Unable to retrieve value from interface using frida

After almost going bald from attempting to find a solution, I have decided to ask my fellow programmers who are most likely better at Java than I.

I have a method that looks like this

i.l.a.i.m.a.e

public class e extends Object {
    public final a5.e0 a(java.net.URL url, i.l.a.i.b bVar, 
        java.util.Map<java.lang.String, java.lang.String> map, 
        java.util.HashMap<java.lang.String, java.lang.String> hashMap){
        i.l.a.i.m.a.b bVar2 = ((i.l.a.i.m.a) bVar).b;
    }
}

Different decompiler result:

public final e0 a(URL p0,b p1,Map p2,HashMap p3){   
    a$b bVar2 = p1.b;

I am trying to retrieve bVar2 from my frida script but had no luck. I believe it is casting, but I don't know how to carry this out from frida.

My frida script

setImmediate(function() {
Java.perform(function() {
    var targetClass='i.l.a.i.e';
    var methodName='a';
    var gclass = Java.use(targetClass);
    gclass[methodName].overload('java.net.URL','i.l.a.i.b','java.util.Map','java.util.HashMap').implementation = function(arg0,arg1,arg2,arg3) {

        var aa = Java.use('i.l.a.i.m.a.b');
        var a = Java.cast(arg1, aa);

        console.log(a);
        
        var i=this[methodName](arg0,arg1,arg2,arg3);
        console.log('\treturn '+i);
        return i;
    }
})
})

I have tried calling arg1.b from my Frida code and it returns undefined. I believe I'm only missing the casting.

i.l.a.i.b

public interface b {
    void onFailure(java.io.IOException iOException);
}

i.l.a.i.m.a.b

public class b {
    public org.json.JSONObject a;
    public java.lang.String b;

    public b(java.lang.String str, org.json.JSONObject jSONObject) {
        this.b = str;
        this.a = jSONObject;
    }
}

i.l.a.i.m.a

public abstract class a implements i.l.a.i.b {
    public final i.l.a.i.m.a.b b;
    public final android.os.Handler c;
    public final java.lang.String d;
    public final java.lang.String e;
    public final java.lang.String f;
    public final java.lang.String g;
    public final java.lang.String h;
    public final java.lang.String i;
    public final boolean l;
    public final java.lang.String m;
    public final java.lang.String n;
    public final int o;
    public final java.lang.String p;
    public final java.lang.String q;
    public final float r;
    public final float s;
    public final i.l.a.i.o.c a = new i.l.a.i.o.c();

    ... useless code

}

Solution

You simply need to follow the decompiled Java code you have posted: Cast the second argument to i.l.a.i.m.a (for an unknown reason you casted to a different class). And then access the field b.

Java.perform(function() {
    var targetClass='i.l.a.i.e';
    var methodName='a';
    var gclass = Java.use(targetClass);
    gclass[methodName].overload('java.net.URL','i.l.a.i.b','java.util.Map','java.util.HashMap').implementation = function(arg0,arg1,arg2,arg3) {

        var aa = Java.use('i.l.a.i.m.a'); // changed from 'i.l.a.i.m.a.b'
        var a = Java.cast(arg1, aa);

        console.log(a._b.value); // You need to use _b to make sure you are getting field b not method b and then get the actual Java value
        
        var i=this[methodName](arg0,arg1,arg2,arg3);
        console.log('\treturn '+i);
        return i;
    }
})