Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Function previously hooked then no longer intercepted #319

Open
Trakeur opened this issue May 22, 2024 · 2 comments
Open

Function previously hooked then no longer intercepted #319

Trakeur opened this issue May 22, 2024 · 2 comments

Comments

@Trakeur
Copy link

Trakeur commented May 22, 2024

Hi everyone,

I'm using Frida since 1 week to hook function at runtime in an android app. In my case I need to intercept function from okhttp3 lib to analyze network request. Everything was working well with the following code :
var OkHttpClient = Java.use('okhttp3.OkHttpClient') OkHttpClient.newCall.overload("okhttp3.Request").implementation = function (request) { console.log("Catching request...") ... return this.newCall(request); }
So I was able to analyze request object (url, method...). But without changing anything (maybe reload frida-server) the "newCall" method is no longer intercepted. Note that my script is correctly injected and run with some other functions getting hooked.

Could it be something related with thread ? Or some sort of obfuscation (the app has indeed some sort of lib minification) ?

Also the requests that I want to catch are at app's startup, so I guess it could be the problem. (I tried launch app with -f package without resolution...). I'm able to catch some request that are after app startup.

@Trakeur
Copy link
Author

Trakeur commented May 22, 2024

Also note that everything is executed inside Java.perform(function() {...} and I tried with setTimeout(function() { }.

@Trakeur
Copy link
Author

Trakeur commented May 22, 2024

For those of you who would face the same problem, I bypass it by reimplementing the RequestBuilder.build() method. I have something like :
var RequestBuilder = Java.use('okhttp3.Request$Builder'); RequestBuilder.build.implementation = function(... args) { var request = this.build(...args); ... return request
It allows me to modify the request before being sent to server.
I'm still curious why the previous implementation with OkHttpClient didn't work anymore.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant