frida-rcs-hack/scripts/sendsms1.js

Java.perform(() => {
    Java.deoptimizeEverything()

    let found = false
    Java.choose('com.android.internal.telephony.SmsDispatchersController', {
        onMatch: function (instance) {
            if (found) {
                return
            }
            found = true

            const Intent = Java.use('android.content.Intent')
            const SubscriptionManager = Java.use('android.telephony.SubscriptionManager')
            const Base64 = Java.use('java.util.Base64')

            let subId = 0
            let slot = 0

            const subscriptionManager = SubscriptionManager.from(instance.mContext.value)
            for (let i = 0; i < subscriptionManager.getActiveSubscriptionInfoCountMax(); i++) {
                const subInfo = subscriptionManager.getActiveSubscriptionInfoForSimSlotIndex(i)
                if (subInfo != null) {
                    subId = subInfo.getSubscriptionId()
                    slot = subInfo.getSimSlotIndex()
                    break
                }
            }

            const Integer = Java.use('java.lang.Integer')
            subId = Integer.valueOf(subId + '')
            slot = Integer.valueOf(slot + '')

            const intent = Intent.$new()
            intent.putExtra('android.telephony.extra.SUBSCRIPTION_INDEX', subId)

            intent.putExtra('messageId', Java.use('java.lang.Long').parseLong('' + parseInt(Math.random() * 100000000)))

            const pdu = Base64.getDecoder().decode('{pduBase64}')
            const pdus = Java.array('[B', [pdu])
            intent.putExtra.overload('java.lang.String', 'java.io.Serializable').call(intent, 'pdus', pdus.$w)
            intent.putExtra('format', '3gpp')
            intent.putExtra('android.telephony.extra.SLOT_INDEX', slot)
            intent.putExtra('phone', slot)
            intent.putExtra('subscription', subId)
            // instance.mContext.value.sendBroadcast(intent)

            intent.setAction('android.provider.Telephony.SMS_RECEIVED')
            instance.mContext.value.sendBroadcast(intent)

            intent.setAction('android.provider.Telephony.SMS_DELIVER')
            instance.mContext.value.sendBroadcast(intent)

            console.log('OK')
        },
        onComplete: function () {}
    })
})