All right.
In the last section, we have installed the Android framework, and now now we are going to finally
use the call graph.
We create our first call graph for a challenge I have prepared for you.
So, are you ready?
Let's go.
In this section, I have attached a reverse me application and this is more like a demo application
than a capture deflect.
But yeah, we use this to illustrate this call graph function.
Please download this file and then we are going to install it and see how it looks like.
I've already downloaded it over here and I copy paste this into our app's directory because we want
to have our system in a clean state.
We name this reverse me challenge.
Then I'm opening a new terminal.
I do an ADB connection to all the time machines and I'm going to install this.
And this is a nice arrow we get right now.
So within the cheatsheet, I also provided you tons of ADB arrows I faced during my last seven years
and also the solution for this one.
I've created a debug version out of this and we can see this is a test only installation and we can
use ADB install or the help of ADB install to figure out how we can solve this.
So we use ADB install shell or I guess it's only ADB Shell.
And let's see, within the installation process over here, yes, we can see in this parameter allow
the installation of test packages and if we provide this one, we can install this application.
So we run ADB, install dash tx reverse me apk and then we can see success.
It's working.
Let's get this screen content over here that we do not have to switch between them.
I swipe this up and here we have our reverse MI application.
I'm going to open this and here we can see.
Yes, it's not looking that nice because it's more like a demo application.
The other challenges are more in a nicer visual state, but it's pretty simple.
We have to provide a password and hit the button and then we can see, okay, the password wasn't correct.
So let's try.
Let me in.
Also not working.
Let me in, please.
I did say please.
Okay.
We have seen we are not going to solve this challenge in this way.
Therefore, let's have a look into the source code.
We close this one and we use the exclusion.
Okay.
We can see it's loading over here and now we've got this application.
And the first thing I like to do is I like to check the manifest example over here.
Let me make this a little bit larger.
All right.
Here we've got the Android Manifest XML, and we can see this application doesn't require any certain
permissions.
We also got only one activity, this main activity, and this is our launcher.
So we do not have additional activities.
And this is pretty simple and clean.
Therefore, let's have a look into the main activity which is available and come up.
Hacking reverse mean main activity.
Okay.
Here we are now at the main activity.
And if you are not familiar with the Android development, absolutely no problem.
I guide you through this.
You do not need to be an Android developer for absorbing this course right now, but it is a little
bit helpful if you understand this structure about this.
We have seen this button and if we press this button, our input text, the text we have inserted in
this application gets checked and this one is over here.
How do we know that this one is now the button?
Well, we have to take a look into the Android layout of this.
So this activity got some layout file.
And this layout file describes how these buttons are organized, where this input text is and all this
stuff, we can find this within the resources.
So we go into resources layout and then we have this activity main layout over here.
I'm going to copy paste this into a new code editor because here, this is not easy to read over here.
So we create a new one, we insert this, and we also toggle the word rap.
Okay, now we've got the single elements over here.
Let me.
Expend them.
We've got an edit text, which is our text field.
We are going to insert our flag gas.
Then we've got this button.
That's obviously what this button is.
We've got a text view.
This might be displaying this text or wrong flag.
And we've got an image view which is the lock of this icon.
If you go into the button over here, we can see this button has an on click attribute and this one
has this method name over here.
So now we know if you press this button, this check method gets called, and if you go back into the
main activity, we can see, all right, this is the method that gets called if we hit the button and
this method takes now our input text and pass it to this function over here to this class function one.
Move on.
Let's have a look at one.
Here we are now at one and one move on.
Cuts in string as parameter and it checks if the string contains becoming okay.
That's the first spoiler.
But I'm not going to go deeper into this if you want to solve this afterwards, but it's regarding to
a demo purpose.
So it's not a real challenge approach.
However, all right, if this text contains becoming, then we go into to move on.
So within to move on, we've got another method and then we go into three, move on and so on.
Within one move on.
We also have our flag over here so we can see this is the flag method and this flag method now is going
to be called somewhere in all these functions.
It's not going to be called over here.
So some function over here is referencing to this method.
And this is the most important part.
If you want to solve this challenge, which function is referencing this and how can we get to this
point?
And therefore, you guessed it, we are using this call graph.
All righty.
So I'm going to close this one.
Odds are going to close this one, also going to clear this one.
And now finally, we create our first call graph.
So we use Andrew Card.
That should help.
Here we have the call graph, this key parameter.
So we say Andrew got ZG dash dash held and now we've got the options.
Creating a graph is super simple, so we only have to run.
Andrew got call graph and then we use the out option over here to create this output file.
And this output file has this HTML extension and we use a tool named Giphy or I'm not sure about the
pronunciation, I'm going to show you the installation process, so don't worry about this to visualize
this call graph afterwards.
And that's all we need to do.
We can also filter on certain class methods, method names, if this is a huge application and we are
only interested in one, but I'm going to show you how this looks for an application like this because
yeah, then you also see how you can handle larger files later on.
And so let's create this call graph.
We run Andrew card call graph and then the dash option and we name this file called graph dot HTML.
I guess this would be also the default name and the last parameter is the APK reverse me apk.
Okay.
Now Andrew, God is going to create this call graph in this file format and here we are getting now
our first arrow.
Isn't this nice?
It absolutely is.
But we can fix this easily.
The reason for this error is that the call graph function is relying on an older network library and
network library.
And Andrew God comes with network 2.2 so we can find this within the requirements of the GitHub repository.
I'm going to show you this real quick.
Andrew got GitHub.
Here we have the requirements and here we can see and regard this package name did in star 2.2.
To use the code graph menu, we have to downgrade this library version to 1.11.
I'm not sure why this is not default case for this program.
Maybe it's in backing issue.
I don't know.
We can fix this.
And yeah, this is also pretty simple.
Just one command.
Therefore we run this command pip three, install network x and then we can provide with two equals
the exact version we want to install for this library.
And in our case it's 1.11.
And now Pip is uninstalling the existing version and also installing the older version, which we can
see over here.
Now, let's try to run this command once again.
And we can see.
Yes, it's finally working.
All right, nice.
Now we've got this file called Graph HTML.
Let's take a look into this.
Here we have now the graph HTML.
And I want to provide you some information about us because you cannot read this.
Of course, we haven't talked about the smiley part over here yet.
I just want to provide you some hints on how you can do this without understanding Smiley.
The first one, this Big L, is always the first letter over here.
And this is a type definition in Smiley.
This means afterwards there will be a class and here we can see, for example, this one is the Android
support V4 app IE Notification section.
So this is the class name that is going to be referenced.
Don't worry, you do not have to understand this.
The most important part regarding to the call graph is this one.
Then over here.
After this class name, there's this arrow.
And now we've got this function name.
So after this arrow, there's always this function name over here.
And we can later on navigate or recognize our function codes by this name after this arrow.
We do not have to understand what's here or maybe in front of this.
So we just focus on this arrow and then the name after what's because this is the method name that it's
going to be called there.
All right.
Now, to view this file, we need to install the tool.
And this is also mentioned on the Android documentation.
So Android got call graph.
And here we can see to visualize this call graph, we use this cefi tool over here.
So we're going to download this one and download it for Linux and now it's going to be downloaded.
Why this is downloading.
I want to show you some nice pictures over here.
So here we can see a graph of an application and everything is dot is a function name and you might
think, well, is this more easy to handle?
And I can tell you yes, because here are now all functions included.
But we only focus on a certain function and we will filter them out over here.
All right.
I'm going to close this one.
And now we are going to run or instead gaffey.
And copy paste us and we go into the tools directory.
Giphy.
I'm also not sure about the correct pronunciation.
It's probably the case that this one is wrong, but I stick to it.
Extract over here.
And yes, I hate when things like this happen.
So I'm going to.
Copying this pasted here and then delete this one over here.
Okay, so now we've got this goofy directory and here we have the spin and we can directly start as
one.
If you're using a windows, you also have a windows executable over here.
Let's start this tool.
It's loading and nice.
We get our second arrow.
Great.
This time it's regarding to the chopper version.
So Jeff is relying on an older travel version.
In my case, I'm using Java 11, but Jeffrey only works on Java eight.
Therefore, we have to install Java eight right now.
The nice thing about handling Java on a Linux system is you can have multiple instances and switch between
them easily, but you need to take care that the other tools are also going to rely on the new updated
version.
So for example, might not work on Java eight.
Therefore, you have to figure this out and then switch back for the certain type.
All right.
Now let's instead try by eight.
Therefore we run sudo update inside open shade key JDK sorry
eight.
And then the shade key.
I will come back when this installation process has been finished, because this might take some year
minutes.
Okay.
Now, we've also got travel agents that let's figure out what's the case.
We run Java dash dash version.
And we can see we are using Java 11 right now to switch back to Java eight.
We have to update those alternative config and we can do this by sudo update alternatives dash dash
config.
And then we provide Java and here we can see we are using Java 11, but we can switch now to Java eight
because we have just now installed I type in number two.
We can see this on the selection over here and now we are using Java eight and that's all.
This is pretty easy, right?
Let's figure this out.
We can see this Java eight has a different version parameter which is super ridiculous, but okay.
And now we can see, yes, we are using version eight.
We also have to do this for the Java compiler and therefore I go back to the command and I simply do
this once again for Java C and also provide the selection tool over here.
And now we also have this Java C instance updated to Java eight.
And so at the same.
Yes, okay.
Now let's try running Giphy once again.
And we can see.
Yes, coffee is now working.
Great.
Please take care that you have switched your Java instance for now and this might interfere with other
tools.
So after using giphy, you might want to switch back to Java 11.
Okay.
But for now we stick to this one.
Let's open this file.
So open graphical or yeah.
Uses over here.
We go on to EPS.
Reverse meet challenge.
Call graph and we select this file and then hit the okay button.
Going to maximize this real quick afterwards.
Now we can see we've got 28,000 nodes and 58,000 edges.
So these are functions and yeah, displaying them will be ridiculous.
Let's see how good this can be doing this.
We can see it slowly loading, but now it's finished.
Nice.
So we've got this big blob over here and everything will start as a single function call.
We can now apply different layouts to handle this a little bit better and we can find them over here.
So if we choose a different layout, for example, this one over here and we click Run, then Jeffy
is trying to expand this to The View, which we have seen on the documentation.
But I'm going to stop this because even if Giphy is able to display all this information, we are not
able to handle them easily.
Therefore, let's filter out in just the information we are interested in.
So to filter this, we go into the data laboratory over here.
And within the label we can see this class names and also underneath the arrow, the function name.
We are not interested in the Android support before and other packages.
We are just interested in our package.
Therefore we use this filter, we click onto label and then we provide.
Com dot app checking dot reverse mean.
It's a regular expression and therefore we do not have to provide those slashes over here.
And these are now all function cards within our application.
It looks way more clean, right?
Okay, let's extract them.
I click with the left mouse button onto one and I select this.
I hit control A to select all of them.
And then I click Right Mouse Button.
And then we say, let's see, move to new workspace.
This is the easiest way for me to extract them from the other versions over here or the other function
calls.
We have now created a new workspace so we can close the workspace.
One, the old ones.
Yes.
And now if we go back to the overview.
Nice.
This looks way better than the previous approach.
So we have limited those edges and function nodes only to our package name, which is way more clean
than the approach before.
Okay.
So let's figure out out how we can display these information.
So by browsing over one, we can see.
Yeah, only the single function point gets highlighted.
If you want to get the reference to this one, we can enable this by hitting this button over here.
So edge and now we can see those lines and if we have our one, we can see, okay, this one is calling
those three or vice versa.
We will figure it out how to read this later on.
I'm also going to enable this one because if we highlight one color later on, these function points
are also going to be highlighted.
Also those lines, we've got some single dots which are not going to be referenced in here.
So what is this function called over here that seems not to be called?
We can enable the label for this with the text button over here.
And now this has not become more clean, right?
Yes.
But we can adjust this label.
So by expanding it over here, we go into labels and then we can select the font size and also here
the color and things like this.
I go on a font size 12.
Okay.
This looks more clean back again.
Let's figure out what the single thought is here.
And if you do not have the track menu, you have to select it over here and then you can drag and drop
those points.
We can see this one is regarding to the class, the init.
So we are not going to call this constructor for this class, but of course it's available and therefore
it's not referenced or yeah.
Has some edge notes over here because we are not calling this function, but it did get caught in the
Android system itself.
Therefore we have those single dots which here seems to be not called anymore.
With the right mouse button you can navigate around.
So, yeah, finding our flag method over here, it's like find Waldo in a really huge picture.
And I guess that's also not the approach we want to take.
Let's mark our flag function that we can find this more easily.
We go back into the data laboratory, we search for a label and then for the flag method.
And we can see unfortunately the resource hasn't really been reduced because we've got this flex parameter
and all those functions over there.
We have to do a different approach.
Therefore we search for one because this is the class name that contains this method.
And here we can see the only focus on the part after this arrow.
So here we have the method flag.
Move on in it.
Distraction and one compare.
I do a left mouse click on the flag over here and then a right mouse click and I say Edit node.
And now we can adjust some layout for this node point.
I do a color change, therefore I click onto this.
I select green and then I track also this button over here, which is, I guess some alpha value for
this color.
Let's see.
Yeah, it got some more values over here.
Okay, but now if you click, okay, we can see this flag has now been set to green.
Let's go back and find our Waldo over there.
Zoom out a little bit and here we can see.
Yes, it's good to see this one over here.
Nice.
We've got our flag method and we can now also see which functions are referencing to this.
We can now start dragging out those functions, but this is not a nice approach.
Therefore, we use a filter or a layout.
We select this one, this Orion code.
This is pretty good for our task.
Then we hit run and now we can see the layout changes.
I guess we can hit stop because it's already done.
You also have some other, for example, for expansion.
Then you are going to expand this whole graph.
It's more like a zoom in and also contraction and other stuff.
So feel free to play around with the layouts.
In my case, yeah, I think this one is really good for our task.
Okay.
Let's filter this a little bit more manually right now.
So our function calls are now stacked together over here and we can select all of them.
Let me figure out this one that's not contain our to our block.
Okay.
We are now tracking them a little bit together.
In this way.
And we are using this cursor over here and we say configure the size of this cursor to, let's say 80.
It can be a little bit bigger.
120.
Yes.
And now we can simply or sorry, we have to stick to the hand and now we can simply click and drag this
block out.
All right.
We have isolated our function, choreographed regarding to our flick method from all the rest.
Nice.
Now I do some manual adjustment over there that we get a nicer overview.
I'm going to speed this process up a little bit.
Therefore, I switch back the size of this cursor and now I'm going to do this.
All right.
Here we have now our final overview about our function called graph.
Let's figure it out how we can reach this flag method.
So we start over here and yeah, here we have to look very careful because here we can see if we zoom
in.
This arrow is pointing into our direction and this green arrow is pointing away from our flag method.
Therefore, we need to follow the left approach because we want to reach our flag method.
Okay, let's see what we have to call.
Within this one.
We have to call this one for move on and this one needs to call three move on and this one needs to
call to move on.
One move on.
And here we are at our check, which is our entry point.
Okay, now we have traced this bag.
Let's figure out how we can reach this from the beginning.
All right, we've got our check method, and this one calls one move on.
We can see this in the arrow over here.
Now we've got our first branch over here.
So this method makes a decision, and we end up in.
This one over here to move on or we end up in five final value.
And if we end up in five final value, we are out because we cannot reach our method on top anymore
because there is no reference to this one.
This one is going from here to there, but it's not going to be backwards.
You can also see this.
If you hover this, we only have this line at the bottom.
At this point, we already know, okay, we have to make this check that we definitely go into to move
on.
From there on, we've only got one direction into three.
Move one, four, move on.
And here we have our next branch.
And this one is also really important because this one makes now the final decision.
If we go into our check over here, our flag check, or if we end up at this one five move on.
But this one is a dead end.
So if we go this direction, we lose.
If we go right, we win.
That's easy.
And yeah, this is the approach on how to create and handle a core graph.
And let's assume I wouldn't have named this that nice for you.
So there isn't a method one, two, three and four.
So these methods are named a, B, A, B, A, B, C, and so on.
You would go crazy if you stare at this code and try to figure it out.
Which direction ends up in the final flag?
Check over here and maybe the flag check isn't named as flag and things like this, so you can try to
do this approach manually.
It's also not that big of a flow graph over here, but imagine you would have go through 30 or 40 function
codes to finally reach your point.
I guess this is the best approach, at least in my opinion, to solve this task.
Feel free to solve this challenge.
I'm not going to spoil at this.
And yeah, if you have question regarding to the solution of this, please write me a message.
Alrighty.
In the next section we take a look at the real world Android capture the flick and this one was pretty
hard.
So showing this approach on a challenge like this really points out the benefit of creating a call graph
or a flow graph or an application that is obfuscated or made to be hard to reverse.
Engineer Feel free to play around with this.
Furthermore, also with the settings, layout, color, definition and things like this.
And yeah, after you have finished this, I'm looking forward to see you in the next section where we
take a look at the real world, capture the flag challenge.
So I'm going to see you there.