In the last video, we did finish our installation process, so our emulator is now running.
In this video.
We want to create a little shortcut that we do not have to start the Android studio first.
And we will also have a look into these features and we will also discover a little bit hidden one which
is super awesome.
Are you ready for this then?
Let's go.
All right, here we are back at Ubuntu VM and let's first create some kind of shortcut.
So in the last video we did start the the emulator in the following way.
We did start our Android studio.
And then we did go into more actions which are device manager and we have it starting the emulator in
this way is still recommended if you encounter some errors because the error handling in the terminal
is not as good as we are having it here right now.
For example, if the emulator couldn't be closed, there are some kind of log file which we need to
delete manually over here.
We get this notification if we try starting it within the terminal or not.
But generally speaking, we do not need to start the Android studio to run this emulator all.
Okay, so therefore let's create our shortcut.
And if you are not encountering any error, then this is the more easy way.
All right, and let's close this.
So our Android SDK comes with this emulator binary.
Therefore we're going into Android SDK and we have noticed emulator directory.
And if you run this emulator binary and let's do this.
Yes, that's the way to go.
So over here we can see we have to specify and device name.
So we need to run our emulator and then add and the device name.
Okay, let's see how we can find out what's the device name.
So therefore, let's make this a bit larger and we are simply using the dash dash head option for this
one.
All right.
This is a lot.
So some of these options might be really useful, but for now, we are only interested in.
Let's see.
Well, here, for example, we can set an emulation camera pretty nice.
But back to the topic.
Yeah, we have it at the beginning, of course.
So list a beads and let's do this.
Emulator list a beads.
Yes.
Here we've got now the name.
All right.
If you want to start this by the terminal, we have to go into the fallen path and then we have to run
this emulator binary and then we have to apply it and then Nexus five.
So these are a lot of steps.
Let's add this emulator binary, this one to our path variable.
Then we can simply start this emulator without going into the directory first so we can run this from
the terminal wherever we like.
We could also create an alias which directly starts this Nexus device, but in case if we're having
multiple, then it's not that useful anymore.
All righty.
Okay, so let's make this a bit smaller.
All right?
So that's the path over here.
Let's open a new terminal.
And once again, I'm using them and we're opening the settings h rc shell.
Here we've got the path variable.
So let's see, let's go.
Let's do it this way.
So here we can see path and we are, we are assigning the path itself.
All right.
And then these additional directories.
So every time we start in binary, the terminal is looking into those directories for those binaries.
And in this case, we have to add this one that this binary will be found by our terminal OC.
So let's copy this, let's go at the end of the line pressing I for insert already done then colon and
we add this path.
This is all.
Now I hit src colon WQ now it's being saved.
So normally this should work right now if you run emulator in this case not the reason for this is the
path has not been updated yet.
If you run an a new terminal emulator, then we can see it works.
But this one over here needs to be refreshed.
We can use new terminal or we can simply use this one with the source command and update it.
Now it set are set as HRC will be updated and we can run this command also in here right now.
All right, let's get rid of those and let's focus only on this one.
So now we are running emulator a list of these.
We've got the Nexus five.
So to start this one, we can use emulator loops, emulator this way at Nexus five.
So we need to provide this ad in front of the name or we can use Dash AVD and then Nexus five.
But that's easier for me right now.
And there we go.
All right.
This is all to run this emulator right now, setting it up once.
Okay.
Now we can repeat this over and over again.
Oh, yes.
Something I didn't mention yet is if the smartphone stays black, then we have to hit this power button
over here.
So this is our first introduction into this emulator right now.
By hitting this power button, we are not powering it up.
It has been already powered, but we can see now the smartphone is returning.
So this is the same if we lock this device and simply press this power button once again.
All right.
And now we are directly kicking in into the usage of this emulator so we can use this mouse over here,
which is absolutely awesome.
And we use this as an S finger to drag and drop and click on certain things.
For example, if you click on the button and drag this upwards, then we get back this menu over here.
We can also open the applications by simply clicking on them, for example, those settings and we can
see it's lagging a little bit, but it's not too bad in case if you cannot afford an dedicated device
or a dedicated laptop to perform all the stuff, you can still move on because by having this one over
here, so this is perfectly fine.
If you have a dedicated laptop, I highly recommend using this one.
So for example, getting in Linux on to this and then running the emulator directly on the whole system.
This is way more powerful as we will see later on.
Okay.
But back to this one.
So the usage.
Yes, with the mouse and now the question, will, we've got no buttons over here.
How we how we get back?
Those buttons are now on the right.
So over here we've got those those three buttons, we've gotten back button, we've got the home button
and we've got this, what's the name, the overview button.
All right.
So this one will show all the applications which has been put into the background.
None of them are available yet.
But later on, if you have some apps open, this is pretty useful.
Then we've got the Zoom button over here so we can we can zoom into certain things.
I'm not sure if this is really useful.
We've got to take screenshot button.
This might be useful, but we could also do this on our laptop screen.
But nevertheless, we've got it over here.
The location will be saved to the desktop.
I guess we will find this out later on.
This one is handy because later on we have some mobile games which are which needs to be rotated.
And if we can, we can easily rotate the screen.
You make this back.
Then we've got volume down and volume up and this one we have already seen.
This is the power button.
So these are some shortcuts for this device, but more important are those three dots.
So these are the real settings.
Let's open this one and we already start.
We the UI is not responding, but I guess that's okay.
We can try closing this.
Yes, it will simply restart it.
So I guess we got to go.
All right.
So here we've got now the the main menu of this emulator and here we've got tons of amazing things.
For example, this location over here.
So let's see.
Yes.
He has a location already inserted.
We can delete this one.
And we can also insert a new one by simply clicking onto this map.
And then we can say, safe point here, we get those latitude longitude coordinates and we can also
make a description in the routes.
Let's see.
Yes, we can import safe locations, so it needs to be in a certain format and then we can play it back
so that we are traveling this route over here.
But I mean, this is not like faking those locations.
I guess in the older versions it would work, but we're using a different trick.
And later on we will also spoof GPS locations based on on some other stuff.
So we will do runtime manipulation with that and then we will directly override those methods.
But more on this later.
So right now, this is not that useful, in my opinion, this location over here.
But it's it's handy to have this map and getting easy access to those coordinates and things like this.
And then we've got this place and this is even more useless, I guess.
I haven't used this once right now so we can add additional displays.
All right.
Not that interesting, but now.
Now it's getting now it's getting really funny and cellular.
So here we've got now the mobile connection of this device.
And this sounds absolutely crazy, right?
So let's enter the main menu.
But now I see what the problem is.
So the menu over here is missing?
Yes.
So I need to restart this emulator.
All right, then let's do this.
How can we restart this easily?
Let's see if we click Long on Power Down.
Yes.
Then we can we can hit restart.
So let's do this.
Okay, so let's restart it.
And we might encounter a problem which is good to show right now.
I mean, it was all planned in this way.
Let's see.
Yes.
Give me here.
We can see right now a snapshot operation for Nexus is pending or time out has expired.
So this this error message is not that useful right now.
So therefore, let's open it once again with the Android studio.
We have an shortcut for this one.
I forgot about this one.
Okay.
And then within more actions AVD, which are device manager.
And here right now if we click play.
Then yes, here we get now this notification if the nexus is already running, but it's not, it seems
to crash in a certain way.
So we need to delete the following file.
All right, let's delete this file.
So a new terminal.
And then I guess the best option would be using an and file browser.
And then let's see where is the stored log file.
Oh, we've got multiple log files.
So let's see.
So normally I would do this by the command line.
But, yes, if you if you mistype there, then you might delete your whole disk so that this would be
absolute unfortunate.
All right, so this one is the file we need to delete.
Let's delete this one.
Okay.
Those other tools also need to be deleted.
So now we have those log files deleted so we can close those.
Now we can try running it once again and we can see.
Yes, now it's starting.
So the easiest way to get rid of this log files is simply using our M and then this command over here.
But please be careful, because otherwise you might delete wrong files.
I mean, it couldn't be too bad because it only deletes files with the log extension, but we never
know.
All right.
So now the screen still is turned black.
So let's start it once again.
Yes, we can see the UI is still missing, so it seems not to be close correctly.
Let's power it off right now.
After powering it off.
Let's do an cold boot so the state gets saved.
But if there was an error, the error also gets saved.
It's a little bit of an down side, but we can easily fix this by going on to the right over here and
then, yeah, let's do an cold boot.
Okay.
So now the smartphone is being booted up once again and that's not rely on an online snapshot right
now.
So let's see.
Okay.
So now we can see this might take a while if you hit this power button.
Yes.
It's it's not immediately turning back.
So it really needs to start right now.
So it's the same like we have it after the installation process.
So unfortunately, we have to wait a little bit until the smartphone has been wounded.
Up here we can see the smartphone is now booting.
So you simply really have to wait a little bit.
All right.
So now the device is up and running a little bit unfortunate, but now you also got everything you need
to know about troubleshooting.
I mean, things like the cold boot might be also available via the terminal, but having it in this
mainly graphical view, it's way easier.
So that's the device manager of the Android studio.
In case of any errors, try starting it by the Android studio and here and powering it off.
Close it over here and then simply perform in cold boot that the that the safe, broken state gets overwritten
once again.
Alrighty.
Okay, perfect.
So the thing I would like to show you where I did start was this one over here we were talking about
cellular.
Alrighty.
And here we've got now wi fi and mobile connection.
And this is super awesome because this device over here, I mean it has no SIM card in there and also
no no access to an wi fi access point right now.
So all of this is being emulated and we can see this over here.
So this one is now network type edge and we can see the signal strength is poor.
We can set this to great and then this will change over here.
So as a developer, this is super handy.
We can simulate certain certain circumstances, but also as an attacker, let's say the application
behaves differently regarding to FI or on cellular network.
We can emulate and simulate this right now over here.
We can also go up up to five g, whatever foil means.
Not sure, but I guess five G is now the highest, right?
Yes.
Should be the highest.
Right.
So this can be easily done with mouse click.
So this would be absolutely awesome if it would work in reality.
Right.
So we could easily get better signal by just clicking this over here.
Unfortunately, in reality not.
But on this emulator, it's pretty easy.
Okay, next we've got battery and over here we can play around with the battery level.
And this is yeah, I would say this is really important.
Maybe not really, but it's it's more important right now because later we will talk about broadcast
receiver.
Broadcast receiver has some kind of messaging system in an Android application and some of them react
on certain events.
Like, for example, the battery level, let's say the battery level is going down and we can observe
this directly on your smartphone, that the battery is running pretty low right now.
And there we go.
We get this message.
So this is in broadcast, which will be sent out to all those applications.
And those applications can react to this event.
And for example, they could say, oh, we're running out of battery, let's save our data really quickly
before they get lost so we can force file saves by driving the battery.
And it could be also use tool to charge your phone pretty easily.
So let's see, full speed charging in 3 to 1.
There we go.
All right.
Back to 100%.
We can also play around with the with the battery health.
Yes.
Here we've got it.
So we can say this one.
Is that failed or.
Yeah, things like this.
So pretty cool.
Okay.
Next, we've got the camera.
So here we can provide virtual scene images.
For example, we can provide images for our virtual camera in our smartphone.
So, I mean, it has a camera back in front.
Let's open this maybe over here and this one is simulating some.
Yeah.
Some views.
Alright.
We can see it's a little bit laggy.
Yes.
So here we have it.
So that's the front view and we can also have the back view.
So this is some simulated stuff over here, but we can also apply our own virtual camera or we can apply
images to this one.
I mean, we could use this, for example, to scan QR codes or things like this, and this would be
easily possible.
Next we've got phone and this is maybe the most amazing feature because we have seen Let's go back.
We could use this on this pattern.
So we have seen that we've gotten wi fi and cellular connection, but both of them are emulated, which
means all the phone codes and SMS can be emulated.
And this is exactly what we have over here.
We can select any number we want here and then we can call this device.
So all of this is, of course, virtualized.
There is no real phone call happening, but this means we can also define the caller by ourself.
For example, let's say we've got this number one, three, three, seven, and now we can call this
device.
And in just a moment here, we have this icon over here and he has this code.
So now we can see we can also answer it and we can talk to this based on microphones.
Right now, I'm doing in this line, if the application is performing some phone calls, this might
be super handy to emulate.
For example, if there's a certain SMS from a certain number triggering an event, we can emulate what's
happening over here.
So we can spoof any number we want to have based on SMS or on phone call.
Awesome.
Right.
And it doesn't cost anything.
That's even better.
Regarding to SMS, we've got this here, so let's send the SMS.
And this app hacking course is absolutely awesome.
I mean, that's the truth, right?
Of course.
Let's see.
So that message.
Yes, I can see this.
I can over here a little bit leggy as as many times mentioned right now.
Oh, it is up here.
Let's open this one.
So that's the SMS medicine manager.
This way.
All right.
I guess I agree with our chat features.
Yes.
Here we've got this SMS.
So I guess it has been displayed, but it might be too laggy to show right now.
But we can see this app course is absolutely awesome.
Right.
So we have we have received this SMS over here.
Okay.
Next, we've got this one.
This can be ignored.
That's not really useful right now.
Microphone.
I mean, we can insert an headset and then we can also call ourself and have some voice interaction
or for example, having some voice interaction with applications if they enable those microphones,
a fingerprint, something I haven't really used.
So I find this not that important in the emulator.
Virtual sensors here, we've got tons of sensors.
For example, we've got pressure, temperature, light or also magnetic field sensors.
So all of them are being emulated, which means we can manipulate all of them.
For example, we can enable this light sensor or other stuff to decrease or increase the temperature.
Yeah, things like this.
Then back report.
I mean, we can send back report.
Let's ignore this.
Then we've got snapshots.
So this enables quick boot, which means the state of the device gets saved, which is absolutely awesome
if we do not have any errors.
Like we have seen this at the beginning of this video.
But if you do not have any errors, we can, for example, freeze the current state, then we can install
certain things, play around, create user accounts and then revert back like this wouldn't have never
happened.
So this is pretty cool.
And it also enables starting this device quite fast.
We have seen also at the beginning that running in Cold Boot will take several minutes and within the
quick boot it just takes a few seconds.
So maybe 20 seconds onto the device to boot up.
What's here?
Yes, that's just an additional settings menu.
All right.
And then we've got record and playback.
This one is cool.
I, I basically say that's true to every option right now, but here we can create an screen recording
so we can say, start recording, and then we can perform some awesome actions and show the customer
how heavily we have hacked this application and then we can stop this recording.
And then we can play it back again.
Okay.
So simply screen recording here, we've got macro playbacks.
This is all so cool, but we will use this differently later on.
First, let's talk about this one.
So macro playbacks or macros are predefined actions that can be used in this device.
For example, if we open the camera.
We can, for example, play this this macro here, and then this one will be inserted into the camera
stream.
So let's play this and we can see this one is happening right now.
So we can also create our own macros, which means we can perform certain interactions with this device,
record them and play them back again.
Sounds absolutely useful and it is.
It absolutely is.
But we will use a different approach.
We will later write our own automation script for mobile game.
So we will we will keep playing this game without even interacting with this one.
And this approach is a little bit better, in my opinion, because it gives us more flexibility and
it also works on real devices.
So therefore we are not using this one.
But I mean, it's cool to know over here, by the way, we can see it seems like we cannot record our
own macros, but I will show you a hidden interface in this emulator which can be used to also record
our own.
More on this later.
Google play.
Yes.
We can also have I guess we have a Google play store.
Yes, we have one.
But we need to lock in into this one to use it.
So if you open this one.
All right.
Here we can see.
Yes, we have to sign in.
And then also this one boat would be working over here.
I'm not going to use this, but in case if you want to create an account, feel free to also have this
playstore enabled and downloading these applications.
Last but not least, we've got these settings and this one might be the most important one emulator
window theme.
We can change this to dark.
All right.
Awesome.
Right.
So here we can see this is also the screenshot and safe location.
It's the desktop and most of the stuff is not that interesting anymore.
Beside one, let's go back into the settings network and Internet.
Yes.
And here we've got the WiFi menu and most of the courses if they perform a man in the middle attack
recommend inserting and proxy within this Wi-Fi menu over here.
So within this Android wi fi, go into settings on this one and then let's see.
Advance option proxy.
So why is this a bad idea?
Well, if we insert our perps with one man in the middle proxy as some proxy in our life settings,
we encounter a lot of issues.
The first one is this emulator has several network interfaces.
For example, there's cellular and also this wi fi network interface.
And in the past I have encountered this quite often that the device is switching between them and it's
not clear when this is happening.
It could be the case that the emulator is splitting this Internet connection between the b fi and also
the cellular connection.
This means we are missing information because only the Wi-Fi connection, this connection type will
be intercepted.
And this is something you definitely do not want to have.
You want to have everything within this network connection.
The other reason why this could be bad is applications can determine if there some proxy in there,
for example, in the spy file settings, and then they can make a decision if they want to send those
data or not.
In case if the application do not want to be proxy, then the application is simply not sending these
data, which means this application is behaving differently and it might not send all the data out.
Also there we are missing those data.
And last but not least, we could have some some not that common network requests, for example, S-H,
SK or regarding to Iot devices, which is pretty common and cute.
So these are not that common TCP protocols and those might not be intercepted by an proxy within those
Wi-Fi settings.
And even if they are, things like UDP are definitely not.
And this is absolutely terrible regarding to our analysis.
Therefore, I have prepared a dedicated set up within the man in the middle section where I go through
all of these topics.
And there we will also figure out how to intercept in connection, how to establish a man in the middle
connection, to fetch everything in TCP, UDP, ICMP or whatever protocol or type would be sent over
here.
All righty.
OC In case if you want to perform a quick setup, I've got a solution for you.
So therefore let's have a look.
OC So the key takeaway right now is please do not use this one in case if you want to quickly set it
up and perform a man in the middle four and simply mobile application that is just doing HTTP or HTTP
network request, then we can go into those proxy in these settings over here and then we can choose
manually sort of manual proxy configuration this way and here we can now insert our stuff.
We will do this later on in the man in the middle section.
So this one is more like a system proxy and this will fetch both our network connections and cellular
and also by connection.
All righty.
OC And this is all regarding to those settings right now, I guess we have covered the most important
ones and feel free to play around with this one.
And now we want to have a look into more hidden interfaces of this emulator because these are even more
powerful that we've got over here right now.
So how can we how can we connect to those hidden interfaces?
I mean, they are not that hidden.
Let's see.
OC To connect to them, we need to figure out something first.
So therefore we are opening a terminal and then we are getting the root privileges and then we are using
net stat and this one.
Okay.
We have to install those net tools first.
All right.
And now we repeat this command.
Let's make this a little bit larger.
Let's walk this a little bit.
Okay.
So here we can see we've got several more plots where the system is listening to.
So our local host is listening on five, five, five, five, five, five, five, four, and this one.
So.
Q IMO, that's the emulation framework of this emulator over here, which means these are services provided
by this emulator.
And let's have a look into this one.
So let's see port five, five, five, four.
So let's make a connection to this one.
I open a new terminal and then telnet local host and then five, five, five, four.
Let's close this.
All right.
And here we can see.
Oh, interesting.
And we're console authentication required.
We need to type out and this auth token to authenticate.
And where can we find this out token.
Well, it's over here.
So this one has been created.
Let's copy this and cut this token out.
And now we select everything beside this percentage sign.
So we this one is not being selected.
It's, it's an, let's call it false positive that it has been marked over here.
And now we can authenticate to our emulator by having the secret key.
Okay.
So we have successfully authenticated and now we have some additional commands.
So by tapping in help, we've got a lot of additional commands.
For example, this key or command.
Let's see how this works.
Help shield here.
We can send a fixed GPS coordinates onto our smartphone.
Or let's say this smartphone is receiving a fetching fixed GPS coordinates, which are provided by us.
Let's get some.
So let's find some out.
So this is where this location comes handy.
Let's search for Greenland, for example.
All right.
And let's take this position.
So here we can see this is the position.
Let's save this right now.
Set location.
Okay.
And now let's take those coordinates.
Safe point.
In Greenland.
And that's the newest one.
So we can delete this one.
Okay.
So.
And let's see.
EDIT Okay, here we've got now the latitude and longitude.
So let's see how this command works.
Let's put this a little bit more to the right.
Help your fix.
All we need to do is we need to apply geo fixed and then longitude latitude.
We can also define satellites and things like this.
So regarding through GPS, we are having four satellites.
Three are regarding to the position and the fourth one is regarding to the time and super awesome to
get in view into this.
But I guess this is not required right now.
So let's see.
The first one is the longitude.
This is this one.
Oh, I cannot mark it.
So let's insert it in this way.
If there's a little typo, I guess maybe we still stick in Greenland, so it should be fine.
And then the latitude OC and let's insert this.
Now we have defined some fixed locations, so if we now go back into those Google Maps.
And if we now click on this one, which should fetch our current position, let's see.
Okay.
So for now, I only see white.
So let's see if if we are in Greenland right now, because this might be the case if you are in Greenland.
Right.
So let's double click on this one.
And then we go.
We are in Greenland at this location, exactly like we have pointed this out in our smartphone right
now.
Awesome.
Right.
So this is a way to easily spoof certain GBS locations also for Google Maps and things like this.
So this is pretty awesome.
Within this menu we will find some additional things.
For example, we've got auto rotation.
Yes, automation.
Sorry this way.
So this is what we have seen before and let's do this.
And here we can see if the command is not known.
We are getting K.O..
All right.
Ahead, automation.
Yes.
And we can use automation record and then we can perform our macro record and then we can stop and play
once again.
But as already mentioned, we will use some better approach.
So I guess we had an extensive view into this emulator.
Those features hit menus and what else?
Troubleshooting.
Yeah.
Also the troubleshooting guy, I mean, this was a little bit unfortunate, but I guess this is very
helpful for you in the future because this is something you will encounter sooner or later during this
course.
All right.
So this is all for this video right now.
In case of any questions, please drop me a message.
I have also included an troubleshooting guide within the cheatsheet and otherwise.
I'm really looking forward to see you in the next video.