1 year ago

#308703

test-img

hanan

Hook instagram apk using Frida

I wanted to hook some functions from instagram apk using frida, decompiled the apk with jadx/JEB, one of the functions I wanted to hook was in this:

    public static void A00(HGf arg8, I1Y arg9) {
        arg8.A0P();
        Boolean v0 = arg9.A0v;
        if(v0 != null) {
            arg8.A0l("about_your_account_bloks_entrypoint_enabled", v0.booleanValue());
        }
//some other code here
}

Tried to hook the function with this frida script:

  try {
    //

    let I1X = Java.use("X.I1X")
    console.log("this is instance: ", I1X)
    console.log(
      "these are the methods:: ",
      Java.use("X.I1X").class.getDeclaredMethods()
    )

    I1X.A00.overload().implemention = function (HGf, I1Y) {
      console.log("A0l is called")
      let ret = this.A0l(str, z)
      console.log("A0l ret value is " + ret)
    }
} catch (e) {
    console.log("failed!" + e)
  }
})

this script outputs:

this is instance: <class: X.I1X>

these are the methods::

failed!TypeError: not a function

apparently the A00 here is not a function, so back to jadx in the compiled code there is another class with the same name within same package but consisting of some other code, here it is:


/* renamed from: X.I1x  reason: case insensitive filesystem */
/* loaded from: classes7.dex */
public final class C39227I1x {
    public C39229I1z A00 = null;
}

apparently Frida is hooking this variable instance A00 In my opinion that is why it is returning not a function here.

So my question, how can I hook like this situation?

Edit:

the two classes are somewhat different in jadx.

reverse-engineering

malware

deobfuscation

frida

0 Answers

Your Answer

Accepted video resources