Function is unhookable by Frida-CodePudding

I have the following Java code and I'm trying to hook the getTimeZone function:

package com.myapp.models;

public class User {

    private String timeZone;

    public void setTimeZone(String str) {
        this.timeZone = str;
    }

    public String getTimeZone() {
        return this.timeZone;
    }
}

This is the frida code I'm trying to use:

Java.perform(function () {

    var User = Java.use("com.myapp.models.User");
    User.getTimeZone.implementation = function() {
        console.log("timezone requested")
        return 12;
    };

});

However, the hook does not seem to happen since the app crashes on getTimezone not returning a vlue:

10-21 12:17:23.013 26553 26553 E AndroidRuntime: Process: com.myapp.android, PID: 26553
10-21 12:17:23.013 26553 26553 E AndroidRuntime: java.lang.NullPointerException: Attempt to invoke virtual method 'java.lang.String com.myapp.models.User.getTimeZone()' on a null object reference
10-21 12:17:23.013 26553 26553 E AndroidRuntime:        at com.myapp.features.home.logs.updateChart(Presenter.java:370)
10-21 12:17:23.013 26553 26553 E AndroidRuntime:        at com.myapp.features.home.logs.loadGraph(Presenter.java:217)
10-21 12:17:23.013 26553 26553 E AndroidRuntime:        at com.myapp.features.home.logs.onResume(Fragment.java:313)

I know that there is no typo in the function and it is identified successfully since I ran in frida:

[Redmi Note 7::myapp]-> Java.use("com.myapp.models.User").getTimeZone
function
[Redmi Note 7::myapp]-> Java.use("com.myapp.models.User").getTimeZone.implementation
"0x7e3682a128"

CodePudding user response：

Your Frida code has one major problem:

The definition of getTimeZone is String getTimeZone() hence you have to return a String.

But your Frida code return an int value: return 12;

Change it to return "12"; and your Frida code should work.

There may be a second problem in the Android app defining the User class (in one of the method com.myapp.features.home.logs.updateChart you have not included in your question). Based on the exception

java.lang.NullPointerException: Attempt to invoke virtual method java.lang.String com.myapp.models.User.getTimeZone()' on a null object reference

the app seems to call getTimeZone() without constructing an User() instance first. Unless you correct that the Frida hooking code can not work properly.