`TypeError: cannot write property 'implementation' of undefined` error in frida

Question

I am trying to inject the below script using frida

setImmediate(function() { //prevent timeout
    console.log("[*] Starting script");

    Java.perform(function() {

      var bClass = Java.use("sg.vantagepoint.uncrackable1.a");
      bClass.onClick.implementation = function(v) {
         console.log("[*] onClick called");
         // do nothing
      }
      console.log("[*] onClick handler modified")

    })
})

Throws the below error

Attaching...                                                            
[*] Starting script
TypeError: cannot write property 'implementation' of undefined
    at [anon] (../../../frida-gum/bindings/gumjs/duktape.c:57636)
    at /inject.js:10
    at frida/node_modules/frida-java-bridge/lib/vm.js:11
    at E (frida/node_modules/frida-java-bridge/index.js:346)
    at frida/node_modules/frida-java-bridge/index.js:298
    at frida/node_modules/frida-java-bridge/lib/vm.js:11
    at frida/node_modules/frida-java-bridge/index.js:278
    at /inject.js:13
    at frida/runtime/core.js:55

command i am using frida -U -l inject.js owasp.mstg.uncrackable1

Below one is the decompiled code of the apk file.

package sg.vantagepoint.uncrackable1;

public class MainActivity extends Activity {
        private void a(String str) {
            AlertDialog create = new AlertDialog.Builder(this).create();
            create.setTitle(str);
            create.setMessage("This is unacceptable. The app is now going to exit.");
            create.setButton(-3, "OK", new DialogInterface.OnClickListener() {
                public void onClick(DialogInterface dialogInterface, int i) {
                    System.exit(0);
                }
            });
            create.setCancelable(false);
            create.show();
        }

Answer 1

This is happening because you're trying to override the onClick function of the main activity: sg.vantagepoint.uncrackable1.MainActivity$1 doesn't have an onClick() function. You can either cancel the function call entirely by overriding the a function to do nothing, or if you want to retain the logic but instead just cancel the display, should use Java.choose(...) API to choose the alert dialogue once it is instantiated and change it to fit your needs - for example, you can make the dialogue window cancelable, like this:

setImmediate(function() { //prevent timeout
    console.log("[*] Starting script");

    Java.perform(function() {

      var bClass = Java.use("sg.vantagepoint.uncrackable1.a");
      var oldImpl = bClass.a.implementation;
      bClass.a.implementation = function(v){
          console.log("Initial activity logic is launching");
          oldImpl(v);
          Java.choose("android.app.AlertDialog", {
              onMatch: function(instance){
                  console.log("Found an alert dialog, making it cancelable")
                  instance.setCancelable(true);
              }
              onComplete: function(){
                  console.log("Done")
              }
          })
      }

    })
})

Answer 2

Try to inject this script

setImmediate(function () {
    console.log("[*] Starting script");

    Java.perform(function () {

        var bClass = Java.use("sg.vantagepoint.uncrackable1.MainActivity$1");
        bClass.onClick.implementation = function (v) {
            console.log("[*] onClick called.");
        }
        console.log("[*] onClick handler modified")


        var aaClass = Java.use("sg.vantagepoint.a.a");
        aaClass.a.implementation = function (arg1, arg2) {
            var retval = this.a(arg1, arg2);
            var password = ''
            for (var i = 0; i < retval.length; i++) {
                password += String.fromCharCode(retval[i]);
            }

            console.log("[*] Decrypted: " + password);
            return retval;
        }
        console.log("[*] sg.vantagepoint.a.a.a modified");

    });

});