FRIDA | resolution direction-of-arrival finding algorithm

How do you know the class is app.name.RootUtils have you decompiled to app using Jadx or apktool? How about the method where RootUtils.isRooted() is called? Is there any special code that loads the RootUtils class e.g. from a non-standard dex file included in the app? If the class is loaded from a special dex file you could hook this dex loading mechanism and first execute it and then install your hook for RootUtils.isRooted().

Alternatively assuming RootUtils.isRooted() is called only from one other method and does not use special code for loading the RootUtils class you could hook that method and use the this hook to install install your RootUtils.isRooted() hook.

The correct way to handle errors in JavaScript is using try catch block, not the setTimeout function:

Sounds like you need to use the "maven-assembly-plugin" with the "jar-with-dependencies" descriptor.

E.g. here is a full example pom file with a dependency on ByteBuddy:

I believe this is what you are looking for. Using np.sort will change the order of the first two columns for each row so it is alphabetical, allowing the merge to work correctly.

You want to look at the part of the specification that tells you what the message format is.

But to answer your questions:

0x08000000: Length of Message Body (Little Endian), starting from end of Header. This should be referring to the eight null bytes at the end?

Correct.

0x70000000: (Little Endian) Not sure what this represents? This value does correspond to the length of the array of struct, excluding trailing null bytes, that starts from 0x0010 and ends at 0x007F.

That's the length of the array in the header. The DBus header is of a variable size - after the first few bytes, it is an array of struct(byte,variant). As per the documentation, that looks like a(yv) if you were to express this as a DBus type signature.

0x01: Decimal Code for Object Path 0x01: Not sure what this represents?

This is where the parsing gets interesting: in our struct, the signature is yv, so the first 0x01 is telling us that this struct entry is the header field for Object Path, as you have seen. However, we now need to parse what the variant contains inside of it. To marshal a variant, you first marshal a signature, which in this case is 1 byte long: 01 6f 00. Note that signatures can be a max of 255 bytes long, so unlike other strings they only have a 1-byte length at the front. As a string, that is o, which tells us that this variant contains an object path inside of it. Since object paths are strings, we then decode the next bytes as a string(keeping note that the leading 4 bytes are the string length): 15 00 00 00 2f 72 65 2f 66 72 69 64 61 2f 48 6f 73 74 53 65 73 73 69 6f 6e 00

If I've done the conversion correctly, that says /re/frida/HostSession

Shouldn't this be how to achieve a third menu layer?

First of all install Node-v16*.exe and Git-2*.exe.. Create new folder anywhere you want (like D:\il2cpp-bridge) Open command prompt from created folder and type

Frida Swift bridge author here. The method you're trying to hook isn't symbolicated which is why the bridge can't intercept it, from the docs:

A major caveat is that the function at target has to have a Swift symbol or either we bail. The symbol is required for the parsing of argument and return types.

The API should be returning a more useful error though, so I'll fix that.

(Also feel free to open an issue on GitHub as it'll get much better coverage there, I came across this by chance!)

Looks like the common problem in Frida that the way to access fields is different in Frida.

Frida uses JavaScript code so it can't handle non-JavaScript objects directly. Therefore it wraps "native" objects (Android Java objects in this case) in JavaScript objects.

If you now call in Frida this.carrier you are getting the Frida JavaScript wrapper, not the Java Carrier instance you are aiming.

Of course the Frida JavaScript wrapper does not has the methods you try to call, therefore this.carrier.setId(123); will always fail.

To access a field you always have to call .value on it to get the actual value:

So if you want this.carrier you have to use this.carrier.value.

Furthermore it is recommended to access a field by it's name with an additional underscore in front. Otherwise in obfuscated apps it may occur that there is a field and a method of the same name. In such a case Frida doesn't know if you want to access the field carrier or the method carrier.

Conclusion if you want to access a field of an Java class instance in an Android app using Frida the recommended way is