Frida (android) - why java.lang.StringBuilder append is not hooked - frida

Question

I'm studying frida.
As an example, I simply created a string through the StringBuilder and append it.
I hooked "append" using "frida".
But it doesn't work.
String val;
val = "Log Data....";
StringBuilder log = new StringBuilder("LOG : ").append(val);
log.append("[[");
log.append("]]");
Java.perform(function () {
var StringBuilder = Java.use('java.lang.StringBuilder');
var ctor = StringBuilder.$init.overload('java.lang.String');
ctor.implementation = function (arg) {
var log_arg = '';
var result = ctor.call(this, arg);
if (arg !== null) {
log_arg = arg.toString();
}
console.log('new StringBuilder("' + log_arg + '");');
return result;
};
var append = StringBuilder.append.overload('java.lang.String');
append.implementation = function (arg) {
var result = append.call(this, arg);
var log_arg = '';
if (result !== null) {
log_arg = result.toString();
}
console.log('StringBuilder.append1(); => ' + log_arg);
return result;
};
});
Result :
new StringBuilder("LOG : ");
" Log Data....[[]] " - I can't see the message.... Probably not hooking.

Answer 1

Your hook to append isn't hooking the instance that was initialized.
var ctor = StringBuilder.$init.overload('java.lang.String');
This is where you initialize and allocate, so you need to make the call here.
Something more like
var append = ctor.implementation = function(arg)...
should work. But because StringBuilder has a ton of overloads to cover a ton of data types and it can get called a ton of times, it's much easier to simply hook its toString method so that you don't have to do any casting or write a ton of overloads.
const StringBuilder = Java.use('java.lang.StringBuilder');
StringBuilder.toString.implementation = function () {
var res = this.toString();
var tmp = "";
if (res !== null){
tmp = res.toString().replace("/n", "");
console.log(tmp);
}
return res;
};
should hook the actual string that it will output.