How to get ANDROID_ID with Frida

Question

The ANDROID_ID is unique in each application in Android.

To get the ANDROID_ID with Java inside Android I amd using this code:

import android.content.Context;
import android.content.ContentResolver;
import android.provider.Settings;
protected void onCreate(...) {
  context = (Context)this;
  String androidId = Settings.Secure.getString((ContentResolver)context.getContentResolver(), (String)"android_id");
}

But I want to run it inside some other application on my andoird phone.
I wanted to use Frida for this.

I am loading my injected script with Python:

import frida
device = frida.get_usb_device()
pid = device.spawn(["com.target.app"])
device.resume(pid)
time.sleep(1) #Without it Java.perform silently fails
session = device.attach(pid)
script = session.create_script(open("jsfrida.js").read())
script.load()

#prevent the python script from terminating
raw_input()

But inside my script I don't understand how to call it, this is what I tried:

Java.perform(function (){
  console.log("Inside java perform function");
  var ActivityThread = Java.use('android.app.ActivityThread');
  var Context = Java.use('android.content.Context');
  var settings = Java.use('android.provider.Settings.Secure');
  var ctx = Java.cast(ActivityThread.currentApplication().getApplicationContext(), Context);
  //console.log(ctx.getPackageName());
  //console.log(ctx.getContentResolver());
  var androidId = settings.Secure.getString(ctx.getContentResolver(), "android_id");
  console.log(androidId);
  console.log("END");
 });

But it doesn't print the androidId, it only prints:

Script loaded successfully 
Inside java perform function

I think your problem is the context. You can't create a new context, you have to use an existing one. To get an existing context you need to hook a function that retrieves the context as a parameter. — Robert, Feb 21 '19 at 19:34
@Robert you are right. I fixed the context issue, I now have context (I verified it with the commented lines), but still have problem with the `Setting` class. — E235, Feb 21 '19 at 19:43
I remember some issues with subclasses like `Settings.Secure` in frida the class name may be different. Print the complete class list for classes which name start with `android.provider` and see if the class name is correct: https://stackoverflow.com/a/54149567/150978 — Robert, Feb 21 '19 at 19:54

whoopdedoo · Accepted Answer · 2019-02-22T00:35:54.880

Secure is inner class so you need to use $
- inner classes will be compiled to ClassName$InnerClassName
To get CotentResolver you can invoke getContentResolver without casting.

$ frida -Uf com.app.example --no-pause
     ____
    / _  |   Frida 12.1.2 - A world-class dynamic instrumentation toolkit
   | (_| |
    > _  |   Commands:
   /_/ |_|       help      -> Displays the help system
   . . . .       object?   -> Display information about 'object'
   . . . .       exit/quit -> Exit
   . . . .
   . . . .   More info at http://www.frida.re/docs/home/
Spawned `com.app.example`. Resuming main thread!                    
[Android::com.app.example]-> 
function getContext() {
  return Java.use('android.app.ActivityThread').currentApplication().getApplicationContext().getContentResolver();
}                                         
function logAndroidId() {
  console.log('[?]', Java.use('android.provider.Settings$Secure').getString(getContext(), 'android_id'));
}
undefined
[Android::com.app.example]-> Java.perform(logAndroidId)
[?] 52d1497b52bf8a11
undefined
[Android::com.app.example]->

How to get ANDROID_ID with Frida

1 Answers1