Practical Frida Java API Tips

This note collects a few useful patterns for working with Android Java classes through Frida.

Frida Java API operations must run inside a Java.perform callback, and overloaded methods must be selected with the exact parameter signature. Use these techniques only on applications and devices you are authorized to test.

Assign a value to an instance field

Create an object with $new() and access a Java field through its .value property:

Java.perform(function () {
  var TargetClass = Java.use("com.tencent.mm.o");
  var instance = TargetClass.$new();
  instance.a.value = 1;
});

If the field is inherited, private, renamed by obfuscation, or represented by an accessor method, inspect the runtime class before assuming the field name is stable.

Call an overloaded static method

Use overload() to select the required signature explicitly:

Java.perform(function () {
  var StringClass = Java.use("java.lang.String");
  var TargetClass = Java.use("com.tencent.mm.o");

  TargetClass.b
    .overload("java.lang.String")
    .call(TargetClass, StringClass.$new("111"));
});

For a true static method, the receiver passed to call() is usually the class wrapper. For an instance method, pass the target object instead. When a hook fails, print the available overloads and verify the class loader, method signature, and application version.