java.util.HashMap<java.lang.String, java.lang.String> hashMap){
i.l.a.i.m.a.b bVar2 = ((i.l.a.i.m.a) bVar).b;
}
}
Different decompiler result:
public final e0 a(URL p0,b p1,Map p2,HashMap p3){
a$b bVar2 = p1.b;
I am trying to retrieve bVar2 from my frida script but had no luck. I believe it is casting, but I don't know how to carry this out from frida.
My frida script
setImmediate(function() {
Java.perform(function() {
var targetClass='i.l.a.i.e';
var methodName='a';
var gclass = Java.use(targetClass);
gclass[methodName].overload('java.net.URL','i.l.a.i.b','java.util.Map','java.util.HashMap').implementation = function(arg0,arg1,arg2,arg3) {
var aa = Java.use('i.l.a.i.m.a.b');
var a = Java.cast(arg1, aa);
console.log(a);
var i=this[methodName](arg0,arg1,arg2,arg3);
console.log('\treturn '+i);
return i;
}
})
})
I have tried calling arg1.b from my Frida code and it returns undefined. I believe I'm only missing the casting.
i.l.a.i.b
public interface b {
void onFailure(java.io.IOException iOException);
}
i.l.a.i.m.a.b
public class b {
public org.json.JSONObject a;
public java.lang.String b;
public b(java.lang.String str, org.json.JSONObject jSONObject) {
this.b = str;
this.a = jSONObject;
}
}
i.l.a.i.m.a
public abstract class a implements i.l.a.i.b {
public final i.l.a.i.m.a.b b;
public final android.os.Handler c;
public final java.lang.String d;
public final java.lang.String e;
public final java.lang.String f;
public final java.lang.String g;
public final java.lang.String h;
public final java.lang.String i;
public final boolean l;
public final java.lang.String m;
public final java.lang.String n;
public final int o;
public final java.lang.String p;
public final java.lang.String q;
public final float r;
public final float s;
public final i.l.a.i.o.c a = new i.l.a.i.o.c();
... useless code
}
You simply need to follow the decompiled Java code you have posted: Cast the second argument to i.l.a.i.m.a (for an unknown reason you casted to a different class). And then access the field b.
Java.perform(function() {
var targetClass='i.l.a.i.e';
var methodName='a';
var gclass = Java.use(targetClass);
gclass[methodName].overload('java.net.URL','i.l.a.i.b','java.util.Map','java.util.HashMap').implementation = function(arg0,arg1,arg2,arg3) {
var aa = Java.use('i.l.a.i.m.a'); // changed from 'i.l.a.i.m.a.b'
var a = Java.cast(arg1, aa);
console.log(a._b.value); // You need to use _b to make sure you are getting field b not method b and then get the actual Java value
var i=this[methodName](arg0,arg1,arg2,arg3);
console.log('\treturn '+i);
return i;
}
})
Do you want to get his return value? She needs to get from his properties, not the return value.
setImmediate(function () {
Java.perform(function () {
var targetClass = 'i.l.a.i.e';
var methodName = 'a';
var gclass = Java.use(targetClass);
gclass[methodName].overload('java.net.URL', 'i.l.a.i.b', 'java.util.Map', 'java.util.HashMap').implementation = function (arg0, arg1, arg2, arg3) {
console.log(arg1.b.value)
}
})
})