frida icon indicating copy to clipboard operation
frida copied to clipboard

[Android] Issue with frida-java-bridge

Open kikoas1995 opened this issue 3 years ago • 9 comments

Hello!

I'm trying to load a script to test SSL Pinning on an application. However, I'm getting the following error:

C:\platform-tools\platform-tools_r33.0.1-windows\platform-tools> frida -U -f de.robv.android.xposed.installer -l multiple.js --no-pause
     ____
    / _  |   Frida 15.2.2 - A world-class dynamic instrumentation toolkit
   | (_| |
    > _  |   Commands:
   /_/ |_|       help      -> Displays the help system
   . . . .       object?   -> Display information about 'object'
   . . . .       exit/quit -> Exit
   . . . .
   . . . .   More info at https://frida.re/docs/home/
   . . . .
   . . . .   Connected to Pixel 4 (id=9B201FFAZ005ZD)
Spawned `de.robv.android.xposed.installer`. Resuming main thread!
Error: getPackageInfoNoCheck(): has more than one overload, use .overload(<signature>) to choose from:
        .overload('android.content.pm.ApplicationInfo', 'android.content.res.CompatibilityInfo')
        .overload('android.content.pm.ApplicationInfo', 'android.content.res.CompatibilityInfo', 'boolean')
    at X (frida/node_modules/frida-java-bridge/lib/class-factory.js:569)
    at K (frida/node_modules/frida-java-bridge/lib/class-factory.js:564)
    at set (frida/node_modules/frida-java-bridge/lib/class-factory.js:932)
    at <anonymous> (frida/node_modules/frida-java-bridge/index.js:224)
    at <anonymous> (frida/node_modules/frida-java-bridge/lib/vm.js:12)
    at _performPendingVmOpsWhenReady (frida/node_modules/frida-java-bridge/index.js:244)
    at perform (frida/node_modules/frida-java-bridge/index.js:204)
    at <anonymous> (/frida/repl-2.js:172)
[Pixel 4::de.robv.android.xposed.installer ]->

It seems to happen with all other applications and also by loading any script, so I guess it's a problem from frida-java-bridge...

Any idea?

Versions used: Frida-tools in Windows:

$ frida --version
15.2.2

Frida server using A13 Pixel4.

/tmp # ./frida-server-15.2.2-android-arm64

kikoas1995 avatar Sep 03 '22 22:09 kikoas1995

I'm also seeing error reports due to this, and there's similar complaints on Stack Overflow.

It looks like this is failing here: https://github.com/frida/frida-java-bridge/blob/0e0aa7858a07bc6b0f8747a5c53bac4a3f865717/index.js#L443

@ofcosar, what Frida version & Android OS version are you using? These errors seem to be all new, so it's either a bug in the latest Frida release, or in Android 13, which came out a few weeks back. Looks like @kikoas1995 is using Frida 15.2.2 and Android 13, both the latest releases.

Can you both try downgrading to an older Frida release, and/or try using an older Android OS if possible, and see if one of those solves the issue?

pimterry avatar Sep 06 '22 12:09 pimterry

I'm also seeing error reports due to this, and there's similar complaints on Stack Overflow.

It looks like this is failing here: https://github.com/frida/frida-java-bridge/blob/0e0aa7858a07bc6b0f8747a5c53bac4a3f865717/index.js#L443

@ofcosar, what Frida version & Android OS version are you using? These errors seem to be all new, so it's either a bug in the latest Frida release, or in Android 13, which came out a few weeks back. Looks like @kikoas1995 is using Frida 15.2.2 and Android 13, both the latest releases.

Can you both try downgrading to an older Frida release, and/or try using an older Android OS if possible, and see if one of those solves the issue?

after running the code script ı also opened the script file. this method worked for me. thank you for all your work.

ofcosar avatar Sep 07 '22 12:09 ofcosar

after running the code script ı also opened the script file.

@ofcosar sorry I don't understand, could you explain a bit more?

boehs avatar Sep 07 '22 22:09 boehs

Can you both try downgrading to an older Frida release, and/or try using an older Android OS if possible, and see if one of those solves the issue?

@pimterry I've just tried downgrading to 15.1.23 to no success. I am also running a13 so I suspect it's OS related

boehs avatar Sep 07 '22 22:09 boehs

Tada! The trick is to run the normal frida command, wait for it to error, and then run %reload in the shell. Thanks @ofcosar !

# frida -U -f de.robv.android.xposed.installer --codeshare akabe1/frida-multiple-unpinning --no-pause
...
Error: getPackageInfoNoCheck(): has more than one overload, use .overload(<signature>) to choose from:
...
[Pixel 6::de.robv.android.xposed.installer]-> %reload

======
[#] Android Bypass for various Certificate Pinning methods [#]
Full walkthorugh
➜  Downloads frida -U -f de.robv.android.xposed.installer --codeshare akabe1/frida-multiple-unpinning --no-pause
     ____
    / _  |   Frida 15.2.2 - A world-class dynamic instrumentation toolkit
   | (_| |
    > _  |   Commands:
   /_/ |_|       help      -> Displays the help system
   . . . .       object?   -> Display information about 'object'
   . . . .       exit/quit -> Exit
   . . . .
   . . . .   More info at https://frida.re/docs/home/
   . . . .
   . . . .   Connected to Pixel 6 (id=hidden for privacy)
Spawned `de.robv.android.xposed.installer`. Resuming main thread!
Error: getPackageInfoNoCheck(): has more than one overload, use .overload() to choose from:
        .overload('android.content.pm.ApplicationInfo', 'android.content.res.CompatibilityInfo')
        .overload('android.content.pm.ApplicationInfo', 'android.content.res.CompatibilityInfo', 'boolean')
    at X (frida/node_modules/frida-java-bridge/lib/class-factory.js:569)
    at K (frida/node_modules/frida-java-bridge/lib/class-factory.js:564)
    at set (frida/node_modules/frida-java-bridge/lib/class-factory.js:932)
    at  (frida/node_modules/frida-java-bridge/index.js:224)
    at  (frida/node_modules/frida-java-bridge/lib/vm.js:12)
    at _performPendingVmOpsWhenReady (frida/node_modules/frida-java-bridge/index.js:244)
    at perform (frida/node_modules/frida-java-bridge/index.js:204)
    at  (/frida/repl-2.js:172)
[Pixel 6::de.robv.android.xposed.installer]-> %reload

====== [#] Android Bypass for various Certificate Pinning methods [#]

boehs avatar Sep 07 '22 22:09 boehs

Tada! The trick is to run the normal frida command, wait for it to error, and then run %reload in the shell. Thanks @ofcosar !

# frida -U -f de.robv.android.xposed.installer --codeshare akabe1/frida-multiple-unpinning --no-pause
...
Error: getPackageInfoNoCheck(): has more than one overload, use .overload(<signature>) to choose from:
...
[Pixel 6::de.robv.android.xposed.installer]-> %reload

======
[#] Android Bypass for various Certificate Pinning methods [#]
Full walkthorugh
➜  Downloads frida -U -f de.robv.android.xposed.installer --codeshare akabe1/frida-multiple-unpinning --no-pause
     ____
    / _  |   Frida 15.2.2 - A world-class dynamic instrumentation toolkit
   | (_| |
    > _  |   Commands:
   /_/ |_|       help      -> Displays the help system
   . . . .       object?   -> Display information about 'object'
   . . . .       exit/quit -> Exit
   . . . .
   . . . .   More info at https://frida.re/docs/home/
   . . . .
   . . . .   Connected to Pixel 6 (id=hidden for privacy)
Spawned `de.robv.android.xposed.installer`. Resuming main thread!
Error: getPackageInfoNoCheck(): has more than one overload, use .overload() to choose from:
        .overload('android.content.pm.ApplicationInfo', 'android.content.res.CompatibilityInfo')
        .overload('android.content.pm.ApplicationInfo', 'android.content.res.CompatibilityInfo', 'boolean')
    at X (frida/node_modules/frida-java-bridge/lib/class-factory.js:569)
    at K (frida/node_modules/frida-java-bridge/lib/class-factory.js:564)
    at set (frida/node_modules/frida-java-bridge/lib/class-factory.js:932)
    at  (frida/node_modules/frida-java-bridge/index.js:224)
    at  (frida/node_modules/frida-java-bridge/lib/vm.js:12)
    at _performPendingVmOpsWhenReady (frida/node_modules/frida-java-bridge/index.js:244)
    at perform (frida/node_modules/frida-java-bridge/index.js:204)
    at  (/frida/repl-2.js:172)
[Pixel 6::de.robv.android.xposed.installer]-> %reload

====== [#] Android Bypass for various Certificate Pinning methods [#]

So happy to help :)

ofcosar avatar Sep 08 '22 04:09 ofcosar

I'm also seeing error reports due to this, and there's similar complaints on Stack Overflow.

It looks like this is failing here: https://github.com/frida/frida-java-bridge/blob/0e0aa7858a07bc6b0f8747a5c53bac4a3f865717/index.js#L443

@ofcosar, what Frida version & Android OS version are you using? These errors seem to be all new, so it's either a bug in the latest Frida release, or in Android 13, which came out a few weeks back. Looks like @kikoas1995 is using Frida 15.2.2 and Android 13, both the latest releases.

Can you both try downgrading to an older Frida release, and/or try using an older Android OS if possible, and see if one of those solves the issue?

after running the code script ı also opened the script file. this method worked for me. thank you for all your work.

By the way, i used a text edit app to open the file after running. However, @boehs 's "reload" way seems more suitable and programmatic.

ofcosar avatar Sep 08 '22 04:09 ofcosar

FYI @oleavr then: this strongly suggests the Java bridge is broken for Android 13 (which came out a few weeks ago) because the signature of ActivityThread.getPackageInfoNoCheck has changed, and so this built-in hook no longer works.

Reloading the script after startup to avoid this seems like a solid workaround, glad that helps, though I'm not sure if there's any other downsides to that (and it's definitely awkward and non-obvious for the many people who are going to run into this in future, as Android 13 becomes more widely used).

pimterry avatar Sep 08 '22 11:09 pimterry

also already reported here: https://github.com/frida/frida-java-bridge/issues/262 maybe fixed by: https://github.com/frida/frida-java-bridge/pull/263 but currently waiting for review

Bleuzen avatar Sep 08 '22 14:09 Bleuzen

windows 7 Android pixel4 version 12 frida server 15.2.2 frida client 15.2.2 https://httptoolkit.tech/blog/frida-certificate-pinning/ but the error is that: 无标题

lsqtongxin avatar Oct 04 '22 01:10 lsqtongxin

@lsqtongxin your error is completely unrelated

I mean, one, it's on Android 12, this only affects 13. But also the error is completely different. %reload isn't going to magically fix the code/issue, it's only a workaround for this specific error.

I don't really know how you associated this issue with yours, but if you still think they are the same please elaborate with words

Thank you!

boehs avatar Oct 04 '22 10:10 boehs

I know it's not related to this question, but the version is very similar to my environment, so wanted to ask. @boehs Some say lower version of frida, some say lower version of android. I'm an android beginner so don't know what to do my environment : windows 7 Android emulator version 7 frida server 15.2.2 frida client 15.2.2 https://httptoolkit.tech/blog/frida-certificate-pinning/

I tested the simulator in the same environment, version 7, but the error is the same. So I don't know how to solve it, please give me some advice,thanks!

lsqtongxin avatar Oct 04 '22 12:10 lsqtongxin

This is likely an issue with your code, not with frida. In any case, this specific issue isn't the appropriate avenue, sorry

boehs avatar Oct 04 '22 22:10 boehs

I think this issue is the same as https://github.com/frida/frida-java-bridge/issues/262, and this was recently fixed in https://github.com/frida/frida-java-bridge/commit/b51769a46c82bf7036a30014fd6432fd2e76b14e.

That was released in Frida-Java-Bridge v6.2.3. Looks like that's not included in an official Frida release yet, but I imagine it'll be included in the next one.

pimterry avatar Oct 06 '22 15:10 pimterry