`TypeError: cannot write property 'implementation' of undefined` error in frida - instrumentation

Question

I am trying to inject the below script using frida
setImmediate(function() { //prevent timeout
console.log("[*] Starting script");
Java.perform(function() {
var bClass = Java.use("sg.vantagepoint.uncrackable1.a");
bClass.onClick.implementation = function(v) {
console.log("[*] onClick called");
// do nothing
}
console.log("[*] onClick handler modified")
})
})
Throws the below error
Attaching...
[*] Starting script
TypeError: cannot write property 'implementation' of undefined
at [anon] (../../../frida-gum/bindings/gumjs/duktape.c:57636)
at /inject.js:10
at frida/node_modules/frida-java-bridge/lib/vm.js:11
at E (frida/node_modules/frida-java-bridge/index.js:346)
at frida/node_modules/frida-java-bridge/index.js:298
at frida/node_modules/frida-java-bridge/lib/vm.js:11
at frida/node_modules/frida-java-bridge/index.js:278
at /inject.js:13
at frida/runtime/core.js:55
command i am using frida -U -l inject.js owasp.mstg.uncrackable1
Below one is the decompiled code of the apk file.
package sg.vantagepoint.uncrackable1;
public class MainActivity extends Activity {
private void a(String str) {
AlertDialog create = new AlertDialog.Builder(this).create();
create.setTitle(str);
create.setMessage("This is unacceptable. The app is now going to exit.");
create.setButton(-3, "OK", new DialogInterface.OnClickListener() {
public void onClick(DialogInterface dialogInterface, int i) {
System.exit(0);
}
});
create.setCancelable(false);
create.show();
}

Answer 1

Try to inject this script
setImmediate(function () {
console.log("[*] Starting script");
Java.perform(function () {
var bClass = Java.use("sg.vantagepoint.uncrackable1.MainActivity$1");
bClass.onClick.implementation = function (v) {
console.log("[*] onClick called.");
}
console.log("[*] onClick handler modified")
var aaClass = Java.use("sg.vantagepoint.a.a");
aaClass.a.implementation = function (arg1, arg2) {
var retval = this.a(arg1, arg2);
var password = ''
for (var i = 0; i < retval.length; i++) {
password += String.fromCharCode(retval[i]);
}
console.log("[*] Decrypted: " + password);
return retval;
}
console.log("[*] sg.vantagepoint.a.a.a modified");
});
});

Answer 2

This is happening because you're trying to override the onClick function of the main activity: sg.vantagepoint.uncrackable1.MainActivity$1 doesn't have an onClick() function. You can either cancel the function call entirely by overriding the a function to do nothing, or if you want to retain the logic but instead just cancel the display, should use Java.choose(...) API to choose the alert dialogue once it is instantiated and change it to fit your needs - for example, you can make the dialogue window cancelable, like this:
setImmediate(function() { //prevent timeout
console.log("[*] Starting script");
Java.perform(function() {
var bClass = Java.use("sg.vantagepoint.uncrackable1.a");
var oldImpl = bClass.a.implementation;
bClass.a.implementation = function(v){
console.log("Initial activity logic is launching");
oldImpl(v);
Java.choose("android.app.AlertDialog", {
onMatch: function(instance){
console.log("Found an alert dialog, making it cancelable")
instance.setCancelable(true);
}
onComplete: function(){
console.log("Done")
}
})
}
})
})