Welcome back.
I put on my training shirt and yeah, you might have realized in the real world I might be practicing.
Not that much, but in the Android world, I would be at least.
At least the Hulk, I would assume.
Yeah, at least.
So now we are going to pitch this application and I'm feeling pretty confident in my Hulk form that
we are able to do this.
We did not understand anything about the smiley part, but let's figure out what we've got.
Therefore we need to switch to the Ubuntu VM and we also need to verify that the value 0xa is our corresponding
player power.
Let's open Android studio.
We go on to tools.
Android Studio Bin Bash, Studio Port S-H.
Oops, there's an O missing.
Here we are now with our player class and we can see our power level is equal to ten.
Let's open the corresponding smiley code to this.
So we would have assumed that this 0xa is our player value, our player power.
How can we verify this behavior?
Do we have an idea?
Please think about this for a moment.
Alrighty.
I'm pretty sure you got the solution.
We simply go to our player studio code over here and then we switch this value or change this value
from 10 to 12, for example.
Then we safeties and we create our new RPC.
Afterwards, we check the smiley code once again and see if this value has been changed.
That's it.
We can now also use trade excuse because yeah, the RPC tool output is in my case much more easier to
read.
But regarding to comparing a single value, both outputs will be the same.
So therefore let's have a look into this and click on Locate.
Then we open a new terminal and we say, trade.
Excuse me, empty packed ABQ.
Then we go into our player class.
We hit the smiley button and we can see, yes, the value has been changed from zero x 8 to 0 x.
Let's have a look.
Python 30xc.
This is the value 12.
All right.
We now know where our player value is.
This one over here, this is our player power.
Before we are patching this, let's make some sort of visual output because otherwise we do not see
if our player power has been increased.
So therefore we go back into our Android studio code, we go on to the main activity class and we have
to create a new instance over there.
So we say player, player equals new player.
Now we can access this player power field and we print this out in the system console output.
Therefore we use system out print line and then we have to adjust this to add a string over here.
So we call this player power equals and then we concatenate this value.
I know this player dot power is an integer value, but it's working in this way so we can concatenate
the string with this integer value over there.
Okay.
Now let's build this application back again.
This time, it's a lot more faster.
We click on Locate, we click open a new terminal and we make our ADB connection to our virtual machine.
Now we can install this application.
In case if you get an error message over here regarding to test devices or things like this, then we
have to adjust this key parameter, this one over here.
Otherwise, please have a look into the cheat sheet I have provided you.
I've inserted they are all ADB errors I've encountered so far, and if there's a new error then please
write me a message.
I try to figure out what's the root count.
I try to figure out what the root cause and also provide an update to all members about this.
Okay, now let's get back to the screen so we get our screen here.
And we open this one.
We can see this is our first build application.
It's an helloworld application, but we didn't do anything about this helloworld part.
It's a text field that's already inserted over there and within the ADB logcat output adb logcat we
can now grep for player power.
Nice.
We can see our player power equals 12 over there.
If you want to add this value or change this value.
Right now we have to do this process once again and I show you a more easy approach within the Android
studio.
Okay to connect Android studio via ADB to this virtual machine.
We have to create a new configuration file over here.
That's not that hard.
We simply go on to run.
Then we go into edit configurations, we opening up this templates and we click on remote.
Then we have to insert our IP address and port over there.
Let's figure this out real quick.
ADB Connect.
This is the IP address of this virtual machine and the port is five, five, five, five.
This is the default ADB port and that's all if you click on Apply, then we can uninstall this application
first and then verify if our configuration is working.
So we hit uninstall it, be uninstall come packing smartly.
One.
In case you have chosen a different package name, you can find this over here in the Android manifest
example this one.
So this application has been successfully uninstalled.
That's verified.
Yes, yes.
It's not available anymore.
Now, let's keep this in foreground that we can see this effect.
We click now and run app.
And if you do not have a device attached or virtual device already started, it's automatically choosing
disconnection.
And we can see it's directly opening over here.
And we also have this loggerhead output over there.
Nice.
This is a little bit more faster if you do this a lot.
So changing, experimenting around this, this might be more handy to use.
Okay.
We can also search in this one for player power and we can see, yes, we've got this two times over
here.
This one is the old version and this one or old version is the old application, and this one is a new
application.
We can see this on the timestamps.
Nice.
Okay.
Let's do a quick recap.
We definitely know that this one over here is our player power.
We do not know what this one is.
Or this one.
This one.
Just one.
This one.
We do not know anything in this file beside this venue over here.
We know this is our player value.
In this case, it's now 0xc because we have changed as value.
We also added some form of visual output and now we are ready to patch this application.
We do this in a short moment before let's do a quick recap on all these steps in a graphical way on
our slides, and afterwards we increase our player power and make it over 9000.
All right.
And let's go let's switch back to the slides first.
By switching back to the slides, I came up with a different approach or solution for this.
Let's make this as an own challenge.
I guide you through this whole approach, how we patch Mali application and afterwards you can try it
on yourself.
I throw you definitely in the cold water and I do not expect this to work right now.
Okay, so I've got no expectation that you can already do this, but I guess you will learn more by
doing this in this way.
We discussed the solution, of course, afterwards, and if you struggle or cannot patch this right
now, this is absolutely no problem.
As already mentioned, pure cold water.
We've got our game application and this only consists of this output of the player power.
So we do not have or we assume we do not have the source code because we are hackers and normally you
do not have the source code.
Therefore we take this APK and we put it into our apps directory and this is our base we are working
on.
We've got a random application pulled from the device and we want to patch this.
Okay, so we've got our game application and the first thing we need to do is we need to get those Mali
files out of this application.
We can do this with the APK tool.
So we use the APK tool D command to decompile or decode this application and get back our Mali codes.
Then we need to go into the player's Mali class and we can find this by looking at the package name.
So you can also use CD X to take a look at the source code and navigate a little bit more easier around
this.
We've also discussed this point in the previous section, so maybe you want to rewatch or rewind this
one if you do not remember this anymore.
Okay, by looking at the player dot smiley class, we do not know anything about the syntax over here,
but we have identified our 0x8 value, which is the corresponding player power.
We want to increase our player power to be over 9000, therefore opening up in Python terminal and to
figure out which value is over 9000 and then take this hex value and replace it at this point.
So the only requirement for this one is that the player power is over 9000.
That's the only requirement OC write it afterwards.
We need to build back this application so we use the APK tool B command to get our modified version.
Then we have to sign this application and we use the zip align APK signer approach in case if we have
to deal with Android 11 applications in the future.
After signing this application, we can then use the ADB install command to check this out.
And after installing this application, we take a look at the ADB logcat and after installing this application
we take a look into the ADB locked and then we will see if our player power is over 9000 or not.
And in case this is, then congratulations.
You have done your first smiley patch, and this is an amazing feeling.
All right, guys, I'm super excited how good this is going.
And don't worry if you cannot do this right now.
It's an experiment from my side.
If you are already at this level right now, if this is not the case, don't worry.
We start at zero and I will guide you through until we reach our year, our hero class afterwards that
we become a super smiley ninja.
All right, now let's try this.
And afterwards, we discussed the solution about this.
Let's go.