// JWT Token Interceptor — captures tokens from Base64 decode, headers, and memory strings
// Usage: frida -U -f com.target.app -l jwt-hook.js --no-pause

Java.perform(function() {
    // --- Base64 JWT detection ---
    try {
        var Base64 = Java.use('android.util.Base64');
        Base64.encodeToString.overload('[B', 'int').implementation = function(input, flags) {
            var result = this.encodeToString(input, flags);
            if (result.length > 50) console.log('[Base64 OUT] ' + result.substring(0, 300));
            return result;
        };
        Base64.decode.overload('java.lang.String', 'int').implementation = function(str, flags) {
            if (str && str.startsWith('ey')) console.log('[JWT DECODE] ' + str);
            return this.decode(str, flags);
        };
    } catch(e) {}

    // --- OkHttp3 Authorization header ---
    try {
        var RequestBuilder = Java.use('okhttp3.Request$Builder');
        RequestBuilder.header.implementation = function(name, value) {
            if (name.toLowerCase() === 'authorization') console.log('[JWT/AUTH] ' + name + ': ' + value);
            if (name.toLowerCase() === 'x-auth-token') console.log('[TOKEN] ' + name + ': ' + value);
            if (name.toLowerCase() === 'x-api-key') console.log('[API KEY] ' + name + ': ' + value);
            return this.header(name, value);
        };
    } catch(e) {}

    // --- String patterns for JWT/API keys ---
    try {
        var String = Java.use('java.lang.String');
        String.valueOf.overload('java.lang.Object').implementation = function(obj) {
            var result = this.valueOf(obj);
            if (result && result.startsWith('ey') && result.length > 50) {
                console.log('[JWT String] ' + result.substring(0, 300));
            }
            return result;
        };
    } catch(e) {}

    console.log('[RTExit] JWT hook loaded.');
});
