I am trying to hook into a constructor that initialises a couple of interfaces, along with other objects. My Frida script is as such:
Java.perform(function(){
Java.scheduleOnMainThread(function(){
var Vid = Java.use('com.ss.android.testcamera.tcamera.TESTVideoMode');
var TESTCamera2 = Java.use('com.ss.android.testcamera.TESTCamera2');
var Context = Java.use("android.app.ActivityThread").currentApplication().getApplicationContext();
var CameraManager = Java.use('android.hardware.camera2.CameraManager');
var Handler = Java.use('android.os.Handler');
var type = 3;
var CameraEvents = Java.use('com.ss.android.testcamera.TESTCameraBase$CameraEvents');
var PictureSizeCallback = Java.use('com.ss.android.testcamera.TESTCameraBase$PictureSizeCallBack');
var TESTCam2 = TECamera2.$new.overload('int', 'android.content.Context', 'com.ss.android.testcamera.TESTCameraBase$CameraEvents', 'android.os.Handler', 'com.ss.android.testcamera.TESTCameraBase$PictureSizeCallBack');
TESTCam2.call(TESTCamera2, type, Context, CameraEvents, Handler, PictureSizeCallback);
var VidInstance = Vid.$new(TESTCam2, Context, CameraManager.$new(), Handler.$new());
})
})
However, I am encountering errors, like the one shown below.
Error: expected a pointer
at value (frida/node_modules/frida-java-bridge/lib/class-factory.js:1057)
at e (frida/node_modules/frida-java-bridge/lib/class-factory.js:580)
at call (native)
at <anonymous> (/camera.js:18)
at <anonymous> (frida/node_modules/frida-java-bridge/index.js:182)
For more context, the application code I am trying to hook is as such.
For Vid:
public TESTVideoMode(@NonNull TESTCamera2 camera2, @NonNull Context context, @NonNull CameraManager cameraManager, Handler handler) {
super(camera2, context, cameraManager, handler);
}
For TESTCamera2:
protected TESTCamera2(int type, Context context, TESTCameraBase.CameraEvents cameraEvents, Handler handler, TESTCameraBase.PictureSizeCallBack callBack) {
super(context, cameraEvents, handler, callBack);
Interfaces listed:
public interface CameraEvents {
void onCameraClosed(TESTCameraBase TESTCameraBase);
void onCameraError(int i, int i2, String str);
void onCameraInfo(int i, int i2, String str);
void onCameraOpened(int i, int i2, TESTCameraBase TESTCameraBase);
}
public interface PictureSizeCallBack {
FSI getPictureSize(List<FSI> list, List<FSI> list2);
}
My question is how do I initiate the TESTCam2.call without getting the expected a pointer error? Thanks in advance!
Edit: The code fails before Vid.$new, at the initialisation of TESTCam2.
I've attached console.log to every instance of Java.use, and here are the results:
Vid: <class: com.ss.android.testcamera.tcamera.TESTVideoMode>
TESTCamera2: <class: com.ss.android.testcamera.TESTCamera2>
Context: com.ss.android.ugc.aweme.CamApplication@7249ed6
CameraManager: <class: android.hardware.camera2.CameraManager>
Handler: <class: android.os.Handler> CameraEvents: [object Object]
PictureSizeCallback: [object Object]