Android Frida Hook构造函数失效问题求助

Let's break down why your Frida script isn't hooking the DemoTest constructor and fix it step by step:

1. Critical Typo in Constructor Call #

The biggest issue in your script is that you're using this.init instead of this.$init when calling the original constructor. Frida uses the $init identifier to reference Java constructors, so plain init won't resolve to the correct method—this is why your hook isn't executing as expected.

2. Optional: Adjust Script Timing for Lazy-Loaded Classes #

While your setTimeout with a 0 delay might work, some target classes load lazily after the app starts. You can tweak this to ensure the hook runs when the class is available:

• Increase the timeout (e.g., setTimeout(..., 3000) to wait 3 seconds for the app to initialize)
• Or wrap your hook in Java.whenReady() to trigger only after the Java environment is fully ready

3. Verify Class and Method Signatures #

Double-check these details to avoid silent failures:

• The full class name com.demo.app.test.DemoTest matches exactly with your app's package structure
• The overload signature (String, int, boolean) perfectly aligns with your DemoTest constructor parameters

Fixed Frida Script (test.js) #

setTimeout(function() {
    Java.perform(function() {
        console.log("=== Demo Test Hook Initialized ===");
        var DemoTest = Java.use("com.demo.app.test.DemoTest");
        
        // Hook the constructor with the correct signature
        DemoTest.$init.overload('java.lang.String', 'int', 'boolean').implementation = function(arg0, arg1, arg2) {
            console.log(`Constructor triggered: v1=${arg0}, v2=${arg1}, v3=${arg2}`);
            // Call the original constructor using Frida's $init identifier
            return this.$init.overload('java.lang.String', 'int', 'boolean').call(this, arg0, arg1, arg2);
        };
    });
}, 1000); // Small delay to ensure app classes start loading

Additional Troubleshooting Tips #

• Confirm the app creates DemoTest instances: If your app never calls new DemoTest(...), the hook won't trigger. Test with a build that explicitly instantiates the class (e.g., new DemoTest("test", 123, true)).
• Check for Frida errors: Remove --no-pause from your command temporarily to see if Frida throws class-not-found or method-signature mismatches.
• Try JNI-style overload signatures (optional): If string-based overloads fail, use JNI type signatures instead:

  DemoTest.$init.overload('Ljava/lang/String;', 'I', 'Z').implementation = function(arg0, arg1, arg2) {
      // Same logging and original call logic
  };
  

Verified Frida Command #

Keep your command as-is, just ensure the app package com.demo.app is correct:

frida -U -f com.demo.app -l test.js --no-pause

内容的提问来源于stack exchange，提问作者deeptimancode