search

frida / frida-java-bridge

Java runtime interop from Frida
318 stars 118 forks source link

Function previously hooked then no longer intercepted #319

Open Trakeur opened 1 month ago

Trakeur commented 1 month ago

Hi everyone,

I'm using Frida since 1 week to hook function at runtime in an android app. In my case I need to intercept function from okhttp3 lib to analyze network request. Everything was working well with the following code : var OkHttpClient = Java.use('okhttp3.OkHttpClient') OkHttpClient.newCall.overload("okhttp3.Request").implementation = function (request) { console.log("Catching request...") ... return this.newCall(request); } So I was able to analyze request object (url, method...). But without changing anything (maybe reload frida-server) the "newCall" method is no longer intercepted. Note that my script is correctly injected and run with some other functions getting hooked.

Could it be something related with thread ? Or some sort of obfuscation (the app has indeed some sort of lib minification) ?

Also the requests that I want to catch are at app's startup, so I guess it could be the problem. (I tried launch app with -f package without resolution...). I'm able to catch some request that are after app startup.

Trakeur commented 1 month ago

Also note that everything is executed inside Java.perform(function() {...} and I tried with setTimeout(function() { }.

Trakeur commented 1 month ago

For those of you who would face the same problem, I bypass it by reimplementing the RequestBuilder.build() method. I have something like : var RequestBuilder = Java.use('okhttp3.Request$Builder'); RequestBuilder.build.implementation = function(... args) { var request = this.build(...args); ... return request It allows me to modify the request before being sent to server. I'm still curious why the previous implementation with OkHttpClient didn't work anymore.