# Hooking & Intercepting

## 📌What is hooking?

Hooking is the technique of intercepting and altering the functionality of functions or methods within an application or the Android operating system. For instance, by hooking a method in our app, we can modify its behavior by implementing our own logic.

### 📍How Frida Hooks into Apps

Frida can be injected into an app using two different approaches:

1. **Injected Mode (Recommended)**
   * Runs `frida-server` on your device.
   * Allows you to attach to running apps without modifying the APK.
2. **Embedded Mode**
   * Requires modifying the APK manually.
   * You must inject the Frida Gadget (`.so` file) into the APK, repack it, and resign it.
   * Useful for bypassing anti-debugging protections.

### 📍**When to Run Your Script**

Depending on when you want to start hooking the app, use the appropriate command:

* **If the app is already running (attach after objects are loaded):**

  ```bash
  frida -U -n package_name
  ```
* **If you want to start the app from the beginning (Before app initialization):**

  ```bash
  frida -U -f package_name -l script.js
  ```

## 📌What Does Interception Mean?

**Interception** is the process of hooking into a function at runtime to observe or modify its behavior. With **Frida**, this lets us:

* **See what arguments** are passed to the function.
* **Modify those arguments** before they’re used.
* **Run custom code** when the function is called.
* **Change the return value** before it’s given back to the app.

### 📍Basic Frida script

* ***This is the skeleton we can use***

  ```jsx
  // Ensure the script runs inside the Java environment
  Java.perform(function () {
      // Store the target class in a variable
      var varName = Java.use("package_name.class_name");

      // Hook the onCreate method
      varName.onCreate.implementation = function (bundle) {
           // Log a message when the method is called
          console.log("onCreate called");

          // Call the original onCreate method to avoid breaking the app
          this.onCreate(bundle);
      };
  });
  ```
* ***A short explanation of the functions***
  * **`Java.perform(function() { ... })`**
    * Ensures that the script runs within the Java environment of the target app
  * **`Java.use("com.example.app.className")`**
    * Loads the specified Java class (`className`) from the target Android app so it can be manipulated.
  * **`.implementation`** is used to **hook and modify** a method’s behavior at runtime. It allows us to intercept method calls, log data, modify parameters, or even change the method's return value.

📍In Java, methods can be **overloaded**, meaning multiple methods can have the same name but different parameters. For example, an Android `Activity` class might have multiple `onCreate` methods:

```java
public void onCreate() { ... }  // No parameters
public void onCreate(Bundle savedInstanceState) { ... }  // Takes a Bundle
public void onCreate(Bundle savedInstanceState, String extra) { ... }  // Two parameters
```

Since Frida needs to know **exactly** which method we are targeting, we use `.overload(...)` to specify the parameter types.

```java
Java.perform(function () {
    var varName = Java.use("com.example.app.className");

    // Hook the onCreate method (assuming it takes a Bundle as a parameter)
    varName.onCreate.overload("android.os.Bundle").implementation = function (bundle) {
        console.log("onCreate called");
        this.onCreate(bundle);
    };
});
```

### 📍Modifying a Method's Return Value

This script hooks into the `randomDice()` method of the `DiceGameFragment` class and changes its return value to `5`.

```jsx
// Run the script within the Java VM context
Java.perform(function () {

    // 1. Get a reference to the target class
    var DiceGameFragment = Java.use("io.hextree.fridatarget.ui.DiceGameFragment");

    // 2. Hook the 'randomDice' method
    DiceGameFragment.randomDice.implementation = function () {
        // Optional: Call the original method
        this.randomDice();

        // 3. Return a fixed value instead of the original result
        return 5;
    };
});
```

***


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://e1mazahy.gitbook.io/tomesec/droidtomesec/android-pentesting/frida/hooking-and-intercepting.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.