Hello,
I have been working on analyzing an obfuscated Android malware. When I try to call a function, I receive an error called "TypeError: cannot read property '$handle' of undefined." Any idea what is wrong with it ?
Caller function
....
if (str3.getBytes(com.android.mobile.r.i.iIIiiIIiiI("ypj)4")).length > this.iiiIiiiIii.length) {
...
Callee function
...
public class i {
public static String iIIiiIIiiI(String str) {
StackTraceElement stackTraceElement = new CloneNotSupportedException().getStackTrace()[1];
String stringBuffer = new StringBuffer(stackTraceElement.getMethodName()).insert(0, stackTraceElement.getClassName()).toString();
int length = stringBuffer.length() - 1;
int length2 = str.length();
char[] cArr = new char[length2];
length2--;
int i = length2;
int i2 = length;
while (length2 >= 0) {
int i3 = i - 1;
cArr[i] = (char) ((str.charAt(i) ^ stringBuffer.charAt(i2)) ^ 69);
if (i3 < 0) {
break;
}
i = i3 - 1;
length2 = i2 - 1;
cArr[i3] = (char) ((str.charAt(i3) ^ stringBuffer.charAt(i2)) ^ 77);
if (length2 < 0) {
length2 = length;
}
i2 = length2;
length2 = i;
}
return new String(cArr);
}
....
Command line
frida.exe -U -l call.js "com.android.xyz" --no-pause
call.js
Java.perform(function() {
var decoder = Java.use("com.android.mobile.r.i");
var y = "ypj)4";
var z = decoder.iIIiiIIiiI.overload("java.lang.String").call(y);
console.log(z);
});
Frida error (10.2.0)
TypeError: cannot read property '$handle' of undefined
at [anon] (duk_hobject_props.c:2323)
at frida/node_modules/frida-java/lib/class-factory.js:1909
at call (native)
at iIIiiIIiiI (input:1)
at call (native)
at [anon] (repl1.js:4)
at frida/node_modules/frida-java/lib/vm.js:39
at y (frida/node_modules/frida-java/index.js:325)
at frida/node_modules/frida-java/index.js:297
at frida/node_modules/frida-java/lib/vm.js:39
at java.js:2208
[...]
Hello,
I have been working on analyzing an obfuscated Android malware. When I try to call a function, I receive an error called "TypeError: cannot read property '$handle' of undefined." Any idea what is wrong with it ?
Caller function
....
if (str3.getBytes(com.android.mobile.r.i.iIIiiIIiiI("ypj)4")).length > this.iiiIiiiIii.length) {
...
Callee function
...
public class i {
public static String iIIiiIIiiI(String str) {
StackTraceElement stackTraceElement = new CloneNotSupportedException().getStackTrace()[1];
String stringBuffer = new StringBuffer(stackTraceElement.getMethodName()).insert(0, stackTraceElement.getClassName()).toString();
int length = stringBuffer.length() - 1;
int length2 = str.length();
char[] cArr = new char[length2];
length2--;
int i = length2;
int i2 = length;
while (length2 >= 0) {
int i3 = i - 1;
cArr[i] = (char) ((str.charAt(i) ^ stringBuffer.charAt(i2)) ^ 69);
if (i3 < 0) {
break;
}
i = i3 - 1;
length2 = i2 - 1;
cArr[i3] = (char) ((str.charAt(i3) ^ stringBuffer.charAt(i2)) ^ 77);
if (length2 < 0) {
length2 = length;
}
i2 = length2;
length2 = i;
}
return new String(cArr);
}
....
Command line
frida.exe -U -l call.js "com.android.xyz" --no-pause
call.js
Java.perform(function() {
var decoder = Java.use("com.android.mobile.r.i");
var y = "ypj)4";
var z = decoder.iIIiiIIiiI.overload("java.lang.String").call(y);
console.log(z);
});
Frida error (10.2.0)
TypeError: cannot read property '$handle' of undefined
at [anon] (duk_hobject_props.c:2323)
at frida/node_modules/frida-java/lib/class-factory.js:1909
at call (native)
at iIIiiIIiiI (input:1)
at call (native)
at [anon] (repl1.js:4)
at frida/node_modules/frida-java/lib/vm.js:39
at y (frida/node_modules/frida-java/index.js:325)
at frida/node_modules/frida-java/index.js:297
at frida/node_modules/frida-java/lib/vm.js:39
at java.js:2208
[...]