Java reflection does not get correct result

[oleavr]

(Continuation of frida/frida-gum#143.)

As described by @3asm:

Testing on Android emulator ARM 4.4.2 with latest frida-server. The following sample code crashes silently:

        send("element: " + element);
        send("element.getClass: " + element.getClass());
        send("element.getClass.getDeclaredFields: " + element.getClass().getDeclaredFields());

Giving the following results:

[+] element: android.content.UriMatcher@b1d01c28
[+] element.getClass: class android.content.UriMatcher

element.getClass() is supposed to return an instance of java.lang.Class.

[Oreaz]

Any updates on this one?

Java.perform(function () {
	    var clz = Java.use('java.net.URL');
	    var url = clz.$new("https", "google.com", 80, "/index.html");
		
		send("url.getClass: " + url.getClass());
		send("url.getClass().getDeclaredFields(): " + url.getClass().getDeclaredFields());
});

{"type":"send","payload":"url.getClass: class java.net.URL"}

{"type":"error","description":"TypeError: undefined not callable","stack":"TypeError: undefined not callable\n at [anon] (duk_js_call.c:773)\n at [anon] (script33.js:6)\n at frida/node_modules/frida-java/lib/vm.js:33\n at y (frida/node_modules/frida-java/index.js:322)\n at frida/node_modules/frida-java/index.js:296\n at frida/node_modules/frida-java/lib/vm.js:33\n at java.js:1373\n at script33.js:7","fileName":"frida/node_modules/frida-java/lib/vm.js","lineNumber":33,"columnNumber":1}

[zbx91]

Java.perform(function() {
bClass = Java.use("java.security.MessageDigest");
test=bClass.update.overload('[B')
bClass.update.overload('[B').implementation = function(bb) {
console.log("[] called");
p = ''
for(i = 0; i < arguments[0].length; i++) {
p += String.fromCharCode(arguments[0][i]);
}
console.log("[] inData_s: " + p);

     console.log('[*] inData:',arguments[0]);
     console.trace();
     var ret=test(bb);
     console.log(ret);
     return ret;
  }

[] called
[] inData_s: usercenter d41d8cd98f00b204e9800998ecf8427e 1501127872554 U186622684
[*] inData: 117,115,101,114,99,101,110,116,101,114,100,52,49,100,56,99,100,57,56,102,48,48,98,50,48,52,101,57,56,48,48,57,57,56,101,99,102,56,52,50,55,101,49,53,48,49,49,50,55,56,55,50,53,53,52,85,49,56,54,54,50,50,54,56,52
{u'columnNumber': 1, u'description': u'TypeError: undefined not callable', u'fileName': u'script1.js', u'lineNumber': 13, u'type': u'error', u'stack': u'TypeError: undefined not callable\n at [anon] (duk_js_call.c:842)\n at script1.js:13\n at call (native)\n at update (input:1)'}

where is wrong??

[zbx91]

Java.perform(function() {
bClass = Java.use("java.security.MessageDigest");
bClass.update.overload('[B').implementation = function(bb) {
console.log("[] called");
p = ''
for(i = 0; i < arguments[0].length; i++) {
p += String.fromCharCode(arguments[0][i]);
}
console.log("[] inData_s: " + p);

 console.log('[*] inData:',arguments[0]);
 console.trace();
 var ret=this.update(bb);
 console.log(ret);
 return ret;

}
[] called
[] inData_s: usercenter d41d8cd98f00b204e9800998ecf8427e 1501127872554 U186622684
[*] inData: 117,115,101,114,99,101,110,116,101,114,100,52,49,100,56,99,100,57,56,102,48,48,98,50,48,52,101,57,56,48,48,57,57,56,101,99,102,56,52,50,55,101,49,53,48,49,49,50,55,56,55,50,53,53,52,85,49,56,54,54,50,50,54,56,52
{u'columnNumber': 1, u'description': u'TypeError: undefined not callable', u'fileName': u'script1.js', u'lineNumber': 13, u'type': u'error', u'stack': u'TypeError: undefined not callable\n at [anon] (duk_js_call.c:842)\n at script1.js:13\n at call (native)\n at update (input:1)'}

where is wrong??

[oleavr]

Use Java.cast() when dealing with generics.

[pharazone]

I used Java.cast(), but the same problem....