Discussion Embedding a GUI inside a Frida script

// We need to get an instance of the main activity.
var activity;

// If you know the activity class, you can replace android.app.Activity with it's class name
// (e.g. for MIUI calculator, you could use com.miui.calculator.cal.CalculatorActivity)
// Java.choose just iterates all objects until it finds one with a certain class (?)
Java.choose("android.app.Activity", {
    onMatch: (obj) => activity = obj,
    onComplete: () => {}
});

// Runs a function on the main thread, a.k.a. the UI thread.
// Any extra arguments passed will be passed to `func`.
function RunOnMainThread(func) {
    var args = Array.prototype.slice.call(arguments, 1);

    // We create our own runnable, then pass it to runOnUiThread.
    // source: https://stackoverflow.com/questions/65790594
    var runnable = Java.registerClass({
        name: "com.whatever.UIRunnable",
        implements: [ Java.use("java.lang.Runnable") ],
        methods: {
            run() {
                func.apply(null, args);
            }
        }
    }).$new();

    activity.runOnUiThread(runnable);
}

// We get the root view, and cast it to a ViewGroup. (https://developer.android.com/reference/android/view/ViewGroup)
// We can then call addView to add our own view.
var rootView = Java.cast(activity.getWindow().getDecorView().getRootView(), Java.use("android.view.ViewGroup"));

// We create a basic button (https://developer.android.com/reference/android/widget/Button), that when clicked, prints out a toast.
var Button = Java.use("android.widget.Button");
var btn = Button.$new(activity);

btn.setText(Java.use("java.lang.String").$new("Click me!"));
btn.setMinWidth(500);
btn.setMinHeight(250);
btn.setX(200.);
btn.setY(200.);
btn.setOnClickListener(Java.registerClass({
    name: "com.whatever.OnClickListener",
    implements: [ Java.use("android.view.View$OnClickListener") ],
    methods: {
        onClick(view) {
            // Already in main thread, so we don't need to do anything.
            Java.use("android.widget.Toast").makeText(activity, Java.use("java.lang.String").$new("You clicked!"), 5).show();
        }
    }
}).$new());

RunOnMainThread(() => {
    // We also need a LayoutParams (https://developer.android.com/reference/android/view/ViewGroup.LayoutParams) that describe how the view is layed out.
    rootView.addView(btn, Java.use("android.view.ViewGroup$LayoutParams").$new(500, 250));
});