function trace(tag) { Log.e((tag || '') + Java.use('android.util.Log').getStackTraceString(Java.use('java.lang.Throwable').$new())) } function readFile(path) { var FileOutputStream = Java.use('java.io.FileOutputStream') var FileInputStream = Java.use('java.io.FileInputStream') var File = Java.use('java.io.File') var InputStreamReader = Java.use('java.io.InputStreamReader') var BufferedReader = Java.use('java.io.BufferedReader') var ByteArrayOutputStream = Java.use('java.io.ByteArrayOutputStream') var file = File.$new(path) var fileInputStream = FileInputStream.$new(file) var inputStreamReader = InputStreamReader.$new(Java.cast(fileInputStream, Java.use('java.io.InputStream'))) var bufferedReader = BufferedReader.$new(inputStreamReader) var line var content = '' while ((line = bufferedReader.readLine()) !== null) { content += line + '\n' } bufferedReader.close() inputStreamReader.close() fileInputStream.close() return content } setImmediate(() => { Java.perform(function () { const Log = Java.use('android.util.Log') function log(msg) { console.log(`\x1b[30m[system_server] ${msg}\x1b[0m`) Log.d('frida-system_server', msg + '') } const classLoaders = Java.enumerateClassLoadersSync() classLoaders.forEach((classLoader) => { log(classLoader) }) const wifiClassLoader = classLoaders.find((i) => i.toString().includes('wifi')) Java.classFactory.loader = wifiClassLoader const WifiServiceImpl = Java.use('com.android.server.wifi.WifiServiceImpl') log(WifiServiceImpl) WifiServiceImpl.getFactoryMacAddresses.overload().implementation = function () { const original = this.getFactoryMacAddresses() const spoof = ['00:00:00:00:00:00'] log(`WifiServiceImpl.getFactoryMacAddresses() called, returning: ${spoof}, original: ${original}`) return spoof } WifiServiceImpl.getConnectionInfo.overload('int').implementation = function (arg) {} }) })