Failed Get Result Custom Plugin

[yayip]

Hi,

I run custom plugin to call function AES encryption and decryption, but always got java error like this and in the Brida not show anyting.

And configuration my custom plugin like this :

And my script to call function like this :

Thanks.

[federicodotta]

Hi @yayip,

That exception is caused by the fact that for some reason the return value of your function is null. Probably your JavaScript function is not working properly for some reason.

You can try the function in the "Debug export" pane or even better directly in the Frida CLI, in order to check that the function is working properly.

One potential issue: "nf.a.a" and "nf.a.b" are static functions? Because if not, you have to first get an instance of an object of type "nf.a". You can do that in many different ways like saving a reference of the object you need with a Frida hook, instantiate the object by yourself or use Java.choose to search for the object in the Java heap.

Federico

[yayip]

Hi @federicodotta,

This script work for me i run on the frida cli, but how to return to brida because in the "Debug Export" always return null ?

function test() {
    Java.perform(function() {
        var aClass = Java.use("nf.a");
    
        //decrypt
        aClass.a.overload('java.lang.String', 'java.lang.String').implementation = function(str, str2) {
            console.log("Calling a() method with parameters: " + str + ", " + str2);
            var result = this.a(str, str2);
            console.log("Result of a() method: " + result);
            return result;
        };
    });
}

Thanks,

[federicodotta]

Hi @yayip,

The script you run on the Frida CLI is different, because you start from a hook and call "this.a". If "a" is not a static function, "this" is an instance of your class and consequently in your Frida script will work, while in your Brida script will not because you call "class.function" instead of "instance.function".

Try to execute in the Frida CLI the "a" function as you do in the Brida script, directly from the "nf.a" class, because otherwise you are in a different scenario.

You can try to paste directly in the Frida CLI something like that to see if it works correctly:

Java.perform(function() {
        var aClass = Java.use("nf.a");
        var ret = aClass.a("AAAA","BBBB");
        console.log(ret);
    });

Federico

[yayip]

Hi @federicodotta,

Thanks to guide me, now I successfully to call encrypt function with the script, but now I have problem to call decryption function because this function have two parameter (msg, key), key must be generated automatically by application, what best way to get key ?

    encrypt: function(msg) {
        var ret = null;
        Java.perform(function() {
            Java.choose("nf.a", {
                onMatch: function(instance) {        
                    var resultB = instance.b(msg);
                    ret = resultB;
                },
                onComplete: function() {
                    //pass
                }
            });
        });
        return ret;
    },

.

Decrypt function

Thanks.

[federicodotta]

Hi @yayip,

You can do in many ways, but it depends on your application, on where the key is stored and on how often the key changes.

You can for example add a hook to a function that uses or sets the key and save the key in a global JavaScript variable in your Brida script. Then you take the key from the variable in your Brida function.

You can also also check the code of "nf.a" class. Maybe there is a get function that returns a key or the key is stored in a variable (with Frida you have access also to internal variables). Or maybe the key is stored in another object that you can get with Java.choose or with another hook.

Is the key never changes you can also simply add a hook to the "decrypt" function, retrieve the key and then copy the key directly in your Brida JS code. Simple but effective.

Hope this helps.

Federico