[Python] Frida: How to send byte[] array from JavaScript to Python

I have a Frida JS script inside a Python session, and I'm trying to pass an array of bytes (from a Bitmap image) from the JavaScript environment back to the Python environment. Here is my attempt:

import frida
import sys
import os

JS_SCRIPT = '''
setTimeout(function () {{
Java.perform(function () {{
// declare dependencies on necessary Java classes
const File = Java.use("java.io.File");
const Bitmap = Java.use("android.graphics.Bitmap");
const BitmapCompressFormat = Java.use("android.graphics.Bitmap$CompressFormat");
const BitmapConfig = Java.use("android.graphics.Bitmap$Config");
const ByteArrayOutputStream = Java.use("java.io.ByteArrayOutputStream");

// instantiate a new Bitmap object
const bitmap = Bitmap.createBitmap(100, 100, BitmapConfig.ARGB_8888.value);

// output bitmap to a byte stream in PNG format
const stream = ByteArrayOutputStream.$new();
const saved = bitmap.compress(BitmapCompressFormat.PNG.value, 100, stream);
console.log("[*] Compressed as PNG:", saved);

// get byte array from byte stream
const byteArray = stream.toByteArray();
console.log("[*] Byte array length:", byteArray.length);

// send the byte stream to the Python layer
send({{ type: "bitmap", page: pageNum }}, byteArray);
stream.close();
}});
}}, 1000);
'''

def on_message(message, data):
if message["type"] == "send" and message["payload"].get("type") == "bitmap":
page = message["payload"].get("page")
with open(OUTPUT_FILENAME, "wb") as f:
f.write(data)
print(f"[+] Saved page {page} as {OUTPUT_FILENAME}")
else:
print(f"[?] Unknown message: {message}")

def main():
device = frida.get_usb_device(timeout=5)
session = device.attach(pid)
script = session.create_script(JS_SCRIPT)
script.on("message", on_message)
script.load()
device.resume(pid)

if __name__ == "__main__":
main()


The problem happens on the call to send() because the second argument byteArray is not a pointer:

Error: expected a pointer

It's unclear to me how to get byteArray into a format that can be sent using the send() function, and I'm having trouble finding the solution in the Frida API docs.

Continue reading...