Frida Cheatsheet

Java.perform(function() {
    var str = Java.use('java.lang.String'), objectClass = 'java.lang.Object';
    str.equals.overload(objectClass).implementation = function(obj) {
        var response = str.equals.overload(objectClass).call(this, obj);
        if (obj) {
            if (obj.toString().length > 5) {
                console.log('what was I doing here')
            }
        }
        return response;
    }
});

public class c{
    public c(){

    }

    public static int a(int a){
        return 1;
    }

    // This is the method we want to hook
    public static String a(String a){
        return "Hello";
    }
}

Java.perform(function() {
    const helper = Java.use('com.example.testapp3.c')
    const overloads = helper.a.overloads
    overloads.forEach(overload => {
        // Assuming we want to hook the method that returns a string
        if (overload.returnType.name == 'Ljava/lang/String;'){ 
            overload.implementation = function(args){
                // Your hook here

                return overload.call(this, args)
            }
        }
    })
});

console.log(
    Java.use('android.util.Log')
        .getStackTraceString(Java.use('java.lang.Exception').$new())
    )

Java.perform(() => {
    // Hooking logger so we can get some detail back
    let Logger = Java.use('android.util.Log')
    Logger.i.overload('java.lang.String', 'java.lang.String').implementation = function(tag, message){
        console.log(tag + ':' + message)
        return 0
    }

    // Hooking the function that uses Colour
    let MainActivity = Java.use('com.example.testapp.MainActivity')
    MainActivity.test.implementation = function(colour){
        colour = colour.RED.value // Overwrite the colour with the new value
        return colour
    }

    // This should print 'red', instead of 'orange'
})

let hCarEnum = Java.use("com.dealership.CarsEnum")
hCarEnum.getCarType.implementation = function(car){
    return hCarEnum.MAZDA.value
}

Interceptor.attach(ObjC.classes.NSFileManager['- fileExistsAtPath:'].implementation, {
    onEnter: function (args) {
        console.log('open' , ObjC.Object(args[2]).toString());
    }
});

static fingerprint(addr, offset = 0, size = 64) {
        console.log(hexdump(ptr(addr), {
            offset: offset,
            length: size,
            header: true,
            ansi: true
        }));
    }

const SIGTRAP = 5

// Firstly, get a pointer to the signal function
const signal = Module.findExportByName(null, 'signal');
let breakpoints = {}
if (signal === undefined){
    console.log('No libc?')
}else{
    // Get the native signal function
    const _signal = new NativeFunction(signal, 'void', ['int', 'pointer']);

    var buffer = Memory.alloc(8)
    Memory.protect(buffer, 8, 'rwx');

    // Use frida to create a new signal handler
    Interceptor.replace(buffer, new NativeCallback((_) => {
        Thread.sleep(30) // You'd make this much lower and loop it
        return
    }, 'void', ['int']))
    _signal(SIGTRAP, buffer)

    Interceptor.attach(Module.findExportByName(null, 'puts'), {
        onEnter:function (){
            Module.findExportByName(null, 'puts').writeU8(0xCC)
        }
    })
}

// Assume we can find the entryPoint
// Please note the ptr(parseInt(...)) calls; without you will get `Error: expected a range object or an array of range objects`
const entryPoint = ptr(parseInt(DebugSymbol.fromName('main')))

let breakpoints = {}

// Breakpoint that's triggered when the memory is read|write|executed (single use)
MemoryAccessMonitor.enable({base: entryPoint, size: 1}, {
    onAccess: function (details) {
        breakpoints[entryPoint] = false
				// Use details.operation to filter
        console.log(`Breakpoint at ${DebugSymbol.fromAddress(entryPoint)} triggered`)
        while (breakpoints[entryPoint] === false) {
            Thread.sleep(1)
        }
    }
})

// Hook based breakpoint (works until the hook is removed)
Interceptor.attach(Module.getExportByName(null, 'puts'), {
    onEnter(args) {
        console.log(`Breakpoint at ${DebugSymbol.fromAddress(this.context.pc)} triggered`)
        breakpoints[this.context.pc] = false
        while (breakpoints[this.context.pc] === false) {
            Thread.sleep(1)
        }
    }
});

Interceptor.attach(Module.findExportByName(null, "open"), {
  onEnter: function(args) {
    this.flag = false;
    var filename = Memory.readCString(ptr(args[0]));
    console.log('filename =', filename)
    if (filename.endsWith(".xml")) {
      this.flag = true;
      // Here is an example of how to throw a native backtrace
      var backtrace = Thread.backtrace(this.context, Backtracer.ACCURATE).
                        map(DebugSymbol.fromAddress).join("\n\t")
      console.log("file name [" + Memory.readCString(ptr(args[0])) + "]:")
      console.log(backtrace)
    }
  },
  onLeave: function(retval) {
    if (this.flag) // passed from onEnter
      console.warn("\nretval: " + retval);
  }
});

Interceptor.attach(DebugSymbol.fromName("main").address, {
    onEnter: function(args){
        Stalker.follow(this.threadId,
            {
                events: { call: true },
                /*
                    Since we are tracing calls, events in this case represent
                    any function call
                */
                onReceive: function (events) {
                    console.log("Stalker Calls:")
                    let calls = Stalker.parse(events, {annotate: true})
                    calls.forEach(event => {
                        console.log(DebugSymbol.fromAddress(ptr(event[2])))
                        })
                    },
            }
        )
    },
    onLeave: function(ret){
        Stalker.unfollow(this.threadId)
    }
})

#include <stdio.h>
#include <unistd.h>

 void parser_getArgCount() {
    puts("There are 3 args");
}

 void parser_getEntry() {
    puts("Returning entry");
}

 void createParser(){
    puts("Creating parser");
    parser_getArgCount();
    parser_getEntry();
    parser_getEntry();
    parser_getEntry();
}

int main() {
    createParser();

}

let symbol = ptr(DebugSymbol.fromName('check_zxcvbn').address
Interceptor.attach(
    symbol, 
    {OnEnter: ..., OnLeave: ...}
)

let buffer = new Uint8Array(args[0].readByteArray(64));
console.log(buffer[0])

/**
 * Interface representing a continuation after a suspension point that returns a value of type `T`.
 */
@SinceKotlin("1.3")
public interface Continuation<in T> {
    /**
     * The context of the coroutine that corresponds to this continuation.
     */
    public val context: CoroutineContext

    /**
     * Resumes the execution of the corresponding coroutine passing a successful or failed [result] as the
     * return value of the last suspension point.
     */
    public fun resumeWith(result: Result<T>)
}

import kotlinx.coroutines.*
import kotlin.coroutines.Continuation
import kotlin.coroutines.resume
import kotlin.coroutines.suspendCoroutine

suspend fun fetchData(): String = suspendCoroutine { continuation ->
    // Simulate fetching data asynchronously
    Thread {
        Thread.sleep(1000)
        continuation.resume("Data fetched")
    }.start()
}

fun main() = runBlocking {
    println("Start")
    val data = fetchData()
    println(data)
    println("End")
}

Java.perform(() => {
    const hContinuation = Java.use('kotlin.coroutines.Continuation'); 
    Java.registerClass({
      name: 'com.constbox.Continuation', 
      implements: [hContinuation],
      methods: {
        resumeWith: function() {
            console.log("Continuation resumed")
        },
        getContext: function(){
            return null
        }
      }
    });
  
    const customImpl = Java.use('com.constbox.Continuation');
    const customImplInstance = customImpl.$new();

    const hMainActivity = Java.use("com.example.myapplication.MainActivity")
    hMainActivity.fetchData.implementation = function(){
        return this.fetchData(customImplInstance)
    }
})

hMainActivity.fetchData.implementation = function(oldContinuation){
        oldContinuation.resumeWith("Foobar")
        return this.fetchData(customImplInstance)
    }

function getClassHandle(name) {
   return new Promise((resolve, reject) => {
       Java.perform(() => {
           const loaders = Java.enumerateClassLoadersSync()
           let found = false

           // Try to get a handle using each of the class loaders
           for (let i = 0; i < loaders.length; i++) {
               const loader = loaders[i]
               const factory = Java.ClassFactory.get(loader)

               try {
                   const klassHandle = factory.use(name)
                   resolve(klassHandle)
                   found = true
                   break
               } catch {

               }
           }
           if (found == false) {
               reject()
           }
       })
   })
}


// Example Usage
getClassHandle("java.lang.String").then(javaString => {
   javaString.toString.implementation = function(){

   }
})


// Await example

async function main(){
   let javaString = await getClassHandle("java.lang.String")
   javaString.toString.implementation = function(){

   }
}
main()