Android Malware Analysis in Action

// --- Frida Script: JSON Data Interception ---

function json_data() {
    // Obtain a reference to the Android's JSONObject class
    const Json = Java.use('org.json.JSONObject');

    // Hook put(String key, int value) overload
    // This logs key-value pairs when an integer is put into a JSONObject.
    Json.put.overload("java.lang.String", "int").implementation = function (key, value) {
        var result = {key:value.toString()};
        console.log(JSON.stringify(result));
        // Call the original put method to ensure normal app functionality
        return this.put(key, value);
    }
    
    // Hook put(String key, Object value) overload
    // This logs key-value pairs when any Object is put into a JSONObject.
    Json.put.overload("java.lang.String", "java.lang.Object").implementation = function (key, value) {
        var result = {key:value.toString()};
        console.log(JSON.stringify(result));
        // Call the original put method
        return this.put(key, value);
    }

    // Hook the JSONObject(String jsonString) constructor
    Json.$init.overload('java.lang.String').implementation = function (jsonString) {
        console.log(JSON.stringify(jsonString));
        // Call the original constructor
        return this.$init(jsonString);
    };
}

// Entry point for Frida script execution
setImmediate(function() {
    Java.perform(function() {
        console.log("[+] Starting Frida JSON hooking!");
        json_data();  
        console.log("[+] JSON hooks are active!");
    });
}, 0);