Function is unhookable by Frida

Question

I have the following Java code and I'm trying to hook the getTimeZone function:

package com.myapp.models;

public class User {

    private String timeZone;

    public void setTimeZone(String str) {
        this.timeZone = str;
    }

    public String getTimeZone() {
        return this.timeZone;
    }
}

This is the frida code I'm trying to use:

Java.perform(function () {

    var User = Java.use("com.myapp.models.User");
    User.getTimeZone.implementation = function() {
        console.log("timezone requested")
        return 12;
    };

});

However, the hook does not seem to happen since the app crashes on getTimezone not returning a vlue:

10-21 12:17:23.013 26553 26553 E AndroidRuntime: Process: com.myapp.android, PID: 26553
10-21 12:17:23.013 26553 26553 E AndroidRuntime: java.lang.NullPointerException: Attempt to invoke virtual method 'java.lang.String com.myapp.models.User.getTimeZone()' on a null object reference
10-21 12:17:23.013 26553 26553 E AndroidRuntime:        at com.myapp.features.home.logs.updateChart(Presenter.java:370)
10-21 12:17:23.013 26553 26553 E AndroidRuntime:        at com.myapp.features.home.logs.loadGraph(Presenter.java:217)
10-21 12:17:23.013 26553 26553 E AndroidRuntime:        at com.myapp.features.home.logs.onResume(Fragment.java:313)

I know that there is no typo in the function and it is identified successfully since I ran in frida:

[Redmi Note 7::myapp]-> Java.use("com.myapp.models.User").getTimeZone
function
[Redmi Note 7::myapp]-> Java.use("com.myapp.models.User").getTimeZone.implementation
"0x7e3682a128"

Robert · Accepted Answer · 2021-10-21T12:40:22.673

1

Your Frida code has one major problem:

The definition of getTimeZone is String getTimeZone() hence you have to return a String.

But your Frida code return an int value: return 12;

Change it to return "12"; and your Frida code should work.

There may be a second problem in the Android app defining the User class (in one of the method com.myapp.features.home.logs.updateChart you have not included in your question). Based on the exception

java.lang.NullPointerException: Attempt to invoke virtual method java.lang.String com.myapp.models.User.getTimeZone()' on a null object reference

the app seems to call getTimeZone() without constructing an User() instance first. Unless you correct that the Frida hooking code can not work properly.

edited Oct 21 '21 at 12:40

answered Oct 21 '21 at 12:35

Robert

39,162
17
99
152

Thank you very much but I have not quite understood your second suggestion since I am reversing an existing app and the code which calls this function works. This is the line of code that calls getTimeZone: Session.getInstance().getUser().getTimeZone(); So does the frida code need to be changed besides changing the return value 12 to "12" ? – – toothpick Oct 21 '21 at 13:42
1

@toothpick You don't have to do more changes on your Frida code. I am not sure if the Exception you got was caused by your wrong return type or if this is a bug of the app you are hooking. My first impression was that `Session.getInstance().getUser()` returns `null` so `getTimeZone()` will always fail (and the Frida code never trigger). Make sure that you are logged on in the app you are hooking. – Robert Oct 21 '21 at 13:53
getUser was indeed null, the error makes much sense now. thank you very much – toothpick Oct 21 '21 at 13:57

Function is unhookable by Frida

1 Answers1