frida-rcs-hack/scripts/wifi.js

function trace(tag) {
    Log.e((tag || '') + Java.use('android.util.Log').getStackTraceString(Java.use('java.lang.Throwable').$new()))
}

function readFile(path) {
    var FileOutputStream = Java.use('java.io.FileOutputStream')
    var FileInputStream = Java.use('java.io.FileInputStream')
    var File = Java.use('java.io.File')
    var InputStreamReader = Java.use('java.io.InputStreamReader')
    var BufferedReader = Java.use('java.io.BufferedReader')
    var ByteArrayOutputStream = Java.use('java.io.ByteArrayOutputStream')

    var file = File.$new(path)
    var fileInputStream = FileInputStream.$new(file)

    var inputStreamReader = InputStreamReader.$new(Java.cast(fileInputStream, Java.use('java.io.InputStream')))
    var bufferedReader = BufferedReader.$new(inputStreamReader)
    var line
    var content = ''
    while ((line = bufferedReader.readLine()) !== null) {
        content += line + '\n'
    }

    bufferedReader.close()
    inputStreamReader.close()
    fileInputStream.close()

    return content
}

setImmediate(() => {
    Java.perform(function () {
        const Log = Java.use('android.util.Log')

        function log(msg) {
            console.log(`\x1b[30m[system_server] ${msg}\x1b[0m`)
            Log.d('frida-system_server', msg + '')
        }
        const classLoaders = Java.enumerateClassLoadersSync()
        classLoaders.forEach((classLoader) => {
            log(classLoader)
        })
        const wifiClassLoader = classLoaders.find((i) => i.toString().includes('wifi'))
        Java.classFactory.loader = wifiClassLoader
        const WifiServiceImpl = Java.use('com.android.server.wifi.WifiServiceImpl')
        log(WifiServiceImpl)
        WifiServiceImpl.getFactoryMacAddresses.overload().implementation = function () {
            const original = this.getFactoryMacAddresses()
            const spoof = ['00:00:00:00:00:00']
            log(`WifiServiceImpl.getFactoryMacAddresses() called, returning: ${spoof}, original: ${original}`)
            return spoof
        }
        WifiServiceImpl.getConnectionInfo.overload('int').implementation = function (arg) {}
    })
})