frida-java-bridge icon indicating copy to clipboard operation
frida-java-bridge copied to clipboard

The application freezes after replacing the method implementation

Open Holpak opened this issue 1 year ago • 2 comments

I'm trying to replace the StringBuilder constructor implementation in a desktop Java application, but it freezes immediately.

$ java --version
java 17.0.11 2024-04-16 LTS
Java(TM) SE Runtime Environment (build 17.0.11+7-LTS-207)
Java HotSpot(TM) 64-Bit Server VM (build 17.0.11+7-LTS-207, mixed mode, sharing)
$ frida --version
16.2.5

Script

Java.perform(() => {
    
    const StringBuilder = Java.use('java.lang.StringBuilder');
    // We need to replace .$init() instead of .$new(), since .$new() = .alloc() + .init()
    const ctor = StringBuilder.$init.overload('java.lang.String');
    ctor.implementation = function (arg) {
        console.log(arg); return this.ctor(arg);
    };
    console.log('[+] new StringBuilder(java.lang.String) hooked');
});

Holpak avatar May 28 '24 17:05 Holpak

what about:

Java.perform(() => {
    const StringBuilder = Java.use('java.lang.StringBuilder');
    const ctor = StringBuilder.$init.overload('java.lang.String');
    ctor.implementation = function (arg) {
        console.log(arg); 
        return ctor.call(this, arg);
    };
    console.log('[+] new StringBuilder(java.lang.String) hooked');
});

or:

Java.perform(() => {
    const StringBuilder = Java.use('java.lang.StringBuilder');
    StringBuilder.$init.overload('java.lang.String').implementation = function (arg) {
        console.log(arg); 
        return this.$init.overload('java.lang.String').call(this, arg);
    };
    console.log('[+] new StringBuilder(java.lang.String) hooked');
});

realgam3 avatar Jul 28 '24 07:07 realgam3

@Holpak FYI, I patched Frida's JDK17 support in #333 and I think it'll help with your issue. I can confirm Frida 16.5.6 contains this fix.

c8rri3r avatar May 25 '25 19:05 c8rri3r