Skip to content

String array type inside variable arguments  #36

Description

@agvim

On a rooted nexus5x with android 6.0 I'm hooking the java.lang.reflect.Method invoke method. When the invoke is of a java.lang.Runtime.exec I am unable to log the value of the String array parameter.

The hook is as follows:

    var juarrays = Java.use("java.util.Arrays")
    var javastringarray = Java.use("[Ljava.lang.String;")

    var jlrmethod = Java.use("java.lang.reflect.Method")
    jlrmethod.invoke.implementation = function(object, parameters){

        var retvalue = this.invoke(object, parameters)

        var type = Object.prototype.toString.call(parameters)
        if(type == '[object Array]'){
            var arrayLength = parameters.length;
            // console.log(arrayLength)
            for (var i = 0; i < arrayLength; i++) {
                var parameter = parameters[i]
                var paramstring = String(parameter)
                if(paramstring.startsWith("[Ljava.lang.String;@")){
                    console.log("------------")
                    console.log("string array")
                    console.log(type + JSON.stringify(parameter))

                    // // TODO XXX FIXME does not work. Casting also does not work
                    // use java arrays to parse the array string
                    // var casted = java.cast(parameter, javastringarray)
                    // var result = juarrays.toString(casted)
                    var result = parameter
                    console.log(type + result)
                    console.log("------------")
                }
                else{
                    console.log(type + parameter)
                }
            }
        }
        else{
            console.log(type + parameters)
        }
        console.log("Method.invoke(object, parameters): '" + this + "' = '" + object + "', '" + parameters + "' = '" + retvalue + "'")
        return retvalue
    }

The parameter object is not picked up as a String array and I am not successful converting it. The call works normally though.

The console output:

------------
string array
[object Array]{"$classHandle":"0x101bc2","$handle":"0x101bc6","$weakRef":344}
[object Array][Ljava.lang.String;@2b0cd6b
------------
[object Array]null
[object Array]null
Method.invoke(object, parameters): 'public java.lang.Process java.lang.Runtime.exec(java.lang.String[],java.lang.String[],java.io.File) throws java.io.IOException' = 'java.lang.Runtime@aec987', '[Ljava.lang.String;@2b0cd6b,,' = 'Process[pid=7604]'

I'm not sure if I'm doing something wrong or if there is a problem with frida getting the correct type of a string array inside variable/array arguments.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Fields

    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions