Frida hook override method of anonymous class?

nhujasf :

package com.test.testapplication;

import android.content.Context;
import android.webkit.ValueCallback;
import android.webkit.WebView;

public abstract class TXOut extends WebView {
    public TXOut(Context context) {
        super(context);
    }

    private class TXIn implements Runnable {
        String a;
        ValueCallback b;

        TXIn(String str) {
            this.a = str;
        }

        private void b() {
            TXOut.this.evaluateJavascript(
                    "(function() { return ('<html>'+document.getElementsByTagName('html')[0].innerHTML+'</html>'); })();",
                    new ValueCallback<String>() {
                        @Override
                        public void onReceiveValue(String html) {
                            // code here
                        }
                    });
        }

        public void run() {}
    }
}

How could I hook TXOut ---> TXIn ---> b ---> new ValueCallback() ---> onReceiveValue using frida?

I want to get this method's html argument

Robert :

Anonymous inner classes are getting a generated class name using the following scheme:

<outer class name>$<number>

Where number starts at 1 and for each anonymous inner class it is just incremented by one.

Therefore in your case most likely it will be com.test.testapplication.TXOut.TXIn$1.

It seems like you are practicing using Frida, because usually you don't have the source code of an app. Therefore the common way is to use the compiled APK file and decompile it using e.g. apktool. In the generated smali sources you can easily identify the inner class you are looking for you just have to replace / with . to convert the smali class name back to a regular Java class name.

Frida hook override method of anonymous class?

Guess you like