frida-java-bridge icon indicating copy to clipboard operation
frida-java-bridge copied to clipboard

12.9.5 version handles strings with embedded nuls not right

Open centy720 opened this issue 5 years ago • 7 comments

if utf8 string contains nuls, the stringFromJni only return string ends with nuls, it truncates string

var blob = [126,83,69,77,73,95,88,77,76,126,0,20,46,109,115,103]; the right utf8 string is "~SEMI_XML~

centy720 avatar Jun 08 '20 11:06 centy720

i think the real resolution is comment code g_utf8_validate (data, length, &end) at bindings/gumjs/gumdukmemory.c:

`case GUM_MEMORY_VALUE_UTF8_STRING: { gchar * data; guint8 dummy_to_trap_bad_pointer_early; const gchar * end;

    data = address;
    if (data == NULL)
    {
      duk_push_null (ctx);
      break;
    }

    if (length != 0)
      memcpy (&dummy_to_trap_bad_pointer_early, data, sizeof (guint8));

    if (!g_utf8_validate (data, length, &end))
    {
      _gum_duk_throw (ctx, "can't decode byte 0x%02x in position %u",
          (guint8) *end, (guint) (end - data));
    }

    if (length < 0)
    {
      duk_push_string (ctx, data);
    }
    else
    {
      gchar * slice;

      slice = g_strndup (data, length);
      duk_push_string (ctx, slice);
      g_free (slice);
    }

    break;
  }`

use readUtf8String not readUtf16String

centy720 avatar Jun 08 '20 12:06 centy720

I've also encountered this issue. Java strings get truncated if they contain a null byte.

As an example, this code will show param1 as having a length of 14 characters, when in fact it should have 36 characters. The 15th character is a null byte.

SecureStorage.decrypt.overload('java.lang.String', 'byte').implementation = function(param1, param2) {
    console.log("Param1: " + param1);
    console.log("Param1 length: " + param1.length);
}

This issue was also identified in December 2019 issue #1120 in the main frida/frida repo: https://github.com/frida/frida/issues/1120

Is there a work around where we could access the native parameter in memory without too much trouble?

Frida is wonderful, thanks so much for creating it oleavr

andyacer avatar Jul 23 '20 03:07 andyacer

I've encountered this issue, too. Waiting for a reasonable solution.

slient2009 avatar Aug 19 '21 12:08 slient2009

Can you please confirm that this issue is present on latest frida (15.0.17)?

s1341 avatar Aug 23 '21 05:08 s1341

Can you please confirm that this issue is present on latest frida (15.0.17)?

I only tried it on the frida-15.0.15 and the target app was KGB-Messenger.

slient2009 avatar Aug 24 '21 15:08 slient2009

I am seeing this issue on Frida 15.1.1 (specifically, I am running into https://github.com/frida/frida/issues/1120)

SarahAnnTolsma avatar Sep 17 '21 16:09 SarahAnnTolsma

Same issues on same ctf on release 16.0.8-android-x86_64

MikailChambellant avatar Jan 26 '23 13:01 MikailChambellant