Objection Practical - Invoking Method using Objection

I have challenged my self to use tool Objection to solve the labs on the Android Frida Labs created by MobileHackingLab. For you that don't familiar with frida, the course is very easy to follow and teach you basic concept of using frida during mobile application pentest.

I have written how to hook and watch method using Objection yesterday. You can visit the article here : https://www.dhirubhai.net/pulse/objection-practical-introduction-hooking-watching-using-syuhada-6rzic/

Now, we will continue with the next topic, invoking method. I recommend you to read the material from the course and practice using frida before using Objection as this article will not cover the frida part.

Prequisite :

1. Android studio Emulator or any other Emulator eg;( NOX
2. Frida server on android emulator
3. Frida-tools on your laptop/PC
4. Objection installed on your laptop
5. Enroll course here (it's free) https://www.mobilehackinglab.com/course/android-frida-labs.
6. Download app-debug.rar from section "Invoking a method using Frida".

1.?????? Running objection

objection -g com.mobilehackinglab.fridatwo explore

2.?????? List all activities

android hooking list activities

3.?????? List class methods from class MainActivity

android hooking list class_methods com.mobilehackinglab.fridatwo.MainActivity

There is static method decryptFlag() and static void method showFlag()

Checking the code using jadx-gui we can see that the showFlag() never called by the activity.

4. Get instance's hashcode??????

Objection have “android heap” command that can be used to call the methods. But first we need to know the hashcode of the Class MainActivity.

android heap search instances com.mobilehackinglab.fridatwo.MainActivity

We get the hashcode : 85345637

5.?????? Using “android heap execute” we can call the method showFlag

android heap execute <hashcode> <methods>

android heap execute 85345637 showFlag

6.?????? Other way, we can use “android heap evaluate” to execute script

android heap evaluate <hashcode>

android heap evaluate 85345637

• Add code :

var i = Java.use("com.mobilehackinglab.fridatwo.MainActivity");

i.showFlag();

?

• Click [Esc] and then [ENTER].

?

This article series is part of #menulis100hari process.

~Bandung , 12 February 2025

~17/100